Yesterday I restored factory settings on my home router (TP-Link WR1043ND, nothing fancy) and set a new SSID and a new password (WPA2-PSK). Then I entered the new password on my laptop and my phone as well as my wife's tablet.
She has just called to tell me that her iPhone is connected to the new network and sent me a screenshot – the new SSIS is there, IP address looks reasonable, she can access the Internet. However, we did not set the new password on her phone yet.
Is that possible?
Since all the hardware, the MAC addresses are the same, can the phone authenticate using some kind of authorization token other than the password? Some session ID?
I'm shooting in the dark here, because it shouldn't work. But it does.
Someone in the neighborhood could be running WiFi Pineapple or something similar, but: (1) I never noticed any hacker-like activity, (2) the phone connected to a network with a completely new SSID, not a known one.
Best Answer
If you put that password into a different Apple device then that password will be accessible to the phone over its cellular data connection, assuming that they are both using the same Apple account.
The FAQ for iCloud Keychain states