Hacker News new | ask | show | jobs
by Fnoord 2769 days ago
Hmm, using BLE to send your WPA2-PSK password? Isn't that insecure?
2 comments
ploxiln 2769 days ago
You probably want to encrypt it with a public key for which the raspi has the private key. You could validate the public key with a qr-code on the raspi, or some other pre-arranged scheme.

This is a very similar situation to being able to access the device on the LAN over tcp/ip and needing to pass it a secret.

link
sdenton4 2768 days ago
(Or just use diffie hellman to generate a symmetric key pair for communicating for the length of the session... you'd still want something to prevent MITM, but if you're not concerned about MITM attacks at session creation time, DH gets user effort down to about zero.)
link
anon4242 2769 days ago
BLE has support for encrypted communication so should be ok, at least in theory.
link
aceperry 2769 days ago
The older BLE 4.x versions had lots of security exploits. I'm not sure about the latest 5.x versions though.
link