6 ms·
Isn't there a proper 802.whatever standard for "inviting" devices into the network? Android does it with QR codes, but Bluetooth can also be used. Is this that,
by franga2000 6y ago
Isn't there a proper 802.whatever standard for "inviting" devices into the network? Android does it with QR codes, but Bluetooth can also be used. Is this that, or did Apple reinvent the wheel again?
- emteycz 6y agoAre you sure Android didn't reinvent the wheel (again)? I certainly remember iOS having the option far earlier than any Android.
- franga2000 6y agoYes, quite sure. They implemented an existing protocol called DPP (Device Provisioning Protocol), more commonly branded as "Wi-Fi Easy Connect", that is a part of the 802.11 standard and implemented by more than just Google. If Apple isn't using that, then it's them who are ignoring the standards and doing their own thing.
- brorfred 6y agoIt seems like DPP is part of WPA3, which came out in late 2018 and Apple’s version was first introduced in iOS 11, which was released 2017?
- nashashmi 6y agoRemember WPS? Apple never implemented that and then android removed it too. Ugh. On iPhone if you and a friend in iMessage are together and one can connect to a protected WiFi, the other can connect to. Automatically.
- pmontra 6y agoWhat if the owner of the WiFi network wants you to connect but not your friends? Scenario: people come to my home, I give the password to a friend of mine that never visited me before or changed phone and asks me for the password. I don't know the other people and they don't ask for the password, but they get on the network anyway? Principle of most surprise and least security.
- ballenf 6y agoEven my least tech savvy friends understand that their wifi password is like a traditional front door key: anyone with a copy can unlock the door. I'd call that very unsurprising to most people. The idea that more sophisticated authentication is possible to prevent password sharing would be a surprise to most laypeople I know. Also home internet is increasingly coming with smart routers that will alert you to new devices on the network. Tech savvy people are the only ones who BYOD.
- xoa 6y ago>What if the owner of the WiFi network wants you to connect but not your friends? Then they should switch their network to a more complex authentication scheme. Multiple SSIDs, run 802.1x authentication (maybe with certs), MAC filtering maybe (bypassable sure, but will foil most casual users), run their own simple portal and shunt different classes onto different VLANs with different levels of isolation and traffic shaping, etc. Ultimately if there is one password which then gets any device on, well that's that. Sharing has always been pretty trivial. If the owner of a network wants more fine grained and powerful security, all the tools exist to do that already, but they'll have to use them.
- djrogers 6y agoHow is this scenario any different when you tell your friend the password or show them a QR code? They can still get and share that password with anyone else...
- Nextgrid 6y agoWPS had significant security issues if I remember correctly.
- acct776 6y agoInsanely insecure, holy wow.
- gcblkjaidfj 6y agojust as insecure as wpa and every other wifi "security" of the time. That's what you get when all the decisions are made by a comitee that only cares about the BOM cost in the modems. btw, nothing on this have changed. Only that the not-so-secure stuff is still relatively new and not exploited yet. all hail wpa3, the new crapy unsafe standard of tomorrow.
- gcblkjaidfj 6y agoAre the people downvoting still using WPA? or betting their life on WPA3 that haven't had a decent sized deployment yet? Or did they bet their lives on WPA2-PSK/WPA2-enterp during the first months of launch before any exploit was public? :)
- AshamedCaptain 6y agoWhatever issue you mean, it cannot be worse than the issues these "Wireless Password Sharing" systems have. Or at least the WPS-Button system cannot be worse than any of these systems, which seem very prone to MITM attacks.
- nemothekid 6y agoWPS was laughably insecure. If Apple's solution was piggybacked off of iMessage's key infrastructure then MITM is a non-issue.
- Nextgrid 6y agoI believe the problem with the WPS button is that it comes with a WPS PIN (might be optional, but enabled by default in most cases) which means brute-force attacks are possible even without having to press the button, where as the solution described in the repo would at least require you to eavesdrop on an active key exchange between 2 users.
