[IPP] IPP Wi-Fi Configuration Extensions v1.0

[Michael Sweet]

Benjamin,

> On Feb 16, 2024, at 1:04 PM, Benjamin Gordon <bmgordon at chromium.org> wrote:
> 
> I read through this and had a couple of quick thoughts:
> 
> 1. On page 7, step 4 uses a different verb tense from the other steps.

Thanks, I've made note of this.

> 2.  This specifically talks about IPP-USB.  A lot of printers
> broadcast some kind of initial setup SSID when they're first plugged
> in.  Does it make sense to allow this mechanism when connected to that
> SSID as well?  This would be an improvement in convenience for the
> user, especially in cases where they might not be planning to put the
> printer within USB range of a computer.
> 
> Obviously it's not as secure as being physically plugged into the
> printer, but in most home networks, the window where an attacker is
> going to come connect a new printer to a rogue network is going to be
> small.  Since that SSID is specifically used for setting up the
> printer, an attacker could potentially just connect to it and set up
> the printer anyway.
> 
> Does this deserve some discussion in the document, either as a
> possible implementation or as a reason why it's a bad idea?

Probably worth discussing.  FWIW, such usage would be trivial to exploit, from a distance, through walls, etc. With proper authentication it would be fine, just not without some access control.

________________________
Michael Sweet