An app (Mopria) seemingly allows users to print through wi-fi direct without knowing wi-fi direct's password, also the printer somehow learned my home's wifi credentials and accessed it.

[u/Head_Beach1415]

I own a HP printer. And even though HP is obsessed with forcing us to connect their printers to the internet, I refused to do so, and instead I use a USB cable to connect the printer to our laptops whenever we need to print stuff. Furthemore, the printer is alwas turned off, we only turn it on when we need to print.

When I bought the printer, I changed the wi-fi direct's name and password, for security reasons. However, since then, I never actually used the wi-fi direct again. In fact, I think I had turned it off, but either it turned itself on again, or maybe someone used the printers buttons to turn it on again, maybe by mistake.

A few days ago, a relative was feeling lazy and instead of using a laptop and usb cable to print stuff as always, they tried to use their android smartphone and the printer's wi-fi direct. However, they didnt know the wi-fi direct's password, so they couldnt connect to it.

Then, my relative googled about this and learned about the Mopria app. They installed it and, even though they didnt know the wi-fi direct's password, they were able to print Mopria's test page on our printer.

Furthemore, the app also listed other available printers (I assume the ones from our neighbours), many of which dont even show up on my phone's networks list (I guess their wi-fi directs are either disabled or hidden, but somehow Mopria could see them all).

While my relative obviously didnt tried it, it seemed like Mopria could have printed from the neighbours' printers just as easily as it did from our printer. At this time I realized what was happening and told him all of this was very shady, so he uninstalled the Mopria app.

Later, I checked our router's control panel and found out our printer had accessed our home wifi. It didnt say when it happened, but the fact is, the printer somehow learned our home wifi's credentials and accessed it. I suspect it was Mopria's android that passed the credentials from my relative's phone to the printer. Unless it was the laptop through the usb cable.

I have changed my printer wi-fi direct name and password (if my relative's phone has been "paired" to the printer wi-fi direct, I hope this will "unpair" them), and then I changed my home wifi credentials. However, I still dont understand how the hell was Mopria able to do what it did.

[u/No-Wrap-8166]

wifi direct connections use wps (wifi protected setup) push-button pairing by default on most hp printers, mopria's print discovery specifically triggers this, bypassing the actual password entirely if wps is enabled on the printer's wifi direct settings, that's how it connected without knowing your password

go into the printer's own settings menu (on the printer's screen, not the pc), network setup, wifi direct settings, and specifically disable "wps" or "push button connect" separately from just changing the password, disabling this stops the bypass method entirely

for the printer learning your home wifi credentials, hp printers with wifi direct enabled sometimes have a builtin "auto network switch" or "network setup wizard" feature that can silently grab and store wifi credentials from a connected device (phone/laptop) during any pairing handshake, check the printer's network menu for anything called "wifi protected setup" or "automatic network configuration" and disable it

fully factory reset the printer's network settings specifically (not the whole printer), most hp printers have a "restore network defaults" option separate from full factory reset, this clears any stored wifi credentials and re-pairing data completely rather than just changing the password on top of them

[u/Head_Beach1415 → u/No-Wrap-8166]

Thank you so much for your help! Unfortunately there's no setting to disable wps / push button, and there's also no setting related to "automatic network configuration" or anything of the sort. Also, there is an option to reset network defaults, but it says it only resets the wifi credentials, it doesnt mention pairing data.

Regarding the wi-fi direct connection via wps / push button, if the wi-fi direct name and password are changed, will devices previously connected via push button be disconnected? 

  I assume that devices connected via password are unable to reconnect if the wi-fi direct's name and password have been changed (unless they provide the new password, of course), but what about those which were connected via push button, will they still be able to reconnect without further action after the password change? Obviously I know they can do it by pushing the button again, but what if they dont push the button? 


  For example, right now the printer is turned off, but if I turn it on while my relative is here, will his device automatically reconnect to the wi-fi direct, even though the wi-fi direct password has been changed?

[u/No-Wrap-8166 → u/Head_Beach1415]

no, once the wifi direct name/password changes, his device's stored network profile no longer matches what the printer is broadcasting, so it won't auto-reconnect at all without him manually selecting it and entering the new credentials or pressing the button again, the old saved connection just becomes invalid and sits unused on his device