Is it acceptable to do a security test on a company's open WiFi before an interview?

Question

I was invited to an interview for an IT position in an organization called XYZ.

While waiting in the lobby, I found an open WiFi network called XYZ. I connected to it and was greeted with a web page requesting for a username and a password. I ran a scan of the connected devices using Fing (an app on android) and found that there are some laptops with names XYZ-HR-1 and XYZ-FN-1.

In the interview, I told them that since my position entails some security aspects, I found that the open network is a security vulnerability in their network.

The IT manager was impressed but the HR representative was not, and acted defensively and said that I am not hired yet to check out their network security. I told them that this is a serious issue and should not wait until I or anyone else be hired.

Was I right in telling them that I did that? Did I kill my chances with them? Should I do it again with other job opportunities (if something is discovered by accident)? How can I gain an edge in the interview with this kind of information?

Answer 1

A stunt like this would - in most environments - be a show-stopper from HR. The reason for this is very simple: You knew what you were doing, and it was none of your responsibilities to perform the test.

If you happened to come across the issue in a "The shares showed up in the windows explorer" way it would probably have been ok. But a security professional needs to know that running a network scanner on a network, where this was not agreed to by the admin of the network, is definitely under the category "not nice" to "hostile". It may also cause real cost e.g. when you trigger a false alarm. I once wasted a few hours trying to find the source of a scan which some punk from some other department ran without our permission (or anybody else on the internal network).

Depending on the circumstances, one could also imagine that the network is not visible until you are inside the company area. I once worked on a site large enough that you would not see a wifi signal from the outside (without very special measures). In that case there would even be a breach of trust. (I know that it's still not a good idea to run an open wifi, you know, IT guys know, but I don't know if management and HR knows or wants to hear).

Answer 2

Imagine I invited you to my house for a backyard bar be que and you arrived and, while we were in the kitchen, said

I stopped by yesterday while you were at work. That fence doesn't keep anyone out. I noticed that your swing set isn't properly anchored into the ground - that could be unsafe if larger children swing really hard. Also, the spacing on your deck rails is too wide, these days code specifies X inches and you have Y.

I would be standing there with my mouth open staring at your rudeness. Nobody asked you, you didn't check if it was ok, you just intruded and now you're criticizing. Sure, children's safety on swing sets and back deck is really important. But so are the rules of polite society. A better guest wouldn't invade the back yard without consent and wouldn't blurt out an inspection report early in a conversation. Instead that guest would wait until reaching the back yard with a glass of lemonade and then say

Ooooh, a swingset. I know a little about these. Is it anchored properly? May I check?

and

You know these days deck rails are supposed to be Y inches ... It looks like yours might be older ... I can grab my measuring tape and confirm if you like?

Now you're showing your deep knowledge of backyard safety and that you possess tools, but you're not hurting anyone.

Now the point of this metaphor/analogy is not to correspond perfectly with the act of checking out an open wifi and discovering some machine names. It is to show you the emotional response this behavior can elicit. They invited you to their offices for an interview. You did something that is outside the norm of an interview, without permission or invitation, when they were not there to see you do it. And you criticized their operations in the same paragraph in which you told them what you had done. At least one of them was shocked and upset. The thought experiment above is to lead you to an understanding of those feelings of being shocked and upset.

To leave the metaphor/analogy behind, how could you have handled this better? Instead of blurting out your results early in the interview, you could have waited until discussing the security aspect and then said "a lot of good companies have no idea that their networks are vulnerable to some of the newer attacks. I could run a 5 minute scan on your guest wifi if you like." You could of course make this offer with confidence because you already did it in the lobby :-). Now you're showing your skills and your tools, in the right context, and with permission. You even set them up a face-save that it doesn't mean they're idiots if you find something. When you find it, you can tell them that you know how to change things so that vulnerability will be closed. Now they want to hire you instead of being offended.

Answer 3

I told them that this is a serious issue and should not wait until I or anyone else be hired.

Was I right in telling them that I did that?

Lecturing an interviewer is seldom a good way to get a job.

Did I kill my chances with them?

There's no way to know the answer to that unless you hear from them directly.

Should I do it again with other job opportunities (if something was discovered by accident)?

Wait until your assessment is specifically solicited, or until you are hired.

Answer 4

Running a scan on their network was very ill-advised, and in some locations could have gotten you charged with a crime.

