2

I have an old wifi router which SSID is ASDF and password is 1234567890, I bought a new one when the old one broken and set the SSID and password to the old one's.

Then I found that my Android phone connects to the new one automatically without asking me password.

Is this some kind of Wi-Fi specification? does it a security issue?

For example, if A has a router with SSID AAA then B can setup a router with SSID AAA and make A's router power off. so A's phone will connect to B's router with password. Then B can sniff traffic in his router to get A's password.

When a device connect to a wifi router, what else does it look beside SSID? for example MAC address? so even if a new device with same SSID comes up, it still makes the new device a different one?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Feb 19 '18 at 18:12
2

I'm not sure I understand your confusion. Your phone has the correct SSID and password to your new router. Why would you expect it not to associate?

Assuming you're using WPA2, the password itself is encrypted, so you can't just sniff it.

There are methods beyond simple SSID and passwords to identfy devices. You can read about PEAP and EAP-TTLS to verify the identity of the client and the access point.

You can also ask more detailed questions about WiFi security on the information security SE.

| improve this answer | |
2

Then I found that my Android phone connects to the new one automatically without asking me password.

Is this some kind of Wi-Fi specification?

First, a PSK is not a password. This is a common misconception.

A PSK does not provide any sort of authentication. Rather, it is a known value by the station and AP to generate and securely (at least from outside sources without the known value) exchange keying material for use in encrypting further traffic.

To be clear, WPA/WPA2-Personal does not authenticate, it only encrypts traffic.

As such, the behavior you describe is normal 802.11 operation. Your Android device was able to connect to the SSID it was configured for and then with the same PSK, it was able to successfully negotiate encryption with your new access point.

When a device connect to a wifi router, what else does it look beside SSID? for example MAC address? so even if a new device with same SSID comes up, it still makes the new device a different one?

Most client devices only look at the SSID. Some can be configured to look instead (or additionally) to the BSSID, which is a 48-bit MAC address.

Limiting the scope of a client's ability to connect to a specific BSSID will either prevent roaming (between APs in a multi-AP deployment or between radios in a dual band deployment with shared SSIDs) or require multiple configuration settings to add each BSSID in the environment to the client device.

does it a security issue?

No, this is normal operation. You just need to understand the limitations of the technology in use. WPA/WPA2-Personal provides encryption to your wireless communications. That is it.

It is not meant to provide any sort of benefit that authentication normally provides nor to validate the network to which you are connecting. Additionally, any device with the PSK that also captures the WPA/WPA2 encryption handshake (i.e. when the client device connects to the wireless network) will also be able to decrypt all the data.

Does this make it insecure. No, rather it is just providing the level of security for which it is designed.

If you want a more secure option, then WPA/WPA2-Enterprise is the way to go. Depending on the deployment choices, it can provide unique encryption material for each connection, validate the user and/or device connecting to the network and validate that the network to which you are connecting. This does come as a trade off as it is more complex on both sides of the connection and can require user education to maintain security. This is a normal security vs. ease of use trade off.

Generally speaking, WPA/WPA2-Personal is sufficient for most small deployments.

Note: some portions of this answer have been copied from my own answers to similar questions elsewhere on the SE network. As they are my own answers, I am not citing them.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.