4 ms·

Remember WPS? Apple never implemented that and then android removed it too. Ugh. On iPhone if you and a friend in iMessage are together and one can connect to

Remember WPS? Apple never implemented that and then android removed it too. Ugh. On iPhone if you and a friend in iMessage are together and one can connect to a protected WiFi, the other can connect to. Automatically.

pmontra 6y ago
What if the owner of the WiFi network wants you to connect but not your friends? Scenario: people come to my home, I give the password to a friend of mine that never visited me before or changed phone and asks me for the password. I don't know the other people and they don't ask for the password, but they get on the network anyway? Principle of most surprise and least security.
- ballenf 6y ago
  Even my least tech savvy friends understand that their wifi password is like a traditional front door key: anyone with a copy can unlock the door. I'd call that very unsurprising to most people. The idea that more sophisticated authentication is possible to prevent password sharing would be a surprise to most laypeople I know. Also home internet is increasingly coming with smart routers that will alert you to new devices on the network. Tech savvy people are the only ones who BYOD.
- xoa 6y ago
  >What if the owner of the WiFi network wants you to connect but not your friends? Then they should switch their network to a more complex authentication scheme. Multiple SSIDs, run 802.1x authentication (maybe with certs), MAC filtering maybe (bypassable sure, but will foil most casual users), run their own simple portal and shunt different classes onto different VLANs with different levels of isolation and traffic shaping, etc. Ultimately if there is one password which then gets any device on, well that's that. Sharing has always been pretty trivial. If the owner of a network wants more fine grained and powerful security, all the tools exist to do that already, but they'll have to use them.
- djrogers 6y ago
  How is this scenario any different when you tell your friend the password or show them a QR code? They can still get and share that password with anyone else...
Nextgrid 6y ago
WPS had significant security issues if I remember correctly.
- acct776 6y ago
  Insanely insecure, holy wow.
  - gcblkjaidfj 6y ago
    just as insecure as wpa and every other wifi "security" of the time. That's what you get when all the decisions are made by a comitee that only cares about the BOM cost in the modems. btw, nothing on this have changed. Only that the not-so-secure stuff is still relatively new and not exploited yet. all hail wpa3, the new crapy unsafe standard of tomorrow.
    - gcblkjaidfj 6y ago
      Are the people downvoting still using WPA? or betting their life on WPA3 that haven't had a decent sized deployment yet? Or did they bet their lives on WPA2-PSK/WPA2-enterp during the first months of launch before any exploit was public? :)
- AshamedCaptain 6y ago
  Whatever issue you mean, it cannot be worse than the issues these "Wireless Password Sharing" systems have. Or at least the WPS-Button system cannot be worse than any of these systems, which seem very prone to MITM attacks.
  - nemothekid 6y ago
    WPS was laughably insecure. If Apple's solution was piggybacked off of iMessage's key infrastructure then MITM is a non-issue.
  - Nextgrid 6y ago
    I believe the problem with the WPS button is that it comes with a WPS PIN (might be optional, but enabled by default in most cases) which means brute-force attacks are possible even without having to press the button, where as the solution described in the repo would at least require you to eavesdrop on an active key exchange between 2 users.
franga2000 6y ago
WPS was a disaster and Android has removed it in favor of the WFA's official replacement: "Wi-Fi Easy Connect". My point is that there is a new and perfectly good standard for this that Apple should really be following (although I doubt they will). As for the iMessage thing, holy shit that is such a bad idea and I'm really glad I never gave any iPhone users access to my network!
yarcob 6y ago
> On iPhone if you and a friend in iMessage are together and one can connect to a protected WiFi, the other can connect to. Automatically. I don't think this is accurate. The Wifi sharing feature works differently. It's documented here: https://support.apple.com/en-us/HT209368 https://support.apple.com/en-us/HT209368

pmontra 6y ago

What if the owner of the WiFi network wants you to connect but not your friends? Scenario: people come to my home, I give the password to a friend of mine that never visited me before or changed phone and asks me for the password. I don't know the other people and they don't ask for the password, but they get on the network anyway? Principle of most surprise and least security.

ballenf 6y ago
Even my least tech savvy friends understand that their wifi password is like a traditional front door key: anyone with a copy can unlock the door. I'd call that very unsurprising to most people. The idea that more sophisticated authentication is possible to prevent password sharing would be a surprise to most laypeople I know. Also home internet is increasingly coming with smart routers that will alert you to new devices on the network. Tech savvy people are the only ones who BYOD.
xoa 6y ago
>What if the owner of the WiFi network wants you to connect but not your friends? Then they should switch their network to a more complex authentication scheme. Multiple SSIDs, run 802.1x authentication (maybe with certs), MAC filtering maybe (bypassable sure, but will foil most casual users), run their own simple portal and shunt different classes onto different VLANs with different levels of isolation and traffic shaping, etc. Ultimately if there is one password which then gets any device on, well that's that. Sharing has always been pretty trivial. If the owner of a network wants more fine grained and powerful security, all the tools exist to do that already, but they'll have to use them.
djrogers 6y ago
How is this scenario any different when you tell your friend the password or show them a QR code? They can still get and share that password with anyone else...

Nextgrid 6y ago

WPS had significant security issues if I remember correctly.

acct776 6y ago
Insanely insecure, holy wow.
- gcblkjaidfj 6y ago
  just as insecure as wpa and every other wifi "security" of the time. That's what you get when all the decisions are made by a comitee that only cares about the BOM cost in the modems. btw, nothing on this have changed. Only that the not-so-secure stuff is still relatively new and not exploited yet. all hail wpa3, the new crapy unsafe standard of tomorrow.
  - gcblkjaidfj 6y ago
    Are the people downvoting still using WPA? or betting their life on WPA3 that haven't had a decent sized deployment yet? Or did they bet their lives on WPA2-PSK/WPA2-enterp during the first months of launch before any exploit was public? :)
AshamedCaptain 6y ago
Whatever issue you mean, it cannot be worse than the issues these "Wireless Password Sharing" systems have. Or at least the WPS-Button system cannot be worse than any of these systems, which seem very prone to MITM attacks.
- nemothekid 6y ago
  WPS was laughably insecure. If Apple's solution was piggybacked off of iMessage's key infrastructure then MITM is a non-issue.
- Nextgrid 6y ago
  I believe the problem with the WPS button is that it comes with a WPS PIN (might be optional, but enabled by default in most cases) which means brute-force attacks are possible even without having to press the button, where as the solution described in the repo would at least require you to eavesdrop on an active key exchange between 2 users.

franga2000 6y ago

WPS was a disaster and Android has removed it in favor of the WFA's official replacement: "Wi-Fi Easy Connect". My point is that there is a new and perfectly good standard for this that Apple should really be following (although I doubt they will). As for the iMessage thing, holy shit that is such a bad idea and I'm really glad I never gave any iPhone users access to my network!

yarcob 6y ago

> On iPhone if you and a friend in iMessage are together and one can connect to a protected WiFi, the other can connect to. Automatically. I don't think this is accurate. The Wifi sharing feature works differently. It's documented here: https://support.apple.com/en-us/HT209368 https://support.apple.com/en-us/HT209368