34

I have iCloud Keychain sync enabled, but I want to stop it syncing WiFi passwords.

I have a portable WiFi hotspot which I use for my laptop and iPad, but I don't want my iPhone to connect to it since it has it's own 3G

Because iCloud is syncing the settings, within about 30 seconds of connecting my laptop to the 3G hotspot, my iPhone will connect itself. If I go into wifi settings on the iPhone and manually disconnect, about 30 seconds later my laptop will disconnect too. It seems with iCloud wifi sync on, I can’t connect my laptop to WiFi without my phone also connecting.

The only way to get around it seems to be disabling Keychain sync in iCloud. I’ve tried Googling, but got no real help on how to disable it without turning off Keychain, which is what I’ve done at the moment.

I also don't want to enable 'Ask before joining networks' on my iPhone, since I'll be manually re-connecting it constantly.

nohillside
  • 92,308
  • 39
  • 198
  • 242
Smudge
  • 443
  • 1
  • 4
  • 6
  • 1
    This is a really big problem. If I connect my iPad to a hotspot, then all my Apple devices will connect to this hotspot when it loses the home Wifi as if it is free data (say, if my home internet is down). Keep on playing YouTube one after another, download all app updates, download possibly even the whole MacOS Sierra, download all Podcast subscriptions, and 7GB downloaded, and that means $70 for Project Fi's usage, or $105 for Verizon – nonopolarity Nov 22 '16 at 02:40
  • This is a problem for me for a slightly different scenario. I go to a coffee shop across the street from my office, while there for coffee or meetings or whatever i use their wifi on my phone or laptop, but my desktop in my office across the street ends up on this network... – Michael May 18 '17 at 14:18
  • This is a problem for me for a slightly different scenario as well. If I am out and about I occasionally need to use an `xfinity` (Comcast) wi-fi hotspot to get on the internet. Well, there is also one near my home, so when I do this, my home MBP connects to `xfinity` as well. (Even though it is lower in the priority list than my actual home wi-fi...) Then, I can no long remotely access my home laptop (which I frequently do over VNC, using a forwarded port and ddns.net address). Perhaps removing `xfinity` from my wi-fi list on the phone would fix? I will try that. Still a problem though. – Michael Liquori Oct 16 '17 at 17:43

10 Answers10

16

I was able to stop my MacBook from using a wifi password that should only be used on the iPhone by going into KeyChain Access -> System -> UNWANTED_WIFI_NETWORK -> Access Control and then removing airport and airportd from the list "Always allow access by these applications". Seems to be still connecting on the iPhone but not the MacBook.

seq3
  • 261
  • 2
  • 4
  • It seems a combination of this tip with the tip from @atldeadhead would resolve the issue. – Khürt Williams Oct 29 '15 at 13:08
  • 1
    I prefer the tip from @Yoeri to set the phone to a static non-existant IP (which works automatically), over the tip from atldeadhead (which requires me to remember to turn my wifi back on later). – datico Apr 20 '17 at 04:19
12

I too was facing this problem and came up with a slightly more elegant workaround.

In the end, I deleted all of the relevant Wi-Fi networks from iCloud Keychain and used configuration profiles to install the network credentials on the desired devices instead.

I have written a step by step guide for those not familiar with creating and installing .mobileconfig files for OSX & iOS.

We're going to create a config profile for each SSID and password combination and install those selectively on our devices.

  1. Install Apple Configurator (free) from the Mac App Store.
  2. Launch Configurator, proceed past first run screens.
  3. Select the Supervise tab from top toolbar of the main application window.
  4. Under All Devices > Settings > Profiles, click the '+' icon to create a new profile.
  5. Under the General tab, give the profile a name, I suggest the same as your first Wi-Fi SSID.
  6. On the left select Wi-Fi, click Configure.
  7. Enter the SSID in the SSID field. From Security Type, select Any (Personal). Enter the Wi-Fi password into the Password field.
  8. Click Save.
  9. Repeat steps 4-8 for your second and any other SSIDs.
  10. Select each of your profiles one by one and click the share icon to export the profiles.

Now that this is done, delete your SSID settings from iCloud keychain, e.g. on your Mac go to System Preferences > Network > Wi-Fi > Advanced and forget any of the SSIDs in question by selecting their names and clicking the '-' icon. Keychain sync should forget these networks across the board, but you may need to repeat this step on your iOS devices by selecting 'Forget this network' from the SSID settings if it auto-connects undesirably. YMMV.

You are now ready to install the profiles by double clicking, or by opening from an email attachment on any iOS devices, accepting all security warnings.

qzyphus
  • 376
  • 2
  • 7
  • This is the solution that I was using successfully for years, but it seems to be broken now. Currently, you can deploy these profiles on all your devices except for the ones you don't want to use and iCloud Keychain still syncs it across all devices. You can even deploy a profile with the "Auto-Join" set to "False", but this is also ignored. – ranvel Mar 28 '17 at 11:36
  • @ranvel So in your case, iCloud syncs wifi password read from profiles? – Teejay Dec 06 '17 at 10:34
6

Unfortunately I can offer no perfect solution however I can confirm this shortcoming in the iCloud Keychain sync. I've been able to reproduce this same behavior. Indeed a selective disabling ability in the keychain settings would do the trick. Until Apple implements functionality like that I think your options are

  1. turning off wi-fi on your phone when your near that hotspot
  2. turning off iCloud Keychain sync on your phone.

