[ehamberg]

An iOS device will only connect to known networks. By enabling “Ask to Join Networks” it will list networks and ask if you want to join any of them – but only if no known network is in range. This is actually less safe, in that you're just a button press away from “accessing random open networks” instead of having to go into the settings and choose a network – so it makes sense to have it default to off.

tl;rl: iOS will only join known networks – toggling this setting will make it easier to join networks when no known networks are in range.

edit: Link to the relevant section in the manual: https://help.apple.com/iphone/8/#/iph1b489c85f

[BenTheElder]

I just checked and on my android phone and you're right, I switched the 'notify me when wifi is available' setting off so that I have to select networks manually. I read the previous comment as meaning that iOS would join open networks if that option wasn't enabled. Du'oh.

However according to this post by the same researchers: https://www.skycure.com/blog/wifigate-how-mobile-carriers-ex... There is no way to disable the carrier pre-configured wifi hotspots which have been proven to be easily spoofable.

[tomswartz07]

Here's the problem:

If a device will "only connect to known networks", that means that it sends out an ARP request. In a nutshell, the phone shouts wirelessly «HEY! IS BILL WI THE SCIENCE FI AROUND?»

You can very easily set up a system that will respond to every single ARP request and then 'broadcast' that SSID. If you broadcast the SSID, with no password, and the device sees it, then it will connect to this 'known' network.

That's a big problem

[rlpb]

> If a device will "only connect to known networks", that means that it sends out an ARP request.

You seem to have confused IP address resolution with wi-fi access point discovery. ARP requests don't happen until after a device is associated with a wi-fi access point.

It is possible to arrange for a device to scan for wi-fi networks passively, so the device will not be detected until it actually discovers and attempts to connect to a particular network.