Show HN: Print a WiFi Login Card(wificard.io) |
Show HN: Print a WiFi Login Card(wificard.io) |
Feature request: giant passwords like that one that was posted on the side of a building.
I ran it with network off and saw the code, so it looks safe.
WIFI:T:WPA;S:${ssid};P:${password};;
Once it sees a QR code then it shows some text that you can touch to open the link.
Also, there are lots of offline QR generator apps...
There are chances out there, unbelievable.
You could also inspect the source, it’s open source, or network requests.
but for semi-public WiFis like the ones in restaurants, hotels, ... it's a survivable risk
From there its up to you how you print.
Why bother setting a password in a non-crowded area?
Average case you are in the middle of bumfuck nowhere with a huge private property surrounding your WiFi and nothing's gonna happen.
Worse case some script kiddie attacks your vulnerable router (if using default password) or a smart gadget (if you have some and it's a couple of years old) to join a botnet and get your IP address on a blacklist limiting your internet usability (blacklisted IPs may not be able to send e-mails, may get captchas on major websites like Google, ...)
Worst case someone driving around noticing you have an open WiFi may drop a battery/solar powered raspberry pi with a 4G modem nearby your WiFi and use your WiFi as an untraceable VPN/proxy to perform some illegal stuff (e.g. upload child pornography or perform some serious hacking) and getting you in trouble with the law.
a QR generator which will magically connect me to the WiFi with my password embedded in the QR somehow.
Usually it's printed in the same places where you would actually print your plaintext Wi-Fi password, if you're already doing that, for example in restaurants (e.g. QR code inside a menu card that's only given to actual customers), offices (QR code inside meeting room for actual guests), airbnbs (QR code on a fridge inside your house), hotels (QR code inside the room with a router))
Think of hotels / offices with guest networks. I use it for my wifi, my home network is not secretive enough to not let friends / family join it when at my place.
If you’re wanting a _really_ secure network, WPA2 isn’t the way to go. You’d want to credential every user using 802.1X or WPA2 Enterprise.
In regards to security, you are completely correct. But this is to be used in cases where one would put a paper with the password on the wall, think of coffee shops. Saves some typing. Or you can put a card on your coffee table to help out your house guests.
This makes me think that we could use some flag that identifies purely static websites. Like next to the green https lock there is a sign that this website can not send data to any server
You'd probably also need some sort of Feature-Policy[3] that prohibits access to any form of persistent storage so sites can't just save data until the next non-CSP-protected page load and transmit it then.
[1]: https://wicg.github.io/webpackage/draft-yasskin-wpack-bundle...
[2]: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
[3]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Fe...
But even a GET request can be used to send data. Just pack the data you want to send in the query string and voila.
Perhaps the site could be allowed to update itself. But this update function should not have access to any local/client state.
Yes, saving the page, disconnecting your network connection, then deleting the page would work, but it's a real bother.
https://en.wikipedia.org/wiki/QR_code#Joining_a_Wi%E2%80%91F...
qrencode -t utf8 'WIFI:T:WPA;S:network;P:password;;'Edit: just use the built in QR code generator with a string in this format.
WIFI:T:WPA;S:$SSID;P:$PASSWORD
https://help.libreoffice.org/latest/en-GB/text/shared/guide/...
UX feedback - disable autocorrections on the input fields [1], you may want to trim white space as well.
This repo of mine walks through how to use a raspberry pi with an eInk screen to automatically update passwords and the resulting QR code. Would love to see what y'all think!
Also, I like the use of guest SSIDs. My guest SSID is just like my main SSID but with L2 filtering for all traffic not going to the gateway. Guests can use my fast internet, but just not interact with my LAN or other guests. I also don't enforce WPA3 only on my guest network for legacy support.
I think nobody ever has scanned the QR code.
[1] https://gist.github.com/ianobermiller/9f17f1022bc75c2228d742...
[2] https://bl.ocks.org/ianobermiller/raw/9f17f1022bc75c2228d742...
For a moment I thought: What a great attack vector. Collect WiFi passwords from around the globe.
Great work, OP. I'll be printing one for my fridge later today.
