8

I've read from Wikipedia that Wi-Fi direct uses WPS (Wifi Protected Setup), and I know that in Android (at least what I have which is 4.0.1 on Galaxy S3) uses the WPS method of the "push button" to authenticate a client. We know that in 2011 a researcher revealed a security flaw in WPS.

  1. Does WiFi Direct device that uses the "push button" method of WPS also vulnerable to the security flaw? (Because in the push button there is no PIN code to try to achieve by brute force).

  2. It also written that

    The standard also includes WPA2 security and features to control access within corporate networks.

    What does it mean exactly? If the authentication done by WPS so what WPA2 has to do?

  3. Does the data transmitted between the two WiFi Direct devices is encrypted?

  4. If it's encrypted, by what key? Can the user configure this key somehow? (I didn't find the way in my device).

Improve this question

1 Answer 1

Reset to default
3

  1. Yes and no. Push-button WPS is "just pray that noone will attack you during the connection establishment phase" anyways, so it is vulnerable by design. While the button is not pressed, however, it cannot be attacked.

  2. According to the source linked in the Wikipedia article

The Alliance says they've considered that and mechanisms are in place so that, for example, a laptop with Wi-Fi Direct doesn't suddenly become a unwanted bridge.

  1. Yes, using WPA2

  2. A random key established using WPS. On Anrdoid, the group owner can get the passphrase using WifiP2pGroup.getPassphrase()

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .