[HN Gopher] iOS Wi-Fi Profile Generator
___________________________________________________________________
iOS Wi-Fi Profile Generator
Author : transpute
Score : 64 points
Date : 2023-12-31 15:25 UTC (7 hours ago)
(HTM) web link (daduckmsft.github.io)
(TXT) w3m dump (daduckmsft.github.io)
| lakpan wrote:
| Yes but for what? Why should I install a profile instead of just
| scanning a QR?
| rcdemski wrote:
| For personal networks this doesn't make sense but does seem
| like a fun project to build. The profiles are really most
| powerful for enterprise networks.
| lxgr wrote:
| I was also wondering that. Some iOS configuration options are
| only available via profiles (and not the GUI), but I don't see
| any of these on the site.
| xyst wrote:
| It's overkill for personal networks, but as others mentioned if
| you manage a fleet of devices of various types (mobile vs
| desktop vs laptop). Then managing connections via profiles is
| the way to go.
|
| Push updated profile via MDM. End user should transparently
| receive the updated profile before logging into corp network.
|
| No reconfiguration required on the user end. Reduced or no
| calls to internal tech support.
|
| Personally, I just use the method you describe. Post a QR code
| for my guest network and be done with it.
| zerkten wrote:
| You can follow the GitHub link and see that the author works
| with Microsoft Intune (MDM) which confirms what you are
| writing here.
| 1letterunixname wrote:
| They're for automated deployment to many devices. In general,
| for personal use, QR codes for WiFi are more portable as they
| work on iOS, Android, etc. without any special magic or setup.
|
| If you have MDM, then great, use these. Otherwise, I have a QR
| code and plaintext on the back of many pantry door with WiFi
| deets.
| Avamander wrote:
| It would be nice if this generator also added options for WPA3
| and (disabling) MAC randomisation. Plus generating a per-SSID
| encrypted DNS (DoH/DoT) configuration, those profiles are
| actually tedious to assemble.
| WirelessGigabit wrote:
| Something I discovered later on is that the MAC doesn't change
| for a saved SSID. It always uses the same.
|
| So there's a mapping that is like SSID -> MAC. They can get
| reset. But I stopped turning it off on my phone.
| iimblack wrote:
| Hmm I definitely see my family phones get new MAC addresses
| from time to time. Maybe the cadence at which they refresh is
| just irregular?
| WirelessGigabit wrote:
| I believe an iOS update triggers it.
| radicality wrote:
| One thing that's bugging me currently in iOS is that I
| constantly see a "Privacy Warning" text in the wifi section
| because I turned of 'Private Wifi Address' since I'm on my
| own home network.
| spr-alex wrote:
| Unfortunately this is also an issue with the QR Code format
| which is underspecified, and this extends to a bug we've been
| begrudgingly waiting for apple to fix here.
|
| The QR Code format is something like this ``` type = 'WPA'
| return `WIFI:S:${_ssid};P:${password};T:${type};${hidden};` ```
|
| So the long standing bug (feedback id 9991042) we have filed
| with Apple is about a downgrade issue with QR Codes. If an iOS
| devices connects with a QR Code it will successfully connect
| with WPA3. But when the device goes to reconnect it has saved
| the SSID as a WPA2 network only and will incorrectly only
| authenticate with WPA2. This is very unfortunate because the
| zero-knowledge aspect of dragonfly in wpa3 is a huge step
| forward for wifi security. Although I guess it's all still
| resting on AES CTR at the end of the day :-)
| Avamander wrote:
| I'm pretty sure iOS also doesn't support GCM as the group
| cipher, so these downgrades are not all that uncommon with
| iOS unfortunately. Hopefully they'll improve it in the future
| though.
| captn3m0 wrote:
| As another cool trick, you can host a mobileconfig file and use
| QR codes for fairly quick (10 taps on iOS or so) enrolment.
|
| I've used them for enrolling users to custom CardDAV/CalDAV
| servers and it is so cool - going from scanning a QR code to
| magically seeing new events and contacts showing up in the
| calendar and contact book.
| k8sToGo wrote:
| Fastmail does this
| captn3m0 wrote:
| Migadu used to do this till they forgot to renew the signing
| certs for their profiles, and felt it was too much hassles.
| jauntywundrkind wrote:
| Is this a thing on any non-Apple systems too? Is it additive or
| does it overwrite, on clients you've seen? If you can just go
| places and add their caldav servers with events, that's a semi
| viable way to share calendars?
| captn3m0 wrote:
| iOS/MacOS, and Linux are great with this.
|
| Mobileconfig is an Apple-only MDM but it works on iOS and
| MacOS.
|
| There's webcal:// protocol for CalDAV subscriptions that
| works on Apple and Linux
|
| Unfortunately the user story is bad on Android, where Google
| hates any standards.
|
| Edit: You can test out a recent project I did with webcal at
| https://captnemo.in/blr-habba/
| joeig wrote:
| Slightly related: If you're self-hosting your email, you can
| use autoconfiguration[1] and autodiscover[2] to help your users
| set up Thunderbird and Outlook correctly.
