BSides Buffalo 2026: Still Cracking: WPA2 Prevalence and Password Weakness in 2026

In 2021, a CyberArk researcher collected 5,000 network hashes across Tel Aviv using $50 in equipment and cracked over 70% of them via the clientless PMKID attack technique. Five years later, this talk revisits that methodology — this time closer to home. This session presents the results of a real-world WPA2 survey conducted locally in 2026, measuring how prevalent WPA2 remains, how password hygiene has (or hasn’t) improved, and how accessible this attack vector continues to be for any motivated adversary. No live cracking — just honest data, a reproducible methodology, and a candid look at whether the security community has meaningfully moved the needle on wireless security. Attendees will walk away with a clear understanding of the PMKID attack surface, what current data says about password practices in the wild, and actionable guidance for individuals and organizations looking to actually secure their wireless environments.