> Should you trust this tool with your WiFi password?

> Of course not! You shouldn't trust anything on the internet ever — but if it > makes you feel better, I promise none of the information you enter on this page > is saved anywhere.

I saw a theory on Reddit that you could safely use a tool like this by disconnecting from your internet before entering the information, then reconnecting after saving the QR code and having deleted it (thereby theoretically preventing your information from ever being sent to the website).

That sounds plausible, and the tool does seem to work while offline, but I don't have the expertise to confidently state that this would 100% protect you. Anyone want to chime in with how hard this would make it for them to harvest your data (if they wanted to, which I'm inclined to believe they don't, but just in terms of best practices)?

You could always write code that saves the data temporarily until the user reconnects to the internet or even visits the website again. I'm not certain how I would use people's wifi passwords without being at their home, but I'm certain somebody on Hacker News could tell me exactly why it is a bad idea to share your wifi password to the internet.

> I'm not certain how I would use people's wifi passwords without being at their home

Doesn't Google track router SSID names and MAC addresses? This definitely used to be a searchable database that was connected to Maps. I can't find any of the old websites but it looks like it might still be accessible via API.

> but I'm certain somebody on Hacker News could tell me exactly why it is a bad idea to share your wifi password to the internet.

Not a hacker but I'm going to give a easy but not critical example. If you have access to another device in range (say, because you run a botnet) you can jump into another neighboring network. I'm sure someone on HN could give us a much more worrisome example.

Well, if you connected to my service I can probably geolocate you. Or I can use a SSID=>lat/lon database to find where your wifi is assuming you have a unique name for your Wi-Fi network. Then I can go there and connect a laptop it and do nefarious stuff from there, and attribute it to you. Threaten the president, torrent Linux ISOs, etc.

Surely Linux isos are among the least nefarious things to torrent ha

>You could always write code that saves the data temporarily until the user reconnects to the internet or even visits the website again

Use private browsing?

Yes you're right, that would probably prevent it

If you're actually concerned about your data, find an offline QR generator. Encoding a WiFi network is just adding some extra plaintext to a normal QR code.

One explanation is here:

https://pocketables.com/2022/01/how-to-format-that-wifi-qr-c...

The irony it’s your infinitely better protected using a webpage in Incognito with network disconnected, than downloading an offline generator and running the binary on your computer.

Depends a lot on context. Generally I agree, but for this particular use case, I use QR Scanner from SECUSO. It's available on F-Droid, and I think it's a very good tool for the offline generation use-case. Android-only though, of course.

https://f-droid.org/en/packages/com.secuso.privacyFriendlyCo...

Android apps are not sandboxed. Even if they were, a webpage is safer.

My point is more about who wrote the source, and how that source made its way to me.

For a bad actor, this is easily work-around-able using various local persistence mechanisms like evercookie. https://samy.pl/evercookie/

Just curious, what could the operator of the site do with your WiFi password? Wouldn't it only be useful in physical proximity to your router?

one time i couldn't find _any_ other way, so I saved the page source to desktop, gave the javascript a once-over, disabled networking, opened the chrome inspector network tab, opened the saved copy of the page, did my thing, didnt see any network activity, closed the browser, then re-enabled networking

hope that worked

use qr-encode on the command line like this: qr-encode -t utf8 "wifipassword"

on a Mac, one can 'brew install qrencode' (from https://fukuchi.org/works/qrencode/index.html.en)

the little DSL format looks like this:

  WIFI:S:NETWORK-NAME;T:WEP;P:NETWORK-PASSWORD;H:false;;

and i use the python tool `qr` to generate one: https://pypi.org/project/qrcode/

The key/value pairs after the "WIFI:" prefix are as follows:

  S - the SSID
  P - the password
  T - the encryption type (WEP, WPA, or blank)
  H - whether or not it's a hidden network

The only required pair is "S"; all other pairs are optional and may be omitted if desired.

Is this format specified somewhere? How do you escape the separation characters if used in one of the keys?

the closest i have found is https://pocketables.com/2022/01/how-to-format-that-wifi-qr-c...

If you really want to overengineer things, take a look at https://kmanc.github.io/be_my_guest/! I only put in the effort to make this work for my own networking gear, but it could be pretty easily extended to work on other hardware :)

FYI this is a builtin feature on Android (maybe iPhone too?).

On Android, go to "network details" for a wifi that you're logged into and click the "share" button and it will create a QR code for logging in.

