Or, alternatively, treat your LAN/WiFI like public internet and don't send anything unencrypted thru it