35 ms·
Tell HN: iOS lets carriers add WiFi networks that you can’t stop from joining
Well this was a major surprise so I figured I’d share it here to get some eyeballs on it.
Essentially, the latest iOS (16.4 at post time) allows your cellular carrier (via eSIM) to add “managed networks” to your device.
These networks cannot be removed, they cannot have “automatically join” disabled, and they have equal priority with your real, personal networks.
So guess what happens when your neighbors get a wifi/modem combo that blasts a free hotspot SSID? Not only does it pollute the already crowded 2.4ghz band, your iPhone will often prefer this connection over your real /local wifi (despite said wifi being at 1 bar).
As of post-time, there is no way to remove these networks short of completely disabling cell service/removing the eSIM and resetting all network settings.
You can see this for yourself by going to WiFi/“edit” and scrolling down.
Edit: to clarify, I can disable “auto join”, but in 4-5 minutes all of my devices have auto-join turned back on. I’m guessing it re-syncs with the carrier profile. Also, this does not seem to be eSIM or SIM related it can happen on both.
- wpm 4y agoT-Mobile's you absolutely can disable, but I would have never ever thought to look there until I read this. I switched off Auto-join on both "t-mobile" and "TMobileWingman", but I couldn't hit the "Done" text-but-its-really-a-button in the upper right until I made some change to the normal known networks list, so I deleted a couple that I didn't remember or recognize. YMMV. It's gross either way. No way, no way in hell this is something that should be shadow dropped onto my phone.
- newZWhoDis 4y agoWait 5 minutes and check it again. “Auto join” will be turned on again
- kccqzy 4y agoI have T-mobile but I haven't a clue what you are talking about. There are Wi-Fi networks called "t-mobile" and "TMobileWingman"? I just don't see them at all. Under what condition should I see them?
- newZWhoDis 4y agoSettings/Wifi/edit/scroll down to “managed networks” These are networks added by your carrier you can’t remove. They have equal priority to your real networks. In my case, 2 neighbors have freebie wifi/modem combos blasting out 1-bar hotspots that match my carriers free hotspot SSIDs, so all my family’s personal devices constantly switch between my real home network and these “hot spots” with no way to stop it short of removing everyone’s SIMs
- diebeforei485 4y agoI am able to disable "Auto-join" on those, but I don't have these WiFi hotspots near me so I can't test if that Auto-join toggle actually works.
- newZWhoDis 4y agoWait 4-5 minutes and open the menu again. In my case I disable auto join on all and they’re all back on in 4-5 minutes. I was also able to verify this as the device will still really connect to the “disabled” hot spots, even after switching it off. Just took a while for the profile to resync. Edit: only 5 of 9 re-enable auto join after I disable it.
- diebeforei485 4y agoIt's been more than five minutes, I opened the menu again and it's still disabled. I'm on an iPhone 12 Pro Max on iOS 16.4, which is the latest iOS. > even after switching it off This might be your issue, because after a restart your iPhone no longer has access to your saved Wi-Fi credentials, but it can still use EAP-SIM to join T-Mobile's Wi-Fi network first. But I see your point that it does not respect the "Auto-join" toggle.
- newZWhoDis 4y agoSorry, to clarify my device will reconnect to a carrier-managed hotspot that has had auto-join manually disabled without a reboot within 4-5 minutes.
- s3p 4y agoThis is insane. I have never heard of these and after checking I also have them on my iDevice. Tmobile should explain what wingman is and why it's on IOS devices.
- ajmurmann 4y agoI don't understand why Apple allows carriers to do this. Apple id a well-respected brand by most of their customers while carriers are seen as an evil you cannot do without.
- jrockway 4y agoI suppose "brand perception" loses to "we bought all the RF spectrum". If T-mobile, AT&T, and Verizon say "no iPhone", guess who is out of business? Not the spectrum owners.
- nulbyte 4y ago> If T-mobile, AT&T, and Verizon say "no iPhone", guess who is out of business? If Apple said, "no, you can't force users onto Wi-Fi networks without their consent," T-Mobile, AT&T, and Verizon would just say, "ok, it was worth a try," and carry on as if nothing happened. People will still want Apple products in sufficient numbers, and carriers will still want money from those people. But Apple isn't interested in what people want, Apple is interested in what they can convince people they want.
- tekknik 4y agoI mean I’m certainly not switching back to a dumb phone or android. And since iOS maintains 56% market share in the US Apple can easily force some hands.
- isleyaardvark 4y agoApple already fought and won that battle when they introduced the iPhone, when they had much less negotiating power than today.
- 4y ago
- ummonk 4y agoThanks I just did this as well. I often defend Apple's decisions but this is downright ridiculous.
- newZWhoDis 4y agoMake sure you check up on it later, in my case the carrier turns auto-join back on a few minutes later.
- ummonk 4y agoThanks. Doesn't seem to have happened yet but I have no confidence it'll remain that way.
- codazoda 4y agoWingman does not stay turned off for me, as op mentioned in his edit.
- nvrspyx 4y agoIt doesn't stay off for me either, but after some digging on the internet, Wingman appears to be an in-flight wifi network on planes (which may not actually exist anymore and T-Mobile are in the process of removing from devices according to this recent comment by a stranger on an old Reddit thread[1]). While it's annoying that it doesn't stay off, it doesn't seem to be something that would cause problems in practice because flights typically only have one wifi network. 1: https://reddit.com/r/tmobile/comments/7u535i/_/jcl01il/?context=1 https://reddit.com/r/tmobile/comments/7u535i/_/jcl01il/?cont...
- KerrickStaley 4y agoYou can hit Cancel and it will still retain the auto-join setting (very counterintuitive).
- bobbylarrybobby 4y agoVery bizarre: I unchecked the auto join settings and, as you said, the done button wasn't enabled. So I pressed cancel, and the changes persisted.