It’s also a feature in the AT&T Smart Home app. The printing from iOS is not ideal so I have an 8" square QR code taped to the wall for people who want to join my guest network.

iphones can scan such qr code to join the network, just point at it with the camera and hud will hover with the ssid. then click on it.

i created one out of plastic beads the other year with my wife

this is what i used:

    qrencode -s 6 -l H -o "wifi.png" "WIFI:S:SSID;T:WPA;P:PASSWORD;;"

https://fukuchi.org/works/qrencode/

iPhones don’t :(

Ehm, iPhones do support this just fine: https://appleinsider.com/articles/21/05/14/how-to-make-a-qr-...

I have used this many times without a problem.

iPhones share with contacts if you bring phones close to one another. No need for QR code.

What if the guest has an Android phone?

As an iPhone owner, I just don’t allow Android people into my home.

Where will the blue bubblism end?

We ask them politely yet firmly to leave[1]

1. https://youtu.be/42GaHU4txpc

Android's share does both. Enables NFC sharing and shows a QR code. Don't worry, I'm sure iPhone will catch up in a few years. :-)

What is this, the stone ages?

NFC tag is the way. https://lifehacker.com/do-this-to-seamlessly-connect-guests-...

NFC I have to touch with my phone. A QR code I can scan from across the room.

Sounds like a step backward to me (on ease of use, not security obviously).

Only stone age people don't have bunch of NFC tags around, use smartphone without NFC, and have guests with phones without NFC?

If you don't have data plan with a smartphone you are definitely in the stone age.

Or travelling to another country. Roaming is expensive as f*ck particularly outside Europe or Asia.

Android gives you a QR code to share the network. Realistically you could just screenshot that, crop and print it out. Not have to rely on a third party QR service you aren't sure about.

I emailed that very screenshot to a sibling after connecting to their network the hard way.

Beware of "online QR code services", all of them insert some spam redirectons in the QR code. After trying a dozen founds from Google, I finally found a decent one from a german university.

I made this one so I'm pretty sure it doesn't do that — but you just got me thinking of all the QR codes on tombstones and inked into people's skin that probably redirect to a pay day loan website or something.

Related: "Quishing", or phishing via QR code attacks: https://www.isaca.org/resources/news-and-trends/industry-new....

The trick is to use whatever that is built into the system you are using. On iOS I use the Shortcuts app to create an action to generate QR codes. On desktop I just use Chrome's built-in QR code generator right from the address bar.

Assuming you already trust your OS and your browser, this means you do not need to trust any additional party for this simple task.

My Frtzbox router will generate QR codes so I can just pint those. You could also save the QR code from Android device as an image and them print it. The same from a KDE desktop with the additional step of a screenshot of the active Window.

I reused a small CD jewel case to store the guest network WiFi QR code on the coffee table, and I also included a NFC tag with the same info that you can tap under the QR code, with a small NFC symbol carved out in the middle of the QR code (thanks to the error correction mecanism) to indicate the possibility.

Printing? In this day and age? Probably time for a weekend project with e-ink display which displays current guest wi-fi password. Or a simple LED matrix would be cheaper to build? As a bonus password is rotated on a daily basis.

This sounds a bit over-engineered. Wifi passwords change rarely so I think it’s totally acceptable to print a page every now and then.

This is awesome, I've always been to lazy to set this up and regret it every time someone is over and I have to tell them my wifi password is tacokissies456

I typically chose passwords that are long, easy to remember sentences (no caps or spaces).

Generic example: millionsandmillionsofpeopleliveinthiscity

Easy to share aloud, but long enough to protect against being brute-forced.

I prefer: thewifipasswordisonthefridgenospaces

This sounds like an Abbott and Costello (or Monty Python) [or Arrested Development] sketch.

then the word 'no spaces' but actually also no spaces. no, it's not on the fridge. type 'the wifi password is on the fridge' and then...

I got a sticky NFC tag from eBay and programmed it with my phone. I ask visitors to tap their phone on it if they want WiFi.

Is NFC ubiquitous now? Every phone has it? I used to use it for stuff when I used android like changing the phones mode when I got in my car before I could do it when connected to my cars bluetooth etc but I thought most phones didn't have it or were removing it a few years ago. I'm iphone 13 pro now no idea.

It's pretty ubiquitous ever since GooglePay/ApplePay took off and gave most people a reason to want it, at least in markets where those systems operate. I have noticed that grey-market imports of Android phones are sometimes missing NFC support when the domestic version has it though, so it does depend on where you are.

I don't have many friends, so it hasn't been a problem so far. I did write the information on the tag as well to avoid me having to dig it out for people without nfc.

https://openwireless.org (supported by EFF)

What a delightful site! I really enjoy the writing style, and it does have a few nice tips. Kinda reminds me of that "list of things you didn't know you could do" (or something like that) that was shared here a while ago.

I love the simplicity of the blog layout - is this open source I'd love to setup my blog to look similar!