This is a lot like what got Google in trouble - mapping all WiFi access points while collecting StreetView images. Microsoft is just doing it in a distributed way.
Does all the collected WiFi data go to Microsoft HQ?
Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers
21–30 of 116 posts
Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers
#22I'm lucky I don't have a Facebook account anymore :)
Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers
#23From https://www.windowsphone.com/en-gb/how-to/wp8/connectivity/w... > Your contacts don't see your WiFi network password. > When you share network access, your contacts get Internet access only. How can they ensure these two?
They could require "secure enclave" hardware. But that'd need cooperation with the NIC, too, eh? Most likely they mean "we disable the show password option".
Let's assume that they have somehow secretly shipped this "secure enclave" with all machines that will support Win10, and that they have h4xXx0r proof-ed the code to make it impossible to RE the code and implement the protocol directly, presumably we'll still be able to emulate Win10 and have a virtual NIC which spits out the key when it's handed off to it.
Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers
#24"The only way to opt out of this "feature" is to change the name of your SSID to include _optout at the end"
Google requires you to have "_nomap" at the end of SSIDs to "opt out" of certain services...
Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers
#25[deleted]
Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers
#26"The only way to opt out of this "feature" is to change the name of your SSID to include _optout at the end" Google requires you to have "_nomap" at the end of SSIDs to "opt out" of certain services...
So you are saying I can't opt out of both?
Or will they take XYZ_nomap_optout ?
Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers
#27This is a lot like what got Google in trouble - mapping all WiFi access points while collecting StreetView images. Microsoft is just doing it in a distributed way. Does all the collected WiFi data go to Microsoft HQ?
Google captured and stored traffic from unencrypted WiFi connections. It is not really similar at all.
Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers
#28Earlier quoted context omitted.
They could require "secure enclave" hardware. But that'd need cooperation with the NIC, too, eh? Most likely they mean "we disable the show password option".
Let's assume that they have somehow secretly shipped this "secure enclave" with all machines that will support Win10, and that they have h4xXx0r proof-ed the code to make it impossible to RE the code and implement the protocol directly, presumably we'll still be able to emulate Win10 and have a virtual NIC which spits out the key when it's handed off to it.
You won't be able to emulate the secure enclave, no. That'd sort of defeat the entire point.
It is supposed to be impossible to RE the code for anything useful - the keys are encrypted using the public key of the secure enclave. You'd need to break the chip itself to win, and since Intel knows this, we can assume they'll make it incredibly hard.
Of course, since MS wants this to work on current hardware, not "shipping sometime in the future" we can assume they aren't using Intel SGX. But in theory it's fairly strong DRM.
https://software.intel.com/en-us/blogs/2013/09/26/protecting...
Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers
#29https://www.windowsphone.com/en-gb/how-to/wp8/connectivity/u... >... WiFi Sense can do a lot of things for you to get you connected to the Internet using WiFi, so you don't have to do them on your own. These include:... > - Accepting a WiFi network's terms of use on your behalf... That doesn't seem appropriate.
On the contrary, dealing with captive portals is quite annoying, especially since they just generate browser warnings with HTTPS. You have to go out of your way to open a plain-HTTP website so that it can be intercepted properly, just so you can click "I accept" again. Additionally, these things have short memories - if you're at a coffee shop you frequent, you might be clicking through the captive portal for the 150th time.
Apple deals with this somewhat by opening a Webkit view of apple.com (unsecured) and displaying it the user if it's not in fact apple.com. But an even further level of automation would be great.
Let's be honest, no one reads these things anyway. If you're one of the handful of people in the world who would decide not to use a WiFi network because you didn't like its TOS, then you're 1) probably not running Windows anyway and 2) could turn this feature off.
Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers
#30So, isn't this basically a massive distributed attack on wireless security by Microsoft/Facebook? Similar to what Google's done in the past?
And of course, all this data is open to .gov subpoena, yes?
EDIT:
Oh boy!
Some WiFi hotspots ask you to accept the terms of use in a web browser, provide additional information or do both before you can connect. WiFi Sense can do these things on your behalf to get you connected quickly.
Yeah, this isn't a fucking trap at all.