WPS security anno 2013 -- okay or not?

[Morty_UA]

"WiFi Protected Setup" (WPS) got a bad rep, because there were significant security issues with the PIN based WPS, leading to remote exploits granting full access to the WiFi net. The recommended workaround was to disable WPS.

But -- how is WPS today? I just bought a Linksys EA6300 router, and would really like to keep WPS enabled, because it makes adding mobile phones, friends' tablets etc so much easier.

I tried to look at Linksys' support pages to see of the EA6300 rate limits PIN WPS attempts or in some other way secures the WPS functionality -- but I didn't find anything.

What's the verdict, should WPS still be disabled on modern routers like the EA6300?

 

[stevech]

I disable WPS.
With WPA2, it takes 10 seconds one time to enter the encryption pass phrase. Should never have to enter it again.

 

[sfx2000]

If you don't need WPS, I would disable it. And keep your current firmware current and see if your vendor has applied the fix.

WPS as intended is secure...

Most current (e.g. on the shelf) devices - they should be good to go as the primary Board Support Vendors (e.g. Broadcom, Marvell, Ralink, etc) they've already fixed their side.

Remember, the main issue with the WPS problem was two-fold - weak passphrases and that if one disabled WPS in the GUI, it really wasn't at the driver/OS level... the end user would disable WPS (for whatever reason), use strong passphrases for WPA/WPA2, and the WPS would still be active, negating the user's efforts to better secure their network.

sfx