I never trust anything online that generates anything with a password. I got burned from a crypto wallet scam once. but fool be twice...!!!
Something like wifi will have a custom prompt that says “Connect to WiFi network MyNetwork.”
The Android wifi menu (where you select from nearby networks to join) also has a QR icon that lets you scan to immediately join a network (next to "Add network"). I'd imagine you'd also join if you scanned it from the camera app, too.
WIFI:S:<SSID>;T:<WPA|WPA3|WEP>;P:<password>;;
And can be generated with any qrencode program.
WIFI:T:WPA;S:${ssid};P:${password};;
(It makes sense for OP/the project to host it as a demo and for people who don't care or trust it to use though - I'm not hating on the site existing.)
iptables -I OUTPUT 1 -m owner --uid-owner luser -j REJECT
Now log in as luser and run your browser.
wifi: // [username] : [password] @ ssid
A remedy exists, it costs around 100€, is sold by Brother and is called "wifi-enabled laser printer". Your life will be free off printing woes onwards.
I also have a Canon MG6220 for when I need color, which is not often. I gets used more as a scanner/copier than as a printer. It has also been really reliable, and since it doesn't print all that much, the ink cost has been quite bearable. I might not feel the same about the Canon if I didn't have the little brother laser printer available to pound out B&W documents when I need them.
There's often some silly reason its stuck, or it prints wrong, or the colors are off, etc, its really just a super painful experience and I can't believe its still so bad.
Out of yellow -> refuses to print black. DRM cartridges that you can't have refilled. Black ink being more expensive than blood. Driver problems. Network issues. Paper jams. Out of paper error when there is paper. Trying to draw from the wrong paper tray. It doing five minutes of warmup exercises when you really want to get going but forgot to print this signed form to hand in. A new printer being literally free if you just buy the ink with it (my grandma has one of those). And so on.
It's insanity more often than not.
Ironically, Linux drivers are (as of ~2013 I've noticed this) more reliably than Windows ones. For scanners also. My dad had to re-add the printer (which works fine on Linux) every time on Windows in the configuration panel. It would say 'offline' but could be discovered and then printed with just fine. But only until it goes into standby mode, the next day it's the same story. Now he got an expensive scanner (the kind where you get business support), same story: it just doesn't see the device half the time. This time it's clearly a device issue though: it also only responds to ping when the computer can work with it (i.e. the device is just unreachable when the computer says it's unreachable; not a driver issue for once). And you pay a few hundred bucks for that.
The big ones at school or in bigger companies, those seem to work reliably most of the time these days, and if one is out of order you can go a floor up and use the next one. I also remember my old boss (RIP) had a printer that never had a single issue -- of course the model went out of production by the time it gained the track record (all I remember is that it was a Brother laser printer, no colors, only one paper tray, no scanning... all that probably helped). Perhaps you, too, had one of these lucky models and were spared these printer problems.
But so yeah that sparked a whole category of jokes on the internet, most people having this experience (at least until a few years ago, perhaps it has gotten better? People also just don't print as much).
The printer needs to be connected to wifi all the time but on the flip side, the printer orders ink cartridges well in advance (so they get delivered in time and I have them ready when I need).
It is interesting how many ideas come to oneself when drawing and filling the grid. By the end I had all sorts of weird MC Escher style insanity.
After first gaining popularity, the domain could later pass to someone with malicious intent quite easily, eg:
1. Tech people like HN verify the site as credible and approve of it
2. The site gains popularity and goes viral / receives significant use
3. The original author abandons the site because of costs, or simple boredom
4. A malicious actor acquires the domain and begins recording users credentials alongside IP addresses.
Conceivably, an enormous amount could be captured before the malicious recording became exposed, and (importantly) most of those whose credentials were compromised would have no straightforward path by which they could be alerted.
Other scenarios: site is malicious to begin with but set up to not transmit credentials during its first ~28 days.
Mirrors of this site with credential capture added, (hard to claim that's a flaw of this site itself, just a flaw with "this type of site being normalized").
> View the source code
It would be really nice if the source code in the browser (no, not the Github repo; how do I know the web server served the same thing as the Github repo?) were displayed in a human-readable format with proper tabbing, comments if applicable, and not an obfuscated, minified form.