You may want to read up on the case of Randall Schwarz, a well known tech author. In the 1990's he was a contract system administrator for the super computer group at Intel. He was concerned about security in the group, so he ran a password cracker on some of his colleague's accounts. Though he was an Intel contractor, security and penetration testing were not officially in his duties, and he ended up being convicted of two felonies for his activities. Many thought the convictions were an injustice, and in 2007 the convictions were sealed. Regardless, it shows you the kind of deep water you can end up in, when you decide to help out with security vulnerabilities, without actually being asked to do so.

Answer 5

I'll take a counter viewpoint to most of the answers here. The other answers are correct, from a strictly corporate viewpoint, you are in the wrong. However, I think you did what you did because you are confident in your abilities, and you go looking for issues to fix, which are great traits to have, but will not fit in every corporate culture.

There will be some places that will be fine with this, but such an independence streak is also great for entrepreneurship. You might be well suited to starting your own business.

So, I would say you are 3 options: 1. Try to conform more to corporate culture, 2. Don't conform, but risk not getting some jobs, 3. Go the small business route.

Answer 6

Short answer:

Don't test|access|hack anything without an explicit authorization.

Did I kill my chances with them?

Most certainly.

Ps: Downvote as much as you want, but the OP broke one of the first rules in IT/Pentesting and that's the only objective of my answer.

Answer 7

While waiting in the lobby I found an open wifi network called XYZ. I connected to it and was greeted with a web page requesting for a username and a password. I ran a scan of the connected devices using Fing (an app on android) and found that there are some laptops with names XYZ-HR-1 and XYZ-FN-1.

I think what you did was fine. It was an open network and you accessed it and took a look around. As long as what you did was within the scope of what the network was intended for. Scanning for devices might have been illegal in some places.

As a candidate preparing for a job interview. It's upon you to research the company, culture and background. Gather knowledge that you can use in the interview to explain why they should hire you.

You gathered knowledge but you didn't use it wisely.

Was I right in telling them that I did that?

In cases like this. Use what you've learned to ask compelling questions and provide compelling answers, but don't point fingers, make accusations or find fault with anything related to the business or people.

• You can talk about risks of an open network without mentioning their network.
• You can talk about risks of having devices on that network.
• You can share how you would fix the problem.
• You can share your idea of a better network.

You use what you know because it makes you relevant to their current challenges, but you do it in a nice, friendly and professional way.

Now, ask yourself if you still want the job based upon what you've discovered. Ask questions that reveal the nature of the culture of the company.

• Ask, how do you handle the discovery of a security hole?
• Ask, what freedoms will I have to implement changes?
• Ask, who implemented your current IT system. Will I be reporting to that person?
• Ask, how do you measure the success of my IT efforts?

You've uncovered that there are problems already in the company. Dig deeper to see if it's still the right fit for you.

Answer 8

Whether you get the job or not, and whether this helped or hindered your chances, what you did was unprofessional and possibly illegal. If you had looked at their public website or they had had a totally open network (no password), you would have been on firmer ground.

You hadn't been hired at the time, and you were in effect attacking their network looking for vulnerabilities. As a professional you should know not to do that without prior agreement and investigation of possible consequences.

There's a somewhat related question on the security stack -- asking if a pentest company should sign a contract promising no negative consequences of the test and to cover any damages incured. The accepted answer says "I've knocked systems over with a port scan". It's impossible to know what someone else's code is going to do, and thus what negative consequences of intracting with it might be. You put their organization at risk, without warning, agreement or justification.

Using their system the way it is meant to be used and seeing what happens, is justifiable, non-standard usage is not. That includes trying to guess a username/password -- standard usage is to HAVE a username and password, not try to find one.

Answer 9

There are some really good answers addressing why this was the wrong thing to do from an Infosec angle, and somewhat more generalized ones on the ethics of running a scan without authorization, but I'm going to try to address the "right way" to approach situations like this, based on how I would have considered addressing this in an interview if I found myself in a similar situation.

Was I right in telling them that I did that? Did I kill my chances with them? Should I do it again with other job opportunities (if something was discovered by accident)? How can I gain an edge in the interview with this kind of information?

There are a couple of things going on here, particularly when it comes to gaining an edge.

For one, do you have an ethical imperative to discuss security issues which you have noticed (and I think the ethics have already been generally addressed by others).

For the second, are you stepping on toes when pointing out something wrong.

Thirdly, are you possibly creeping people out.

Finally, is this going to create a negative impression of you as a candidate due to the related interaction, even if you are right.

