7

Some say that a 32-character random string is a good idea for SSID names:

Treat your WiFi network name as you would a password. Make it complex and avoid using any whole words. Maximum length for an SSID is 32 characters.

I use something like "ASZumFY2J6JeIbpv8xNWVRqmY8SDF8AX" (without quote marks) for my SSID. You can use one of the key generators below to generate your own random SSID. Just trim it back to 32 characters, and you'll have a very strong one.

Others say it can be too unique:

Pick an SSID that is neither very common nor one that is very unique...

There are a number of sites where you can go to look up a SSID and get a location for the network. A prime example is WiGLE.net. If you have a very unique SSID and your network is listed in such a database, this can provide a physical location of your network, which can have a number of negative side effects.

Are these side effects a real concern? The bottom line: how unique should I make my SSID to be a sufficiently strong salt while keeping in mind "side effects" and the nuisance of a user-unfriendly 32-character string?

Improve this question
3
  • You don't mean 'salt'.
    – Neil Smithline
    Jan 3, 2016 at 1:14
  • Are you going to broadcast your ssid?
    – Neil Smithline
    Jan 3, 2016 at 1:15
  • @NeilSmithline I do mean salt; WPA uses the SSID as a salt. I gather that there's little security benefit from not broadcasting, so I was planning on broadcasting.
    – Logical Fallacy
    Jan 3, 2016 at 1:23

1 Answer 1

Reset to default
10

According to IEEE specification 802.11i WPA2 networks use the SSID as a salt in the following way.

PSK = PBKDF2(PassPhrase, ssid, ssidLength, 4096, 256)

In order to avoid the use of rainbow tables you are correct in thinking that you should have a unique SSID. However your second point regarding the aspect of being 'too unique' I don't really buy into a whole lot. Wigle.net can also take BSSID (your router's MAC address) as a search parameter, which is arguably more unique anyways. On top of that, having your AP possibly show up on a map with millions of other APs may or may not be acceptable.

To answer your question I don't think there is any harm in being "too unique". Users typically have to type in only the password and the the SSID that they are connecting to, so the usability shouldn't be affected very often.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .