CC3000 broadcasts network password unencrypted

I dont follow hardware much, but I guess something like the Ralink RT3070.

The Ralink Wi-Fi modules aren’t really suitable for embedded systems; they are designed for a system with an OS (like a Raspberry Pi).

The options besides Texas Instruments for embedded Wi-Fi (that I’m familiar with, there may be others) are GainSpan, Roving Networks (part of Microchip now), Broadcom, and Qualcomm. GainSpan and Roving Networks are too expensive in my mind; they’re almost twice as expensive as the CC3000 in volume. Broadcom and Qualcomm are cheap but completely inaccessible in low volumes, making them poor choices in my mind for an open source project. The CC3000’s advantage isn’t just SmartConfig; it’s the price and availability in small quantities.

Ok, I get you. The CC3000 is more of a revolution in the IOT than I thought.

Another alternative would be to pass via USB - USB comms is not very supported in smartphones.

Am I correctly assuming that you are suggesting to configure the device through USB? Your post suggests with a smart phone though, hence my confusion. Surely better to assume people (end users) will be able to configure with a laptop/pc.

In that case, we can always expose the usb port to the outside of the finished project/product? Maybe a toggle switch to change from developer mode to operative?

Thoughts?

We actually have put in place a method for providing Wi-Fi credentials over USB, either for more security or if Smart Config doesn’t work, which is the case on some more complex network topologies.

Yes I was suggesting configuring the device through USB. I think its a safer assumption that users will have a smartphone than a PC. PC sales are down 20% last quarter alone. People seem to be ditching them in favor of smartphones and android or apple tablets.

That’s cool then. And will it be easy to switch between developer mode and inputting wifi creds?
I agree with your stats rockvole, but then again only one pc per household would be required, rather than one smart phone per person. And corrent me if im wrong, but wont pc software be easier for developers and consumers?

Just in case it’s not clear, the method we’re providing for sending Wi-Fi credentials to a Core over USB is from a laptop or desktop computer, not from a smartphone.

Yep and if you’d like to see how you can set up the Core over USB:

http://docs.spark.io/#/connect/connecting-your-core-connect-over-usb

You guys are all seriously overthinking this… For the average home user, all a WiFi password does is prevent their neighbor from stealing their bandwidth, and that’s if they even have a concept of how WiFi works, most don’t! (Quite a large number of people think WiFi is just freely available internet, floating through the aether.)

The majority of older WiFi access points use default passwords, the newer ones may come with stickers that has a pre-generated password, but that’s often changed to the SSID name or something easily guessable (phone number, address, last name). I’ve even seen some pre-generated passwords be the WiFi MAC address!

Besides, like Zach said, someone would have to know precisely when you were activating your CC300, what product it was in and be sniffing at that exact moment. If someone is going to go through that amount of trouble there are much easier ways to get onto the network (I.e., social engineering, viruses, brute force and so on). Security through obscurity isn’t always the best idea, but some times it’s good enough. In the case of the CC3000, I think it’s plenty good for 99% of use cases.

As someone else mentioned, corporations are using WPA Enterprise for RADIUS, which the CC3000 doesn’t support, so that’s a moot point.

If you’re deploying your own product you can easily flash a unique key to the CC3000 and do setup that way.

Just my two cents.

1 Like