Show HN: Print a WiFi Login Card (opens in new tab)

You'd probably also need some sort of Feature-Policy[3] that prohibits access to any form of persistent storage so sites can't just save data until the next non-CSP-protected page load and transmit it then.

[1]: https://wicg.github.io/webpackage/draft-yasskin-wpack-bundle...

[2]: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

[3]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Fe...

But even a GET request can be used to send data. Just pack the data you want to send in the query string and voila.

A remedy exists, it costs around 100€, is sold by Brother and is called "wifi-enabled laser printer". Your life will be free off printing woes onwards.

It is interesting how many ideas come to oneself when drawing and filling the grid. By the end I had all sorts of weird MC Escher style insanity.

After first gaining popularity, the domain could later pass to someone with malicious intent quite easily, eg:

1. Tech people like HN verify the site as credible and approve of it

2. The site gains popularity and goes viral / receives significant use

3. The original author abandons the site because of costs, or simple boredom

4. A malicious actor acquires the domain and begins recording users credentials alongside IP addresses.

Conceivably, an enormous amount could be captured before the malicious recording became exposed, and (importantly) most of those whose credentials were compromised would have no straightforward path by which they could be alerted.

Other scenarios: site is malicious to begin with but set up to not transmit credentials during its first ~28 days.

Mirrors of this site with credential capture added, (hard to claim that's a flaw of this site itself, just a flaw with "this type of site being normalized").

> View the source code

It would be really nice if the source code in the browser (no, not the Github repo; how do I know the web server served the same thing as the Github repo?) were displayed in a human-readable format with proper tabbing, comments if applicable, and not an obfuscated, minified form.

In fact if your goal isn't specifically obfuscation, it's not necessary to minify JS in general. Web servers do a good job gzipping stuff.

I'm not sure if this affects service workers though.

And it's crazy you can't disable phone service on iPhone.

Also, if you worried about someone accessing your network then you probably need to isolate your devices from seeing each other.

TBH other than pwning my router or misusing my IP address in some way I don't see much problem having my devices on public net. All of them run firewall and are up to date. Most traffic is HTTPS and I'm not sure if you can MITM with just Wifi password lol.

    read -rp "SSID: " ssid
    read -rsp "Password: " pass
    echo -e "\n"
    qrencode -t utf8 "WIFI:T:WPA;S:$ssid;P:$pass;;"
    echo "SSID: $ssid"

    #!/usr/bin/env bash
    out="${1:-wifi-card.pdf}"
    read -rp "SSID: " ssid
    read -rsp "Password: " pass
    echo -e "\nGenerating PDF..."
    {
    cat << EOF
    <table>
    <tr>
    <td><img src="data:image/png;base64,$(qrencode -o - -t png "WIFI:T:WPA;S:$ssid;P:$pass;;" | base64)"></td>
    <td><span>SSID: $ssid</span><br><span>Password: $pass</span></td>
    </tr>
    </table>
    <p>
    <img width=16 height=16 src="https://raw.githubusercontent.com/iamcal/emoji-data/master/img-apple-64/1f4f8.png">
    <img width=16 height=16 src="https://raw.githubusercontent.com/iamcal/emoji-data/master/img-apple-64/1f4f1.png">
    Point your phone's camera at the QR Code to connect automatically.
    </p>
    EOF
    } | pandoc --pdf-engine=xelatex -f html -t pdf -o "$out"
    echo "$out"

Can someone please explain this command, and why it is presumably given as a criticism of this submission?

"This should be the accepted answer."

  WIFI:S:SSID;T:WPA3;P:PASSWORD;;

  nmcli device wifi show-password

    Write-Host "?"

Also, I like the use of guest SSIDs. My guest SSID is just like my main SSID but with L2 filtering for all traffic not going to the gateway. Guests can use my fast internet, but just not interact with my LAN or other guests. I also don't enforce WPA3 only on my guest network for legacy support.

I use Make as the standard way to interact with every repo I own. This allows me to type `make build` instead of `$some-language-specific-command-I-forget-in-2-weeks`.

I use Docker for distributing every app I build. If the app is a website I also use the nginx base image. Docker images make packaging and distribution a breeze IMO.

Regarding yarn, npx, react, and jest: I'm similarly disillusioned by the churn but I also like to remain knowledgeable as the industry evolves. React was something I hadn't touched before, so I decided to pick a simple project to give it whirl ;)

Anyway, this project provides exactly what I needed. Thanks to OP for sharing! Slick and simple

It's also surprisingly possible to learn enough about programming to get a job without understanding basic computing concepts. I've met professional software engineers, with multiple years of experience and promotions under their belt, who did not know the difference between hard drives and RAM in a server context. I've literally code-reviewed attempts to deploy a database server with 1 TB of RAM in order to store 1 TB of data.

