I recall having read several articles online, and even passing along the advice, stating that disabling SSID broadcast is not only useless as a security measure but also harmful to the security of the client devices. The logic goes like this:
SSID Broadcasting On
- Client devices passively listen for known networks.
- Clients initiate connection when a known network is heard.
- Attackers do not know what networks un-associated client devices are looking for.
SSID Broadcasting Off
- Client devices must actively probe for known networks.
- Client devices are advertising trusted SSIDs.
- Attackers can capture trusted SSID info and use it to trick clients into connecting to a Rogue AP when they are not near the actual trusted network.
This seems a generally sensible supposition. However, I don't think I've seen any claims that take into account what happens when an attacker tries to impersonate a network without knowing other attributes of the network's security configuration - particularly, the encryption protocol or keys. The connection should, in theory, fail with protocol mismatch or bad key negotiation.
Given the above, it would seem to me that disabling SSID broadcast (while still not at all a reliable security mechanism) still has a net-positive impact on security - or net-neutral, at worst. Is there something I'm missing?