Change should always come from a place of knowledge, and you don't know everything about the surrounding context in an interview

As an example, in software development interviews, I've had arguments made that we should be using language xyz.

From a technical standpoint, of course there is room for improvement, and one of those improvements might be a change in language. I could make arguments as to the value in moving to certain languages all day long. But arguing it as a job candidate makes the candidate look very naive as to the surrounding concerns that might have lead to the language we're using, not to mention the technical hurdles to switching to a different language now, and it also comes across as presumptuous and possibly indicative of shallow thinking.

You don't know why the WIFI was set up that way, so don't presume that it's without intent.

Questioning is fine. I value questions during interviews a lot. Noticing things is great. You could use that if a related opening appears:

"I noticed you had an open WIFI SSID, so I thought maybe it was meant as a guest network and I could check email on it and connected briefly. As soon as I did I saw the password page and realized it must be meant as an internal network so I disconnected, but couldn't help but noticing that it didn't seem secure. As someone who cares a lot about information security, I was curious if you knew why it's set up this way?"

Digging deeper uninvited is very much not great. I think that's been covered sufficiently in other answers, but to echo Kate Gregory's answer, it's going to come across as "creepy" at best. People can argue her analogy all they want (technicalities aside, I think it captured the heart of it), but it's close enough to how most lay people are going to feel, especially when you start rattling off machines you saw. That first psychological aversion response is going to sink you, no matter how "right" you are.

At most, if a related opening naturally occurs (i.e. only if the conversation actually continues when you bring up the first part) you might ask if they'd considered running some scans to check whether anyone is at risk via that WIFI, and what their preferred vulnerability testing tools are. That gives a clear window (and opportunity for them to ask related questions back about your own preferences) into your related skill… but don't push it. You are not the head of IT, you are here for an interview, and while you might disagree with what they're doing it's also not your place to argue for something different unless invited, because you could just as easily be making a fool of yourself in their specific context.

If asked "Oh, that's interesting, what would you do", that would be your opening to discuss the scans you might run to show the vulnerabilities and how you would then put forward a proposal for a change to the WIFI, assuming there were not externalities you weren't aware of as someone not part of the company related to the particular installation that necessitated it being set up like this: and if so, how you might mitigate them via VLANs, internal firewalling, etc, but it would really require knowing more particulars. Being open about what you don't know in terms of context is encouraging: with details about what you'd need to learn about the environment it can help show degrees of your related skill and knowledge, and your discerning flexibility to account for different situations.

Don't (even inadvertently or unintentionally) insult people

This goes along with the preceding, but I really want to focus on it for a moment: start from a presumption of intelligence in others. It's flattering. The opposite is insulting. If something doesn't appear "smart" from an outside perspective, begin with the assumption that there are other reasons with a foundation of intelligence and skill on the part of those involved. Even if you don't stick your foot in your mouth horribly by having overlooked something as a possibility, ultimately being right isn't going to matter after you've just finished trashing someone you're asking to hire you.

Don't lose sight of the goal

If you want to see change occur, be an advocate for yourself and your generalized views and outlooks and skills (and how they align with your interviewers/the company, which is going to require getting them to talk about that: so ask!), not for the specific change you want to implement when it is merely a single detail.

If seeing a likely security lapse fires you up, great. But you can't become so focused on that specific issue that you derail the interview in a way that leaves you looking weaker as an overall candidate. That won't get the problem solved. Getting hired might. So re-focus your related caring and intensity into advocating yourself, rather than a relatively less meaningful back and forth on one single security detail. You'll have plenty of time to advocate on that specific issue once you're hired.

Feel people out (and hopefully create natural openings)

Not only do you not know the technical context and surrounding constraints that lead to a situation like this open WIFI network, but you more importantly don't know the people you're talking to, their personalities, and their involvement and opinions on this and similar issues.

It's one thing to offer up your expertise and give examples, it's another thing to push. Confidence in yourself and your skills is good (it's great), but pushiness is rarely something an interviewer is looking for, in my own experience.

So just remember that these people are strangers who you've had a short amount of time to gain an acquaintance of in a very narrow, very constrained way. Don't push yourself on them: find out what they think instead.

Rather than reeling off on them about what your opinion is on a given technical topic (which can easily look negative to someone less technical, and can easily step you into landmines with someone more technical), ask them what they do currently in relation to that topic, and if necessary then ask what the individual's opinion is. It shows the sophistication of knowledge to know what to ask about without pushing your opinions and thoughts on them, and gives you some space to feel them out.

