Not sure if this is a hot take, but: I believe most WiFi passwords serve no meaningful purpose and are actively harmful to security.
You all know how this works. You're in a hotel, at a conference, in a restaurant, etc., you want to connect to the wifi. There's probably a sign somewhere with the password.
First of all, it's annoying that you have to figure out where to find it, ask around if anyone knows it.
🧵
What security goal does that password serve? I'd say, there's no reasonable "threat" you're defending against.
The password is freely shared.
Yeah, you're "protecting" your Wifi from being used by a random stranger sitting somewhere close enough to use it, but not a guest of your facility/event/... - but is that really something it's worth to protect against?
Brainstorming non-security purposes:
Marketing: Our service is exclusive to you. You are special. The fee you paid to be here gives you something that we only give to you.
Capacity: We cover a wide area, but only provide limited capacity on the high-bandwidth channel. We can make selected users happy by reducing the number of who have access.
Status: Interactions with staff are annoying to some, but for others they are a sign of high-end service. The power to receive a secret or exclusive benefit is worth paying for.
Advertising intelligence: If you use a locally distributed password, the system knows where you are, and can target advertising. The sign that announces the password can also have advertising, to which you pay attention because it is adjacent to something you know you need.
hanno
Bradalot “
”