Student can Locate the password for Student SSID

[HTCS-Bobd]

Students with iPads can look at the wireless networks in settings and look at the SSID password for the connected network. This password should stay hidden and not available to students. I have not found a policy setting in SM that will prevent this ability. Is anyone aware of a way to block students from locating and seeing the SSID password?

[alemabrahao]

Unfortunately, as of now, there isn't a direct setting in SM to prevent students from viewing the SSID password on their iPads.

[alemabrahao]

If you want to prevent this type of situation you can use another more secure authentication method, such as 802.1x or even MAB.

https://documentation.meraki.com/MR/Encryption_and_Authentication/Meraki_Local_Authentication_-_MR_8...

https://documentation.meraki.com/MR/Encryption_and_Authentication/Enabling_MAC-based_access_control_...

[vassallon]

If you're pushing out a wireless profile from Meraki they shouldn't be able to see the password.

How are the student iPads getting connected to your network?

[rhbirkelund]

It's no different from any other OS. You can also get the PSK from any configured SSID on Windows as well. 

[vassallon]

Yes, you are correct that windows does share PSK but iOS and MacOS does not share PSKs that are pushed via profile to enrolled devices from MDM.

I know this as I submitted a bug report with Apple when this feature was originally introduced. I've also just tested this with a MacBook and iPad and neither device is showing the PSK password when you look in the Wi-Fi settings.

I also recommend disabling Share passwords over AirDrop as this will stop the sharing of wireless passwords between devices.

[BrandonD]

Hi @HTCS-Bobd,

As @alemabrahao noted there isn't a direct restriction/setting for the referenced use case, mainly because Apple changed the way that iOS displayed known PSKs previously with iOS 16. I believe in my previous testing, versions prior to iOS 16 you are unable to reveal the password (see below.)

• https://support.apple.com/en-us/104961

That being said, I did do some testing on my iOS 18 device and was successfully able to prevent viewing of a MDM deployed SSID PSK when enabling the following restriction:

• https://developer.apple.com/documentation/devicemanagement/restrictions
  
  • forceWiFiToAllowedNetworksOnly

Please note that this will prevent users from joining any SSIDs outside of those defined & deployed with MDM configuration, and we advise testing with one device prior to enabling 'globally'. This is to ensure the WiFi Payload is properly configured as if improperly deployed, it could prevent the device from connecting to the internet and processing future commands.

[vassallon]

There was an a bug when this feature was originally implemented which allowed pushed out wifi profiles to have the passwords shown.

I just double checked on iPads running 18.3.2. and 18.4.1 and the password field is not being displayed on my pushed out wireless profiles. 

What is your process for connecting iPads to wireless to start? The reason, I ask is if you are hand entering the password then that could be the reason why it is able to be shown.

[HTCS-Bobd]

I have tried to find a solution to automatically apply the Wireless authentication through Meraki with Sentry and a couple other processes from factory defaults and have not had any success autoconfiguring an iPad thought the first several screens before having to select the SSID and entering a password. After it authenticates it will auto install all configs and Apps. However even though the policy forces the SSID the password is still accessible. iPadOS 17.7.1 

[vassallon]

That explains why the password would still be present and visible. We have our iPads connect to an open WiFi that is restricted to just access Meraki and Apple networks to allow the iPad to set up and then switch to our normal student network. 

Do you have more than one SSID being broadcast? Can you try setting up the iPad another network and then seeing if it works correctly and no longer shows the PSK?

[BlakeRichardson]

In an education environment I would strongly suggest using 802.1x; are the devices school supplied or BYOD?