Re: IPP Wi-Fi Configuration Extensions v1.0
Michael Sweet via ipp <[email protected]>
| Newsgroups | gmane.ietf.ipp |
|---|---|
| Message-ID | <[email protected]> |
Benjamin, > On Feb 16, 2024, at 1:04 PM, Benjamin Gordon <[email protected]> wrote: > > I read through this and had a couple of quick thoughts: > > 1. On page 7, step 4 uses a different verb tense from the other steps. Thanks, I've made note of this. > 2. This specifically talks about IPP-USB. A lot of printers > broadcast some kind of initial setup SSID when they're first plugged > in. Does it make sense to allow this mechanism when connected to that > SSID as well? This would be an improvement in convenience for the > user, especially in cases where they might not be planning to put the > printer within USB range of a computer. > > Obviously it's not as secure as being physically plugged into the > printer, but in most home networks, the window where an attacker is > going to come connect a new printer to a rogue network is going to be > small. Since that SSID is specifically used for setting up the > printer, an attacker could potentially just connect to it and set up > the printer anyway. > > Does this deserve some discussion in the document, either as a > possible implementation or as a reason why it's a bad idea? Probably worth discussing. FWIW, such usage would be trivial to exploit, from a distance, through walls, etc. With proper authentication it would be fine, just not without some access control. ________________________ Michael Sweet _______________________________________________ ipp mailing list [email protected] https://www.pwg.org/mailman/listinfo/ipp