4 ms·

> Should you trust this tool with your WiFi password? > Of course not! You shouldn't trust anything on the internet ever — but if it > makes you feel better,

> Should you trust this tool with your WiFi password? > Of course not! You shouldn't trust anything on the internet ever — but if it > makes you feel better, I promise none of the information you enter on this page > is saved anywhere. I saw a theory on Reddit that you could safely use a tool like this by disconnecting from your internet before entering the information, then reconnecting after saving the QR code and having deleted it (thereby theoretically preventing your information from ever being sent to the website). That sounds plausible, and the tool does seem to work while offline, but I don't have the expertise to confidently state that this would 100% protect you. Anyone want to chime in with how hard this would make it for them to harvest your data (if they wanted to, which I'm inclined to believe they don't, but just in terms of best practices)?

pockybum522 3y ago
If you're actually concerned about your data, find an offline QR generator. Encoding a WiFi network is just adding some extra plaintext to a normal QR code. One explanation is here: https://pocketables.com/2022/01/how-to-format-that-wifi-qr-code-in-plain-text.html https://pocketables.com/2022/01/how-to-format-that-wifi-qr-c...
- eastbound 3y ago
  The irony it’s your infinitely better protected using a webpage in Incognito with network disconnected, than downloading an offline generator and running the binary on your computer.
  - rpdillon 3y ago
    Depends a lot on context. Generally I agree, but for this particular use case, I use QR Scanner from SECUSO. It's available on F-Droid, and I think it's a very good tool for the offline generation use-case. Android-only though, of course. https://f-droid.org/en/packages/com.secuso.privacyFriendlyCodeScanner/ https://f-droid.org/en/packages/com.secuso.privacyFriendlyCo...
    - eastbound 3y ago
      Android apps are not sandboxed. Even if they were, a webpage is safer.
      - rpdillon 3y ago
        My point is more about who wrote the source, and how that source made its way to me.
DitheringIdiot 3y ago
You could always write code that saves the data temporarily until the user reconnects to the internet or even visits the website again. I'm not certain how I would use people's wifi passwords without being at their home, but I'm certain somebody on Hacker News could tell me exactly why it is a bad idea to share your wifi password to the internet.
- gruez 3y ago
  >You could always write code that saves the data temporarily until the user reconnects to the internet or even visits the website again Use private browsing?
  - DitheringIdiot 3y ago
    Yes you're right, that would probably prevent it
- oh_sigh 3y ago
  Well, if you connected to my service I can probably geolocate you. Or I can use a SSID=>lat/lon database to find where your wifi is assuming you have a unique name for your Wi-Fi network. Then I can go there and connect a laptop it and do nefarious stuff from there, and attribute it to you. Threaten the president, torrent Linux ISOs, etc.
  - kylecazar 3y ago
    Surely Linux isos are among the least nefarious things to torrent ha
- godelski 3y ago
  > I'm not certain how I would use people's wifi passwords without being at their home Doesn't Google track router SSID names and MAC addresses? This definitely used to be a searchable database that was connected to Maps. I can't find any of the old websites but it looks like it might still be accessible via API. > but I'm certain somebody on Hacker News could tell me exactly why it is a bad idea to share your wifi password to the internet. Not a hacker but I'm going to give a easy but not critical example. If you have access to another device in range (say, because you run a botnet) you can jump into another neighboring network. I'm sure someone on HN could give us a much more worrisome example.
westmeal 3y ago
use qr-encode on the command line like this: qr-encode -t utf8 "wifipassword"
- dmitris 3y ago
  on a Mac, one can 'brew install qrencode' (from https://fukuchi.org/works/qrencode/index.html.en https://fukuchi.org/works/qrencode/index.html.en)
jareklupinski 3y ago
one time i couldn't find _any_ other way, so I saved the page source to desktop, gave the javascript a once-over, disabled networking, opened the chrome inspector network tab, opened the saved copy of the page, did my thing, didnt see any network activity, closed the browser, then re-enabled networking hope that worked
recursive 3y ago
For a bad actor, this is easily work-around-able using various local persistence mechanisms like evercookie. https://samy.pl/evercookie/ https://samy.pl/evercookie/
alanbernstein 3y ago
Just curious, what could the operator of the site do with your WiFi password? Wouldn't it only be useful in physical proximity to your router?

