Prevent wpa_supplicant from joining hidden networks

Question

Is there any way to prevent wpa_supplicant from trying to join hidden networks? If SSID Foo is out of range, wpa_supplicant seems to broadcast "Is Foo available?"-queries. This is not particularly privacy-friendly, consdering lists of SSIDs can be uniquely identifiable.

Answer 1

I assume you want to be able to connect to the network later and so don't want to permanently remove it from your config. In that case, you can either disable your wifi adapter to prevent connecting to any wifi network, or you can set scan_ssid = 0 for the relevant network config in wpa_supplicant.conf.

If a network is hidden, it can only be found by the client broadcasting requests for that network. In fact, for this reason "hidden" networks in which the access point doesn't broadcast the SSID can actually be less secure than those that do.

From http://networking.nitecruzr.net/2005/05/disabling-ssid.html :

You can disable the broadcast of the SSID in the beacon. This will make your AP invisible, as long as there are no stations associating with it. As soon as any stations (wireless computers) associate with the AP, the SSID will be out there for everybody to see.

Associating with an AP, with SSID beacon disabled, can be done, as long as the SSID is known to the station wishing to associate. But the process is complex, and generates a lot of excess traffic. This traffic exposes your SSID even more than if you had been broadcasting the SSID in the first place.