5 ms·

> Like many other 'smart' appliances, it creates it's own AP so allow you to set it up. So anyone within range could attach it to their network, and then do wha

> Like many other 'smart' appliances, it creates it's own AP so allow you to set it up. So anyone within range could attach it to their network, and then do whatever they like with it. Considering the security risk of smart devices generally working like this, I feel like the industry ought to standardize on something more sensible. Maybe some kind of NFC pairing?

yrro 4y ago
It's called WPS. God knows why manufacturers prefer to do something as iduotic as crearing their own WiFi access point rather than using it!
- Dylan16807 4y ago
  WPS is severely broken and insecure. And the QR/NFC thing they added to replace it will require quite new devices.
  - yrro 4y ago
    WPS PIN method is severely broken and insecure, absolutely typical of most stuff put out by the Wi-Fi Alliance. As far as I know, WPS push button method is fine. I haven't ever needed or wanted to try to use the NFC method, I would disable it on any equipment I installed until I had a need for it. And even then I would do some research to see how badly the Wi-Fi Alliance fucked it up before making a judgement about whether I would feel comfortable enabling it.
- Crosseye_Jack 4y ago
  Depending on the router manufacturer you may not be able to disable WPS pin and keep WPS push button (this is the case of the router that was supplied by my ISP as it comes with a rather dumbed down UI, not sure if I could disable it via editing a settings backup file and applying that back to the router as I use my own equipment, but most consumers will just use the router issued to them from their ISP). WPS enter pin has a max number of possibilities of 11k pins (it checks the pin in 2 half’s and the last digit is a check digit, so 10k possibilities for the first half and 999 possibilities for the 2nd half), and some routers don’t rate limit the connection requests. Some router manufacturers fixed the issue by removing WPS pin, others “fixed” it by rate limiting WPS pin connection attempts, but that will just delay the attack. So we are left with WPS Push button (if that’s available because as stated above, consumer routers may only allow disabling WPS completely rather than just disable WPS pin). But thats a bit of a pain for items like Shellys that are designed to be put behind fixtures. But yeah, in the case of a fridge and most other consumer grade equipment putting a push button somewhere for WPS Push Button should be easy to factor in.
  - deleted 4y ago
    [deleted]
yrro 4y ago
Additional: it seems the Wi-Fi Easy Connect is replacing WPS. https://www.wi-fi.org/discover-wi-fi/wi-fi-easy-connect https://www.wi-fi.org/discover-wi-fi/wi-fi-easy-connect By the same geniuses that brought you WEP, WPA (TKIP) and WPS PIN... now we finally have QR codes and NFC mixed in. I'll be turning this off so I can avoid the inevitable security flaws.

yrro 4y ago

It's called WPS. God knows why manufacturers prefer to do something as iduotic as crearing their own WiFi access point rather than using it!

Dylan16807 4y ago
WPS is severely broken and insecure. And the QR/NFC thing they added to replace it will require quite new devices.
- yrro 4y ago
  WPS PIN method is severely broken and insecure, absolutely typical of most stuff put out by the Wi-Fi Alliance. As far as I know, WPS push button method is fine. I haven't ever needed or wanted to try to use the NFC method, I would disable it on any equipment I installed until I had a need for it. And even then I would do some research to see how badly the Wi-Fi Alliance fucked it up before making a judgement about whether I would feel comfortable enabling it.
Crosseye_Jack 4y ago
Depending on the router manufacturer you may not be able to disable WPS pin and keep WPS push button (this is the case of the router that was supplied by my ISP as it comes with a rather dumbed down UI, not sure if I could disable it via editing a settings backup file and applying that back to the router as I use my own equipment, but most consumers will just use the router issued to them from their ISP). WPS enter pin has a max number of possibilities of 11k pins (it checks the pin in 2 half’s and the last digit is a check digit, so 10k possibilities for the first half and 999 possibilities for the 2nd half), and some routers don’t rate limit the connection requests. Some router manufacturers fixed the issue by removing WPS pin, others “fixed” it by rate limiting WPS pin connection attempts, but that will just delay the attack. So we are left with WPS Push button (if that’s available because as stated above, consumer routers may only allow disabling WPS completely rather than just disable WPS pin). But thats a bit of a pain for items like Shellys that are designed to be put behind fixtures. But yeah, in the case of a fridge and most other consumer grade equipment putting a push button somewhere for WPS Push Button should be easy to factor in.
- deleted 4y ago
  [deleted]

yrro 4y ago

Additional: it seems the Wi-Fi Easy Connect is replacing WPS. https://www.wi-fi.org/discover-wi-fi/wi-fi-easy-connect https://www.wi-fi.org/discover-wi-fi/wi-fi-easy-connect By the same geniuses that brought you WEP, WPA (TKIP) and WPS PIN... now we finally have QR codes and NFC mixed in. I'll be turning this off so I can avoid the inevitable security flaws.