Dangers in hiding WiFi SSID?

[Julian]

I have my home WiFi router set up to not broadcast my SSID. It is only me who uses it and I have a separate guest SSID that I can turn on when visitors need it so I see no reason to broadcast my main SSID except...

I just got a new iPhone and I I am look at the WiFi settings page on my iPhone as I type this. My phone is connected to my home WiFi via my hidden SSID at the moment and the settings page on the iPhone says...

Hidden Network

Using a hidden network can expose personally identifiable information.

If this is your Wi-Fi network, configure the router to broadcast this network.

I'm struggling to understand how simply not broadcasting the SSID can reveal more personally identifiable information than broadcasting it which is how I interpret this warning. Frankly it sounds like nonsense to me but surely a company of the size of Apple wouldn't put misleading rubbish in the info/advice text of such a core product would it?

Assuming that Apple hasn't lost the plot then all I can think of is that either there is truth in this or Apple are making a bit of a leap that perhaps if someone misunderstands the don't-broadcast-SSID feature they might call their SSID some innocuous/anonymous name if they are broadcasting it but might be fooled into giving it a meaningful name that might include personal data such as real name or address if they have it set to not broadcast.

Maybe I'm clutching at straws on that last one but the other two options are that one of the biggest (the biggest?) tech companies in the world is putting nonsense advice into its core products or there is some way that enabling don't-broadcast-SSID actually does result in more info leakage over WiFi.

Thoughts? Explanations?

- Julian

[Infrasonic]

https://apple.stackexchange.com/questio ... ble-inform

[swill453]

That was a new one on me, but it seems it's true.

If your SSID "JoeAtHome" is hidden, then you have to manually enter it into, say your phone. The phone then constantly asks "Are you JoeAtHome?" all the time. (Unless you're actually connected to it, of course). It does this for all hidden networks it knows about and is configured to connect to.

So Mr Baddy could capture these broadcasts as you happen to walk by, and use the name for his nefarious purposes.

Scott.

[Julian]

https://apple.stackexchange.com/questions/244171/ios-10-warning-using-a-hidden-network-can-expose-personally-identifiable-inform

Wow. Thanks infrasonic. I definitely learned something today. Interesting that they do also tie in my theory about people maybe being tempted to put personal names into their hidden SSIDs.

My hidden SSID is anonymous but the stuff in that article about possibly being able to use it as an identifying token on repeat visits or a tracking token across multiple sites makes me think that I might as well un-hide my home SSID. There's not really much downside except that neighbours might try to hack the password but it's a pretty strong one anyway so I'm not too worried about that.

- Julian

[chas49]

I think I've understood the linked forum thread enough to be able to say that this is an Apple issue. If you (or anyone else you permit) connect to your home Wifi network which has a hidden SSID and they connect using an Apple IOS device, *that device* will go round broadcasting your SSID wherever it is. Windows and Android devices don't do that.

If you really want to stop that, either unhide the SSID, or ban Apple devices

[swill453]

Windows and Android devices don't do that.

Are you sure? I'd be surprised if they used a different mechanism to connect to hidden SSIDs.

Scott.

[chas49]

Windows and Android devices don't do that.

Are you sure? I'd be surprised if they used a different mechanism to connect to hidden SSIDs.

Scott.

There's a post on that thread which claims "after a quick scan, it appears they do not broadcast for the SSID (They broadcast for all SSID's and then choose from the list). It appears to be an Apple specific issue.... "

On re-reading, I'm not certain if this is correct.

In any case, the upshot appears to be that, at best, hiding your SSID doesn't make you much more secure, and may possibly in some circumstances expose some information....

[jofc]

When I tried hiding the SSID from snooping google streetview cars, all I got was complaints that half the devices in the house stopped connecting to the internet.
It wasn't just limited to Apple devices, it hit some android phones/tablets & the samsung smart TV too

[swill453]

When I tried hiding the SSID from snooping google streetview cars, all I got was complaints that half the devices in the house stopped connecting to the internet.
It wasn't just limited to Apple devices, it hit some android phones/tablets & the samsung smart TV too

Yes, that's not the issue being discussed here. If you hide the SSID, then all devices have to be manually told the hidden SSID so they can connect to it.

The issue discussed here is how the device "looks" for the hidden network. It seems Apple devices do it in a way that potentially has privacy issues. Android et al may do it in a different way.

Scott.