Right, it's all based on this lack of configuration, and could be avoided by users. It's alternately amusing, annoying and irksome to me that the researchers p

Right, it's all based on this lack of configuration, and could be avoided by users. It's alternately amusing, annoying and irksome to me that the researchers propose to fix the situation with a "product that could be installed in wi-fi access points to prevent this kind of hijacking - without requiring the user to take responsibility". That is the wrong approach. User education is hard, and lacks incentives for the gear makers, but adding new layers (maybe proprietary, maybe with vulnerabilities of their own) is the wrong approach. The autoconfiguration features on some routers are an example. Equally bad is the "dumbing down" imperative that in recent years has made interfaces more opaque, restrictive and stupid. "Click this big, colorful icon and we'll do it all for you, so you don't have to think!" -- and then interface makers try to cope with users being more ignorant than ever -- failing to perceive the cause and effect relationship. The right approach is giving controls for all the functionality, status displays to show what is happening, explaining in plain terms what each control is for, giving step by step instructions for the essentials, and making the default configuration safe. (In the case of a router, this would mean no WAN connection until you configure the device.)