7 ms·

> Wi-Fi Alliance is also introducing Wi-Fi CERTIFIED Easy Connect™, a new program that reduces the complexity of onboarding Wi-Fi devices with limited or no dis

> Wi-Fi Alliance is also introducing Wi-Fi CERTIFIED Easy Connect™, a new program that reduces the complexity of onboarding Wi-Fi devices with limited or no display interface – such as devices coming to market for Internet of Things (IoT) – while still maintaining high security standards. Wi-Fi Easy Connect™ enables users to securely add any device to a Wi-Fi network using another device with a more robust interface, such as a smartphone, by simply scanning a product quick response (QR) code. Wi-Fi Easy Connect and WPA3 represent the latest evolution in Wi-Fi Alliance programs to ensure users receive a positive experience while remaining securely connected as the security landscape evolves. This is highly reminiscent of WPS. The language indicates that they've learned their lesson and focused on making the standard secure, at least in theory. Time will tell how well it's implemented, but history says to be skeptical and disable it for the time being.

sandworm101 8y ago
It is allowing any device already on the network to vouch for new devices. What could possibly go wrong? WPS had flaws in its implementation, but was reasonable on a theoretical level. This seems foolhardy at best. WPA2, when properly implemented, is very secure. I'm not sure of WPA3's real purpose. Is strong encryption of wifi signals of any benefit? The days of banking passwords being send in html gets should be behind us. Anything important will be protected by other encryption layers than wifi. Is WPA3 meant to protect unauthorized network access? WPA2 isn't exactly easy to crack. Do we really need a new scheme, and the inevitable new flaws that come with it? Or is this really about streamlining the user experience, about making wifi that little bit less complicated, so that people can attached their smart toasters to the home network without having to actually remember the password. To clarify for those who obviously do not understand the difference between protocol and concept implementation: Errors in the protocol would have been inconsequential if WPS was implemented properly. Had it not been left on 24/7, the temporary use of shorter keys would have been a good thing. It would have allowed home networks to adopt much more complex keys without having to type them into every new device (a big deal on things like printers which didn't have keyboards). WPS could have contributed to greater WPA2 security. But instead the concept was improperly implemented, allowing the inevitable errors discovered in the adopted protocol to be leveraged.
- Ajedi32 8y ago
  It doesn't say _any_ device. On the contrary, it sounds like the network admin has to explicitly delegate that authority to the configurator device: > With Wi-Fi Easy Connect, a network owner chooses one device as the central point of configuration. https://www.wi-fi.org/discover-wi-fi/wi-fi-easy-connect https://www.wi-fi.org/discover-wi-fi/wi-fi-easy-connect Though with WPA2 (personal, at least), isn't it already possible for "any permitted device" to "vouch for new devices" by simply giving those new devices the Wi-Fi password?
  - thisacctforreal 8y ago
    Yes, Apple devices offer to do this for eachother if you are in the person's contacts. Works between your own devices too, requires bluetooth but no pairing.
    - X-Istence 8y ago
      Best thing ever when traveling and your colleague just got the wifi password for the coffee shop you are in and you don't feel like typing it out.
- d33 8y ago
  > WPA2, when properly implemented, is very secure Not really: https://github.com/d33tah/call-for-wpa3/ https://github.com/d33tah/call-for-wpa3/
  - zokier 8y ago
    If I'm not completely mistaken, only the DoS ("Anyone can disconnect you") is valid for true scotsman WPA2 (aka WPA2-EAP aka WPA2-Enterprise). "Silly "terms of service" in your cafe can break your applications and expose you to risk" is hardly fault of WPA2; while some sort of side-channel for provider-provided messages would be nice, I think at least the ToS case could be handled by e.g. DHCP option.
    - 8y ago
IshKebab 8y ago
This isn't really like WPS. It's more like... what a lot of IoT devices already do. I'm not sure any IoT devices ever used WPS.
- comboy 8y ago
  Currently you need bluetooth between your smartphone and the IoT device just to set it up. Maybe with the help of this, bluetooth could be removed.
  - xori 8y ago
    most wifi SoC support peer-to-peer over wifi, now-a-days you don't really need bluetooth.
    - digi_owl 8y ago
      From a user standpoint they lack the profiles that bluetooth has baked in, that ensures that devices can talk to each other with little to no extra software.
    - amckinlay 8y ago
      And if the IoT device is using Wi-Fi anyway there is no need for low power demand of Bluetooth.
  - IshKebab 8y ago
    No, a lot of WiFi IoT devices create a hotspot that your phone connects to. It's hacky as hell - you have to do the connection manually on iOS (unless it uses Homekit), and some devices only support one WiFi connection so they have to disconnect from your phone before attempting to connect to your network so you get zero feedback. But it saves $2 on the BOM.