Ultimately, this provides the best openings, because you can do something like mention things like WIFI being difficult in mixed use environments (assuming the topic comes up) and then asking what they do as company, and what the interviewer's personal preferences are in relation to that. This perhaps provides possible openings for the earlier hypothetical statement I offered, but it also warns you if maybe it might be best to not say anything at all.

Even more than just the openings, this also helps expose dynamics between different interviewers. When you have multiple people interviewing you, you are the center of attention, and it's hard to gauge everything going on well. Asking questions and then asking opinions gives you room to (discretely, since your focus should be on whoever is talking while they are talking) watch what's going on. You'll have opportunities to switch (or even direct) focus between different people, or at least look around to gauge consensus/etc on answers given to you. This will depend, by degrees, on how "on rails" the interview format is.

Leave room for conversation to breath

Yes, you're here to advocate for you, but just you shouting how good you are doesn't necessarily do that effectively. Your resume should already speak for itself in technical and experiential terms, what you're really here for is to speak for yourself as someone to work with, as a coworker and colleague.

And here's the key to that: as they say in writing, "show, don't just tell".

If they ask for your opinion or stance on something, give it, certainly. But when it's not being asked, ASK theirs instead as your opening. Let that naturally lead back to them asking for your own opinion (or not). You'll show just as much related knowledge in asking about topics as you would trying to talk yourself up, but more importantly it comes across less pretentiously and gives you room to look more like someone who would be good to work with on related issues rather than someone who is just going to try to push over everyone else while thinking they already know everything that needs to be known.

There's technical stuff thrown into most in person interviews, but ideally it's just there as a check of whether or not you live up to your resume, and really the ultimate goal of an interview at that stage is to figure out whether you'd be someone they want to work with. We've skipped otherwise technically competent people because of the way they acted during their interview, and how they approached (or even didn't) the related interaction. Because a job is about more than just paper knowledge and basic technical competence. Anyone can run a pen scanner. Not everyone can discern when is the right time to do so and how to effectively use the results if they do, and not step all over everyone's toes in the process so horribly that no one cares anymore and everyone just wants the project canceled and something else worked on.

In some environments, being able to effectively negotiate through project advocacy and related internal political life cycles is just as crucial as having the related technical knowledge. So show your competence at how you interact with your interviewers, make yourself out to be someone easy to work with and to communicate with, who is self confident in the best of ways, the one where they don't just need to blather continually about themselves. And someone discerning who knows when to push something, when not to, and how much.

The hardest thing to regain is trust

You're in an interview situation: you have been granted a basic level of trust in being invited to interview, but you are still a relatively unknown quantity, so it's very much provisional. Anything that puts the trust already given to you in question is absolutely poisonous to your chances as a candidate. You should always assume there are other candidates (for example, in my case, we do things like fail and rework searches that don't yield enough interview candidates to form an adequate comparison pool). You should always assume they are equally qualified in terms of technical qualifications.

Do not engage in actions during an interview that could lead anyone present to calling into question whether you are trustworthy. Actions which are normally associated with a higher level of trust than you have clearly—I would even say explicitly—been granted (you don't ask someone you don't trust to run a security scan, and by default you begin by distrusting someone who randomly runs a penetration scan against you without your express invitation and permission) fall under this. It's not that you are being distrusted, it's that you haven't yet been granted the levels of trust associated with actions of that nature. You need to earn that, and taking actions associated with higher levels of trust before doing so is often immediately seen as overstepping your bounds, in ways that call your decision making skills into question too, and in a first impression situation you can't afford that.

Even if you can regain the base level of trust you're interviewing with, having it ever questioned can quickly put you in jeopardy compared to other candidates. It's rarely spoken of directly, because we run things like background checks to try to ascertain whether we're correct in trusting someone, but the sense of individual and direct trust is a crucial one to not betray during an interview process, because it will easily loom over all other personality and skill impressions if someone at any point becomes "uneasy" with you over an action you take. Ultimately, ascertaining whether you can be trusted is really a core element of an interview, when you really think about it.

Answer 10

All answers are right IMHO, both those that encourage the behaviour and those that discourage it, but miss something important to me : the fact that interview was with different people, who happen to have different goals.

The IT boss wants someone able to think out of the box, someone able to take initiatives, and to identify easily any shortcomings that there might be. Of course he is interested in such a profile.

