Wi-Fi, explained without the theatre
Short, specific pieces on the things people actually ask about — including where the common advice overstates the risk.
What an evil twin actually is
How the attack works, what it can and cannot do to encrypted traffic, and why detection has to happen at the access point layer.
Why Wi-Fi info needs Location permission
macOS hides SSIDs behind Location Services for a real reason — and what to do when the prompt never appears.
Randomised MAC addresses
Why your device list keeps changing, how to spot a randomised address, and why an unknown device is usually yours.
Start here if something looks wrong
Nearly every message we get about a “suspicious device” resolves to one of three things, and two of them are not attacks at all.
- An unfamiliar name in the device list. Usually a phone, console or TV using a randomised hardware address — modern devices invent a new one per network and rotate it on a schedule. Read randomised MAC addresses before concluding anything.
- Your network name showing blank or “unknown”. macOS gates the SSID and BSSID behind Location Services, so an app that has not been granted it simply cannot read them. See Location permission.
- Two access points claiming to be your network. This is the case that is worth acting on. Evil twin attacks explains how the impersonation works, and — just as usefully — what it can no longer do to HTTPS traffic.
What these guides assume
That you own or administer the network in question. Everything described here is passive observation of a network you are already connected to: reading what access points broadcast, and noticing when the answer changes. None of it involves probing anyone else's network, and Airward will not do so.
They also assume you would rather have the boring accurate version than the alarming one. Where a widely repeated risk no longer applies to a patched Mac on an encrypted connection, the guides say so.