A usual method is that the IoT device sets up a temporary Wi-Fi access point. This AP can even be open, or the password et cetera can even be coded into a QR Code. Such codes can easily be generated by tools like this. Try this one:

The advantage is that the user has to provide the actual Wi-Fi password and both of your security risks are avoided, since that link is not any URL, but a standard Wi-Fi descriptor that phones usually support. Thus, only this temporary access point is not very secure. Another advantage is that you only need a camera on the Smart Phone and I'd hazard the guess that every IoT employing user will have a phone with a camera.

A usual method is that the IoT device sets up a temporary Wi-Fi access point. This AP can be open, or the password et cetera can even be coded into a QR Code. Such codes can easily be generated by tools like this. Try this one:

The advantage is that the user has to provide the actual Wi-Fi password and both of your security risks are avoided, since that link is not any URL, but a standard Wi-Fi descriptor that phones usually support. Thus, only this temporary access point is not very secure. Another advantage is that you only need a camera on the Smart Phone and I'd hazard the guess that every IoT employing user will have a phone with a camera.

A usual method is that the IoT device sets up a temporary Wi-Fi access point. This AP can even be open, or the password et cetera can even be coded into a QR Code. Such codes can easily be generated by tools like this. Try this one:

The advantage is that the user has to provide the actual Wi-Fi password and both of your security risks are avoided, since that link is not any URL but a standard Wi-Fi descriptor that phones usually support. Thus, only this temporary access point is not very secure.

A usual method is that the IoT device sets up a temporary Wi-Fi access point. This AP can even be open, or the password et cetera can even be coded into a QR Code. Such codes can easily be generated by tools like this. Try this one:

The advantage is that the user has to provide the actual Wi-Fi password and both of your security risks are avoided, since that link is not any URL, but a standard Wi-Fi descriptor that phones usually support. Thus, only this temporary access point is not very secure. Another advantage is that you only need a camera on the Smart Phone and I'd hazard the guess that every IoT employing user will have a phone with a camera.