The HR boss wants to protect the firm against the employees. That's the job. Identify any harm that an employee could do, and protect the firm against it. Most of the time, it's more on the legal or relationship level, but if the HR feels there is a potential employee that could be clever enough to bypass standard securities, outside an audit controlled by the brass, then he will do what he's paid to do : protect the firm against the (not yet) employee.

Hence the diversity of answers. If you had been speaking only to the IT boss, then (legal issues notwithstanding) your behaviour would have been clever. That's what he needs. But as the HR was present, you should have taken in account his role : to preserve the corporation's natural order and hierarchy.

Be aware that most corporations will be more than willing to lose some efficiency to gain more control upon their employees. If you are looking for a job in the corporate setting, you shall at least fake respecting the rules in front of those who are paid to enforce them. And try to actually respect them as long as it's not obviously preventing you from doing your job. And the first rule is : don't look uncontrollable. In the corporate world, managers hold the power, and see management as the science of control(wether it's right or good is another debate I won't open).

The trap is that you had to format your speech to two different audiences with opposing needs and expectations. Try to think about both next time.

Answer 11

If I had a say in this hiring process this would be a mark against you. Not because you broke some rule, but because you are telling people they should do something without understanding their needs.

IT security is an exercise in risk management. Most of the time IT security practices are not absolute rules. You need to judge the risks of a particular practice against the costs to the business efficiency and then make a decision.

I don’t know the risks associated with the vulnerability you found. It may something thing a company should never do. However, before telling any business manager that they should not do something you should build some trust in your opinion by learning the circumstances in which the vulnerability exists.

Answer 12

When it comes to information or ideas that we possess, while to some it might seem counter-intuitive, it is sub-optimal to tell everyone everything. It took me longer than I would like to admit to fully internalize that I could just not say anything and keep it to myself.

HR is never going to take something like this any other way than what you describe. Anyone, who doesn't understand NetSec is likely to regard you and your commentary with extreme suspicion. Interactions both public and from stage and screen should illustrate the truth of this, there's a whole category of tropes related to "well-meaning specialist tries to alert people who don't understand about potential danger" who end up being punished by the unwashed heathens they attempted to help.

Keep it to yourself.

That said, you could have potentially brought up something tangentially related and steered the conversation over to where a highly edited version of your comments might be perceived as more organic.

True story: I once worked at a place where a guy found a vulnerability in the company's intranet blog. While he was at home, he posted to the blog from outside the network using the vulnerability. Then when he came in the next day, he sent his brilliant find and proof that it was possible to IT. He was immediately given hero status and a huge bonus, raise and promotion. Just kidding, he was immediately fired.

You can disregard every word of this answer if you want to remember this five word phrase: "Being right rarely changes anything."

Answer 13

I'm going to try add another perspective.

Was I right in telling them that I did that?

There are countries where joining and scanning the network is illegal to begin with. Imagine you found a LAN port at the premise and used an ethernet cable to connect to their network.

It is possible HR knows this since they are more aware of laws involved.

It is the responsibility of HR is to manage such legal liabilities for the company. It is possible that's why they seemed less-than-enthusiastic about it.

Answer 14

From the perspective of someone who runs information security: what you did was not clever.

Was it to show that you are an expert in security? In that case if you just show that you can

• connect to an open WiFi
• that some of their machines were on that network

If you tag this as a security issue then, sorry, you do not know much about security. This IT manager does not either. This will probably blow up one day.

So that move was not a good one.

Maybe it was to show proactivity? Well in that case you should really not work in security because you are going to hurt your company by doing such things. There are engagement rules in security and an employee is expected to follow them. You are not a hacker, you are not a bounty hunter. You must not do these things.

However you look at it, it was a stupid move if you wanted to get hired.

Answer 15

So, let's see. From my point of view you:

1. Discovered an open network; (OK)
2. Connected to it; (OK)
3. Discovered it needed a userid/password; (OK)
4. Interrogated devices around you in an apparent hacking attempt; (NOT OK)
5. Bragged about it (STUPID!)

Now, let's cover your questions individually:

1. Was I right in telling them that I did that? Not if you had any desire to work for that company. Also note that most companies I've worked for display a warning when you connect or log in which says something like "Unauthorized access is not permitted. We will contact the authorities and prosecute you if you try it". Also note that ignorance is not an excuse.

2. Did I kill my chances with them? If I was the hiring manager I wouldn't touch you with a 10 foot pole. You're an admitted hacker, proud of it, and a security incident waiting to happen.