- Wowfunhappy 4y agoIs this based entirely on the SSID? In other words, could I force other people's phones to connect to my router by just changing the name of my Wifi network? That seems like an obvious security vulnerability.
- i_am_jl 4y agoThis is funny, because the very first iPhone did exactly this in the US for the SSID "AttWifi". Crazy that they brought it back 15 years later.
- andy_ppp 4y agoThe SSID is the key. There is no other security as far as I understand it - you can test this by changing routers and naming the SSID and password the same. Devices will join this new network no questions asked.
- astrange 4y agoThat depends on the carrier. There is such a thing as SIM authenticated WiFi networks and they can use it.
- Wowfunhappy 4y ago> There is no other security as far as I understand it - you can test this by changing routers and naming the SSID and password the same. Devices will join this new network no questions asked. AIUI this is a feature, not a bug. It allows devices to switch between different access points automatically. For example, a large school will need to use many different access points in order to cover the entire building. Students will not want to manually switch between all of these access points, so the school gives each one an identical SSID and password. Devices will then switch automatically as needed.
- Riverheart 4y agoI read this as cellular providers offloading traffic from their networks by making it so phones will piggyback on Wi-Fi networks. Maybe a symptom of increasing demand for more data but unwillingness to eat the cost or too many users. With Wi-Fi calling they’ve got that covered.
- officialjunk 4y agocan you elaborate on the workaround to remove the settings? after removing an eS and resetting all network settings, once the eSIM is active again, wouldn't the unwanted network settings be added back again?
- newZWhoDis 4y agoThere is no real workaround, it all comes back as soon as you add cellular service again. You can only temporarily fix it by disabling the “Phone” part of iPhone
- nmjohn 4y agoAs another data point: I'm on ios 16.4. I see I have "AT&T Wi-Fi Passpoint" and "attwifi" added to "Managed Networks" - but I am able to disable auto-join for them. I wonder if that can be controlled by the carrier? Does anyone know if there is a specific term for networks added like this to look for more documentation?
- newZWhoDis 4y agoWait 5 minutes and check again, auto join will be on again
- Jtsummers 4y agoMine have remained off for 30 minutes now. I'll try to check again tomorrow but if there's a reset time, it's more than 5 minutes.
- newZWhoDis 4y agoSo the good (?) news is this seems to be carrier dependent. In my case 5 of 9 carrier-managed networks will revert to auto join while with some carriers zero will.
- gloyoyo 4y agoSomething about "carrier to have access to "append"(the word managed was subverted here) the list or something like that in the documentation/news article stuff... I guess they just stuck the word "manage(d)" on the end users to physically read, but were prevented from using it in documentation...crazy
- hnav 4y agothe carrier does already control your phone’s selection of DNS server and on iOS you can’t set DNS when connected to cellular without using apple’s VPN API through an app
- hgsgm 4y agoIt's at least 2 years old. https://www.google.com/search?q=ios+carrier+wifi+applewifi+apple https://www.google.com/search?q=ios+carrier+wifi+applewifi+a...
- worik 4y agoNews to me
- deleted 4y ago[deleted]
- Riverheart 4y agoThis is insane. Thanks for taking the time to share. Good reminder we don’t control our devices.
- gloyoyo 4y agoINSANE
- trafficante 4y agoI noticed this a couple days back at Home Depot, of all places. Was looking up the locations of stuff I needed to pick up via their website while sitting out in the parking lot and my iPhone kept switching off 5g to hop on some single bar wifi that I couldn’t delete or deselect auto-join. Eventually just turned off wifi and the problem was “solved” but man this is going to be annoying if it starts happening at the grocery store or something.
- newZWhoDis 4y agoI noticed this because a condo has neighbors nearby with routers blasting said hotspot, so now you’re not even safe in your own home.
- zrobotics 4y agoA condo-sized Faraday cage would solve that problem...
- toomuchtodo 4y agoThey have faraday paint if you’re so inclined.
- newZWhoDis 4y agoYC24 here I come
- trafficante 4y agoOh god no. I live in one of those “techbaby’s first econobox” neighborhoods where you can shake hands with your neighbors if both of you lean out the window a smidge. I have never had so much trouble with network radio interference as I do here, so I can only imagine the fresh hell when one of my neighbors lights up one of these things. There’s already a “stop hitting yourself” scenario going on with a guy blasting multiple competing 160mhz width APs for some reason. Thank god for Wifi 6E
- 310260 4y agoThis has been around for a while now and is not some new eSIM thing. It's existed with physical SIMs too. It's Passpoint access authorized via your SIM. Your device won't just randomly connect to anything with the same SSID. It has to auth via the SIM and it's on secure networks that your carrier has agreements with. Same as the access you get over the LTE or 5G network.
- newZWhoDis 4y agoThis is wrong, the networks show up as “my networks” and a iPhone 14 Pro Max on 16.4 will 100% connect to that with the same priority as a real/my personal wifi network. >and it’s on secure networks No it’s not, my home networks are behind strong firewalls and things like pie hole. Do you not see the problem with all of my families devices “preferring” a neighbors network over mine?
- 310260 4y ago>Do you not see the problem with all of my families devices “preferring” a neighbors network over mine? I have T-Mobile. T-Mobile maintains agreements for Passpoint networks at random places like airports, T-Mobile stores, or (I recently found out) Home Depot. These networks are encrypted and authorized against a RADIUS server. My SIM has them programmed into it. I can't just stand up the "t-mobile" or "Passpoint Secure" SSID from my home network and my phone automatically connects to it. That's not how it works. Based on the fact that your devices are showing preference, I'm gonna take a wild guess and say you have Xfinity/Spectrum/Optimum Mobile. The cable co. MVNOs maintain their own WiFi networks which are (again) connected to via Passpoint and authorized using RADIUS. However, the cable company WiFi networks extend far into neighborhoods and are broadcast from CPEs. Your devices prefer them because that's part of the network you signed up for. Just VPN back to your home network if you're not confident in their security.
