WeWork offices use the same WiFi password across many locations and employ the weak WPA2 Personal security protocol, creating potential for abuse
Sean Captain / Fast Company : Thanks: @mariedomingo
Context & Ripple Effects
WeWork's shared-credential model collides with a protocol already shown to be fragile: the 2017 US CERT advisory on WPA2 detailed how the protocol could let attackers eavesdrop, hijack connections, and inject malicious traffic. Fast Company's report adds a second failure mode on top of that known weakness — one reused password across many locations.
Venue WiFi has been a contested security surface before: Marriott's fight over blocking guest hotspots framed conference-space wireless as something operators claim responsibility for protecting. WeWork's setup puts that responsibility question back on the table for coworking.
First-order effects
- Any WeWork member who learns the shared password can join networks at other locations, so a single leak compromises access well beyond one building; combined with WPA2 Personal's demonstrated weaknesses, traffic on those networks faces real eavesdropping risk.
- Members handling client work in shared spaces inherit a network posture they did not choose and cannot audit — their security perimeter now includes every other holder of that password.
Second-order effects
- Enterprise customers with compliance obligations face pressure to demand per-tenant credentials or dedicated networks from WeWork, turning WiFi architecture into a differentiator among coworking operators competing for corporate accounts.
- Insurers and enterprise procurement teams gain a concrete due-diligence question about shared-space providers, forcing landlords and flexible-office rivals to document their own network practices.
Third-order effects
- If shared-credential WiFi persists as a pattern in flexible workspace, expect the market to split between consumer-style shared access and enterprise-grade segmented networks, with certification of venue security becoming a standard part of commercial leases rather than an afterthought.
- Repeated demonstrations of weak venue wireless — from the KRACK-era protocol flaws to operator practices like this one — push responsibility toward regulators or standards bodies to set baseline expectations for public-facing business networks, though whether that happens through regulation or customer pressure remains genuinely unsettled.
The trend: Shared-workspace operators are discovering that network security, once invisible infrastructure, is becoming a competitive and contractual requirement as enterprise tenants bring compliance expectations into flexible offices.