Wifi security SSID clarification

Question

I've read several Wifi security related questions on here. There are two things related to the SSID which I don't fully understand.

• Is there a best practice for SSID naming? I know that changing the SSID from the vendor default is recommended and that if two APs have the same SSID but different encryption/ passphrases, Wifi clients will still try to connect.

  So, should SSID naming be more complex than say single words such as "wizardofoz" to something such as "wizardofoz_1d3h2"?

• SSID hiding is not a security feature and I understand that hiding SSIDs for convenience such as when you have corporate private and public Wifis has its place.

  What I'm not entirely clear on is what happens in the two states: hidden and unhidden.

  In the hidden case, the AP does not broadcast the SSID, e.g. "wizardofoz". So instead the Wifi clients which have the SSID configured and saved, broadcast "hey where are you wizardofoz".

  In the unhidden case, the AP broadcasts the SSID, and configured as well as unconfigured Wifi clients see that the SSID "wizardofoz" exists. In this instance the Wifi clients which have the SSID configured do not broadcast looking for the SSID.

  Have I summarised the hidden/nohidden SSID cases correctly?

If so, in a scenario where a Wifi client (e.g. iPhone) is in a remote location from the known AP SSID ("wizardofoz") and we assume that the known SSID is hidden.

Is a rogue user more likely to create an AP with that SSID and try to get the handshake information compared to the unhidden case where the Wifi client would not broadcast the SSID it has saved.

Have I got that last bit right?

UPDATE: With respect to Lucas Kauffman's answer regarding my scenario above, by what criteria do you determine whether to hide the SSID?

Answer 1

• Not really but preferably you have at least one part in it which is random (unless for instance when you need roaming. Another reason is that WPA uses the SSID as salt for the hash. This means that rainbow table exists if you have a on often used SSID (i.e. linksys)
• Yes correctly. It's security through obscurity (but it can be useful). Attackers will generally send deauth packages on all channels in the hopes that a client is connected and will start broadcasting the SSID.

For your scenario it depends, to discover a hidden SSID you need to have at least one client connected to try and discover the SSID. So it depends, he might switch between attacks (depending on his goal).

Answer 2

When it comes to picking your SSID name, my recommendation is always that you pick an SSID that is neither very common nor one that is very unique.

You don't want one that is too common because as it has been pointed out, this can make you more vulnerable.

However many people either don't realize (or forget) the ramifications of the second part. There are a number of sites where you can go to look up a SSID and get a location for the network. A prime example is WiGLE.net. If you have a very unique SSID and your network is listed in such a database, this can provide a physical location of your network, which can have a number of negative side effects.

As for the hidden SSID, you have summarized the problem well. However, keep in mind that some devices will broadcast your SSID whether your network is hidden or not. Basically, for the convenience of end users, they don't provide a "connect if hidden" option and treat all stored profiles as hidden networks.

If you combine that with a too unique SSID as above, then this can have many ramifications. Some criminals are getting very tech savvy in how they operate and there are a number of ways this can be used against you.

As to when to use a hidden SSID, in my mind there are very few use cases. For instance, if an organization was broadcasting multiple SSIDs and wanted to reduce confusion about which network their users and/or guests should connect.