Mobile Hotspots and Tethering From 3G to 5G-Advanced, With Security

A mobile hotspot turns your phone into a small Wi-Fi router: the phone runs an access point, hands out addresses with DHCP and translates your laptop's traffic (NAT) onto its own cellular data connection. Each cellular generation, from 3G through 4G LTE, 5G and now 5G-Advanced, raised the speed and cut the latency of that backhaul, while the security of the last few metres still depends on the Wi-Fi mode you pick (WPA2, WPA3 or open), or on using USB or Bluetooth instead.

A hotspot you control usually beats public Wi-Fi, and NSA guidance for teleworkers says so. It is not automatically safe: a weak password, an open hotspot left on all day, a laptop that shares files on "private" networks, or a link forced down to 2G each undo part of the benefit. This post covers the cellular releases that set the speed, the settings that set the security, what carriers and mobile device management (MDM) control, and how a hotspot compares with public Wi-Fi, with dates checked against 3GPP, the ITU, Apple, Google, the Wi-Fi Alliance, NIST, CISA and ETSI.

Key takeaways

• A hotspot is a router, not a cable. The phone runs an access point, a DHCP server and NAT; your laptop sees a private network whose gateway is the phone.
• The cellular generation sets the ceiling, not the experience. 3GPP's LTE design targets in Release 8 were 100 Mb/s downlink in 20 MHz and under 5 ms radio user plane latency. The ITU's IMT-2020 (5G) minimum requirements are 20 Gbit/s peak downlink and 4 ms user plane latency for mobile broadband. Real hotspot throughput is far lower.
• 3GPP release dates, per the 3GPP portal: Release 8 (first LTE) Stage 3 froze in December 2008. Release 15 (first full 5G set) has a functional freeze of 22 March 2019, after non-standalone 5G radio specs were delivered in late 2017. Release 18, the first 5G-Advanced release, froze in March 2024 with protocols stable in June 2024.
• Pick WPA3 where every client supports it. Android's hotspot API exposes open, WPA2-PSK, WPA3-SAE transition, WPA3-SAE and Enhanced Open (OWE) modes. Apple warns that turning on Maximize Compatibility may reduce "internet performance and Wi-Fi security" for connected devices.
• USB tethering broadcasts nothing. It is the hardest link to eavesdrop on, followed by Bluetooth with a confirmed pairing code, followed by a WPA3 Wi-Fi hotspot. An open hotspot is the weakest choice and Android lets you pick "None", so check.
• Carriers control whether tethering works at all, through carrier configuration flags, entitlement checks and a separate DUN APN, per Android's documentation; Apple says Personal Hotspot requires carrier support.
• MDM can restrict it. Android has DISALLOW_CONFIG_TETHERING, DISALLOW_WIFI_TETHERING and DISALLOW_CELLULAR_2G; supervised Apple devices have "Modify personal Hotspot settings".
• 5G hides your permanent identity, when the operator turns it on. 3GPP TS 33.501 conceals the SUPI inside a SUCI using a home network public key on the SIM. If the operator has not provisioned that key, the "null-scheme" is used and the identifier is not protected.

Which 3GPP releases matter and when were they frozen? A dated timeline

Dates below come from the 3GPP releases page, which extracts its freeze table from the 3GPP portal, from 3GPP release descriptions, and from the ITU, NIST, CISA, Apple and Google pages listed under Sources. "Functional freeze" means Stage 3 is complete and no new functions can be added; the "end date" is when the detailed protocols are considered stable.

Apple's deployment guide gives iOS 12.2 as the minimum version, not a date; iOS 12.2 shipped in spring 2019. The Release 15 date surprises people who remember "5G was finished in 2018". 3GPP's Release 15 page says NSA radio specifications were delivered in late 2017 and that 2018 went into completing "the first full set of 5G standards", while the portal table records the functional freeze as 22 March 2019. Both are fair; say which you mean.

The spec comparison table

The figures in this table are design requirements written by 3GPP or the ITU, not what you will see on a phone hotspot. They tell you what each generation was built to make possible.

