Visible Wi-Fi Passwords in iOS/iPadOS 16

[bsmith93]

Does anyone know if there's a way to restrict the visibility of Wi-Fi passwords on a system level in iOS and iPadOS 16? I looked around but haven't seen anything about this yet. I know they aren't visible to the user if the credentials are provided via configuation profile.

My specific concern is that passwords may become visible to some users if the credentials had to be entered manually (by me) to rejoin the network on the fly. It's a pretty serious security concern, so I'm hoping there's a way to just turn this feature off completely on supervised devices.

[shaquir]

I didn't find any iOS16 config profile keys on Apple's Developer Page or their Github: https://github.com/apple/device-management/tree/release/mdm/profiles

But it seems like the best course of action would be to add the Wifi Config Profile to all your devices.

I tested on my personal device and can confirm once the Wifi Profile is added, it is no longer visible even though I previously added it manually.

Unfortunately I don't believe there'd be a "easy" way to only limit the profile to mobile devices already connected to wifi, but you could probably come up with a solution that fits your needs if this is needed.  But again it appears the password is no longer visible if the wifi profile is installed (but definitely test different scenarios).

[rsmith]

I'm curious how this works when the password must be entered to enroll an iPad.  Wifi has to be put in to enroll, and then profile gets sent after enrollment.  I could use a different network (and do at the start of school year), but then students would have the password to the enrollment network.  There has to be a better workaround.  

[ALA_Matt]

Yeah.  Hopefully something changes soon.

We've ended up using an "onboarding" wi-fi.  Mostly to have a more simple wi-fi password which makes adding devices faster .  Then we have a configuration profile for the wi-fi we want our users on.  We still need to remove the onboarding w-fi from devices so they don't see / connect to it.  Works, but still a lot of steps.

[rsmith]

That is how we have been doing things for a while.  I tried a few iPads out using the main wifi and because the profile attached the same wifi, it seems to have disabled the visibility of the wifi passwords.  This is great news.  

[wifichallenges]

FYI you can buy lightning to ethernet adaptors (amazon, $20). Thats how we get ipads to download all their profiles without needing to enter any credentials.