Comment by est31 | Hacker News Reader

Comment by est31 | Hacker News Reader

> Now, you can share your Wi-Fi details with guests via a QR code while keeping your password secure.

This is terribly misleading. The format used does contain the password so your password is still being shared:

* https://en.wikipedia.org/wiki/QR_code#WiFi_network_login

* https://github.com/zxing/zxing/wiki/Barcode-Contents#wi-fi-n...

I'm saying misleading because there is an interpretation of that sentence that is technically correct: Some people might use short passwords so that they can tell them to guests. With this feature, they can use longer secure passwords. In this interpretation, "keeping your passwords secure" would refer to the entropy of the password instead of how shared it is. However, when you normally read this sentence, this isn't the interpretation that comes to your mind.

I guess that some internal document written by people who understood the difference had something like "with this feature you can have now secure passwords and you are still able share them with guests". Then someone without awareness of this difference reformulated it into the current form.

The feature is a bit more than this. In the WiFi share screen, the network password is actually displayed in plain text as well. It does require a fingerprint/pattern/pin to show anything though.

Security is and always has been a sliding scale, despite always referred colloquially as being either present or absent. "Keeping your password secure" in English really means, "improving the security of your password".

Except this feature doesn't add security, it just adds a tool for reducing the usability trade-off of having a long hard password.

I think it is very misleading phrasing.

If the feature makes folks more likely to use a 64 character random password for your Wi-Fi then I'd say it certainly does add security.

Presumably folks will be "sharing" the plaintext value of their Wi-Fi password with friends regardless of whether they use this feature or not, so it appears to neither increase nor decrease THAT aspect of Wi-Fi password security.

I highly doubt anyone is using 64 character wifi passwords because QR codes are an option.

Good luck typing that into your playstation with a controller and your chinese IoT product.

The best solution is still the middle ground between readability/memorability + strength. Or stored in a password library until needed.

Does the person who scanned the QR code have access to the wifi password after the fact on their phone? From what I remember, there is no way to access saved wifi passwords, you can just modify it but can't see the stored one.

This way, if you just have them scan the QR code on your phone (and don't let them photograph it), technically you have securely given the password without them knowing it, right?

> Does the person who scanned the QR code have access to the wifi password after the fact on their phone?

Yes and this version of Android makes it easy to view saved wifi passwords without a third-party app.

Could they then go and create a QR code to share/decode?

If they use the most popular QR code scanner on Android [1], it shows the password in the scanner (IIRC), along with a button to connect to it. There's no acceptably secure way to give someone a WiFi password without ... giving it to them. QR codes are a simple graphical representation of text, they don't encrypt that text in any way. Sharing a password this way is not more secure than them handing you their device and you typing it in - and if you do that you should regard the other person as in possession of your password.

[1] https://play.google.com/store/apps/details?id=com.google.zxi...

Reply on news.ycombinator.com