|
| [1] https://wiki.mozilla.org/Thunderbird:Autoconfiguration
|
| [2] https://support.microsoft.com/en-
| us/topic/outlook-2016-imple...
| Kiala wrote:
| <key>AutoJoin</key> <true/> <key>CaptiveBypass</key>
| <false/> <key>EncryptionType</key>
| <string>None</string>
|
| A whole bunch of key-value pairs at the same level? What kind of
| cursed XML is this?
| the_mitsuhiko wrote:
| https://en.wikipedia.org/wiki/Property_list
| ezfe wrote:
| Standard plist format
|
| https://en.wikipedia.org/wiki/Property_list
| mobilio wrote:
| Also can be edited using plutil and defaults in command line.
| mock-possum wrote:
| Jeez yeah do not like this
| blashyrk wrote:
| Now imagine that the workspace/project format for the defacto
| IDE for all Apple related stuff uses this exact same format,
| mixed with some random binary blobs and it keeps track of all
| project settings and file structure. Now imagine merging that
| in your VCS of choice whenever another team member makes any
| change to any of the aforementioned things.
|
| Good news! You don't have to imagine! You can live this fever
| dream yourself by using Xcode.
|
| How a company with that much money can unironically produce
| such dumpster fire garbage of a so-called IDE is beyond my
| comprehension.
| guhidalg wrote:
| This is one of the unexpected externalities of Apple's walled
| garden. You may not deal with Xcode directly if you use
| Xamarin et al. then some poor soul somewhere has to sacrifice
| their first born every year when Xcode received an update.
|
| If Apple allowed other App Stores, they would have to make
| Xcode not suck.
| saagarjha wrote:
| What binary blobs? It's a text file?
| JimDabell wrote:
| > Now imagine that the workspace/project format for the
| defacto IDE for all Apple related stuff uses this exact same
| format
|
| It doesn't. Xcode project files are something that look a bit
| like a cross between JSON and an INI file. This is unofficial
| documentation showing what it looks like:
|
| http://www.monobjc.net/xcode-project-file-format.html
|
| That isn't a property list; it's something inherited from
| Project Builder from NeXTSTEP, which Xcode was originally
| based upon. Xcode project files would be a _lot_ easier to
| deal with if they were property list files, because they are
| a standard, documented format with official tools to work
| with them. The Xcode project file format isn't officially
| documented and doesn't have generic manipulation tools like
| plutil.
|
| Maybe you are mixing the project file up with the Info.plist
| file? That is a property list file, but its purpose is to
| tell the operating system about the application. It's not the
| Xcode project file.
| tyingq wrote:
| Here's a large example with nested arrays and dicts, integers,
| strings, etc:
|
| https://github.com/acidanthera/OpenCorePkg/blob/master/Docs/...
| ThePowerOfFuet wrote:
| Sweet Jesus.
|
| I'm filing a human rights complaint at The Hague.
| Spivak wrote:
| Oh it's not that bad, plus it's just an on-disk
| serialization format. You use it like you would Python's
| pickle by dumping/loading from NSDictionary/NSArray.
|
| It's ordered, typed, can be validated by schema, and just
| takes the format you would write naturally and removes the
| boilerplate because your primitive collections in plist
| world aren't trees they're dicts and arrays just like in
| JSON. <dict> <entry>
| <key>Greeting</key> <value type="string">Hello
| World</value> </entry> </dict>
| <dict> <key>Greeting</key>
| <string>Hello World</string> </dict>
| marcellus23 wrote:
| It's not intended to be written by hand. It's also like 30
| years old.
| gjsman-1000 wrote:
| Congratulations, you've found example #78332 that even the
| world's best engineers can have bad ideas.
| ape4 wrote:
| Worse than an .ini file
| aragonite wrote:
| Not entirely unfamiliar from <dt>/<dd> HTML elements. [1][2]
| <dt>term1</dt><dd>definition1</dd>
| <dt>term2</dt><dd>definition2</dd>
|
| [1] https://developer.mozilla.org/en-
| US/docs/Web/HTML/Element/dl...
|
| [2] https://www.w3.org/TR/2011/WD-html5-author-20110809/the-
| dl-e...
| AdamJacobMuller wrote:
| I'm not sure how old you are but congratulations on living this
| long without encoutering the unmitigated hell of Apple plist
| files.
|
| I remember seeing when I first started using OSX 10.0 about two
| decades ago and my reaction was about the same as yours. At
| least now `plutil` can output (and read) JSON, along with lots
| of other enhancements to make it slightly less insane to use.
| skrebbel wrote:
| I kinda like it. About as succinct you can make an ordered map
| with XML, given a predefined set of element names (= easy
| validation)
| Antrikshy wrote:
| Would be perfect with a brief explanation of what this is and how
| to use the generated profile.
|
| People who _need_ profiles probably have better dedicated tools
| for the job. This website could be a nice educational resource
| for people who are unfamiliar but curious; it 's just missing an
| explainer.
