Trying to disable WPS (bringing the topic to the top of lists again)

Thanks again for your reply.

TL;DR Disable the Router's WPS PIN. Then all you have to worry about is physically securing the router. WPS will only be enabled for 2 minutes after the WPS button is physically pushed.

Ok, I did some research.

There are two methods WPS can be used on many routers, including Nighthawks.

1. By entering the router's WPS PIN from a client.
2. By pushing either the physical button or the soft push button in ADVANCED > WPS Wizard

The WPS PIN in method #1 has been proven to be easy to hack. Netgear provides additional protection against PIN hacking by automatically disabling #1 if it detects 3 failed connections by the PIN method. It is also possible to disable #1 altogether as I have shown in my previous post by unchecking Enable Router's PIN.

The method you demonstrated is #2. You and netwrks are correct that it cannot be disabled, except by disabling SSID broadcast. The soft push button can only be accessed by logging into the router, so that's relatively secure. That leaves just the physical button on the router itself. If you can physically secure the router against prying hands, then you should be safe. WPS is not active when the PIN is disabled and is only active for 2 minutes after the push button is pressed.

If you are inclined, I suppose you could physically modify the router and remove/disable the push button. Personally, I think that would be overkill. If someone can physically access the router, then it would easier to connect to one of the Ethernet ports.

"Then all you have to worry about is physically securing the router."

And that's my problem. This was for my daughter at uni. The guest feature looked great for enabling her to share the connection when and with whom she chose, and to share access to files on USB as she decided. But WPS makes setting up a connection very quick and - note my previous message - disabling the PIN actually makes no difference (at least on my R6300).

So, I guess it'll have to be the hidden SSID after all.

The lesser of two evils really.

One last thought - WPS really shouldn't be active permanently anyway. In most (domestic) setups, once you've used WPS to make the connections you need you don't need it again. Scans of my neighbourhood and other places I go show the majority of routers have WPS enabled. A simple Google search shows lots of articles about using an active WPS to gain access although it's also clear that some routers are more vulnerable than others. But it shouldn't be too surprising as you're removing the need for (an up-to) 63 character WPA password with a simple numerical PIN.

Enough from me, thanks for the replies. I'm going to mark this as solved and move on.

Next I need to find a place to moan about using biometrics for security. (In case it isn't obvious I'd better say I'm joking.)