- franga2000 6y agoWPS was a disaster and Android has removed it in favor of the WFA's official replacement: "Wi-Fi Easy Connect". My point is that there is a new and perfectly good standard for this that Apple should really be following (although I doubt they will). As for the iMessage thing, holy shit that is such a bad idea and I'm really glad I never gave any iPhone users access to my network!
- yarcob 6y ago> On iPhone if you and a friend in iMessage are together and one can connect to a protected WiFi, the other can connect to. Automatically. I don't think this is accurate. The Wifi sharing feature works differently. It's documented here: https://support.apple.com/en-us/HT209368 https://support.apple.com/en-us/HT209368
- sigjuice 6y agoQR codes also work on my iPhone. $ qrencode "WIFI:T:WPA;S:${SSID};P:${PASSWORD};;" -o wifi.png
- franga2000 6y agoWhat Android does is slightly more complicated than that, but it's good to know Apple supports at least something standardized. The main advantage of DPP/EasyConnect (what Android uses with QR codes) is that the key isn't actually stored in the code. It creates a temporary key that allows both devices to communicate securely, then transfers the credentials securely over that connection.
- Thorrez 6y agoDistributing a public key through a QR code? That's something I did a number of years ago for a similar purpose: https://throwpass.com https://throwpass.com
- tinus_hn 6y agoAnd at the end of the story there’s still an unlimited amount of devices that possess the key. So what is the gain?
- franga2000 6y agoThe key is only useful to the first device that gets it. It's generated for each transaction and only valid once. The devices (let's say two phones) communicate directly and once that's done, the connection closes. To add another device, the phone weill generate a new key and a new QR code.
- tinus_hn 6y agoYeah that’s great but at the end of the story each phone has the PSK because that’s what it uses to actually connect to the wireless network.
- 6y ago
- junipertea 6y agoApple literally invented a (click) wheel! https://en.wikipedia.org/wiki/IPod_click_wheel https://en.wikipedia.org/wiki/IPod_click_wheel
- JeremyBanks 6y agoAnd it was great.
- WhyNotHugo 6y agoNot really. WPS was kinda close, but you needed to set up the router (most home users won't figure this out), and actually press a button on it to invite a user. Apple's protocol is super user friendly, when someone tries to connect to my wifi at home, I get a popup offering to share my wifi password. I'm glad this sort of protocol is being reverse engineered and FLOSS alternatives pop up, since it'll allow better interaction with Linux desktop and iOS guests.
- tinus_hn 6y agoWPS has two modes: the button and a PIN. The PIN was implemented first because it’s the most convenient and doesn’t need hardware and it turned out to be a security disaster. So now its reputation is shot and for both PIN and the button there had to be a way to turn off WPS (with the ‘secure’ default option being WPS off)
- jedberg 6y agoThe QR codes are standard and old. I have a sign at my front door with the QR code for my wifi so people don't have to ask me, and I've had that for years. But the Apple sharing is something else entirely.
- franga2000 6y agoNope, those are not the same QR codes. What you're thinking is a QR code with the credentials encodes in it that anyone can read and use. New versions of Android instead implement WiFi Easy Connect (technically called Device Provisioning Protocol) that makes one-time codes to create a secure P2P connection betweem two devices, then transmits the credentials securely. It's pretty much exactly what Apple's thing seems to be doing, only they're doing it over Bluetooth instead of ad-hoc WiFi.
- matt74827289 6y agoWhat versions of Android do this? I just tried it on my Pixel 4a and the QR code it generates just contains the network name and password in plain text.
- slacka 6y ago> I have a sign at my front door with the QR code Why not just have an open WiFi network? I stubbornly have kept my network open since my very first Linksys WRT54G router. Am I some kind of internet hippy for feeling like networks should be open and we'd all be better off if we shared with our neighbors? Over the years, I've probably wasted an hours of my life searching for and struggling to correctly enter complex WiFi passwords. Although truth be told, I think it's primarily that I don't want to bothered giving WiFi passwords to my guests:)
- rootusrootus 6y ago> Why not just have an open Wi-Fi network? Because I don't want the creepy neighbor kid to do something on my guest network that will get me a visit from the cops or a letter from my ISP. Sure, guests could do that, but they'd be a lot less anonymous in the process.