Two more ITU requirements are worth knowing because they are closer to real life than the peak figures. M.2410 sets a user experienced data rate of 100 Mbit/s downlink and 50 Mbit/s uplink for 5G in the dense urban test environment, and a control plane latency of 20 ms, which is the time to go from an idle, battery saving state to active data. That second number is why a hotspot that has gone quiet can feel slow for the first request after a pause.

How 3G, 4G LTE, 5G NSA, 5G SA and 5G-Advanced changed hotspot speed and latency

3G: the hotspot as a last resort

Tethering existed in the 3G era with the same shape as today: a phone sharing its packet data connection over a cable, Bluetooth or later Wi-Fi. 3G was built around circuit switched voice with packet data added, so a 3G hotspot was for email when nothing else was available.

4G LTE (Release 8): an all IP design

LTE was a clean break. The Release 8 description records the goal the study set itself in December 2004: "a high-data-rate, low-latency and packet-optimized radio-access technology". The requirements in that document are specific:

• Downlink peak of 100 Mb/s within a 20 MHz allocation, uplink peak of 50 Mb/s.
• User plane latency under 5 ms in an unloaded cell for a small IP packet.
• Control plane transition from a camped (idle) state to active in under 100 ms.

LTE is where tethering became a normal way to work: video calls and large repository clones became realistic over a phone. It also brought the security architecture NIST describes in SP 800-187, including mutual authentication between device and network, which 2G never had.

5G NSA: new radio, old core

The first 5G phones and networks were mostly non-standalone. In NSA mode a phone uses LTE as the anchor for control signalling and the existing EPC core, and adds 5G New Radio (NR) carriers for user data. 3GPP's Release 15 page describes exactly this sequence: NSA NR specifications delivered in late 2017, "integrated in previous-generation LTE networks", then standalone 5G added in 2018.

For a hotspot user, NSA means more throughput when the NR carrier is available and LTE behaviour otherwise. Latency improves less than the icon suggests, because the core and control plane are still LTE.

5G SA: the 5G core arrives

In standalone mode, the phone attaches to a 5G Core (5GC) over NR alone. That matters for two reasons. First, latency: the ITU's IMT-2020 requirement is 4 ms one way user plane latency for enhanced mobile broadband (eMBB) and 1 ms for ultra reliable low latency communications (URLLC). Second, security: features specified in TS 33.501, such as SUPI concealment, belong to the 5G system and its core. A phone showing a 5G icon in NSA mode is attaching through the LTE core, so it does not get the 5G core's identity protection on that attach.

5G-Advanced (Release 18 and 19): refinement, not a new G

3GPP adopted the 5G-Advanced marker at a Project Coordination Group meeting in April 2021, for use "from Release-18 onwards". Release 18 content was largely set in December 2021 and the release froze in March 2024. The executive summary of TR 21.918 lists what it adds: further integration of satellite (non-terrestrial network) access, better support for IoT and machine type communication, sidelink and positioning, multicast and broadcast, network slicing, uncrewed aerial vehicles, AI and ML, and extended reality.

None of that is a new headline peak rate. For hotspot users the effects are indirect: efficiency, coverage at the edges and satellite access where there is no terrestrial signal. Release 18 even includes a study on "Smartly Tethering AR Glasses". Release 19 continues 5G-Advanced and froze in September 2025; Release 20 is projected to freeze in 2027.

Why your hotspot is slower than the table

Four things sit between the cellular design target and your laptop:

1. Radio conditions and cell load. Peak rates assume ideal conditions and one user.
2. The plan. Carriers can cap tethered data separately; Apple and Google both say to check with your carrier.
3. The Wi-Fi hop. A hotspot forced to an older band for compatibility can be slower than the cellular link behind it. Our post on Wi-Fi generations from 802.11b to Wi-Fi 7 and Wi-Fi 8 covers what each generation carries.
4. Heat and battery. A modem and an access point at full load make a phone warm, and phones throttle to protect themselves. Google suggests plugging in while tethering.

How does a phone hotspot actually work?

A personal hotspot is a small router built from four functions the phone already has.

Soft access point (AP mode). The phone's Wi-Fi chip switches from client mode to access point mode, or runs both at once on phones that support it. It broadcasts a network name (SSID), advertises a security mode and accepts clients. Android's developer API calls this a "soft AP" and describes it with SoftApConfiguration, which includes the band (2.4, 5, 6 GHz where supported), the security type and the passphrase.

