13

I would like to know if there is any workaround to protect or hide my TP-LINK Wi-Fi router password from being displayed on phones using Xiaomi (Redmi) phones.

If we go to Wi-Fi in a Redmi phone and tap on previously connected Wi-Fi, then the phone allows us to share the Wi-Fi network by scanning QR code by some other phone or the same phone.

And if I scan this QR code with any other phone, then we can easily see the password. So how can I protect my Wi-Fi password?

Improve this question
5
  • 17
    Just a note, but the standard QR format for Wi-Fi automatically includes the password in plain-text. So I assume what you really want is more like, disabling this sharing feature for a specific SSID instead (if it's even possible)?
    – Andrew T. ♦
    Commented Oct 5, 2019 at 12:25
  • 1
    I just want to protect my wifi password so that it can not be detected by any phone (QR code). Is there any option in TP LINK?
    – Sachin
    Commented Oct 5, 2019 at 12:44
  • 6
    The QR code is generated on-the-fly based on the format above by the phone, not the router; the router config doesn't have anything to do with this. The practical solution is to totally avoid sharing Wi-Fi config using QR code. The extended (and research needed) solution is to find if it's possible to disable/protect this feature using password systematically...
    – Andrew T. ♦
    Commented Oct 5, 2019 at 13:01
  • Is access control an acceptable solution? (Asking the general public as well as OP) Limiting access through your router to only allowed, trusted devices wouldn't protect your "password" per se, but would prevent unauthorized clients from accessing the internet and your network. (which has the same general effect as limiting your passwords share-ability right?)
    – Chase Cromwell
    Commented Oct 7, 2019 at 4:33
  • 1
    What you want is to give your friend the key so he can use it the way you intended. But also not give him the key, in case he tries to use it in any other way. This is simply not possible.
    – Agent_L
    Commented Oct 7, 2019 at 19:02

4 Answers 4

Reset to default
33

The answer to this question is more general than the specific hardware you referenced in your question, and not Android specific in any way, but since this question seems to arise from time to time I will answer it as best I can so that people can see this isn't "magic" in any way.

The reason this is showing your password is that the QR code for WiFi information stores and transmits the WiFi password in plain text, so that anyone who scans the QR code will have your WiFi password. The QR code isn't something special here: although you can't "read" it per se, any device that knows the standard code used for the QR symbol can read it just like words on a piece of paper. This is just how QR codes for WiFi are done and it doesn't matter if it is a TP-Link, Asus, Linksys, or any other device creating them: the password is in plain text. It also does not matter what device is reading the QR code: whether it's Redmi, Samsung, Apple, Google, Huawei, or whatever, it can read the QR code and display the network name and password in plain text, although some apps might "mask" the password for basic privacy (but they do have the information).

The proper way to handle this security in a home environment is not to give your WiFi password out to your friends, only to your family (or set it up yourself for them, although they may still be able to retrieve the password). And for your friends' or guests' use, have a separate SSID with a simple password that is setup to only access the Internet (commonly called Client Isolation), possibly at a throttled rate. I don't know about TP-Link, but many companies like Asus have an app for your cell phone that can very quickly allow you to enable a guest WiFi network for a certain period of time (say 4, 24, 72 hours) then automatically disables it. This example is useful for friends who are over for dinner, the entire day, or weekend perhaps. Some people, myself included, just enable a guest network with a password all the time, but this network has client isolation (users can only access the Internet) and it is throttled to about 1-2% of my ISP speeds (they have 5Mbps down and 500Kbps upload to use) and I change the password 3-4 times a year and put it on the fridge. None of these are perfect answers to security, but they are usually good enough.

Otherwise, if you are giving people access to your network, you might as well just give them the WiFi password... Once they are connected to WiFi it is largely the same as if they plugged into your network with a cable and can access everything, so having physical access to the network and having the WiFi password are essentially the same thing. Besides, it is fairly easy to change the WiFi password later if needed to restrict access. It also isn't a bad idea to change your WiFi password on a regular basis, once every 30-90 days or so, so that if the password is out there, it cannot be accessed later if things change, like your friend for whatever reason is not your friend any longer.