| tffhrdvv wrote:
| Um did you even open the link?
|
| What is this for? Apple offers tools, such as Apple
| Configurator that allow you to create your own iOS
| Configuration Profiles. Apple Configurator is only availble for
| MacOS devices. This is useful if you do not have access to one
| but still need this.
|
| This site will help generate a configuration profile based on
| the network information you provide. Using this, you can import
| the profile into your mobile devices (via a method such as an
| MDM).
|
| You can see all of the modified output in the bottom as aqua
| text.
|
| All of this is run client-side, within the browser.
|
| Extra stuff:
|
| Apple MDM Configuration Profile Reference
| Jolter wrote:
| The text explains "what", but not "why". Who needs a
| Configuration Profile?
| hunter2_ wrote:
| Based on it mentioning MDM, I assume profiles are the only
| way to join a network on some phones with MDM enabled? So
| maybe it's for companies that procure many iPhones and zero
| Macs?
| gumby wrote:
| Thanks, I wondered why I would want this too. I don't use
| MDM.
| Kwpolska wrote:
| This doesn't really explain what a profile would be useful
| for, as opposed to manually configuring the Wi-Fi network, or
| using QR codes.
| xoa wrote:
| There are two primary purposes. Fundamentally .mobileconfig
| profiles are a standardized XML format that are an officially
| blessed way to bundle up a lot of various macOS, iOS, or tvOS
| configuration options into an easy standard format that can
| then be installed on various devices to apply a whole bunch of
| stuff all at once with no additional work. There are various
| GUIs to work with them, including Apple's free Apple
| Configurator, or iMazing does a nice one as well, they're the
| backbone of a lot of MDM usage for iDevices now, and they can
| also be created programmaticly. As well as closed there are
| lots of open source solutions for this and it's not
| particularly hard to roll your own or customize (though you
| probably want to save yourself the pain of dealing directly
| with the ancient format as much as you can).
|
| So first, even for completely bog standard config it can be an
| easy timesaver, as well as way to make a change in a single
| place in a deterministic fashion and then apply it uniformly. I
| use it a great deal just purely for my own personal and family
| devices for example. I've got lots of email accounts, WiFi
| networks, and so on, that aren't special but sizable in number.
| I've made a few profiles for those, which I can then take and
| install on each Mac, iPhone, or iPad to have all the accounts
| loaded saving some manual config work. If I need to change a
| password, add or remove, I can do it in one single place, and
| then push it out to do the config. No need to jump back and
| forth to a password manager doing lots of copypaste of
| passwords on the phone. It's not a huge deal but it's a pretty
| simple time saver.
|
| Secondly, .mobileconfig will let you do stuff that you can't
| (officially) do at all otherwise, particularly on iDevices, so
| in that case it's simply the only easy way to get at certain
| functionality. Some functionality is only available to
| "supervised" devices you setup fresh under supervision now, and
| can give you a much deeper level control. For HN types, it can
| be useful to load your own private root CA and cert chains,
| cert using WPA Enterprise networks, etc. It's another way to
| make it harder to do certain activities with a stolen device.
|
| I think a lot of people with Apple devices who don't " _need_ "
| profiles could still find them handy honestly. It's not exposed
| very well but it's also no some horribly complex thing to get
| some value out of. There are a lot more people with iDevices
| then Macs (so that rules out Apple Configurator), and typical
| serious MDM offerings are all subscription based sadly. So in
| turn free tools for other platforms are nice to see.
| maratc wrote:
| It would be great if there's a way to store the profile on an NFC
| tag. This way, I could tell my guests to tap the tag to connect
| to my home network.
| blutack wrote:
| I use QR codes for this, they work for both android and iOS.
|
| This link explains how they are formatted: https://qifi.org
| captn3m0 wrote:
| An NFC tag with the same contents as WiFi connection strings
| also work.
| maratc wrote:
| I use QR codes too. Otoh NFC tags only work on Android, I
| haven't managed to get them to work on iPhones yet.
| RKearney wrote:
| No escaping is done, so you can end up with a malformed profile
| if your SSID or PSK includes a < for instance.
| jasoneckert wrote:
| Correct me if I am wrong, but won't iOS profiles work identically
| on macOS? If so, the tab at the top should be called "iOS &
| macOS" to be consistent with the "Android & Windows" tab.
| MilaM wrote:
| Neat. A tool like this but for VPN profiles would be nice. I had
| to manually create them to connect to my internet router. The
| number of available options is quite intimidating.
| notherhack wrote:
| Imazing Profile Editor works well to generate VPN profiles, and
| a lot of other profiles I don't use. Runs on Mac or Windows and
| it's free. No personal stake, just a satisfied user.
| https://imazing.com/profile-editor
| rsync wrote:
| Similar:
|
| https://dns.notjakob.com/tool.html
|
| ... which allows you to create configuration profiles for system-
| wide DoH settings which are, currently, not settable in the GUI
| settings.
___________________________________________________________________
(page generated 2023-12-31 23:01 UTC)