General usability question which I feel has intuitive security roots.

Looking up the WEP key for my current wifi network is a task I very frequently have to perform; from telling LAN-party friends to getting a new computer on the network.

Despite the frequency I have to query this information, it is not intuitive to find on any system.

On Ubuntu, for example, clicking the wifi icon at the top right part of the screen yields a drop down with a "connection information" icon on it. This menu shows every piece of information I could possibly care to know about my connection except the WEP key. I have to navigate through the edit connections menu and 2 more tabs to find it.

Windows 10 takes 5 menus to finally find it.

Android phones prevent you from accessing it unless you have special admin privileges on the phone. Users don't have these by default.

OSX makes you re-enter your admin credentials to find it.

Surely a piece of information so frequently required by a system's own user should be intuitive to locate; click on wifi icon, read out WEP-key. I feel like the general user opens the wifi tab for two reasons; either connecting to a new network, or trying to get their friends on a network they themselves are already on.

And it's not exactly critical; I'm already logged in to the network. Are there any quotes / blogs / conferences etc... that explain why this piece of information is obscured from users who are already on the network?

  • 2
    You should not use WEP. Try switching to WPA2 for much better security. Your private life is at stake here. It's trivial to break into your system. – FMaz Nov 25 '17 at 9:25
  • 1
    Semantics. Point is the network key, whatever it is. – DeepDeadpool Nov 26 '17 at 16:12
  • 1
    Why user password is not on a post-it aside a computer if you're going to unlock it and share it with your family or whoever lives on your house? and if you still use WEP and the key is troublesome why don't you open the Wi-Fi instead? – Azteca Nov 28 '17 at 6:21

If you are still using WEP, please stop and convert to WPA2 today. WEP security was broken 10 years ago and is worthless to prevent hacking.

There are good reasons wireless passwords are intentionally difficult to easily recover:

  1. If it was displayed in plain text, anyone viewing your screen while you figure out other details of the network has access to the key.
  2. It would enable people that have access to your machine for only a short period of time, and who are not technically adept, to easily access that data.
  3. A login to a workstation may not be good enough to control access - there are a lot of machines that automatically log in a specific user on boot; this would enable anyone with access to the keyboard to gain access to the network.
  4. Credentials are usually considered sensitive and there may be additional access controls to limit access to this data.
  5. You may not want someone to know the password but you may still want to allow them access to the network. While they can theoretically extract the key if it is saved, in many cases this presents a significant technical hurdle that stops most users from recovering the password.

Try solving the problem a different way, by saving your WiFi passwords in a password manager for easy access. A WPA2 pass phrase can be chosen from text instead of a hard-to-remember hex string. These can be made easily memorable and printable. Two methods for generating strong but memorable pass phrases include the XKCD method or Diceware.

| improve this answer | |
  • Is the answer why the password is hidden, or why the menu to change it is so hard to get to? – guest Nov 25 '17 at 8:04
  • Why it is obscured/hidden. I.e. the question in the title. The menu to change it is easy to get to on most machines once a connection didn’t work. It will just pop up:) – Tobi Nary Nov 25 '17 at 8:07

In general, passwords are not put in obvious places. You don't find the password change option on the front page of a forum control panel, but deeper in your settings. This is simply because it's not true that people often access their passwords. When someone connects to a new network, it's often as simple as clicking on the SSID and putting the key in the password window which opens up.

In the end though, this is a UX question. There is no security reason why it is not displayed prominently. The reason it's usually replaced with asterisks is to reduce the danger posed by shoulder-surfers, however.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.