In fact if your goal isn't specifically obfuscation, it's not necessary to minify JS in general. Web servers do a good job gzipping stuff.
I believe right now, I could use foo.min.js and serve you a cruddy foo.min.map.js to mislead you.
If I served you the original sources foo.concat.js and a build script to go from foo.concat.js => foo.min.js instead, we could have both the speed of the minified version and the (proven by the browser) accurate source code and maps!
I'm not sure if this affects service workers though.
And it's crazy you can't disable phone service on iPhone.
Also, if you worried about someone accessing your network then you probably need to isolate your devices from seeing each other.
TBH other than pwning my router or misusing my IP address in some way I don't see much problem having my devices on public net. All of them run firewall and are up to date. Most traffic is HTTPS and I'm not sure if you can MITM with just Wifi password lol.
read -rp "SSID: " ssid
read -rsp "Password: " pass
echo -e "\n"
qrencode -t utf8 "WIFI:T:WPA;S:$ssid;P:$pass;;"
echo "SSID: $ssid"
#!/usr/bin/env bash
out="${1:-wifi-card.pdf}"
read -rp "SSID: " ssid
read -rsp "Password: " pass
echo -e "\nGenerating PDF..."
{
cat << EOF
<table>
<tr>
<td><img src="data:image/png;base64,$(qrencode -o - -t png "WIFI:T:WPA;S:$ssid;P:$pass;;" | base64)"></td>
<td><span>SSID: $ssid</span><br><span>Password: $pass</span></td>
</tr>
</table>
<p>
<img width=16 height=16 src="https://raw.githubusercontent.com/iamcal/emoji-data/master/img-apple-64/1f4f8.png">
<img width=16 height=16 src="https://raw.githubusercontent.com/iamcal/emoji-data/master/img-apple-64/1f4f1.png">
Point your phone's camera at the QR Code to connect automatically.
</p>
EOF
} | pandoc --pdf-engine=xelatex -f html -t pdf -o "$out"
echo "$out"
Can someone please explain this command, and why it is presumably given as a criticism of this submission?
Even this reply - this is intended as conversation.
"This should be the accepted answer."
WIFI:S:SSID;T:WPA3;P:PASSWORD;; nmcli device wifi show-passwordThis is now my favourite way to grab the WiFi password.
Write-Host "?">There are some standards -- de facto and otherwise -- already in use. This wiki attempts to catalog some possible standards for encoding various types of information, and suggest a standard action associated to them.
[1]: https://github.com/zxing/zxing/wiki/Barcode-Contents#wi-fi-n...
I use Make as the standard way to interact with every repo I own. This allows me to type `make build` instead of `$some-language-specific-command-I-forget-in-2-weeks`.
I use Docker for distributing every app I build. If the app is a website I also use the nginx base image. Docker images make packaging and distribution a breeze IMO.
Regarding yarn, npx, react, and jest: I'm similarly disillusioned by the churn but I also like to remain knowledgeable as the industry evolves. React was something I hadn't touched before, so I decided to pick a simple project to give it whirl ;)
After much fussing around with many kinds of solutions, this too is what I have settled on. Download repo and run `make` will "do the needful" to get you going, and all the major entry points are make stanzas.
I also used to do this until I switched out Make by Just[1]. I find it worth a recommendation.
Anyway, this project provides exactly what I needed. Thanks to OP for sharing! Slick and simple
Share a project -> get opinions on it
What's the problem?
Why post your learning project on HN then? You advertise and get free critique. Double win in my book. What's wrong with that?
It's also surprisingly possible to learn enough about programming to get a job without understanding basic computing concepts. I've met professional software engineers, with multiple years of experience and promotions under their belt, who did not know the difference between hard drives and RAM in a server context. I've literally code-reviewed attempts to deploy a database server with 1 TB of RAM in order to store 1 TB of data.
Yeah that was inevitable in an industry that moves quickly, likes new stuff, and prefers fast, superficial learning when that's all you need to get your product out of the door. Google and StackOverflow are probably controlling a decent chunk of decision making these days such that you don't need to think about solutions too much.
