The summary identifies what is weak about the networks in range (no encryption, one SSID answering from several APs, protections left off) and the action for each. A few are router settings. Most are connection habits on the phone.
Receive-only. Beacon frames are broadcast in the clear by design; BCON receives them and stops there. It never connects, never authenticates, never attacks, and never identifies an individual access point on screen.
Reports on how insecure wireless is in general already exist, and a national average changes nothing you do tomorrow. In addition, nearly every device in range belongs to somebody else, so hardening is not an option. What remains is knowing which ones are dangerous and acting accordingly, which only works if the check ends in an action item.
Each carries a weight, because they are not equally dangerous. An open network you might join by accident carries more than ten times the weight of a transition mode left on by the manufacturer. The weights add up to one score per place, and the score always shows its parts.
No encryption at all. The real hazard is not the network but the phone, which may have a similar name saved for auto-join and will reconnect without confirmation.
One familiar name answering from several different radios. Mesh systems and phone hotspots do this legitimately, so it is reported as a candidate to look at, never as an accusation.
Without PMF, anyone nearby can force a device off the network, and the forced reconnection is exactly the moment a rogue AP exploits. Optional PMF is flagged separately from absent.
The convenience pairing path, and a way around the passphrase that the passphrase cannot defend against. Usually on because it was never disabled.
Several access points carrying one name so the phone hands over without confirmation. Convenient, and a record of movement. The handover is also the easiest moment for a rogue AP to intervene, because the phone is already expecting to switch.
WEP, original WPA, or TKIP still in the mix. Lowest weight because it usually appears on equipment old enough that nobody was going to connect to it anyway.
WPA3 switched on while WPA2 is left open for older devices, which is the manufacturer's default. An attacker simply chooses the WPA2 side, where none of WPA3's protections apply. Weighted lowest because it is still better than no WPA3 at all.
Grouped by action rather than by finding: open networks, evil twins and missing protection share the same first action, and listing them separately would repeat it three times. Ordered by how much of the score each action removes. These are suggestions, not instructions: nobody can change a stranger’s router, so the ones that need a settings change are written as "if any of these is yours".
Readings taken standing still, three minutes at a time, at the places a routine actually passes through: a stop, a restaurant, a lobby, a park. This is a record of specific spots rather than a survey, and it is the only kind of reading in which the figure relates to you.
| Signal | Share | What it means here |
|---|---|---|
| No PMF | 100 | Nearly every device can be forced offline and made to reconnect |
| Default name | 28.5 | Circumstantial: the box was probably never configured |
| WPS on | 37.1 | A pairing path around the passphrase, left enabled |
| Weak cipher | 11.8 | TKIP still in the mix on equipment old enough to have been forgotten |
| Open | 41 | Networks with no encryption at all, within connecting distance |
| Twin candidates | 96 | One name answering from several radios, usually mesh, hence candidates |
Live from the collector: 247 scans across 7 places. Every figure counts only access points within connecting distance: 678 answered in total, and the rest were too weak to matter.
Without the limits beside the reading, a scan report reads as an accusation. Below is the range a single reading can claim.