- newZWhoDis 4y ago> Just VPN back to your home network if you're not confident in their security. I’m sorry but wtf? You’re saying that, in my own home, I should just accept that my devices connect to an external wifi against my will and VPN back into my own home… while in my home? Seriously?
- porcoda 4y ago> they cannot have “automatically join” disabled They can on my AT&T iOS 16.4 device. I was able to disable auto-join on the two AT&T ones. I didn't need to delete a network to enable the "done" button from the edit screen - the state I toggled for auto-joining the managed networks persisted even if I hit cancel on the edit screen. I don't like that they're there and auto-join is on by default, but it does appear that can be turned off.
- newZWhoDis 4y agoCheck again in 4-5 minutes, it will be on again. I can disable it too, but it just switches back.
- pueblito 4y agoJust confirmed with Verizon
- porcoda 4y agoIt’s been 30 minutes and they’re still off for me. I’ll check again later.
- newZWhoDis 4y agoAre all of them off? Sorry to ask, because I have 9 “managed networks” and it seems like now that some turn back on immediately and some stay off. Of course the ones physically nearby all switch back on…
- porcoda 4y agoYes. I have just 2 of these managed networks : AT&T Wi-Fi Passpoint and attwifi. It could be that they’ll switch auto join back on if I move somewhere that they’re visible. Edit: just out of curiosity I rebooted to see if that would toggle auto-join back on, but it did not.
- noncoml 4y agoHappened to me in LAX international terminal. I’m with Verizon. So annoying. I was trying to figure out how I get connected to the crappy WiFi for an hour. Removed all the profiles and what not. Very disappointed by Apple on this one.
- zakki 4y agoI think finally we will applause people who actively find a method to jail break iOS devices.
- worik 4y agoJust don't Use a different sort of device
- rootusrootus 4y agoYou mean not a mobile phone? Because it's not just iPhones with this feature.
- remram 4y agoWhich other phones show this problem?
- rootusrootus 4y agoSorry for the late reply, I missed your question. Even several years ago, and hell, even called managed networks, people experienced this exact phenomenon on some Android phones. For example, https://forums.androidcentral.com/threads/tmobilewingman.862192/ https://forums.androidcentral.com/threads/tmobilewingman.862...
- akomtu 4y agoWhen company A installs spyware on billions of smartphones, and conspires with B and C who provide a network of fake wifi endpoints to steal user data, that's organized crime and FBI gets very interested, but when A is Apple and the B and C are ATT and Verizon, the organized crime becomes above the law and FBI looks the other way.
- jqvincent16 4y agoI was able to disable auto-join and after 10 minutes it's not re-enabled. As a precaution I also set manually IP/Gateway/DNS to 127.0.0.1 for the "AT&T Wifi Passport" and "attwifi" networks and those settings also seem to persist. I'll check it again in 24 hours or so.
- newZWhoDis 4y agoThanks for checking, in my case ~5 of the 9 (!) managed networks switch back on within 4-5 minutes. The rest seem to stay off.
- m463 4y agoI noticed this type of thing a LONG time ago (years) when my browser session was hijacked by some starbucks terms of service popup. my phone had auto joined an at&t wireless hotspot at a nearby starbucks. I could disable auto-join at that time and it didn't happen again. Also as a general precaution I turned off wifi except at home. However, if it cannot be disabled, I find it troubling.
- newZWhoDis 4y agoIn my particular case it’s happening in my condo and all of my families devices routinely switch between my real network and the 1-bar hotspots several floors away. It’s impossible for me to disable and breaks all local connections to things like PLEX, as well as kid safety/adult content filtering.
- m463 4y agoKilling local network access is an actual bug. related - I wonder if this is specific to esim or if this would happen with a regular sim too? and can you just call your carrier? I had a comcast business router and it started broadcasting an open comcast wifi access point (for comcast customers). I called and asked them to turn it off and they did.
- BanjoBass 4y agoI just checked my phone, There were 3 verizon networks in there I don't recognize. I'm using a regular SIM.
- newZWhoDis 4y agoThe carrier told me to contact apple. And in my case, I can’t exactly harass all my neighbors to disable their “free hotspot”. I should be able to control my own phone and dictate what it does/does not connect to.
- m463 4y ago> I should be able to control my own phone That battle was lost a long time ago. I should be able to restrict (or know) what the apps do. I should be able to firewall my phone. I should be able to access the files on it. But in the end, only apple decides this, and their decisions are self-serving.
- causality0 4y agoThis is beyond baffling. Does nobody in the approval chain for this even use a home network? This would immediately break half a dozen things for me. Local game streaming. Network share access. Local wireless backups. Local Plex access. Screen mirroring to my television.
- syntaxing 4y agoWow. Why is this a thing?! I didn't even know where to look for this if it wasn't for the comments here for T-mobile
- kstrauser 4y agoIf this bothers you (and it bothers me!), you can write a personal automation Shortcut like: “When my iPhone joins the Wi-Fi network named … turn off wifi”. It won’t stop you joining in the first place, but can at least keep your phone from spending time on the unwelcome network.
- CameronNemo 4y agoThis doesn't help if the hotspot is in your normal home range.
- kstrauser 4y agoYou could make the shortcut arbitrarily sophisticated. Oh, and if it wasn’t clear, I don’t mean this as approving the design flaw. It’s not “look how easy it is to work around!”, but “well, here’s something you can do while we’re stuck with this terrible idea”.
- myself248 4y agoAwful workaround: Any of the various ESP8266 deauthers, set to target only your specific MAC address. Or, if the phone insists on randomizing MACs, just have it listen for packets above a certain RSSI and keep it very near your phone, and deauth the loud one.
