What your Wi-Fi says about the boat.A passer-by should not be able to read the hull, the owner and the crew off the air.
Stand on the passerelle of almost any yacht in a show harbour, take out a phone, and open the list of available networks. Over three days at Port Hercule this September we did very little that was more technical than that, and wrote down what the harbour announced about itself. We joined nothing. We broke into nothing. The names alone were enough.
What came back was not a story about weak passwords. It was a story about labels — hulls, owners, crew and guests, printed on the air, legible to anyone standing close enough to open a phone. And, more awkwardly, legible a long way from the water.
We listened. We did not break in.
A pocket survey radio walked the harbour across 23–25 September and logged what networks announced about themselves: the name, the type of lock, and roughly how many radios were calling for each. Nothing was joined. Our own equipment was removed from the counts. Names, encryption types and call patterns are enough to make the point — raw addresses and any mapping to a real vessel stay in the working file and are not for circulation.
Across the harbour, the town, the hotels and the boats, roughly two thousand distinct network names were heard.
Finding 01 — If the name makes sense to a stranger, it is wrong
About 333 of the names we heard already explained a hull, a role or a job before anyone typed a password. Not the key. The name.
Tells you who paid for the boat, and which network is theirs.
Tells you which door the staff use.
Tells you which door a visitor should try first.
Tells you how the boat is organised.
Still a hull identifier. Brochures decode it in about a minute.
Tells you the boat is online, and how.
Finding 02 — Owner / Crew / Guest is a map, not a feature
Sixty network families on the quay used one hull stem with separate Owner, Crew and Guest names hanging off it. That is a sensible piece of network design and a poor piece of operational security, because the thing it organises is also the thing it publishes.
What the boat thinks it has built: guests get a simple password, crew keep their iPads off the guest list, owner devices stay private. What the quay reads: that is the owner network, that is the crew network, and that is the cheap door.
Finding 03 — Hide the name and the phones shout it anyway
This is the finding that surprises people, and it is the one worth reading twice. Hiding an SSID does not erase the name. It stops the access point announcing it. Every phone, tablet and laptop that has ever joined still carries that exact string in its saved list, and still asks for it out loud.
We logged 131 boat-shaped or owner-shaped names being called by passing devices when no matching network was on the air at all. The boat did not need to be there. In many cases it was not.
The beacon goes blank. The list looks empty. You think the name is gone. The phones do not forget.
Finding 04 — Most boats lock the door. Some leave it on the latch.
Sixty-six names were open with no key at all — a public bench rather than a house. Ninety-nine were open or still running leftover WEP or WPA1, locks that stopped being locks a long time ago. And fifty-three names had the word Owner sitting in them.
Finding 05 — The phone takes the boat with it
Across the survey we counted 545 guest names being asked for, 283 yacht or MY names, 274 crew names, 154 owner names, 62 satellite or Starlink names and 36 admin, IoT or bridge names.
Those 154 owner asks are not people standing next to a yacht. They are phones that once joined an owner network and then kept calling its name — at a kitchen table, in a car, on a beach, in a hotel lift, in a pub full of strangers. One of the clearest patterns in the data had no hull in sight at all.
This is not a marina problem. A device that once joined an owner network will ask for that name eight hundred miles inland.
A worked example, and it is fiction
To show the pattern without pointing at anybody, here is an invented vessel. Counterpart does not exist. Neither does her owner. Every element below, however, is a thing we saw repeatedly, with the real hull and the real person taken out.
The network name reads Counterpart Owner.
Public pages give the hull as ninety metres, and put a number on it.
A name and a cover story to go with the boat.
A bar, a car, a kitchen. The phone still says Owner.
None of those four steps requires joining anything, standing near the hull, or doing anything a court would call hacking. The first one is given away for free, and the rest is public.
The thirty-second test
Stand on the passerelle, open the phone, and look at the list.
- Can you see the hull? If yes, the boat is labelled.
- Can you see Owner? If yes, that is the principal’s door.
- Can you see Crew? If yes, that is the staff door.
- Can you see Guest with no key strength behind it? If yes, that is the easy chair.
- Is anything still open, WEP or WPA1? If yes, treat it as broken.
- Did the last guest leave with your network still saved on their phone? If yes, it will name the boat at home, in a car, in a pub.
Five changes that do not need a shipyard
Random tokens. No hull, no owner, no family name and no yard number anywhere on the guest radio.
Owner devices join a private onboard network that never broadcasts a role.
Every guest and contractor phone forgets the network before it leaves. Otherwise it keeps naming the boat for months.
No open network except a captive portal you intend to be public. No WEP. No WPA1.
Hidden does not hide. A dull name, a current password and a separate guest door does.
A simple standard: if a stranger can parse it, change it
| Role | Reads badly | Reads better |
|---|---|---|
| Guests | Hull plus Guest | A short random word. Rotate the key each trip. |
| Crew | Hull plus Crew | A second random word, on a different key. |
| Owner kit | Hull plus Owner | No owner SSID at all. Devices stay on the internal LAN. |
| Operations and AV | Hull plus Galley | Function stays off the air. Use the internal LAN. |
| Satcom | Hull plus Starlink | Vendor default renamed to something empty. |
The radio is a name badge. The quay is only where we counted — the same phones ask for the same names at home, in a car, on a beach and in a pub. They do not need to be near the hull. They do not need to join anything. They only need to have joined it once.
If you would not paint it on the tender, do not broadcast it from the mast.