Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Guest WiFi using a QR code

blog.jgc.org

Post reply on HN
Print view View original

31–40 of 284 posts

Re: Guest WiFi using a QR code

#32

Post by latchkey »

btmiller wrote: post #16
latchkey wrote: post #2

Call me paranoid, but I've taken to not scanning "public" QR codes any longer [1]. [1] https://www.washingtonpost.com/technology/2021/10/07/are-qr-...

There is way too much human interest to that article and way too little substance on the problems. Tl;dr - there’s no security risk unique to QR codes are that aren’t simply present on the Internet at-large.

The link to the article wasn't intended to be the be-all reason... just a general "something to think about here".

There is an inherent security risk... it is trivial, as the OPs article suggests, to print out a QR code, cover an existing public one, and send people to a phishing site. Unless people are being very careful about what sites they are on, they could easily be scammed.

Re: Guest WiFi using a QR code

#34

Post by loueed »

I made an iOS Shortcut for this so I can ask Siri for the QR code when needed. There's a built in "Generate QR Code" action that can take a text action containing the wifi string.

Only issue is hard coding the password in the shortcut.

Re: Guest WiFi using a QR code

#38

Post by graton »

It uses the form of:

  WIFI:T:WPA;S:{ssid};P:{password};;
Can generate these on Linux with the qrencode program.

Wikipedia has information on this https://en.wikipedia.org/wiki/QR_code#Joining_a_Wi%E2%80%91F...

Section of the Wikipedia article:

Joining a Wi‑Fi network

By specifying the SSID, encryption type, password/passphrase, and if the SSID is hidden or not, mobile device users can quickly scan and join networks without having to manually enter the data. Note that this technique is valid for specifying only static SSID passwords (i.e. PSK); dynamic user credentials (i.e. Enterprise/802.1x) cannot be encoded in this manner.

The format of the encoded string is:

  WIFI:S:;T:;P:;H:;
Order of fields does not matter. Special characters """ (quotation mark), ";" (semicolon), "," (comma), ":" (colon) and "\" (backslash) should be escaped with a backslash ("\") as in MECARD encoding. For example, if an SSID were "foo;bar\baz", with quotation marks part of the literal SSID name itself, this would be encoded as: WIFI:S:\"foo\;bar\\baz\";;

Re: Guest WiFi using a QR code

#39

Post by banana_giraffe »

btmiller wrote: post #19
phoronixrly wrote: post #8

Making an online wifi QR code generator seems like a nifty way to make a good password dictionary. Just saying.

For Wi-Fi though? Seems relatively low risk to me. Concerns over password security can be mitigated by those that care by using unique, randomly-generates strings per service.

The random string I use for my IoT devices' wifi password showed up on haveibeenpwned, so some IoT device cared enough about it to leak it.

Re: Guest WiFi using a QR code

#40

Post by [deleted] »

graton wrote: post #38

It uses the form of: WIFI:T:WPA;S:{ssid};P:{password};; Can generate these on Linux with the qrencode program. Wikipedia has information on this https://en.wikipedia.org/wiki/QR_code#Joining_a_Wi%E2%80%91F... Section of the Wikipedia article: Joining a Wi‑Fi network By specifying the SSID, encryption type, password/passphrase, and if the SSID is hidden or not, mobile device users can quickly scan and join networks wi…

[deleted]
Post reply on HN