Live data from Hacker News

Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers

news.ycombinator.com

11–20 of 116 posts

Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers

#11
https://www.windowsphone.com/en-gb/how-to/wp8/connectivity/u...

>... WiFi Sense can do a lot of things for you to get you connected to the Internet using WiFi, so you don't have to do them on your own. These include:...

> - Accepting a WiFi network's terms of use on your behalf...

That doesn't seem appropriate.

Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers

#12

https://www.windowsphone.com/en-gb/how-to/wp8/connectivity/u... >... WiFi Sense can do a lot of things for you to get you connected to the Internet using WiFi, so you don't have to do them on your own. These include:... > - Accepting a WiFi network's terms of use on your behalf... That doesn't seem appropriate.

That's the only part that seems kind of cool. It's legally a bit strange, but terms of use on public Wi-Fi can be really annoying, especially when they don't work well. I've had networks refuse to let me on because their terms of use thing is broken.

It isn't as though anyone actually reads the terms of use anyway.

Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers

#13

https://www.windowsphone.com/en-gb/how-to/wp8/connectivity/u... >... WiFi Sense can do a lot of things for you to get you connected to the Internet using WiFi, so you don't have to do them on your own. These include:... > - Accepting a WiFi network's terms of use on your behalf... That doesn't seem appropriate.

That's the only part that seems kind of cool. It's legally a bit strange, but terms of use on public Wi-Fi can be really annoying, especially when they don't work well. I've had networks refuse to let me on because their terms of use thing is broken. It isn't as though anyone actually reads the terms of use anyway.

I agree with you on this, I've had same problem when trying to connect to a Hotel Wi-Fi and my browser didn't render their properly because i didn't have Windows XP with IE 7...

Probably the best feature of Wi-Fi Sense.

Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers

#15
post #10

Earlier quoted context omitted.

"using this system from the start" I don't use Windows, so I cannot use this system at all. "add you neighbor on Facebook and get free access to their WiFi" That's missing the much bigger downside. Give your neighbor your Wi-Fi password and they can share it with hundreds of their friends automatically. Microsoft claims users will not be able to find the password and that users will only be able to access the Interne…

Router companies should get together with Microsoft and make some kind of Flag you can tick, so your router actively tells you can't share this, without the ridicules name of "_optout" as last part :)

That's one solution. I don't think it's ideal. Not everyone would know to tick that box. I would, but my friends would not and their networks would be vulnerable.

It could also require buying new hardware. Once again, I would know to look for a Wi-Fi Sense-proof router, but my friends would not.

I also don't think we should be expected to solve problems that Microsoft caused. Why should the industry adapt to Windows rather than the other way around?

Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers

#16
post #4

Earlier quoted context omitted.

They will only wreck security, because you personally gave them the password, instead of using this system from the start, change your password upon windows 10 release and you are golden? :) Edit1: tho i can see the downsides of this, add you neighbor on Facebook and get free access to their WiFi xD Edit2: You can select whether, you want to share network with Outlook, Skype and Facebook friends, so what i wrote in E…

"using this system from the start" I don't use Windows, so I cannot use this system at all. "add you neighbor on Facebook and get free access to their WiFi" That's missing the much bigger downside. Give your neighbor your Wi-Fi password and they can share it with hundreds of their friends automatically. Microsoft claims users will not be able to find the password and that users will only be able to access the Interne…

> Microsoft claims users will not be able to find the password and that users will only be able to access the Internet, but that assumes there are no security holes.

You don't even need a "security hole": the machine needs to know the key to connect. From there, it's your machine -- you will be able to read it out of memory. Now, this is probably out of reach for most "average users", but for even a moderately capable attacker it provides little protection (and tools automating this will likely become available).

At best, if the Wifi network is using a passphrase it'll only send you the key (which is calculated by applying the PBKDF2-HMAC-SHA1 function to the passphrase using the SSID as a salt for 4,096 iterations), but this still lets the user get on the network and decrypt traffic.

Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers

#18
post #17

From https://www.windowsphone.com/en-gb/how-to/wp8/connectivity/w... > Your contacts don't see your WiFi network password. > When you share network access, your contacts get Internet access only. How can they ensure these two?

They could require "secure enclave" hardware. But that'd need cooperation with the NIC, too, eh?

Most likely they mean "we disable the show password option".

Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers

#19
post #2

you have to select whether you want to share your WiFi with your contacts upon first time connecting there is a Check box which is by default unchecked. Edit1: Also, previous connections are by default not shared automatically either, you have to go to manage known networks and select them and press share before it gets shared. Edit2: If people connect through your shared network, then it shouldn't allow their friend…

That's true but kind of misses the point. I'm not worried about my machine using this. Hell, I don't even use Windows. I'm worried about the zillions of people who do use Windows and who will thoughtlessly enable this because it seems convenient. They will wreck the security of other people who have done nothing wrong.

This is why the "guest login" feature on most Wi-Fi routers exists, to prevent untrusted persons (and by untrusted I mean anyone other than yourself and possibly-but-not-always your immediate family) from having access to your entire LAN when all they need is Internet access. Of course it works best when your guest login feature supports time-limited random passwords. Set up properly, guest accounts can make this Wi-Fi Sense bug a non-issue for your own network.

That said, I think Microsoft made a serious blunder here; it's inherently flawed and I can't immediately think of a way for them to fix it without getting rid of its entire raison d'être.

Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers

#20
post #10

Earlier quoted context omitted.

Router companies should get together with Microsoft and make some kind of Flag you can tick, so your router actively tells you can't share this, without the ridicules name of "_optout" as last part :)

That's one solution. I don't think it's ideal. Not everyone would know to tick that box. I would, but my friends would not and their networks would be vulnerable. It could also require buying new hardware. Once again, I would know to look for a Wi-Fi Sense-proof router, but my friends would not. I also don't think we should be expected to solve problems that Microsoft caused. Why should the industry adapt to Windows…

Well, will at least be interesting to see what the future holds for Wi-Fi Sense :)
Post reply on HN