- tdonovic 4y agoThis is a very US centric way of looking at this. Currently sitting in a packed subway carriage in Busan, South Korea. There are carrier WIFI APs installed in every carriage. Their network is literally built to offload people onto wifi where possible, I presume to reduce congestion on not much or very directional spectrum in the tunnels. In this case, it makes perfect sense to push people onto their wifi. Not connecting to your own networks preferentially is a pita though. Seems like a really neat solution imo
- 01100011 4y agoSort of. I can understand offloading to WiFi. I cannot understand preferring carrier WiFi hotspots over my own.
- newZWhoDis 4y agoFair criticism. But can you defend blocking the user from manually disabling these networks? I’d understand if I got a pop up saying “add these networks for the best experience”, I accepted them, etc. I would have (upon detecting this problem) just removed them and gone about my day. The problem here is that you are forced to use them with no opt-in and no way to disable it.
- stevehawk 4y agoI think most Americans on here are concerned that if they're at home, and their neighbor has a carrier sponsored wifi hotspot, then their phone may prefer the neighbors hotspot to their own home network. Things like this could disrupt talking to local devices (airplay, homeassistant, etc).
- altairprime 4y agoI wish they’d install this in elevators here, too.
- lxgr 4y agoMy office building‘s elevators have 5G signal, which makes much more sense as it avoids a hard handover between SSIDs/networks (or Wi-Fi and mobile data), which in turn has a much higher chance of not dropping calls.
- cstejerean 4y agoI think that might be specific to your carrier, forcing these network to be automatically joined despite your preference. I'm not seeing the same behavior with Verizon, where I get the managed networks but auto-join happily stays off. I'm guessing MVNOs like Comcast would rather force you on their wifi if they can because this way they avoid having to pay the underlying MNO for traffic. Which might explain why they would force enable auto-join. I'd vote with my dollars and pick a different carrier that doesn't have such user hostile wifi policies.
- newZWhoDis 4y agoI’d understand if this was a flip phone, but why should iOS lock the user out of wifi control?
- MrStonedOne 4y ago[dead]
- LeonB 4y agoThis goes to show that the real way to succeed in life isn’t to go about wearing a tin foil hat, but rather to enclose your neighbours house in one.
- stacktrust 4y agoApple Configurator (self-hosted local MDM, free macOS app in store) has an option for "supervised" iOS devices so that Wi-Fi connections are limited to SSIDs which are pre-defined in the MDM profile. It's intended for enterprise usage. Worth testing to see how MDM policy interacts with carrier-managed Passpoint networks. Note: you can't supervise an existing device without wiping it, so this is an experiment to conduct with a spare phone, or one already managed by Configurator/MDM. Apple Configurator training: https://it-training.apple.com/tutorials/deployment/dm095 https://it-training.apple.com/tutorials/deployment/dm095 Wi-Fi payload: https://developer.apple.com/documentation/devicemanagement/wifi https://developer.apple.com/documentation/devicemanagement/w... Another option is using Apple's MDM for small business to define a list of approved SSIDs, https://www.apple.com/business/essentials/ https://www.apple.com/business/essentials/ Edit: is there an option to "Remove Profile" in Settings? General -> VPN & Device Management -> Configuration Profiles Edit2: workaround by null routing the carrier's Wi-Fi SSID? https://www.reddit.com/r/tmobile/comments/vvt6dd/comment/iyrq3v4/ https://www.reddit.com/r/tmobile/comments/vvt6dd/comment/iyr... Change IP address to manual and 127.0.0.1 Change subnet mask to 255.255.255.0 Change DNS to manual and 251.252.253.254
- cxie 4y agoThe "Remove Profile" option in Settings might be helpful if it's available, but it seems like it could be carrier-dependent, and not all users may have this option. The null routing workaround seems interesting and could potentially help in avoiding unwanted connections to the carrier's Wi-Fi SSID. However, this method might require some technical knowledge and might not be ideal for less tech-savvy users.
- newZWhoDis 4y agoI do not have any profiles installed, and none of my devices are managed. I’m aware this could potentially be fixed by enrolling all my family’s devices in an MDM. But I mean come on, wipe everyone’s phone to enroll in MDM? Seems pretty crazy when the phone should just let you control what it does/does not join. Edit: I misread your post, I see now it was more suggesting a test. My bad.
- 4y ago
- rootusrootus 4y agoI was all prepared to be very irritated. Especially if I could not disable them. But disabling does work for me. And according to the documentation[0] these networks wouldn't get selected in preference to my home network anyway. My blood pressure is dropping a bit. Assuming these are actually authenticated networks as described, then I don't know if this is any worse than allowing the phone to use the cellular signal. Same provider. If your phone is hopping onto one of these while at home, I guess check your home wifi signal strength because it's probably dropping out? [0] https://support.apple.com/en-us/HT202831 https://support.apple.com/en-us/HT202831
- newZWhoDis 4y agoOn my device these hotspots show up under “My Networks” Disabling (switching auto-join to off) also does not work, most of them switch back on a few minutes later. This seems to be carrier-dependent from the comments thus far. I disagree based on my reading of the documentation, these are treated as identical to your other networks. The only benefit is my home network is usually louder, but that’s the rub it doesn’t always work and devices routinely switch. In my case I noticed this in a condo, so the physical distances are less
- cxie 4y agoI can understand the frustration this issue might cause, especially if your device keeps switching to these managed networks despite having a stable home Wi-Fi connection. It seems like there might be a difference in behavior based on the carrier, which complicates the situation further.
- newZWhoDis 4y agoI strongly believe these carrier networks should only be added to “my networks” as a permission-gated prompt, and also be deletable. Would solve this whole thing I think
- 650REDHAIR 4y agoIf I make a new SSID with the name of an xfinity/att/Verizon hotspot would that means every up to date iPhone user would automatically connect to it?
