How to disable wifi password sharing on iPhones

jedhelmers wrote:

Keep your parenting advice to yourself. And yes, I know what a MAC address is. I'm looking for an Off-switch.

I'm sorry but you don't get to decide how I answer questions here. While we're at it, the fact that you refer to your children as "little pieces of crap" may explain why they don't listen to you.

The beauty of typing the password into someone else's phone is that there was a middle level of trust between people to whom you'd give the password and people you wouldn't let on your network. It seems that Apple blew that to bits, unless there is a workaround.

Does the now deprecated Apple AirPort Extreme have the ability to create a second network?

Do you mean the WiFi password sharing feature that allows you to share a password to someone else? Or do you mean the wifi password sharing that occurs among all of the devices that are logged into the same Apple ID.

I would love to be able to disable this feature as well. We're a school district where we don't have a BYOD network for students and we don't allow students to authenticate with their Active Directory username and password on the main wireless network - students have to have a district provided device in order to be on the main wireless network. Students cannot be on our guest network as the guest network is not CIPA compliant. Because of this iOS feature, students have figured out that they basically "transfer" the wireless authentication settings from a district iPad to their iPhones, so now students are paying less attention in class because they can use their phones on the wireless network instead of having to use their data plan (and a lot of our schools get horrible cell service inside the buildings) and we've seen a dramatic increase in the number of wireless devices on our network. Our iPads use a generic Active Directory username and password (802.1x) so this iOS "feature" is not limited to pre-shared keys. We would love to be able to disable this wifi password sharing feature on our district devices, or if Apple could modify this feature so that the owner of the original device could set up a password that had to be inputted on the second device in order for the wifi password to be shared (might defeat the purpose of the feature somewhat but something needs to be done for businesses and school districts that use Apple devices and don't want situations like ours to happen).

segalsegal wrote:

What about the following situation: you type the password into a guest's phone. The guest then shares the credentials with other people.

Is there some protection against this scenario?

Don't give the password to people you don't trust. Also, consider setting up a guest network. Most routers will allow you to do this.

Hi Rob,

Also work at a school district and we are looking at reconfiguring our wireless networks. However, you're saying that the password sharing still works even if there's 802.1X authentication? That does not seem safe at all.

I am trying to restrict my children's wifi access where each one has their own account and the house has its own (tv, my laptop, etc.). The little pieces of crap have been passing access back and forth between each other circumventing my parental authority. Sharing any credentials whatsoever is a terrible OPSEC nightmare. Fix this.

Well, it sounds like it's time to take away the devices until your children start respecting your authority.

You can also look into setting up MAC filtering on your router. A MAC ID is a unique hardware ID for each device. Consult the documentation for your router or contact your internet service provider. Some routers or internet services also offer other types of parental controls.

What about the following situation: you type the password into a guest's phone. The guest then shares the credentials with other people.

Is there some protection against this scenario?

No need to disable the feature. Just don't use it.

As Philly said, you can't disable it. You just don't use it. If you don't actively use it, it shouldn't be the cause of the problem.

Is it possible to implement MAC filtering on the network?

Keep your parenting advice to yourself. And yes, I know what a MAC address is. I'm looking for an Off-switch.

There isn't one. Deal with it.