It was recently pointed out to us that Android P lacks support for the Wi-Fi Protected Setup authentication mode. WPS, as its known, is a protocol that allows a client Wi-Fi device to connect to a router using a PIN or a push-button and is widely regarded as being deeply insecure. In short, the PIN-based method for authentication is inherently crackable with a brute force attack, and the PIN mode is required to be enabled by default on routers with WPS support, making using WPS at all a Very Bad Idea.

WPS connections must be initiated manually on Android, but with Android P, it seems Google has removed the feature from the OS entirely. Users on the Google Issue Tracker have noted some strings in Android related to WPS that are now marked as deprecated (no longer supported), leading to speculation that Google doesn't plan to reintroduce the feature once P is officially released. Still, responses from a Googler on the thread indicate that the team is looking into this for further clarification, and we've also reached out to Google ourselves for comment. You can see one of the strings suggesting the feature is gone for good below.

WPS suport has been deprecated from Client mode and this method will immediately triggerWifiManager.WpsCallback.onFailed(int) with a generic error.

Given the security issues associated with WPS and the fact that many newer routers are eschewing the feature entirely, removing OS-level support for it probably only makes sense. WPS was introduced over a decade ago, in a time before everyone was walking around with a smartphone and Wi-Fi was far from ubiquitous. In a world where security is an ever-increasing concern, WPS is just another vector for would-be information thieves to exploit, and getting people out of the habit of relying on it in the first place is probably for the best.

Despite this looking like an intentional move away from WPS, Google has since responded to the Issue Tracker entry linked below with the note:

The issue has been fixed and it will become be [sic] available in a future Android release.

That still leaves us with plenty of questions about the security of WPS, and whether or not we really might be better off without it. At least now we should have ample time to debate all that, with WPS set to make its Android return.

Google has now formally listed WPS deprecation on its catalog of Android P changes. The company cites "security reasons" as its rationale for making this move.

Even with this additional confirmation, we're still wondering if Google's earlier promise will pan out, and we'll either see WPS or (maybe more likely) a functionally similar system debut in a future Android release.

  • Thanks:
  • Nuno,
  • Michael,
  • Yossi