- daferna 4y agoIt's "Passpoint" and uses certificate based 802.11x auth, there's really nothing to worry about except calls dropping due to Wifi switchover. Whitepaper from Aruba here: Solving the Indoor Wireless Coverage Problem: Passpoint and Wi-Fi Calling https://www.arubanetworks.com/assets/wp/WP_Passpoint_Wi-Fi.pdf https://www.arubanetworks.com/assets/wp/WP_Passpoint_Wi-Fi.p...
- stefan_ 4y agoThat's nice but when carriers abuse shitty home routers for these WiFi APs the networks are absolutely not to be trusted.
- newZWhoDis 4y ago> there's really nothing to worry about except calls dropping due to Wifi switchover When this happens: (my = family) 1) my devices are no longer behind my firewall or pihole 2) my devices can no longer access PLEX 3) my devices can no longer access my security system, cameras, etc 4) airdrop will fail My network is my network, when I’m at home I want my devices to be on my network, not randomly dropping out and connecting to random hotspots multiple floors/houses away
- schroeding 4y ago> What analytics can a network extracxt [sic] from Passpoint traffic? > Generally speaking, the local network will have visibility of the same client traffic it would see on any guest network, but it will not have visibility of the subscriber identity or any persistent identifiers other than the associated device’s MAC address > From an analytics perspective, the major benefits of Passpoint are that it creates a much larger and more complete picture of visitor activity. Since a much higher percentage of visitors will be automatically associated with the network and their behavior and traffic will be visible to the local network, the value of any location, business, and security analytics in use will be improved. ... so the temporary host can theoretically MITM the connection and that's a feature? They don't just VPN everything from the phone to the ISP? :/ Sure, most traffic should be encrypted, but your neighbour could still see (and block) e.g. traditional DNS requests. Are DoH or DoTLS enabled by default yet under iOS? Not great, IMO. :/
- 4y ago
- rafaelturk 4y agoI'm sure NSA will love this feature
- 1101010010 4y agoIt's amazing how many people already forgot/ignore Snowden revelations. iOS and the rest of the complicit Apple walled garden is literal spyware for the masses. But with enough of a marketing budget, it's easy to convince people of anything, even when it is against their interests.
- philsnow 4y ago... iOS is the spyware for the masses? I have a background in security and I prefer iOS devices over android devices because the latter is an absolute wild west in comparison. The most relevant bit I recall from the Snowden revelations is that NSA was treating big-4 tech companies as adversaries and splicing into their fiber networks. How would android be any better at protecting against that than apple/ios?
- 1101010010 4y agoLet's see, a literal fourteen year old found a bug in iOS that let him remotely listen to the microphone on any iPhone with only a phone number. Now imagine what a three letter agency is capable of, or is responsible for.
- smoldesu 4y ago> How would android be any better at protecting against that than apple/ios? The AOSP is much easier to hold accountable than the iOS codebase. Apple has a convincing security model if you take their whitepapers at face value, but between the PRISM revelations and Apple's own Transparency page[0] it's hard to claim that they won't let anyone access your data. [0] https://www.apple.com/legal/transparency/ https://www.apple.com/legal/transparency/
- quesera 4y ago
- spike021 4y agoWith iOS the new UX seems a little bad. I have AT&T. If I go to the Wifi settings and tap "Edit", and then go to the AT&T Passpoint managed network, tap the "i" button, and disable auto-join, then back out of the detail view, the save button is still disabled. However, if I just tap the back button out of the managed view, it still saves. So, anyway, at least for AT&T you can definitely disable the auto-join at least.
- RileyJames 4y agoDo you want to re-check if that setting has been retained? It sounds like there may be a re-sync but with the carrier.
- spike021 4y agoIt's been about a half hour and so far so good.
- flenserboy 4y agoInteresting. On an AT&T system, with 2 Passpoints listed. I can turn one off and it stays off; the other neither offers the option to save after the change nor retains the change.
- jxramos 4y agoI'm seeing this behavior on 16.3 as well.
- xbar 4y agoIt gets more sickening every day. I own every Apple device there is. But there has never been a company more anti-Steve-Jobs-vision than Apple. The seamless experience has turned into a my fight against Apple's hatred of their customer.
- 1101010010 4y agoThey're instruments of social control and behavioral management. People will get upset and this comment will probably even get removed (censored), but this is the truth with closed source software from for-profit corporations.
- ksec 4y agoSteve used to care about things like this. And even if he didn’t once it has his attention you know something will be done or at least looked into with a reasonable eye. Now it is nothing.
- lyu07282 4y ago> I own every Apple device there is. I'm not sure anyone really ever "owned" an apple device, at least since the first iPhone or so, it seems to me we kind of redefined what ownership means. Apple owns every device they make, you are allowed to pay for limited and revokable usage rights. You have very limited knowledge or control over most of its proprietary hardware and software. Apple, the phone carrier, the apps you install, all have more, varying control over your device. The kind of freedom Stallman talked about for example has been lost for a very long time.
- Aeolun 4y agoMaybe? I certainly still have more control than on windows.
- d0c_z3r0d4y 4y agoLast I checked, you were still able to install apps on Windows from sources other than the Windows store.
- jsjohnst 4y agoI’ve tested this on iPhone 14 Pro Max, 13 Pro Max, and 12 Pro Max. Using iOS 16.4 and 16.5 beta, I’m unable to replicate this. AT&T 54.0.1 Managed Networks: AT&T Wi-Fi Passpoint, attwifi Verizon 54.0.1 Managed Networks: PrivateMobileWifi, VerizonWifi, VerizonWifiAccess T-Mobile 54.1.0 Managed Networks: t-mobile ——— I’ve tested the following scenarios - confirm auto-join disabled, wait 10min, recheck and still disabled. — confirm auto-join disabled, reboot, recheck and still disabled. - confirm auto-join disabled, enable airplane mode, recheck and still disabled. - confirm auto-join disabled, disable wifi, re-enable wifi, recheck and confirm still not auto-join enabled. - confirm auto-join disabled, switch cellular data to alternate esim, switch back, confirm still not auto-join enabled. At this point I feel there must be something different about your setup that’s non-standard in some way. It’s slimey as hell that they get added automatically, but still very much possible to disable at least it seems. Edit: “Wingman” and related variations never appear on either of my T-mobile devices.