Because iCloud Keychain was delayed from the original release of iOS 7 I'm guessing Apple just didn't have time to implement finer grain controls on what is and isn't synced.

nohillside
  • 92,308
  • 39
  • 198
  • 242
atldeadhead
  • 855
  • 5
  • 5
  • Not ideal, but the best option I can see. I'll stick with keeping Keychain sync off till it's sorted. Thanks – Smudge Dec 04 '13 at 20:49
  • I posted a parallel response which seems to have been missed. If you are still interested in an alternative approach, this still seems to be the best way. – qzyphus Sep 18 '15 at 06:37
  • 1
    I downvoted this because, as the author concedes, this isn't really a "solution" and I want to decrease its visibility in case a solution can be found – Michael May 18 '17 at 14:21
5

I fixed this issue by entering a static IP address without specifying a router for the WiFi network of my portable WiFi HotSpot on my iPhone. To do this:

  1. Power on the WiFi HotSpot,
  2. Join the iPhone to the WiFi network,
  3. Go to the settings of the WiFi network by clicking the (i),
  4. Under IP ADDRESS, click 'Static',
  5. Enter some IP Address, e.g. 192.168.0.10,
  6. Enter a Subnet Mask, e.g. 255.255.255.0.

The iPhone will now stay connected to the WiFi network, but can not use it to connect to the Internet. It will keep using the cellular data connection.

Yoeri
  • 51
  • 1
  • 1
  • This worked great. I set the Router and the IP Address to 192.168.0.0, and the subnet to 255.255.255.255, so it was obvious that they were bogus. My phone connects but with a (!) network icon and the text "No Internet Connection". Cellular data takes right over. I assume when I get home and the phone finds a wifi network it can actually use, it will switch to that instead. – datico Apr 20 '17 at 04:21
4

Not sure in which version of IOS this was added,...

  • When connected to the unwanted network
  • On your device go to WiFi,.. Select the network
  • disable "Auto-Join"
  • switch off and on Wi-Fi

Next time your phone finds the network, it will not join the network

Mulder
  • 41
  • 1
  • Found the same workaround. Me too not sure when it was added. Or, I think it always had been there, but maybe before it was being synced as well? – Teejay Mar 18 '19 at 16:24
3

So I tried the steps using the Configurator, which almost worked. My mac would keep connecting to the proper wifi, but after an hour or so it the keychain would pick it up.

Playing around, I unchecked the auto-join box on the configurator file reapplied it and it seems to have solved the problem. My mac has been connecting to my work wifi every time I reboot and my phone hasn't been.

Which is great, because I don't want my phone on my work's wifi behind my works firewalls.

Gary
  • 31
  • 1
3

I've just found a workaround:

  1. Create a new (temporary) administrator account in Mac OS
  2. Log in as the above administrator
  3. Connect to the wifi network (i.e. the one that you don't wish to share through Keychain)
  4. Log out the temporary admin, and then log back into your regular account
  5. Delete the temporary admin account

Voila, the wifi network is joined but isn't shared with any of your other devices.

Andrew Trevers
  • 139
  • 2
2

Look for files with the name 'lakitu' and either compress them or delete them entirely. Keychain Sync will attempt to set up, but then will fail when it cannot phone home.

user98849
  • 21
  • 1
2

I'v also encountered similar problem. Some wifi network need me manually click "confirm" on its portal when reconnected, the mobile device just silently connected and i am not consciously aware of open browser to click confirm, so the mobile device stuck in such a useless connection.

So far, my solution is: change settings in Mac OS X:

  1. Delete unwanted WiFi settings from Network Settings, wait a minute to confirm mobile device can not connect to the unwanted WiFi without manually enter password.

  2. open System Settings, iCloud, turn off "KeyChain" in iCloud settings enter image description here

  3. Add WiFi settings again, it will not be synchronized to mobile device.
osexp2003
  • 381
  • 3
  • 8
1

Actually it's not that complicated after I have diven a bit into the matter. However I have a bit different problem, I have two Wifis, one I want for the phone, and one I want for the Mac.

On your Mac you have more than one keychain, as probably has your phone. However on the Mac you have to tools to manage them. In the application Keychain the Mac, you have:

  • Login
  • iCloud
  • System
  • ... potentially some more keychains

Apply the following steps:

  1. On your Mac, put the one you want on the phone in the iCloud keychain, and remove all the references, if there are, from other keychains
  2. Put the one for the Mac in the System keychain. (You will say, this doesn't fix my problem, my Mac still connects to the one of the phone.)
  3. Go on your Mac to: System Preferences > Network > Wifi > Advanced...
  4. In the list Preferred Networks make sure your Mac's network is above the other network

Now your phone will know nothing about the Mac's network, and the Mac will prefer his network over the other one. Oh and give your Mac some time to find the correct network the first time, it may take more than a few seconds to apply the correct configuration. (Don't ask me why, just giving you the heads up.)

Damian Vogel
  • 111
  • 3