[AlyssaRowan]

Use WPA3-Enterprise (you can use Let's Encrypt to get a valid certificate so it works fine in a home environment).

Don't use SAE (which is, indeed, an instantiation of Dragonfly). I have a strong suspicion that the way it is used, there will be a practical attack.

[zokier]

Or just use WPA2-Enterprise, afaik there are no pressing security needs to upgrade to WPA3 if you are using EAP, and it is widely supported out of the box

[xenithorb]

The problem with this I found for home use is that IoT devices don't typically support enterprise modes. And without PSK you just flat-out can't use those devices with WiFi

[zokier]

Still, I imagine lot more devices support WPA2-EAP over WPA3-EAP that OP recommended.

[tgsovlerkhgsel]

I was unable to find the spec for SAE as used in WPA3, but SAE itself doesn't seem to hash the shared secret into the session key, which would be an easy way to provide resistance to both quantum attackers and random implementation screwups (e.g. bad PRNGs) that defeat the security of the asymmetric parts of the scheme.

Basically, take the original password/secret, derive two secrets A and B, run SAE with A as the secret, get a session key K, then use hash(K|B) as the actual session key.

If they don't have anything like that, I wouldn't be surprised if real-world implementations end up being less secure than up-to-date WPA2.

[mey]

Can you provide any more info on your concerns about SAE?

[zokier]

Here is some background reading:

https://news.ycombinator.com/item?id=6942145

https://news.ycombinator.com/item?id=7017160