pockybum522 3y ago

If you're actually concerned about your data, find an offline QR generator. Encoding a WiFi network is just adding some extra plaintext to a normal QR code. One explanation is here: https://pocketables.com/2022/01/how-to-format-that-wifi-qr-code-in-plain-text.html https://pocketables.com/2022/01/how-to-format-that-wifi-qr-c...

eastbound 3y ago
The irony it’s your infinitely better protected using a webpage in Incognito with network disconnected, than downloading an offline generator and running the binary on your computer.
- rpdillon 3y ago
  Depends a lot on context. Generally I agree, but for this particular use case, I use QR Scanner from SECUSO. It's available on F-Droid, and I think it's a very good tool for the offline generation use-case. Android-only though, of course. https://f-droid.org/en/packages/com.secuso.privacyFriendlyCodeScanner/ https://f-droid.org/en/packages/com.secuso.privacyFriendlyCo...
  - eastbound 3y ago
    Android apps are not sandboxed. Even if they were, a webpage is safer.
    - rpdillon 3y ago
      My point is more about who wrote the source, and how that source made its way to me.

DitheringIdiot 3y ago

You could always write code that saves the data temporarily until the user reconnects to the internet or even visits the website again. I'm not certain how I would use people's wifi passwords without being at their home, but I'm certain somebody on Hacker News could tell me exactly why it is a bad idea to share your wifi password to the internet.

gruez 3y ago
>You could always write code that saves the data temporarily until the user reconnects to the internet or even visits the website again Use private browsing?
- DitheringIdiot 3y ago
  Yes you're right, that would probably prevent it
oh_sigh 3y ago
Well, if you connected to my service I can probably geolocate you. Or I can use a SSID=>lat/lon database to find where your wifi is assuming you have a unique name for your Wi-Fi network. Then I can go there and connect a laptop it and do nefarious stuff from there, and attribute it to you. Threaten the president, torrent Linux ISOs, etc.
- kylecazar 3y ago
  Surely Linux isos are among the least nefarious things to torrent ha
godelski 3y ago
> I'm not certain how I would use people's wifi passwords without being at their home Doesn't Google track router SSID names and MAC addresses? This definitely used to be a searchable database that was connected to Maps. I can't find any of the old websites but it looks like it might still be accessible via API. > but I'm certain somebody on Hacker News could tell me exactly why it is a bad idea to share your wifi password to the internet. Not a hacker but I'm going to give a easy but not critical example. If you have access to another device in range (say, because you run a botnet) you can jump into another neighboring network. I'm sure someone on HN could give us a much more worrisome example.

westmeal 3y ago

use qr-encode on the command line like this: qr-encode -t utf8 "wifipassword"

dmitris 3y ago
on a Mac, one can 'brew install qrencode' (from https://fukuchi.org/works/qrencode/index.html.en https://fukuchi.org/works/qrencode/index.html.en)

jareklupinski 3y ago

one time i couldn't find _any_ other way, so I saved the page source to desktop, gave the javascript a once-over, disabled networking, opened the chrome inspector network tab, opened the saved copy of the page, did my thing, didnt see any network activity, closed the browser, then re-enabled networking hope that worked

recursive 3y ago

For a bad actor, this is easily work-around-able using various local persistence mechanisms like evercookie. https://samy.pl/evercookie/ https://samy.pl/evercookie/

alanbernstein 3y ago

Just curious, what could the operator of the site do with your WiFi password? Wouldn't it only be useful in physical proximity to your router?