> On iPhone if you and a friend in iMessage are together and one can connect to a protected WiFi, the other can connect to. Automatically.

I don't think this is accurate. The Wifi sharing feature works differently. It's documented here: https://support.apple.com/en-us/HT209368

WPS had significant security issues if I remember correctly.

Insanely insecure, holy wow.

just as insecure as wpa and every other wifi "security" of the time.

That's what you get when all the decisions are made by a comitee that only cares about the BOM cost in the modems.

btw, nothing on this have changed. Only that the not-so-secure stuff is still relatively new and not exploited yet.

all hail wpa3, the new crapy unsafe standard of tomorrow.

Are the people downvoting still using WPA?

or betting their life on WPA3 that haven't had a decent sized deployment yet?

Or did they bet their lives on WPA2-PSK/WPA2-enterp during the first months of launch before any exploit was public?

:)

Whatever issue you mean, it cannot be worse than the issues these "Wireless Password Sharing" systems have. Or at least the WPS-Button system cannot be worse than any of these systems, which seem very prone to MITM attacks.

I believe the problem with the WPS button is that it comes with a WPS PIN (might be optional, but enabled by default in most cases) which means brute-force attacks are possible even without having to press the button, where as the solution described in the repo would at least require you to eavesdrop on an active key exchange between 2 users.

WPS was laughably insecure. If Apple's solution was piggybacked off of iMessage's key infrastructure then MITM is a non-issue.

Oh no it was far worse: the WPS PIN implementations led to straight up non-interactive wifi hacks. That hasn’t happened with these sharing systems (yet) so far as I know.

WPS was a disaster and Android has removed it in favor of the WFA's official replacement: "Wi-Fi Easy Connect". My point is that there is a new and perfectly good standard for this that Apple should really be following (although I doubt they will).

As for the iMessage thing, holy shit that is such a bad idea and I'm really glad I never gave any iPhone users access to my network!

What if the owner of the WiFi network wants you to connect but not your friends?

Scenario: people come to my home, I give the password to a friend of mine that never visited me before or changed phone and asks me for the password. I don't know the other people and they don't ask for the password, but they get on the network anyway? Principle of most surprise and least security.

>What if the owner of the WiFi network wants you to connect but not your friends?

Then they should switch their network to a more complex authentication scheme. Multiple SSIDs, run 802.1x authentication (maybe with certs), MAC filtering maybe (bypassable sure, but will foil most casual users), run their own simple portal and shunt different classes onto different VLANs with different levels of isolation and traffic shaping, etc.

Ultimately if there is one password which then gets any device on, well that's that. Sharing has always been pretty trivial. If the owner of a network wants more fine grained and powerful security, all the tools exist to do that already, but they'll have to use them.

Even my least tech savvy friends understand that their wifi password is like a traditional front door key: anyone with a copy can unlock the door. I'd call that very unsurprising to most people.

The idea that more sophisticated authentication is possible to prevent password sharing would be a surprise to most laypeople I know.

Also home internet is increasingly coming with smart routers that will alert you to new devices on the network. Tech savvy people are the only ones who BYOD.

How is this scenario any different when you tell your friend the password or show them a QR code? They can still get and share that password with anyone else...