Hacker News Reader

Hacker News

Comment by xyst | Hacker News Reader

Full thread

xyst

I would like to see something like this for “home” setups but it would have a much better user experience:

1) user attempts to connect to “home-wifi”

2) owner of “home-wifi” gets notification to confirm or deny access request

3) owner can optionally verify further

4) if approved, then between AP and client device it will create the client certificates with short expiration dates

5) if denied, then no access granted.

6) if user tries to connect multiple times and gets denied for all of them, then their device is blacklisted. No notification.

No more passwords. Minimal friction to adoption.

View on HN

Wardrivers with sufficient randomization to avoid any denylist you implement will get very annoying if you let those notifications interrupt you. Maybe only receive such requests while you expect guests.

You could just not have notifications.

I'd be fine with a system where when someone tries to connect to my network, I need to open an app or go to a web page and pick from the list of attempts to allow.

It's not perfect, and it still leaves open a DoS by filling the DB with spam, but at that point you know something is wrong.

That would be the best way. Turn on notifications when you're expecting a new device. Turn off notifications and auto-deny the rest of the time.

Hi- Did you release your edtech iOS app (the SwiftUI one you posted about)?

Just saw your reply today. That's an excellent memory you have. Surprised anyone remembers me talking about it.

I am still working on it. Just in my spare time. Maybe a release later this year if everything else works out and I can keep focus. Keeping focus is the difficult part, of course.

That seems unlikely to be something I'd ever encounter and solved by muting requests after too many in a row. Yes, a local attacker could DoS the convenience features for my guest wifi. That's fine.

Annoying yes! And I do like your solution (only get notification when expecting guests). But also would be nice to keep a log of those requests.

APs only have so much range (and I think you can configure it to cover a specific area). So can very easily find out who or what is trying to get in.

It’s a crying shame that WPS was fumbled so hard. It was a consumer friendly idea.

That was the “touch a button on the router” to connect, right?

Idea was great in theory but in practice routers were often placed in the most inaccessible parts of a house (closet, ceilings, or walls)

How do you think that blacklist would work that can’t be trivially rotated around by changing client identities?

> if user tries to connect multiple times and gets denied for all of them, then their device is blacklisted. No notification.

Blackhat 2026: WPA free(not three) Enterprise, how to flood and bypass WPA3 with certificate forgery and dual pair attack in 5min!

Reply on news.ycombinator.com