In an authorized WPS assessment, an assessor contrasts online PIN attempt classes with offline pixie-class testing. What is the essential distinction?

In an authorized WPS assessment, online PIN attempt classes repeatedly query the AP, while some flawed implementations leak data that enables offline PIN recovery classes (pixie-style concepts at awareness depth). The essential distinction is interactive online guessing versus offline recovery against leaked material from vulnerable implementations. Municipal assessors must map which class RoE allows and what the specific AP behavior supports.

'Online and offline WPS classes are identical because every AP stores the PIN in beacons' fails because online and offline WPS classes are not identical and PINs are not stored in beacons for every AP. 'Offline classes require breaking AES-CCMP first; online classes only rewrite SSIDs' fails because offline classes do not require breaking AES-CCMP first, and online classes are not merely SSID rewriting. 'Pixie-class methods only apply to WEP and never relate to WPS PIN material' fails because pixie-class methods relate to WPS PIN material on vulnerable implementations—not only to WEP.

Exam caveat: implementation variance matters—do not claim offline success on every WPS-enabled AP. Operational check: identify whether the civic target exhibits lockouts, rate limits, or known vulnerable behavior, choose online versus offline WPS classes accordingly under RoE, and stop when lockouts or policy require. Document observed behavior per AP model. In municipal wireless operations, record the rationale in the engagement notes so future assessors know which control or technique class was chosen and which failure modes the rejected options would create for city services.