Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Yesterday I got a cable modem, and on the back of the modem there is a small sticker with the name of the default SSID, which looks like Vendor-A11 and the default Pre-Shared Key, which is a long password containing both numbers and letters.

I found it convenient that when I want to connect some device to its Wifi, I just need to have a look at the rear of the modem. But then, while doing some research, I saw that it is recommended to change the default SSID. For me, it seems that what comes printed on the sticker is unique to each device sold by the manufacturer (both the SSID and the key).

Then I did some research on the web and, while there are many websites that tell you to change the default SSID (and some even go as far as saying you should change it often), all of them failed to explain what is the purpose of changing it.

Isn't doing this just some sort of security by obscurity? Isn't setting WPA2 with a good password the most important? Just for reference, I have disabled WPS too.

share|improve this question
2  
You could always take a sticky note, write the username and password on it and attach it to the router. It seems less secure ("Never write down your password!" probably) but the existing user/pass is already there and you want to be able to keep it there. –  chipperyman573 Feb 6 at 0:46
add comment

2 Answers

up vote 7 down vote accepted

Changing the Default SSID would serve no particular security purpose where it's not entirely predictable (e.g. 'netgear'). It would allow you to easily identify your wireless network though, if there are lots of others about.

It used to be the case where companies used one string for all their APs that it was relevant to Rainbow table generation (more info here) as the SSID is involved in generating the key (details here)

It could be that the articles you read were confusion the idea of changing the SSID with the idea of changing the Pre-Shared Key.

Changing the PSK can be a good idea, in case there is a problem with the methodology used to generate the first one being predictable (IIRC this has been a problem with some makes of access point in the past).

Also changing the PSK periodically can be beneficial if you're worried about someone brute-forcing the existing one or your worried about someone who has had access to the network and should no longer have it (e.g. in a company set-up where someone leaves the company)

share|improve this answer
1  
Some modem used to generate the WEP/WPA key based on the SSID so in this case if they know your SSID they know your key. More info here : gnucitizen.org/blog/… –  Techbrunch Feb 5 at 20:01
1  
Changing the SSID can also serve as a deterrent to lazy attackers brute forcing against default values. Though that's not necessarily anything significant. –  SteveS Feb 5 at 23:35
add comment

For some routers, the SSID will identify the type of router (one example). This gives potential attackers more information about your network that they can use to break into it. Thus, changing the router name hides that information from the attacker. Some things that knowing the type of router can enable is finding default passwords for that router, or knowing specific attacks that will work against that router.

share|improve this answer
    
So will the MAC address (BSSID). And that's going to be broadcast out regardless of what SSID you pick. –  derobert Feb 12 at 23:56
    
True. But with security, you'll never be perfectly protected. You just need to make it hard enough for the attacker that they don't find it worth their time. This is just one step (albeit, not the most effective step) to raise that threshold needed for a successful attack. Using good encryption and a strong password is probably the best first step, but that doesn't answer the question that was asked. –  John Montgomery Feb 13 at 21:03
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.