Why is my phone connection secure without a password when WiFi is not even with a password?

Question

When I talk on the phone or send text messages, I never need to type a userid and password.

But when I use WiFi I need to use a password.

How is the phone connection secured without a password, and why is that method not used for WiFi?

Answer 1

WLAN/WiFi can be secure when properly configured (this certainly requires a password or key).

Cellphone connections are not really secure. They are encrypted based on a key from your SIM card. This key is also known to your mobile network operator. You do not need a password, but your communication can be intercepted and eavesdropped on by your mobile network operator and law enforcement. The A5/1 encryption used for GSM is actually completely broken.

The reason why this is not done for WiFi is because you do not want an extra SIM card and you do not want your ISP to specify your password/key for WPA2.

You always need a key, password or certificate to authenticate and key/password to encrypt your communication. This information can be stored in various places, like your SIM card or your brain.

Additional information due to comments:

There are several reasons why using SIM cards for authentication to all WiFis in general would not work.

1. The WiFi access point would need to support EAP-TLS, EAP-AKA/SIM or similar which allows authentication with a SIM. Your device (e.g. smartphone) needs to support this authentication as well as the access point.

2. The WiFi access point would need to contact the mobile carrier and check whether the connection should be allowed or not. This has two problems a) ISPs are not necessary the mobile carrier, b) how do you limit who has access to a WiFi. Not everyone with a SIM card should be able to access a WiFi unless authorized to do so. This means either WiFi operators hand out SIM cards for their WiFi and you end up with lots of SIM cards or they need to tell their ISP who tells all mobile carrier which SIM cards are allowed. It would need to be done manually, because you cannot foresee who might want to access your WiFi in the future. This would mean major costs in infrastructure and staff, not to mention time for connection setup.
   The other way to manage it, is to setup a RADIUS-server (see comment of billc.cn). This also requires manual registration of allowed SIM cards and a SIM card reader. You would be able to manage access locally (which is good for security), but it is not the universal access you have asked for in the comments.

3. You would loose control over the security of your WiFi if the authentication is done by your mobile carrier or ISP. They can control who can access your WiFi and are even able to see lots of meta-data. They would know which person accesses which WiFi and also when.

   Even if I have barely scratched on the surface of problems, you see why this is not easily done. You would need new hardware for your WiFi access point, likely your device that you want to connect and the ISPs and mobile carriers would need to adjust their infrastructure too. This makes it entirely infeasible.

Today it would be possible to use a SIM and manage access locally for a WiFi, but this means the SIM is just a substitute for authentication by password and the setup isn't simplified.

Your idea would work for access points operated by your mobile carrier, but as we already have mobile internet through LTE and similar technology (which is not the same as WiFi!), it will not take a central role . Especially since the mobile carrier can charge money for mobile internet usage, which is obviously in their interest. If you have a subscription to special services, some mobile carriers and ISPs offer access to hotspots, that can be accessed through EAP-SIM (thanks billc.cn).

Answer 2

WiFi can be easily sniffed with cheap hardware + software and only properly encrypted WiFi helps against this.

But phone calls are not much better:

• For the traditional old phone system (POTS) you need physical access to the line but once you have this (often available somewhere in the basement) sniffing is very easy too.
• Old style analog wireless phones (i.e. wireless extension of the phone at home) can be easily sniffed with cheap equipment while the more modern DECT standard has encryption built in but this can be downgraded by rogue base stations.
• Mobile phone communication (GSM) is encrypted by default, although not necessarily with strong encryption. For proper encryption and authentication each phone contains a smart card (SIM). But since there is no proper authentication of the base station, calls can be tracked or even hijacked with a rogue base station. This technique is used by law enforcement (Stingray). The needed equipment got cheaper with the years so what once was for government use only can now be done cheaply by criminals too.
• Apart from that, government agencies can listen to all the landline and mobile calls when needed, because the phone switches contain a government mandated tapping interface for this purpose. And while this tapping often needs court approval (depending on where you live), there can be no technical enforcement of this and it can happen that somebody taps the call without approval.

As for messaging, it depends:

• The old SMS is not protected in any way and can be intercepted the same way as phone calls.
• Many of the current internet based messaging solutions (WhatsApp, iMessage...) have builtin encryption. These provide a similar builtin security as HTTPS connections. But this was not always the case and was actually mostly accelerated because of the Snowden affair. For instance WhatsApp added encryption only at the end of 2014. And you still need to have some initial authorization, i.e. username and password, or it is somehow bound to the phone (like depending on the security of a not really secure SMS).

Apart from that you would not even need a secure transport layer (i.e. encrypted WiFi) if your communication is already properly end-to-end encrypted. This includes HTTPS connections, PGP or S/MIME encrypted mails, various messaging solutions or virtual private networks (VPN). So if you use only these (very unlikely) then you could actually mostly ignore WiFi security (meta data could still be sniffed, but no content).

Answer 3

WiFi Security

WiFi networks can be secured using proper algorithm and secure password. For that I point you to these tips.
In short:

• Use WPA-2
• Disable WPS
• Use Complex Password
• Change password of administration panel of your modem/access point

---

GSM Security

GSM uses encryption to make its data transmission secure, be it SMS or a Phone Call but this is nowhere near perfect. There are some flaws (see cryptanalysis part) in the encryption algorithm used and MITM using a rogue BTS antenna is also possible.

The way authentication happens in GSM without entering a password is as follows:

There's an IMSI Number along with a Key stored in your sim card, written by your MNO or sometimes called the carrier.
Your sim card has the IMSI and the key, the carrier also has this information, now your sim card can simply be authenticated and network access along with encryption and identity verification happens.

---

Passwordless Authentication

In the WiFi Scenario there's no single Carrier that gives you wireless service and there's no sim card with a key and id that's also known to the wireless service provider so the same scheme can't be implemented there.

Using your sim card, you can only access the network provided by your carrier, and not others (Let's forget about roaming to keep it simple). In the WiFi scenario, I have my own wifi which only works with my devices and not with my neighbors, I also have my tablets(W/O Simcards) and my laptop and also my PS4 and lots of other devices, Wifi Connectivity is one of the 1000 features these devices provide. Your suggested scheme requires a specific module being added to all these devices, and then I will have to go ahead and register these devices in my network somehow, this doesn't extend well. Wifi devices are made to be able to easily join different WiFi networks whereas GSM devices (Sim cards) are designed to join a single network and stick with that.