Why? Because I have a website template that solves many things for me, like:

- I see no reason not to use SASS or the latest ES even though I know how to. Or pug, for that matter... which I like. I also have a SASS template with some utilities and a particular code organization.

- Using an ES bundler allows you to throw in libraries from npm. I would not write the QR code myself, for instance.

- Automatically watches sources and recompiles.

- Adds hashes to asset filenames in order to cache-bust changes in CSS/JS/images (critical when using a CDN).

- Has placeholders for things I'll probably need, like the metadata for building previews in social networks.

- Is prepared for dealing with i18n, if the need arises.

- Future-proofing, since 80% of projects you think are small end up becoming larger. This is a single-page site, but if I wanted to publish this in Europe it'd already need two extra pages for the Privacy Policy + Impressum... so the single page site suddenly needs to worry about navigation.

- It's prepared for quickly deploying to AWS or Github Pages. It could be quickly tweaked for working on Cloudflare Pages or other hosting/CI environments that do the compilation for you.

And most importantly...

... my stack does not negatively affect the end result. All the extra baggage is just part of the development environment. If you want to skip my tools, they're quite easy to bypass and replace for any other transpiler... or you can just ignore my sources, reindent my compiled files and work on them directly.

PS: Back in the 90s I drew complex table layouts on graph paper, typed them down with vi, and ftped them to the hosting. I'm well aware of the alternatives. My current workflow + templates + helpers are based on the need to efficiently juggle A LOT of completely different projects every year as a freelance developer.

If the maintainer is comfortable using that technology, let it be. No need to rain fire on it.

Here is why I like using CRA for some projects:

1. Live reload. This comes for free with CRA. Makes dev work easy.

2. As easy as installing a component and getting started. And they logically fit in the code flow. Native import libraries, you have to write the JavaScript and point em to your divs and dom and initialize em.

3. Let’s say in the future, I want to reuse the code logic in a different app, I can just take the js and element as one unified component and move it across.

Tbh, for an app like this, after doing a production build (npm run build), I don’t think it’d make a radical difference in performance with raw html or react. Might just be dev preference, and ease of use.

Edit: More

The reason for this model is that it makes everything the same and your caching tier is the great equalizer. Everything is a backend for your caching SSL terminating reverse proxy. And your static site will live in the cache for ages so once your cache is warm there’s no real performance hit.

I don't know VanillaJS that well, so I took a stab at the same concept:

https://q726kbxun.github.io/qrcodes/

Not nearly as pretty, since I know even less about making pages pretty, but still, a fun little stab at making such a site.

This is what a lot of people have trouble understanding: sometimes the best tool for the job is the tool you’re best in.

Evidence? No one has made this static website you’re talking about. It doesn’t exist. This one does. The imperfect app that exists beats the perfect app that is vapor.

That it was a learning project, ok. I guess.

Yeah, probably because nowadays you just do it like that.

Something like wifi will have a custom prompt that says “Connect to WiFi network MyNetwork.”

The Android wifi menu (where you select from nearby networks to join) also has a QR icon that lets you scan to immediately join a network (next to "Add network"). I'd imagine you'd also join if you scanned it from the camera app, too.

https://github.com/bndw/wifi-card

Once it sees a QR code then it shows some text that you can touch to open the link.

  a QR generator which will magically connect me to the WiFi with my password embedded in the QR somehow.

Usually it's printed in the same places where you would actually print your plaintext Wi-Fi password, if you're already doing that, for example in restaurants (e.g. QR code inside a menu card that's only given to actual customers), offices (QR code inside meeting room for actual guests), airbnbs (QR code on a fridge inside your house), hotels (QR code inside the room with a router))

Think of hotels / offices with guest networks. I use it for my wifi, my home network is not secretive enough to not let friends / family join it when at my place.

If you’re wanting a _really_ secure network, WPA2 isn’t the way to go. You’d want to credential every user using 802.1X or WPA2 Enterprise.

In regards to security, you are completely correct. But this is to be used in cases where one would put a paper with the password on the wall, think of coffee shops. Saves some typing. Or you can put a card on your coffee table to help out your house guests.

You could also inspect the source, it’s open source, or network requests.

but for semi-public WiFis like the ones in restaurants, hotels, ... it's a survivable risk

Average case you are in the middle of bumfuck nowhere with a huge private property surrounding your WiFi and nothing's gonna happen.

Worse case some script kiddie attacks your vulnerable router (if using default password) or a smart gadget (if you have some and it's a couple of years old) to join a botnet and get your IP address on a blacklist limiting your internet usability (blacklisted IPs may not be able to send e-mails, may get captchas on major websites like Google, ...)

Worst case someone driving around noticing you have an open WiFi may drop a battery/solar powered raspberry pi with a 4G modem nearby your WiFi and use your WiFi as an untraceable VPN/proxy to perform some illegal stuff (e.g. upload child pornography or perform some serious hacking) and getting you in trouble with the law.