sandworm101 8y ago

It is allowing any device already on the network to vouch for new devices. What could possibly go wrong? WPS had flaws in its implementation, but was reasonable on a theoretical level. This seems foolhardy at best. WPA2, when properly implemented, is very secure. I'm not sure of WPA3's real purpose. Is strong encryption of wifi signals of any benefit? The days of banking passwords being send in html gets should be behind us. Anything important will be protected by other encryption layers than wifi. Is WPA3 meant to protect unauthorized network access? WPA2 isn't exactly easy to crack. Do we really need a new scheme, and the inevitable new flaws that come with it? Or is this really about streamlining the user experience, about making wifi that little bit less complicated, so that people can attached their smart toasters to the home network without having to actually remember the password. To clarify for those who obviously do not understand the difference between protocol and concept implementation: Errors in the protocol would have been inconsequential if WPS was implemented properly. Had it not been left on 24/7, the temporary use of shorter keys would have been a good thing. It would have allowed home networks to adopt much more complex keys without having to type them into every new device (a big deal on things like printers which didn't have keyboards). WPS could have contributed to greater WPA2 security. But instead the concept was improperly implemented, allowing the inevitable errors discovered in the adopted protocol to be leveraged.

Ajedi32 8y ago
It doesn't say _any_ device. On the contrary, it sounds like the network admin has to explicitly delegate that authority to the configurator device: > With Wi-Fi Easy Connect, a network owner chooses one device as the central point of configuration. https://www.wi-fi.org/discover-wi-fi/wi-fi-easy-connect https://www.wi-fi.org/discover-wi-fi/wi-fi-easy-connect Though with WPA2 (personal, at least), isn't it already possible for "any permitted device" to "vouch for new devices" by simply giving those new devices the Wi-Fi password?
- thisacctforreal 8y ago
  Yes, Apple devices offer to do this for eachother if you are in the person's contacts. Works between your own devices too, requires bluetooth but no pairing.
  - X-Istence 8y ago
    Best thing ever when traveling and your colleague just got the wifi password for the coffee shop you are in and you don't feel like typing it out.
d33 8y ago
> WPA2, when properly implemented, is very secure Not really: https://github.com/d33tah/call-for-wpa3/ https://github.com/d33tah/call-for-wpa3/
- zokier 8y ago
  If I'm not completely mistaken, only the DoS ("Anyone can disconnect you") is valid for true scotsman WPA2 (aka WPA2-EAP aka WPA2-Enterprise). "Silly "terms of service" in your cafe can break your applications and expose you to risk" is hardly fault of WPA2; while some sort of side-channel for provider-provided messages would be nice, I think at least the ToS case could be handled by e.g. DHCP option.
  - 8y ago

IshKebab 8y ago

This isn't really like WPS. It's more like... what a lot of IoT devices already do. I'm not sure any IoT devices ever used WPS.

comboy 8y ago
Currently you need bluetooth between your smartphone and the IoT device just to set it up. Maybe with the help of this, bluetooth could be removed.
- xori 8y ago
  most wifi SoC support peer-to-peer over wifi, now-a-days you don't really need bluetooth.
  - digi_owl 8y ago
    From a user standpoint they lack the profiles that bluetooth has baked in, that ensures that devices can talk to each other with little to no extra software.
  - amckinlay 8y ago
    And if the IoT device is using Wi-Fi anyway there is no need for low power demand of Bluetooth.
- IshKebab 8y ago
  No, a lot of WiFi IoT devices create a hotspot that your phone connects to. It's hacky as hell - you have to do the connection manually on iOS (unless it uses Homekit), and some devices only support one WiFi connection so they have to disconnect from your phone before attempting to connect to your network so you get zero feedback. But it saves $2 on the BOM.