- newZWhoDis 4y agoWow, thank you for your detailed post. I have multiple iPhone 14 Pro Max, all 16.4 All on Xfinity Mobile 54.0.1 Yes, I know Comcast sucks but they are the only provider in my area for gigabit and they whitelabel Verizon mmWave 5G for a serious discount if you bundle with their internet (which I’m basically forced to use) In my case, I disable auto join on all 9 managed networks and 5 of them are back to enabled before I’m done checking the list.
- TylerE 4y agoIf you don't want the service, why did you buy it, even if the discount was 100%?
- newZWhoDis 4y ago“The service” was cellphone service, there is no logical reason my phone OS should arbitrarily lock me out of wifi settings due to my cellular carrier.
- user3939382 4y agoBrand trust can be liquidated or purchased in various amounts just like any other corporate asset. In this case Apple decided to sell some to the carriers. Given the % of users who will ever have their purchase decisions affected by this it was probably a highly profitable move.
- CaliforniaKarl 4y agoSIM cards include a lot of capabilities. For example, a SIM card can contain multiple embedded applications, which can communicate with the outside (push and pull), without involving the phone's OS. The secret life of SIM cards (2013) (simhacks.github.io) 225 points by cthackers on Aug 16, 2014 | 43 comments
- happytiger 4y agoThis is a security non-starter. Why would Apple do this? These are not approved networks for most company usage. Apple needs to start being a LOT more protective of their product’s privacy features, as it’s a major reason people stick with them and one of their core brand points.
- TheKarateKid 4y agoThis was clearly requested by carriers. The whole point is to ease demand on cellular towers by utilizing mass Wifi networks that ATT, T-Mobile, etc. have set up all over the place. I can't believe Apple allows this, as every time my phone has tried connecting to my carrier's Wifi it either has no connection at all and kills whatever I'm doing until I turn Wifi off OR it's extremely slow. Horrible user experience.
- mlhpdx 4y agoAre you using the t-mobile app? Maybe uninstall it, if so. Next, on your home network you can block the HTTPS requests that your phone makes to check for profile updates. I don’t recall that domain name (it has to be a domain name and not an IP due to the use of HTTPS for those checks, which Apple requires) but you can probably figure it out from your pihole. You’ll still get updates over cellular. I agree 100% that it should be opt-out (if not opt-in). I suspect however that the problem with overwriting your settings is as likely a bug as intentional. This area of software is buggy as heck.
- newZWhoDis 4y agoOnly my phone has any carrier apps installed but the behavior is global, so the only common factor is the cellular provider. I could block it perhaps, but it will just sync up again next time the kids leave for school.
- infotogivenm 4y agoWell that’s objectively terrible. Question about security ramifications: aren’t APs without x509 set up trivially spoofable anyways? Or is that fixed? I have not paid attention to wifi security in a minute.
- lxgr 4y agoWPA3 has PAKE-based mutual authentication, so with a reasonably hard to guess passphrase, you should be mostly safe. That said, these auto-connect carrier networks mostly use EAP-SIM, which does mutual authentication using the keys on your SIM card anyway.
- hnav 4y agowhat are the security requirements put forth by the carriers? is the backhaul encrypted in any way? are the devices tamper resistant? on one hand this seems similar to 5G stations where third parties have physical access but on the other this seems easier to pwn
- retox 4y agoI have a vague memory of this being a story many years ago, where iPhone's were connecting automatically to the Disney resort WiFi and someone realized if you set your hotspot to use the same name all iPhones in the vicinity would auto connect. Can't find anything online any more though, does anyone remember anything similar?
- lxgr 4y agoYes, there is a not very widely used API for this that allows apps to hook mobile hotspot logins and (I believe) also mark them for auto-connections. It worked horribly. Not sure if it’s still around.
- sircastor 4y agoI have an iPhone 12 mini. I bought mine directly from Apple, and use it on the T-Mobile network. I see “t-mobile” and “TMobileWingman” under managed networks. I disabled the auto join and it has not been switched back on after about an hour.
- xlaacid 4y agoThanks for this. I was able to disable auto join. It sucks that they pull this shit with out telling us.
- neilv 4y agoWhenever someone sadly hits their personal "last straw" threshold for iPhone, one option to consider is the privacy&security-focused GrapheneOS variant of Android. https://grapheneos.org/features https://grapheneos.org/features You can run GrapheneOS on recent models of Pixel hardware. (It usually has to be a unit purchased from Google, or that otherwise hasn't had OEM-unlocking disabled by the carrier that sold it.) https://grapheneos.org/faq#device-support https://grapheneos.org/faq#device-support https://grapheneos.org/install/web#enabling-oem-unlocking https://grapheneos.org/install/web#enabling-oem-unlocking You might also try minimizing the apps that you depend upon, though GrapheneOS has put work into supporting apps in a bit more private&secure way. There's also the option of the F-Droid app store, if you want to try to avoid commercial apps altogether, but still need things like an OpenStreetMap app. There were a lot of things I liked about iPhone, but I overall feel more respected by GrapheneOS. If you end up liking GrapheneOS, and have the means, there's an optional Donate page on their Web site.
- mypgovroom 4y agoThis! I'm very impressed with how well it works and the continued anti-consumer steps iOS and Android make are only driving Graphene's development!