Why? Because I have a website template that solves many things for me, like:
- I see no reason not to use SASS or the latest ES even though I know how to. Or pug, for that matter... which I like. I also have a SASS template with some utilities and a particular code organization.
- Using an ES bundler allows you to throw in libraries from npm. I would not write the QR code myself, for instance.
- Automatically watches sources and recompiles.
- Adds hashes to asset filenames in order to cache-bust changes in CSS/JS/images (critical when using a CDN).
- Has placeholders for things I'll probably need, like the metadata for building previews in social networks.
- Is prepared for dealing with i18n, if the need arises.
- Future-proofing, since 80% of projects you think are small end up becoming larger. This is a single-page site, but if I wanted to publish this in Europe it'd already need two extra pages for the Privacy Policy + Impressum... so the single page site suddenly needs to worry about navigation.
- It's prepared for quickly deploying to AWS or Github Pages. It could be quickly tweaked for working on Cloudflare Pages or other hosting/CI environments that do the compilation for you.
And most importantly...
... my stack does not negatively affect the end result. All the extra baggage is just part of the development environment. If you want to skip my tools, they're quite easy to bypass and replace for any other transpiler... or you can just ignore my sources, reindent my compiled files and work on them directly.
PS: Back in the 90s I drew complex table layouts on graph paper, typed them down with vi, and ftped them to the hosting. I'm well aware of the alternatives. My current workflow + templates + helpers are based on the need to efficiently juggle A LOT of completely different projects every year as a freelance developer.
This might be technically true, but is not true in any meaningful sense if another developer ever has to work with your code. They will have to deal with all your baggage, and their job will be much harder because of it.
If the maintainer is comfortable using that technology, let it be. No need to rain fire on it.
Here is why I like using CRA for some projects:
1. Live reload. This comes for free with CRA. Makes dev work easy.
2. As easy as installing a component and getting started. And they logically fit in the code flow. Native import libraries, you have to write the JavaScript and point em to your divs and dom and initialize em.
3. Let’s say in the future, I want to reuse the code logic in a different app, I can just take the js and element as one unified component and move it across.
Tbh, for an app like this, after doing a production build (npm run build), I don’t think it’d make a radical difference in performance with raw html or react. Might just be dev preference, and ease of use.
Edit: More
The reason for this model is that it makes everything the same and your caching tier is the great equalizer. Everything is a backend for your caching SSL terminating reverse proxy. And your static site will live in the cache for ages so once your cache is warm there’s no real performance hit.
I don't know VanillaJS that well, so I took a stab at the same concept:
https://q726kbxun.github.io/qrcodes/
Not nearly as pretty, since I know even less about making pages pretty, but still, a fun little stab at making such a site.
This is what a lot of people have trouble understanding: sometimes the best tool for the job is the tool you’re best in.
Evidence? No one has made this static website you’re talking about. It doesn’t exist. This one does. The imperfect app that exists beats the perfect app that is vapor.
Another poster whipped one together since this was posted, because it's so trivial to do with vanilla tech:
https://news.ycombinator.com/item?id=27804490
I also don't think anyone has a problem with someone who says: "I dunno, this was just the way I learned and I don't know the underlying tech."
But that's usually not what happens. Instead, there are endless rationalizations for why the obvious over-engineering is not only okay, but preferable.
Single static HTML files are under valued.
That it was a learning project, ok. I guess.
Yeah, probably because nowadays you just do it like that.
This has been the case for quite some time. I assume Android can do it too (and if so, probably did it first).
EDIT: you could also just run the local server in offline mode and shut it down before you re-connect.
Of course even if that's the case, you gotta load the website with the network inspector already open, to see the initiation.
I do that on a site of mine, but for a less nefarious reason: sharing a websocket connection between multiple tabs.
OTOH, I guess a "standard" is whatever the common implementations accept anyway, so if one could dig up the source to the WiFi QR scanner in source.android.com that's the 2nd best thing
> Special characters \, ;, ,, " and : should be escaped with a backslash (\) as in MECARD encoding.
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
23 1445 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 owner UID match 1007
# setuidgid outtest ping -n 1 -4 google.com
PING google.com (142.250.102.100) 56(124) bytes of data.... after the fact ...