Improve this answer
6
  • So in brief, conclusion is there exists no proper technical solution for my this problem. It's very strange and ridiculous that technology has improved so much but we don't have any robust technique for this!
    – Sachin
    Commented Oct 5, 2019 at 16:46
  • 22
    @user3779493 it might be better if you can think an idea on how to improve this technology... 1) the purpose of Wi-Fi QR code is to conveniently share Wi-Fi config for the other devices to connect, and they need the SSID and password. 2) if other devices have connected to that Wi-Fi AP, and if those devices are rooted, then they also can retrieve the Wi-Fi password stored locally on their devices.
    – Andrew T. ♦
    Commented Oct 5, 2019 at 17:54
  • 11
    @user3779493 Technology is there. You can have a more secure system with every user having his own username and password. But if you choose a simple one password for everyone then when giving it out you have to reveal it. That is the nature of a single password. The guest's phone has to get the password in a readable form, be it QR or a simple text or your mouth telling it to your guest. You can offer the guest that you will fill the password for him on his phone.
    – Vladimir F Героям слава
    Commented Oct 5, 2019 at 21:27
  • 5
    @user3779493 Of course more secure solutions exist, but they are not as simple as having a single generic passcode. Enterprise organizations use them all the time, such as WPA2-Enterprise (Radius) or 802.1X where the user does not need a "wifi password" at all, but uses other credentials such as a domain username/password or installs a specific certificate (a file) in the device manually. These are generally not intended for home use though, this is why guest networks (sometimes duration specific) are built into modern home routers. Is the technology there? Yes, but there is no demand for it.
    – acejavelin
    Commented Oct 6, 2019 at 16:26
  • 2
    @user3779493 I would also advice caution about entering the credentials for someone in their device, there is absolutely no security in that... Anyone with minimal Google search skills could recover the password. The other thing to remember is that once it's entered into say a mobile device, this information could also be backed up to the user's cloud account such as Google, and every device they add they account to would immediately have access to your network and password. Again, this lends to having a secure guest network for such purposes where you can limit the time and password use.
    – acejavelin
    Commented Oct 6, 2019 at 16:33
12

The short answer to this question is you can not stop anybody that has the WiFi password from sharing it. Which is exactly what the phone is doing when it generates the QR code.

If you want to prevent users of your network from sharing access with others then you have to use something other than the default password WPA to secure the network. There are a number of possible solutions

  • Use MAC address white lists, this means that only known hardware will be allowed to connect even if they have the password (MAC addresses are easily spoofed with laptops, not sure if it's possible without jailbreaking a phone)

  • Used WPA-TLS, this uses individual certificates for each user, once installed on the phone there is no way to export the private key so no way to share with others (it is possible to extract keys on some jail broken phones that do not have hardware secure elements)

  • Use a captive portal and require a second password that changes regularly (this could be from a 2fa token only given to authorised users)

This list is not complete but should give you some options to look at.

Improve this answer
4
  • 1
    MAC address whitelist/blacklists are tough now days... MAC address randomization is being built into devices for privacy purposes, my Pixel phone has it. source.android.com/devices/tech/connect/wifi-mac-randomization and the other methods are often hardware dependent, not all home networking equipment can do supplicant based authentication, although most can do a guest network with captive portal, I don't see the point of the captive portal if it is a unique SSID anyway, unless you need people to accept T&C to indemnify yourself if they do something malicious.
    – acejavelin
    Commented Oct 6, 2019 at 16:48
  • 3
    Mac address randomisation is only used when searching for a SSID, the device's real Mac address is still used for the actual connection. The captive portal allows you to add a secondary layer of authentication which can be easily changed, it has nothing to do with indemnity
    – hardillb
    Commented Oct 6, 2019 at 16:51
  • Good to know, thanks for the info!
    – acejavelin
    Commented Oct 6, 2019 at 17:01
  • @hardillb At least on my Pixel 3a, it's an option in the settings which MAC to use when actually connected, and random is listed as the default.
    – derobert
    Commented Oct 10, 2019 at 19:30
4

You can have a dedicated guest SSID (if your router supports it). This can separate guests from you to some degree, depending on router capabilities.

If you don't want give the guests permanent access, you can change the password time-to-time.

If you want to go further, you can look at WPA2/WPA3 Enterprise. This allows better access control. However, you probably don't want to do this on your home Wi-Fi, because it is too complex to set up and you might need a better (and more expensive) Wi-Fi router for that.

For explanation why QR code does not hide the password see @acejavelin's post.

Improve this answer
3

I have a second router, just a small cheap one, connected by cable to the main router. They have different wifi networks and different passwords. I give my friends the password of the second router only.

I can change it anytime easily. Or disconnect it.

I find its an easy and effective solution.

Improve this answer
4
  • This is actually a terrible solution... You are giving everyone on the second router full access to everything on the first router's network, and no one on the first router's network can access anything on the second. Unless you have client isolation on the IP address assigned to the second router...
    – acejavelin
    Commented Oct 8, 2019 at 14:20
  • Who said I was giving everyone access? You? I sure didnt. I can configure it so they dont have access to each others networks. Seems safe enough.
    – Don King
    Commented Oct 13, 2019 at 16:24
  • If router 2's internet port is connected to the LAN of R1, all anyone on R2 needs to know is the IP address scheme of the LAN of R1. To R2, your R1 LAN subnet is the Internet, so they can access everything in it as if they were connected directly to it. Simple IP routing says so unless you have made some very specific changes not common in home routers. For example, if my IP on R2 is 10.0.0.10 and your printer on R1 is 192.168.1.50, I can access that directly because R2 will happily route to that device as it knows exactly where it is. Your R1 LAN however knows nothing of 10.0.0.10.
    – acejavelin
    Commented Oct 13, 2019 at 16:29
  • Depending on your router you can configure it so that they are not showing each others networks.
    – Don King
    Commented Nov 7, 2019 at 15:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .