How about the standard solution, WPS. Depending on the method used, it does not require any UI-parts from the device (PIN or NFC methods) or just a simple push-button.

I thought wps still is vulnerably http://en.wikipedia.org/wiki/Wi-Fi_Protected_Setup

Why was that omitted? It should probably have been the first item on that list. Reinventing the wheel is fun, I guess...

Electric Imp seems like a great solution (flash setup data from a smartphone to a light receiver on the device) but I wonder how they handle imposters. For example they brag about a connected door lock. If I was a bad guy I would go to the nearest window, and shine a bright light with the setup pattern through it hopefully reconfiguring the lock.

If they make it too hard to reconfigure the lock then it will increase the support load.

I've had a half baked idea about this for a few years. The thermostat has a terrible screen and is immobile, while my phone is the exact opposite. With Bluetooth LE, and perhaps NFC, you could make a configuration/maintenance interface that allowed for better setting management, using the phone as an interface.

Very interested in this space; for a screenless device it seems to me that 'act as hotspot' and 'usb to pc' are the only real sensible options, although they are not exactly ideal.

A hot-spot is a bad idea because most computers can't connect to two wifi networks at once. That means any time you wanted to configure your thermostat, you'd have to disconnect from the internet.

The article was a bit simplistic here, but I think the more fully fleshed out idea is act-as-hotspot initially. When the device is first powered on or a reset button is pressed, it acts as a hotspot to which you can connect a webbrowser but on first connect to its configuration interface you are prompted to configure the device to switch to connecting to your normal wifi router so you can continue to hit it with a web browser, but over your normal local network.

IMO, this is actually the best way (in terms of overall simplicity, no need for extra hardware, etc) to handle the situation in practice.

Oh, duh. I thought about that a little while after I made the comment.

It still seems like it would be a bit fidgety to set up unless the device itself had two wireless cards. If you give it the credentials to your home network but give it the wrong passphrase, it will still have to disconnect from your laptop, attempt to connect to the network, fail, and then start its own wifi network back up to tell you that it failed.

The link is 404 for me.

works fine

Nope: http://i.imgur.com/Heg3g8e.png

Can you try again and tell me what you see as the copyright statement in the footer? i.e. this: http://cl.ly/image/2I0a16260X0v what do YOU see? (it will tell me which server your hitting) - thanks!

Nevermind -- figured it out. We changed servers yesterday and the DNS hasn't propagated over for everyone yet.

what about speech recognition?

yeah, as the cost of hardware components continues to fall this will be an option (just add a mic, speaker and use the CPU already in there = pretty cheap)