DHCP server. The phone hands your laptop a private IPv4 address, a default gateway (the phone) and a DNS server, usually the phone forwarding queries. The walkthrough below shows how to see this.

NAT. The phone rewrites your laptop's private source address to its own cellular address and tracks replies. Nothing on the internet can start a connection to your laptop through it, and on many mobile networks the carrier adds its own NAT too. That is a real, if accidental, benefit over a hotel network where every guest shares your subnet.

A cellular data bearer. The phone sends the combined traffic over its packet data connection. Some carriers put tethered traffic on a separate access point name, the DUN (dial up networking) APN. Android's CarrierConfigManager even has a flag to use the default internet APN for tethering while roaming, which shows the two can differ.

USB and Bluetooth tethering use the same DHCP and NAT logic; only the first hop changes. Over USB the phone appears to the computer as a network adapter. Over Bluetooth it uses a Bluetooth networking profile. Apple's Personal Hotspot page covers all three methods; Google's Android help page does too, with the note that "Mac computers can't tether with Android by USB."

What security options exist on iPhone and Android hotspots?

iPhone and iPad Personal Hotspot

Apple's support article describes Personal Hotspot as using the cellular data connection of an iPhone or Wi-Fi + Cellular iPad "to create a temporary, portable Wi-Fi network". The settings that matter for security are:

• Allow Others to Join. The switch that makes the hotspot discoverable to devices that are not yours.
• Wi-Fi Password. Apple requires at least eight characters and ASCII only. Eight is a minimum, not a recommendation; use a long random passphrase.
• Maximize Compatibility. On iPhone 12 models and later and some recent iPads, this option helps older devices connect. Apple's own footnote says that when it is on, "internet performance and Wi-Fi security might be reduced" for connected devices. Apple's page does not say which band or security mode it switches to, so treat it as a fallback for one stubborn device, and turn it off afterwards.
• Instant Hotspot. Devices on the same Apple Account or Family Sharing group connect without the password, so your whole Family Sharing group can use your hotspot.
• Device name. The hotspot name is the device name, so "Jane's iPhone" tells everyone nearby who is broadcasting.

Android hotspot

Google's Android help page covers turning the hotspot on from Quick Settings, finding or changing the name and password, and choosing Wi-Fi, Bluetooth or USB tethering. It also documents an option you should avoid: under "Security", you can tap None to remove the password. Google notes you can share with up to 10 devices over Wi-Fi and recommends turning on the setting that switches the hotspot off when no devices are connected, where the phone has one.

The underlying security modes are spelled out in the Android developer reference for SoftApConfiguration:

Which of these Settings shows depends on the phone, its Wi-Fi chip and Android version.

What WPA3 changes for a hotspot

The Wi-Fi Alliance says WPA3-Personal gives users "increased protections from password guessing attempts", that WPA3 networks disallow outdated legacy protocols and require Protected Management Frames (PMF), and that WPA3 is mandatory for Wi-Fi CERTIFIED devices. For a hotspot the practical difference is offline guessing. With WPA2-Personal, someone who captures your laptop joining the hotspot can take that capture away and try passwords against it at leisure, so a short password falls. WPA3's SAE handshake does not give an eavesdropper anything to test passwords against offline. A long random password still matters, because transition mode leaves WPA2 available to anyone who asks for it.

For the history of these modes, including the KRACK, Dragonblood and FragAttacks research, see the Wi-Fi generations post.

USB vs Bluetooth vs Wi-Fi tethering: which is safer and why?

The short version: the fewer radios involved, the fewer people can reach the link.

USB broadcasts nothing, so nobody across the room can see the network, try a password or capture a handshake, and it charges the phone. The risk runs the other way: the computer gets a data link to your phone, so tether only to machines you trust.

Bluetooth tethering keeps the link short range and authenticated by pairing. Apple's instructions tell you to check that the pairing code matches on both devices before tapping Pair; that check is the defence against pairing with an impostor. It is slow, and it keeps Bluetooth on, which NSA and others recommend turning off in public when you are not using it. Our post on Bluetooth versions from Classic to LE Audio covers why old Bluetooth stacks deserve care.