- crossroadsguy 4y agoAs someone who reluctantly moved to iOS from Android and reluctantly stays on iOS there really is no other option for "normal" ("regular"?) users who don't want the Google crap all over their existence. Graphene, Lineage etc are all excellent solutions for people who want to (or "can") get their hands dirty and can live without normal functions of "commercial" apps, for everyone else as of today there is just two option - Apple's iOS or Google blessed Android. I am not even talking about warranty and bricking woes. This is a duopoly as clear as day. We can keep telling ourselves that we have options, we don't. It's settled, at least that is how it is right now (again, maybe except for "tinkerers" which I guess even I was until around a decade ago).
- neilv 4y agoThis doesn't address all your concerns, but for people who want to keep the commercial apps, GrapheneOS now supports that to some degree: https://grapheneos.org/features#sandboxed-google-play https://grapheneos.org/features#sandboxed-google-play
- piffey 4y agoI am pretty sure apps can do this as well. Have noticed hotel apps doing it in Las Vegas and elsewhere. Adding in a Wi-Fi network that is to aid in connecting. Threw me for a loop when I was there last.
- lxgr 4y agoThere is indeed such an API, and frustratingly there does not seem to be a way of preventing apps from doing it. My contact with this was via "iPass", which was a Wi-Fi subscription that also included many in-flight network providers. I was not really interested in connecting to thousands (in my city alone!) of horribly slow, insecure networks on the ground, but it was all or nothing, and required reinstalling the app every time.
- deleted 4y ago[deleted]
- TheKarateKid 4y agoI'm on a prepaid MVNO carrier that does this and iOS has been allowing this for years now. The only difference is that now iOS lets you VIEW what's going on.
- newZWhoDis 4y agoHow can this possibly work with apartments/condos? You’re guaranteed to have multiple “hotspot” networks in range with zero ability to talk to local printers/cameras/TVs etc
- TheKarateKid 4y agoIn my experience, it only connects to carrier Wifi if one of your known networks isn't nearby. So while at home, you will always be connected to your own Wifi so everything local (printers, TVs, etc.) will continue to work. The problem especially is when you are driving and stop at a red light, and it connects to carrier Wifi which will no longer work in 30 seconds, causing streaming music or anything else on your phone to have a momentary loss of connection.
- crossroadsguy 4y agoThis is not even listed in the change-list pop-up. Whenever I see such news I end up wondering how much power these organisations wield without any or much check that even after such incidents and findings they find it okay to just remain silent about them and maybe fix/revert it or maybe not. I was incensed when Find My Device meant either I had to turn it OFF for my devices as well, or turn it ON for everything out there including random people's AirTags. What a choice! It sounds ridiculous, even to me, but I don't think that time is far when phone companies will hand you over to the police on a platter with all the "assumed evidence" if you happen to be near a crime scene with maybe even a "%" attached to you while police will have a version of some AI where they will feed all that data and pick a clear winner. Saving cost, time, and making "justice" productive. Yay! WiFi was one thing I was extremely careful about where to join and where not. Unless I was absolutely sure I always used mobile data when I am outside or wait until I get back home to a known and safe wifi. It started with Apple Wifi turning off from Control Centre meaning "it's off, but it's not really off". At this point I am really not sure what happens when I do an action (even a hardware related action) on my iPhone. Does it really shutdown? Or it does not? I think it already doesn't if Find My Device is on or something. Sometimes I switch off my iPhone and go to sleep and see in the morning the phone was waiting eagerly for me to get up and greets me with the PIN screen. It creeps me out every single time.
- stuckkeys 4y agoJust tried it. I am on xfinity and indeed I cannot disable auto join lol. Dafuq. I have dual sim. Physical sim is with xfinity and esim from tmobile. I was wondering why my phone connected to fuckin xfinity shit while i was driving.
- newZWhoDis 4y agoSo now you better hope one of your neighbors doesn’t get a free wifi/modem combo from Comcast because it will advertise a hotspot by default and you’ll be in the same boat I am.
- stuckkeys 4y agogod damnit.
- redserk 4y agoI wonder if this can be worked around by using the Shortcuts app. Set the Trigger to be when you join the carrier’s SSID — as they show up in the list of valid trigger SSIDs, then set the action set to turn off WiFi.
- bluehex 4y agoMaybe we should be complaining to the FCC[1]. Shouldn't they be protecting us from stuff like this? [1]: https://consumercomplaints.fcc.gov/ https://consumercomplaints.fcc.gov/
- musicale 4y agoWill lockdown mode disable this? It is supposed to block installation of configuration profiles.
- newZWhoDis 4y agoThis isn’t done via a normal profile, but via the carrier settings. I doubt lockdown protects you in this case
- LispSporks22 4y agoIs this a leased phone thing or does it also happen for unlocked/purchased outright iPhones?
- newZWhoDis 4y agoAll phones unlocked, cash purchase.
- someonehere 4y agoFound this about tmobilewingman: https://www.reddit.com/r/tmobile/comments/7u535i/tmobilewingman/ https://www.reddit.com/r/tmobile/comments/7u535i/tmobilewing... Seems to have been around for at least five years.
- eslaught 4y agoCan anyone tell me if there is an equivalent option on Android that I should be looking to disable? (Google Pixel device, stock Android)
- thepbone 4y agoYou should be able to find it by navigating to 'Connections > WiFi > Advanced > Hotspot 2.0' in the system settings. I'm using Samsung, but it should be in the same place for all other Androids too.
- test6554 4y agoCan you imagine this used by your employer to force your personal phone to connect to their network and be subject to their internet filtering? Or what about at retail stores, blocking access to Amazon and competing stores while you shop.
