Securing a WLAN accesspoint is clearly nontrivial.

So a California court had the sense not to ask people to secure their Wifi.

Well, that makes sense in multiple ways. But one aspect that was not mentioned is that known WPS attacks make it hard on a consumer.

What's WPS? Well, WPS is what makes setting up a secure WLAN a possibility for the average user. WPS has basically three ways to facilitate WLAN setups with enabled encryption:

• Pressing the button on you Router allows your phone to join in short time window.
• Then there is variant where you tell the router a pin that device has generated.
• And last and here most relevant is the variant, where you read a pin (usually on a sticker) and enter it on the client.

Now some clever person noticed that WPS gives early feedback if the first part of the long pin is wrong. Depending upon details, this can mean that somebody parking an hour in a car can get access to your WLAN, or that your WLAN is secure anyway.

Counter measures are:

• Change the router not to leak if the first part of the password is good.
• Change how long a WPS pin attempt takes.
• Change how many WPS pin attempts are allowed before locking up.
• Disable WPS pin method.

Now, all of these have some drawbacks. The first three and similar need to be implemented by your device manufacturer, no influence whatsoever for the owner. And the last method is not supported by all routers, might be to complicated for many users (WPS is meant to make setting up a WLAN with encryption noob proof), and worst of all most consumer-grade devices can only turn off WPS completely, hence the user after that needs to register all devices manually with the right crypto key. (again some users might have problems managing that.)