Wi-Fi is the most convenient and the most exposed. With WPA3 and a long password it is fine for most work; the real risks are a password shared and never changed, or a hotspot left on all day.

What do carriers control?

Your carrier controls more of the hotspot than the phone's settings suggest. From the vendor documentation:

• Whether tethering is offered at all. Apple says Personal Hotspot "requires a wireless carrier that supports Personal Hotspot" and that "additional fees may apply". Android's carrier configuration has a carrier_supports_tethering_bool flag.
• How many devices can join. Apple says this "depends on your carrier and iPhone model". Google's general guidance is up to 10 devices over Wi-Fi.
• Entitlement checks. Android's carrier configuration has a flag "to require or skip entitlement checks". In practice an entitlement check is the phone asking the carrier whether your plan allows tethering before turning it on.
• Which APN tethered traffic uses. Android's carrier configuration refers to a DUN APN for tethering, with an option to use the default internet APN while roaming. A separate APN lets the carrier route, bill and limit tethered traffic differently.
• Traffic classification and limits. Plans often have a separate hotspot allowance. Neither Apple nor Google documents how carriers distinguish tethered traffic, so assume the carrier can tell.

For security, two other things matter more. The first is the account: CISA's December 2024 guidance says to set a telco PIN and add MFA to the carrier account against SIM swapping. The second is which network the phone may use. Android's documentation for DISALLOW_CELLULAR_2G says it plainly: "2g has no mutual authentication between a device and cellular base station", and downgrading a device to 2G is "a common tactic" for intercepting or modifying traffic.

Personal hotspot vs public Wi-Fi: what risks change?

Moving from a hotel or cafe network to your own hotspot changes who shares your local network and who sits in the middle.

What does not change: anything that leaves your device in the clear can still be read somewhere along the path. HTTPS, SSH and your organisation's VPN protect content on both. A hotspot also does not make your laptop safer if it is already compromised, and a laptop that treats every network as "home" will still advertise shared folders to whatever is on the hotspot. See also our posts on phone hotspot or hotel Wi-Fi for work, whether public Wi-Fi is safe, whether you need a VPN on public Wi-Fi and conference Wi-Fi.

On VPNs, the agencies are more nuanced than the advertising. NSA's 2021 sheet, as reported at the time, tells teleworkers who must use public Wi-Fi to use a personal or corporate provided VPN. CISA's 2024 guidance for highly targeted individuals says not to use a personal VPN, because it "simply shift[s] residual risks" from your internet provider to the VPN provider, while noting that an organisation's required VPN is a different case. Both fit together: use your employer's VPN, and do not assume a consumer VPN makes an untrusted network safe.

What does NSA guidance on public wireless say?

In July 2021 NSA published a Cybersecurity Information Sheet, "Securing Wireless Devices in Public Settings", aimed at National Security System, Department of Defense and Defense Industrial Base teleworkers, though its advice applies to anyone working away from the office. The PDF on media.defense.gov blocks scripted downloads, so the summary below relies on NSA's own announcement and contemporary coverage of it:

• Avoid public Wi-Fi. NSA's announcement recommends using a personal or corporate mobile hotspot with strong authentication and encryption instead.
• If you must use public Wi-Fi, use a personal or corporate provided VPN, browse only HTTPS sites, turn off Wi-Fi when finished and forget the network, and make sure file and print sharing is off.
• A password is not a guarantee. NSA notes that a password protected network may not encrypt traffic well, or may use encryption a skilled attacker can defeat.
• Turn off Bluetooth and NFC in public when you are not using them, and limit location features.
• Use trusted accessories, such as your original charging cables.
• Get authorisation from your organisation before conducting business remotely or in public.

Note the condition, "strong authentication and encryption": WPA3, or WPA2 with a long password, not an open hotspot.

NIST's SP 800-153 (February 2012), the older federal WLAN reference, makes the same underlying point: a wireless network is only as secure as each component on it, clients included.

What should an admin allow or restrict with MDM?

Here is what the platforms let you enforce, from their own documentation.

