0

There are many talks about why someone should not use WPS because of the attacks it allows. But does it also prevent attacks? For example, if guests want to join my network instead of giving these people my password, which is personal or they might memorize it?

Is there list of things WPS actually good for?

schroeder
  • 123,438
  • 55
  • 284
  • 319
WEs
  • 1
  • 1

2 Answers2

1

WPS is not meant to prevent attacks. It is meant to make it easy to add new devices to the network securely. In short, the "protection" it provides is to make it so that the WiFi owner doesn't use a weak access password and to ensure that encryption is used.

However, all modern WiFi APs use encryption by default (WPA2, at least), and people are used to using complex passwords. So the "benefits" of WPS are found in other methods.

schroeder
  • 123,438
  • 55
  • 284
  • 319
0

The main benefit to setting up a Wi-Fi network with WPS is that one can pick a secure password and still set up devices very easily. That is, it's possible to pick a secure default password or generate a cryptographically secure one and not worry about typing in a long password. It also means that devices can ship with encryption enabled by default after setup with minimal inconvenience.

The benefits of this cannot be understated. I set up a 20-character random password with 128 bits of entropy and I found my friends routinely had trouble typing it in. I am not the only person to have this problem; my colleague reports exactly the same situation. WPS provides sane, easy, secure defaults, which means that for most people, it dramatically improves the state of Wi-Fi security.

There are certainly some attacks on the protocol, and for people who don't want to use it, they don't have to, but overall, by improving default security, it's a big win.

bk2204
  • 7,828
  • 16
  • 15
  • "a 20-character random password with 128 bits of entropy" is overkill ... There are lots of ways to generate secure passwords that are easy to enter – schroeder Aug 21 '21 at 15:35
  • 128 bits of security is the minimal level of acceptable security these days. There are short ways to do that that are hard to type, and there are long ways to do that (e.g., Bubblebabble encoding) that are easier to type. I'm not arguing my password wasn't difficult. But my argument that pressing a button is easier than entering a password doesn't change. – bk2204 Aug 21 '21 at 15:46
  • 1
    "128 bits of security is the minimal level of acceptable security these days" -- for cryptographic keys ... And you're talking about password entropy. That's a different concept. – schroeder Aug 21 '21 at 15:48