- seraphsf 4y agoI know something about this. I built and ran a service for carriers to help with “WiFi offload”. It’s intended as a consumer-friendly way to increase capacity in dense areas (like a sports stadium or mall) where the carrier’s cell towers don’t have enough capacity. Wifi offloading is not new. AT&T helped invent these standards back in ~2009 when their network was getting crushed by massive increases in traffic as iPhone usage took off. WiFi offload networks are configured as “Managed Networks” which are lower priority than any user-selected networks. You can disable them by turning off “auto-join”. (Also these WiFi offload networks are secure; you can’t spoof them). However it appears that the original poster’s carrier (presumably Xfinity Mobile or Spectrum Mobile) has done something new - they’ve disabled the user’s ability to turn off “auto-join” on iOS. Some overzealous team is trying to lower their cellular costs. That’s because both Comcast and Spectrum rent capacity on Verizon Wireless towers, but their MVNO cellular service is not profitable unless their customers are using the cable company’s own WiFi fairly often. However this (disabling “auto-join”) is a dumb move. It’s obviously problematic for users whose neighbors are broadcasting the [Xfinity WiFi or Spectrum Mobile?] SSID. To my knowledge, no major carrier does this. If you’re on AT&T, T-Mobile, or Verizon, the “managed offload networks” can be easily disabled. And the major carriers are using higher-quality commercial WiFi networks for offload, not random home cable modems.
- divan 4y agoThanks for explanation. > they’ve disabled the user’s ability to turn off “auto-join” on iOS How (and why) is it even possible for carriers?
- seraphsf 4y agoFrankly, I don’t know. This thread is the first I’ve heard of it. Carriers ask phone makers for config changes all the time. It’s possible this is a new capability that was requested by certain carriers. To be fair, it’s also possible that the OP and I are misinterpreting what’s going on. For instance, iOS syncs your preferences across devices. Perhaps there’s some bug that’s causing the wrong setting to propagate back to this person’s phone because their iPads, etc are still set to allow “auto join”.
- Someone 4y agoI don’t have managed networks on my iOS device, so I cannot test it, but https://discussions.apple.com/thread/254228630 https://discussions.apple.com/thread/254228630 says: > I spoke to Apple support today and they helped me. First I had to reset Network settings, then at bottom of Wifi settings page, I had to make sure that ‘Ask to join networks’ is set at ‘Ask’, and ‘Auto-Join Hotspot’ is set at ‘Ask to join’ > The hotspot still shows up in my networks, but now it never joins
- Tsiklon 4y agoThis has been a thing for at least the last couple of years, 802.1x with EAP functionality based off the SIM. If you’re in London in the U.K., it’s how EE automatically grant access to the “EE Wifi Auto” network available in the London Underground
- rickdeckard 4y agoI strongly suspect that changing the auto-join setting is not disabled, but the profile is getting checked periodically and "updated" (either by the SIM application or some iOS service), overwriting your manual change. Seems it's a known issue for some months now: https://discussions.apple.com/thread/254228630 https://discussions.apple.com/thread/254228630 Quote: "I spoke to Apple support today and they helped me. First I had to reset Network settings, then at bottom of Wifi settings page, I had to make sure that ‘Ask to join networks’ is set at ‘Ask’, and ‘Auto-Join Hotspot’ is set at ‘Ask to join’"
- sizzle 4y agoDoes this mean that the networks were spying on our WiFi signals without opt-in? Can we sound the alarm to shut this practice down??
- IYasha 4y agoThis is dreadful. I'm not an Apple user, but I suspect Android is not far from implementing similar "features". No way this is just "for technical reasons", it's clearly an agenda.
- hk1337 4y agoJust out of curiosity and I know the latter can be intrusive setting things back up again, but have you tried restarting and resetting your phone to make sure it’s not some weird glitch that’s causing it to not take? *EDIT* I found it, disabled auto-join, restarted my phone, and auto-join is still disabled.
- jonathantf2 4y agoI've used this mainly in places like shopping centres and arenas where my network have installed it, it works great, much quicker than the 4G signal I usually get. I don't see the issue
- DueDilligence 4y ago[dead]
- rythmshifter 4y agoI guess it's time to download as much pirated content from these unremovable networks as possible. that should fix this idiocy.
- deleted 4y ago[deleted]
- DueDilligence 4y ago[dead]
- JohnFen 4y agoThis is an excellent reason to avoid using iPhones. WiFi is too vulnerable to be used without additional security.
- cookiengineer 4y agoAnybody remember class 0 sms? Anybody here that has built an IMSI catcher with osmocomBB and an old motorola phone? The attack surface of 3g/4g/5g is real. Somebody in your neighborhood can simply send you a hidden class sms and your phone will blindly download and install the zip/apk/app file, from an unsecured http server. We live in the golden age of hacking, because there's nothing that the common consumers can do about it...except buying an open phone and flashing an AOSP rom on it, which theoretically can be modified if the GSM modem firmware isn't already implementing this. Oh, and those firmwares are as proprietary as it gets, with as many vulnerabilities as you can imagine. Broadpwn just scratched the surface of it.
- husamia 4y agowhat about MVNO?
- brianaker 4y agoManaged Networks are loaded via the carrier profile. The "attwifi" SSID is defined in: Payload/ATT_US.bundle/profile.mobileconfig You can find the the carrier file, i.e. the ipcc for AT&T here: https://updates.cdn-apple.com/2022/carrierbundles/002-77749/6AE8008D-A1DE-4814-BCA3-6A313E344B3A/ATT_US_iPhone.ipcc https://updates.cdn-apple.com/2022/carrierbundles/002-77749/... Just unzip the file in order to see its contents. If you remove the SIM card from your iPhone the managed networks are removed. If you have disabled any of the Managed Networks and remove/reinsert your SIM card the networks will be re-enabled. Once upon a time you could edit and load your own ipcc carrier bundle, I do not know if this is still the case. ( Whether this has ever been ok/allowed/etc,... I have no idea. )
- aprdm 4y agoYes, it's a pain in the ass, I HATE it!
- e_a_d 4y agoHow could this managed network be used with malicious intent? What could someone theoretically do with this?