Android Enterprise

The UserManager restrictions an MDM sets through DevicePolicyManager.addUserRestriction:

The documentation is precise about who can set these. DISALLOW_CONFIG_TETHERING can be set by a device owner, a profile owner on the primary user, or the profile owner of an organisation owned managed profile on the parent profile. DISALLOW_WIFI_TETHERING can be set by a device owner or the profile owner of an organisation owned managed profile on the parent. A personally owned phone with only a work profile cannot be stopped from tethering by the employer, which is the correct privacy outcome.

Apple devices

Apple's deployment guide lists "Modify personal Hotspot settings" as a supervised restriction from iOS 12.2 and iPadOS 13.1: "Users can't modify personal Hotspot settings." It does not say the hotspot disappears, so test what your MDM does. The supervised restriction "Join only Wi-Fi networks installed by a Wi-Fi payload" keeps a managed iPhone or iPad off hotel Wi-Fi while still allowing a hotspot you have provisioned.

A sensible policy for most organisations

What changes with 5G security that users might hear about?

SUPI concealment, in plain words

Every subscription has a permanent identifier: the IMSI in LTE, the SUPI in 5G. Older networks could ask a phone for its IMSI in the clear, which is how "IMSI catchers" track people; NIST's SP 800-187 covers that class of LTE threat.

5G changes the attach. Under TS 33.501, the SIM holds the home network's public key, and the phone encrypts the identifying part of the SUPI with it before sending, producing a SUCI (subscription concealed identifier). Only the home network's de-concealment function can turn the SUCI back into a SUPI. TS 33.501 defines ECIES based protection schemes, with Profile A using Curve25519 and Profile B a NIST P-256 curve. The specification states that the SUPI "should not be transferred in clear text over 5G RAN", except for routing information such as the country and network codes.

Three caveats:

1. It depends on the operator. TS 33.501 says that if the home network has not provisioned the public key on the SIM, protection is not provided and the "null-scheme" is used. Subscriber privacy "shall be under the control of the home network".
2. It needs the 5G core. SUCI is part of the 5G system. A phone in NSA mode attaches through the LTE core and does not get it on that attach.
3. Downgrades still exist. If a phone can be pushed to LTE, 3G or 2G, it falls back to those generations' protections. That is why blocking 2G on Android 14 and later is worth doing.

Other 5G security changes

TS 33.501 also lets the network apply user plane integrity protection per PDU session, according to a security policy, and uses temporary identifiers (5G-GUTI) after registration. These are network side choices a user cannot see, so keep HTTPS, SSH and VPNs on top.

Step by step: set up and check a hotspot session

This walkthrough reads settings and turns on protections. Nothing here erases data.

1. On the phone

1. Rename the device if its name identifies you. On iPhone: Settings, General, About, Name.
2. Set a long random hotspot password. Apple requires at least eight ASCII characters; aim for 20 or more.
3. On Android, choose WPA3-Personal if every device you will connect supports it, otherwise the WPA2/WPA3 option. Never None.
4. On iPhone 12 and later, leave Maximize Compatibility off unless a specific device cannot connect.
5. Turn on automatic hotspot shut off where the phone offers it.
6. On Android 14 and later, turn off 2G where your phone exposes the setting, or have MDM set DISALLOW_CELLULAR_2G.
7. Prefer USB for long sessions. It is quieter, faster and keeps the phone charged.

2. On a macOS laptop

# Security mode, PHY mode and channel of the current Wi-Fi network
system_profiler SPAirPortDataType | sed -n '/Current Network Information/,/Other Local Wi-Fi Networks/p'

# The gateway should be the phone, on a private address
route -n get default | grep gateway

# What the phone's DHCP server handed out: router, DNS, lease time
ipconfig getpacket en0 | grep -E 'router|domain_name_server|lease_time'

# Is the application firewall on? Turn it on if not.
/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on

# Over USB, an iPhone shows up as its own network service
networksetup -listallhardwareports

Look for "WPA3 Personal" or "WPA2 Personal" in the security line. If it says "None", disconnect.

