Students finding wireless password

[dhalvorsen]

I've been working on a re-work of our wireless networks with building in segmentation.  I created new SSIDs with new passwords and on the first day of them being live, I've been told that staff shared the staff wifi password to students despite every communication saying to not share it with students, but I'm not sure if a staff member actually did or not.  Students have also gained access to the network that is only intended for Chromebooks and that password was not shared to anyone. 

My question is... 

What ways can students try to find out a password to a network when their devices are locked down and the wifi network is only pushed to devices.  Their devices do not have access to crosh.

[ddelboccio]

You've been told staff shared passwords, but you are not sure if it happened or not?  Who shared the passwords with staff?  Word of mouth is our biggest enemy.

Can't think of a way students on chromebooks can see any configured wifi passwords.

[kaned]

There were a couple ways that in chrome://chrome-urls/ it was revealed.  I think it was in one of the network tools.  It's been a bit since this was an issue for us so I don't have the exact location from memory.   We block most of these tools for students from within the Google Admin Console.

We actually got fed up with passwords being released (some time ago).  We now generate 63 char fully randomized passwords and only push them through management systems (Gadmin, MDM, etc).  We do have a method to onboard devices either through a network cable or temporary wifi ssid in select physical locations as needed.

[ddunlap]

Maybe they looked at an unattended teacher laptop and found it there - this shows how - https://www.youtube.com/watch?v=EqiSPLJFFIk

[Michael_Roop]

Have you checked your teachers monitors for any sticky notes?  Also kids are notoriously good at recording teachers when they put in Interactive Flat Panel passcodes, wifi passwords, powerschool logins.... 

[dhalvorsen]

I know we have blocked most if not all of the chrome:// urls.  I can look into those more yet.  The laptop wouldn't be a possibility as it's only pushed to Google devices.  The sticky note situation could be an option for the staff network, but not the one for the chromebooks, which is the one that I'm worried about getting out.  The only real thing I've known would be through Kali/Wireshark, but I also think that wouldn't be something that would be done on day one.

[ddunlap]

What kind of wireless APs are in place?  Is the problem students with Chromebooks on their Chromebook network sliding over to teacher Chromebook network?  Or is it students with phones getting on teacher Chromebook network?