3. Should I do it again with other job opportunities (if something is discovered by accident)? That depends. Do you want to get a job, or do you want to show off? If the former, don't ever do this again. If the latter - well, it's your life, buddy...

4. How can I gain an edge in the interview with this kind of information? You can't. All you can do is make people nervous, and people who are nervous about what you've done, can do, or might do will not hire you. Look at the news - every few weeks another company gets hacked, credit cards and other personal info gets stolen, and they look like idiots, and their customers may turn around and sue them. As someone who works in the IT department of a major retailer I can tell you that this is one of the things that worries people like me. If we think you even might be a problem, you will not be hired. End of story.

Best of luck.

Answer 16

Regarding your chances, it strongly depends on the powers of the IT manager and the HR manager. It also depends on the way how you presented it. If it was "I saw several computers with XYZ-whatever names connected to an unsecured network" it was more an insult to the one who alowed the owners to connect to the network. If it was "I saw your computer, mr. Averagejoe, connected to the unsecured network" it was straight insult to mr. Averagejoe.

If you are about to be a security guy, a paranoia is not mandatory, but it helps. Your check who is there with you (in the open network) clearly shows your attitude towards your possible position. That's why the IT manager was impressed.

On the other hand your presentation of your findings was quite rude. That's why the HR manager backs up and counter you.

Maybe you poured oil in an open fight between IT guys pushing the security issues to stop and the others with the attitude "What the hell the weird ones are talking about?" Something like Moss' talk on not disabling the firewall in IT Crowd S2E1.

Next time, do this check preferably when asked in the interview. If you can't resist, hold the findings to the moment, where the breachers are out of vocal range and you are discussing the IT staff only.

Answer 17

This will hurt your chances because you have demonstrated a failure to understand the concept of area of responsibility. You:

• failed to explain how you were authorized to do that (regardless of what laws may say: you need to convince them, not the judge) and the impact of your actions in non-technical terms
• started telling them (as opposed to merely suggesting) how they should do things without being the person responsible for those things or a contracted consultant

---

• In established environments, every area and task has a person responsible for it (virtually always, a single person; group decisions are typically only warranted for complex, strategic matters rather than everyday tasks). That person is the sole one who can make decisions in that area. This is to ensure that they have the whole picture and a unified vision is applied to it.
• If you are not that person and see a problem, your job is to report it to them and leave it up to them if something needs to be done about it.
  • That's because even if you know this is a problem, you don't have the whole picture to be able to weigh all the pros and cons, and you won't carry the responsibility for your actions. As others have said, security is an exercise in risk management: something is only worth doing if doing it is less costly than not doing it.
  • (Anticipating comments from would-be rebels:) Going over their head is possible and sometimes may be the way to go to get anything done, but it's serious and risky business since you need to somehow convince the higher-ups to incur the rather hefty costs of questioning the competence of an imporant subordinate (doing an independent assessment of their skills and work is time, money and lasting discontent of that person, regardless of the method and the outcome).

---

• What you told them about the scan basically sounded to a non-tech person: "I breached your network and potentially disrupted your business -- all just because I felt like it".
  • This is what provoked a defensive reaction. "No, our business is certainly protected well enough if we're still in business, and you certainly couldn't breach it this easily! What you're claiming can't be true and is plain libel ('cuz this would damage our reputation if others believe it (regardless of whether it's true), so we're definitely not taking kindly to that)!"
  • And a person with such a mindset is certainly not someone who they want to see within a mile's radius of their critical intrastructure.
  • Now, that's of course not what you did. But you failed to convey that in a way they can understand.
  • You should've put this something like: "When I was waiting in the lobby, I noticed an open wifi network with your company's name. Since my job will include information security, I took an opportunity to get an idea of your current practices. Noticed this and this, which is potentially a vulnerability, though it depends."¹ If they still look terrified, add something like: "I can say with confidence (and your colleagues would confirm) that this absolutely couldn't disrupt anything with a stability of, like, a stock Windows installation."
    • This would show that you were authorized to do that because good candidates are supposed and expected to be proactive about researching the company; you did weigh the risks and made an informed decision; and you're merely suggesting that this could be a problem rather than outright stating that since you're not the one responsible and thus don't have the full information to be able to make such categorical statements.

---

¹_{on the outreach of the network, how long and how often machines stay on it, what kind of information and/or functionality they contain and how well they are secured.}