3. On a Linux laptop

# Active Wi-Fi network, its security mode, channel and rate
nmcli -f ACTIVE,SSID,SECURITY,CHAN,RATE dev wifi list | grep '^yes'

# Link details from the driver
iw dev wlan0 link

# Gateway (the phone) and DNS in use
ip route show default
resolvectl status | grep -A2 'Current DNS'

# USB tethering: a new wired interface should appear
ip -br link
sudo dmesg | grep -iE 'rndis|cdc_ncm|cdc_ether|ipheth'

# Make sure inbound connections are filtered
sudo ufw status verbose

Interface names vary; replace wlan0 with the name ip -br link shows.

4. On a Windows laptop

# Authentication, cipher, radio type, band and channel of the current Wi-Fi link
netsh wlan show interfaces

# Gateway and DNS handed out by the phone
ipconfig /all

# Treat the hotspot as a public network so discovery and sharing stay off
Get-NetConnectionProfile
Set-NetConnectionProfile -InterfaceAlias "Wi-Fi" -NetworkCategory Public

Run the last command in an elevated PowerShell. Replace "Wi-Fi" with the interface alias Get-NetConnectionProfile shows, which will be different for USB tethering.

5. After the session

Turn off the hotspot, or let auto shut off do it. Change the password if you shared it with anyone. On the laptop, forget any public networks you joined along the way so it does not rejoin them by name later.

Common mistakes

• Reading the 5G icon as a security label. It describes the radio. In NSA mode the attach still goes through the LTE core, and any link can be downgraded.
• Setting Security to None "just for a minute". An open hotspot is reachable by anyone in range for as long as it stays on.
• Leaving Maximize Compatibility on. Apple says it may reduce Wi-Fi security. Use it for the one device that needs it, then switch it back.
• Short, reused hotspot passwords. Under WPA2 a captured handshake lets someone test guesses offline. Length is the defence.
• Marking the hotspot as a trusted home network on the laptop. That turns on discovery and sharing for everyone on the hotspot.
• Tethering over USB to computers you do not trust. USB has no radio exposure, but it hands the other end a direct link to your phone.
• Forgetting the carrier account. A SIM swap moves your number, your SMS codes and your hotspot to someone else.
• Assuming a consumer VPN fixes everything. CISA's guidance explicitly warns against personal VPNs for highly targeted people; use the organisation's VPN where one is required.

Where Safeguard fits

Safeguard does not configure phones, manage hotspots, enforce MDM restrictions or monitor cellular or Wi-Fi traffic, and nothing in this post depends on it. The honest connection is narrower. Working from a hotspot usually means working on a developer laptop away from the office, and that laptop keeps installing and updating dependencies over whatever link it has. Safeguard can scan the repositories, container images and SBOMs you build on that laptop, match components against vulnerability databases, rank findings with reachability analysis and evaluate your policies before code ships, wherever the laptop happens to be connected. If you build software for phones or routers, the hotspot stacks inside them (hostapd, wpa_supplicant, DHCP and DNS forwarders) are open source components you can list in an SBOM and track the same way.

Fix it without waiting for upstream

A hotspot is mostly configuration, but the laptop on the other end is where your team's code gets written, and it pulls packages from public registries every time it builds, wherever it is connected. If you also ship phone, router or hotspot firmware, its Wi-Fi and networking daemons are open source components with their own advisories, so the same patch discipline applies, while the cellular modem firmware itself still has to come from the device or chip vendor.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

FAQ

Is a phone hotspot safer than public Wi-Fi?

Usually, yes. With WPA3 or WPA2 and a long password, only devices you allow share the local network, there is no captive portal, and the phone's NAT blocks unsolicited inbound connections. NSA's 2021 guidance recommends a personal or corporate hotspot with strong authentication and encryption over public Wi-Fi. You still need HTTPS and your company VPN for anything sensitive.

Should my hotspot use WPA2 or WPA3?

WPA3-Personal if every device that will join supports it, because it resists offline password guessing. Use the WPA2/WPA3 mixed option for older laptops, and WPA2 only as a last resort. Never use the open or "None" option.

What does Maximize Compatibility do on iPhone?

It helps older devices connect to Personal Hotspot on iPhone 12 models and later and some iPads. Apple warns that internet performance and Wi-Fi security might be reduced while it is on. Turn it on only when a device cannot connect, and turn it off afterwards.

