I suspect that an android device is trying all SSIDs it was ever connected during wifi scan. 1) It alone gives enough information to identify the device 2) If a network with no encryption is saved, a MitM attack can be performed.
This would be typical of most mobile devices if you store the connection in a way where it will automatically connect again at a future time.
Is there a way to handle it?
Yes. You can do so by doing whatever combination of the below you like. This will at least limit your exposure.
- Don't store you wireless networks so you can connect automatically in the future.
- Delete wireless networks when you are done.
- Disable wireless on your device when you don't want to be connected.
E.g. trying only networks that are in the range (listen for beacons).
In comments elsewhere, you seem to find "passive scanning only" as an appealing solution. This will significantly increase times for a device to connect to a wireless network (from your reported 3+ seconds to something more like 6-20+ seconds) and have the potential to create what appear to users as "outages" of similar periods every time the device scans to check for better networks to which they can roam.
Put simply, it won't happen. Why? Because it is asking for developers to add a feature that (a) decreases usability by increasing time taken to find/connect to networks and (b) impacts modern devices more significantly than legacy devices. Or put another way, how many users do you think would be pushing developers to "significantly increase the times it takes to connect to a wireless network"?
Automatically trying to connect to any configured SSID as if were hidden was a change made to simplify the user experience and make it easier for the masses. As in many such feature decisions, this does come at a cost for potential security/privacy issues. You will find little support in developer circles for going back on this decision and increase the number of [confusing] choices people [with little technical knowledge] need to make when connecting to a wireless network.
A better and more likely suggestion that you could make is an option (global or per profile) to "allow connections to hidden networks" that would be enabled by default and provide the existing behavior. Knowledgeable users could then choose to disable it if they wanted, and the active scanning for networks taking place could do so without including an SSID. No negative impact from disabling active scanning necessary.
Still a tough sell since there are many features users [in larger numbers] want for their devices and developers tend to follow the demand, but more viable than the prior suggestion.
It will make impossible to connect to hidden SSIDs, but who uses it?
Many organizations do and some home users. Personally I find very few cases where it is used for a valid reason, but my opinion doesn't stop people from using hidden SSIDs.