... for a user of the web app who watches the network panel from their browser's developer tools
How could it work if it didn’t?
As for IPv6 you can obviously just apply a similar rule using ip6tables (or the newer nftables, which I don't know how to use.)
... but I would still get advantages in terms of speed, maintainability, etc. from using a modern web development environment that I see no reason to give up. There are things like cache-busting hashes, linting, splitting js code in modules and using variables in SASS for things like colors, that to me are mandatory in a professional practice.
That's not the requirement I'm talking about. It's "multiple developers you don't know, of varying experience levels, will work on this project over the course of years".
They're going to clone the repository and have to make changes. Ignoring your stack is not an option. They have to figure it out, or throw it away and rebuild something else.
They'll be the ones paying the time cost of all the advantages you get by doing something complex but easy for you.
You may say this doesn't apply in your situation, and maybe right now it doesn't, but it almost always happens in any successful project eventually.
https://www.figma.com/blog/webassembly-cut-figmas-load-time-...
I hear “%s%s%s%s%p” is the preferred SSID these days…
This doesn't look "simpler" after a quick look, and it's a hard dependency of the GP solution.
(I completely agree on the local-only guarantee that this one provides, though)
You're on your own machine, you know the exact spec used to generate the QR, and while you're at it, you can use the same tool to generate TOTP QR codes and WireGuard configurations and a bunch of other things like links to websites or automations for Tasker (et al).
The world is your oyster when you know what and how the "magic" works, and while you're at it, you aren't risking pasting your WiFi passwords into some random website.
Why has it never occurred to me that I might be able to use a QR code? I always do `sudo cat /etc/NetworkManager/system-connections/TheSSID.nmconnection | grep psk`, type in my root password and then re-type the passphrase manually on my phone. The amount of time this is going to save me…
When you abstract "storage" into "my library/tools save state somewhere" (and god forbid you include localStorage into the mix!) and don't deal with the hardware itself, I could see how a lot of new-ish coders wouldn't be able to differentiate RAM and disk.
> a meme is an idea, behavior, or style that spreads by means of imitation from person to person within a culture and often carries symbolic meaning representing a particular phenomenon or theme
From https://en.wikipedia.org/wiki/Meme
The concept of a meme is in no way limited to images.
The original way to do this via a synchronous XHR request in visibilitychange/beforeunload/unload handlers gave you a 1-2s window to exfiltrate the data. That's been deprecated in exchange for a more insidious "invisible background connection to the server maintained after closing the tab or navigating away" that doesn't involve any UI delays. (For "a better experience" of course, not for stealth! Never!)
It's called the beacon API [0] and it's supported by basically all browsers [1]. This was introduced because, chiefly among others, Google Analytics was stuck between blocking in head to record the page view or moving to the end of the html document and using documentready but with a fairly high risk of user navigating away before all that had a chance to trigger at all or after it triggered but before it could exfiltrate the data.
[0]: https://developer.mozilla.org/en-US/docs/Web/API/Beacon_API
Excerpt from their KB
Navigator.sendBeacon() .... It’s intended to be used for sending analytics data to a web server, and avoids some of the problems with legacy techniques for sending analytics, such as the use of XMLHttpRequest.
https://developer.mozilla.org/en-US/docs/Web/API/Navigator/s...
I remember seeing service workers in browser devtools or task manager without having given explicit permission.
The only downside IMO is that you are entering your wifi details in to an untrusted website.
Do you know how long most "Show HN" links still work after a year or two?
genuinely interested in the benefits of this. care to share?
This allows me to self contain all the build tooling. And allows other developers to setup a dev environment in a few easy steps.
Oh you first try fake data? That's easy to counter. For example probabilisticly: the app tosses a coin and only sends the data with 50% chance the first time. Now half of people using your approach will think the app is safe and get their data stolen anyway. Or use some side channel, delay activity, ...
Hard to believe to me.
But yes, I agree running a command like qrencode from terminal is easier in the long run.
The project is so simple that it would be easier to rewrite it from scratch in that time frame. But the qrencode CLI allows to just avoid that.