Is USB tethering more secure than Wi-Fi hotspot?

Yes, for the link itself. USB broadcasts nothing, so nobody in range can see the network, guess the password or capture a handshake. The trade-off is that the computer gets a direct data link to your phone, so only tether over USB to computers you trust.

Does 5G make my hotspot more secure than 4G?

Slightly, in specific ways. 5G standalone networks can conceal your permanent subscriber identity using SUCI, if your operator has provisioned the key on your SIM, and support per session user plane integrity protection if the network enables it. The Wi-Fi link between phone and laptop is unchanged, and downgrades to older generations remain possible.

What is 5G-Advanced and does my phone need it?

5G-Advanced is the name 3GPP uses for Release 18 onward. Release 18 froze in March 2024 and adds enhancements such as AI and ML in the radio, satellite access, positioning and XR support. It is an evolution of 5G, not a new generation, and phones and networks pick up its features gradually.

Can my carrier tell I am tethering?

Carriers can treat tethered traffic differently. Android's carrier configuration includes tethering support flags, entitlement checks and a separate DUN APN for tethered data, and Apple says hotspot availability and device limits depend on the carrier. How each carrier classifies traffic is not documented publicly in detail, so assume it can tell.

Can my employer block hotspot on my phone?

On a company owned Android device, yes, using DISALLOW_CONFIG_TETHERING or DISALLOW_WIFI_TETHERING. On a supervised iPhone, the employer can stop you changing hotspot settings. On a personally owned phone with only a work profile, Android's restrictions cannot be set by the work profile alone.

See how Safeguard would help

These demos show dependency, SBOM and coding assistant workflows, not phone or hotspot configuration. You can download Safeguard and follow the CLI docs to try them on your own projects.

This demo sets up the Safeguard runner on your own machine, approves it with its device code and then scans from the terminal. If you work from a hotspot on the road, the runner on your laptop scans the repositories you are working on locally, so checks keep working whether you are on office Wi-Fi or tethered to your phone.

Click through it at your own pace, or open it full screen.

This demo is a real CLI session: install, open the interactive terminal, ask it to fix the lodash CVE in a repository, and watch it read the finding and advisory, ask before each command, move lodash to 4.17.21, run npm install and npm test with approval, and print a summary without pushing anything. The same approve each step flow applies when you are fixing a dependency on a laptop tethered to your phone between meetings.

Click through it at your own pace, or open it full screen.

This demo is a real Android session: send work to a computer running the CLI, then approve the command on the phone with Allow once, Allow for turn or Deny. It fits the travelling worker in this post, whose phone is already in hand providing the hotspot, and who can approve or refuse each command the laptop's assistant wants to run.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• 3GPP: Releases, including the release freeze and end date table
• 3GPP: Release 18 and the 5G-Advanced marker
• 3GPP: Release 15
• 3GPP: Release 8
• 3GPP: Release descriptions, including the Rel-8 description and TR 21.918 (Release 18)
• ITU-R Working Party 5D: IMT-2020
• ITU-R Report M.2410: Minimum requirements related to technical performance for IMT-2020 radio interfaces
• ETSI TS 133 501 V15.1.0 (3GPP TS 33.501): Security architecture and procedures for 5G System
• Apple Support: Connect to the Personal Hotspot of an iPhone or iPad
• Apple Support: If Personal Hotspot is not working
• Apple Support: Wireless carrier support and features for iPhone
• Apple Platform Deployment: Restrictions for iPhone and iPad
• Android Help: Share a mobile connection by hotspot or tethering
• Android Developers: SoftApConfiguration
• Android Developers: UserManager
• Android Developers: CarrierConfigManager
• Wi-Fi Alliance: Security
• NIST SP 800-153: Guidelines for Securing Wireless Local Area Networks
• NIST SP 800-187: Guide to LTE Security
• CISA: Mobile Communications Best Practice Guidance (18 December 2024)
• NSA: Securing Wireless Devices in Public Settings (July 2021)
• BleepingComputer: NSA shares guidance on how to secure your wireless devices (29 July 2021)

Last reviewed: 23 October 2026. 3GPP dates for Release 20 are projections and may move; check the linked 3GPP releases page for the current schedule.