Can someone steal my WiFi password?

Question

Can someone steal my original SSID password when my pc connects to the other WiFi with the same SSID?

Answer 1

First, let's be clear that clients don't just send their password across the air in plain text, or in a form that an impostor AP ("Wi-Fi router" in layman's terms) could easily decode. So stealing a key with an impostor AP is not as easy to do as you're fearing.

If you were still using WEP, you should upgrade to WPA2, and you'll be fine, especially if you have a strong password.

If your client PC expected your SSID to use WEP, an impostor AP could ask your PC WEP client to perform "Shared Key Authentication", where the AP sends the client a "challenge" which is a block of random bytes, and then the client encrypts that challenge with his WEP key, and sends that encrypted block back as the challenge response. The impostor AP now has everything it needs to do an "offline" (read: high-speed) brute-force dictionary attack to try to discover your key. The impostor AP could even choose the "challenge" bytes it sends in such a way that make they key easier to recover.

With WPA and WPA2, the AP authenticates itself to the client at the same time as the client authenticates itself to the AP, and neither gives away the password, or even any information that could be used to try to brute-force the password. They just exchange random numbers (known as nonces in this context), and use those random numbers, mixed with the pre-shared key (PSK, a.k.a. network password) they each supposedly know, to derive another key called the PTK. Then they each use that PTK to encrypt (sign) a small message and send it to the other, and they each verify that the other correctly signed the message. That way they both know if the other one knows the same PSK as them, but neither has revealed the PSK to the other.

Answer 2

All of your attack scenarios seem to revolve around your SSID. You could disable SSID broadcast on your network to add a layer of obscurity to help prevent against such an attack.

Disabling SSID broadcast means that your network will be accessible only to those who have the name of the network as well as the password. The most an average individual could see would be an "Other Network" appearing in their available Wi-Fi network list.

Keep in mind that this is effective only against someone with a whim or passing interest in your network. If there is an individual who is set on getting in to your network, they probably will. You need to secure more than your access point to stay safe.