Free Wi-Fi*
* just friend my business on Facebook
Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers
31–40 of 116 posts
Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers
#32Earlier quoted context omitted.
They could require "secure enclave" hardware. But that'd need cooperation with the NIC, too, eh? Most likely they mean "we disable the show password option".
Let's assume that they have somehow secretly shipped this "secure enclave" with all machines that will support Win10, and that they have h4xXx0r proof-ed the code to make it impossible to RE the code and implement the protocol directly, presumably we'll still be able to emulate Win10 and have a virtual NIC which spits out the key when it's handed off to it.
[deleted]
Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers
#33"The only way to opt out of this "feature" is to change the name of your SSID to include _optout at the end" Google requires you to have "_nomap" at the end of SSIDs to "opt out" of certain services...
So you are saying I can't opt out of both? Or will they take XYZ_nomap_optout ?
Probably the former.
Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers
#34[deleted]
I don't believe it can go multiple "hops." If you connect it goes to your friends, but it does not go to friends of your friends. If your friends connect to the network using Wi-Fi Sense, it might spread to their friends. I'm not sure.
it better not go more than one hop, 99% of FB users are only ~5 hops apart.
Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers
#35"The only way to opt out of this "feature" is to change the name of your SSID to include _optout at the end" Google requires you to have "_nomap" at the end of SSIDs to "opt out" of certain services...
So you are saying I can't opt out of both? Or will they take XYZ_nomap_optout ?
The Microsoft page says it has to contain _optout, not that it has to end with it.
Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers
#36[deleted]
Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers
#37This is a lot like what got Google in trouble - mapping all WiFi access points while collecting StreetView images. Microsoft is just doing it in a distributed way. Does all the collected WiFi data go to Microsoft HQ?
Could you actually design this feature in a way that didn't share all the raw WIFI passwords with Microsoft? I think it would be pretty difficult.
Bear in mind though that Google probably knows your wifi password if you or a friend syncs their phone's authentication data.
(Google's legal troubles were a separate issue btw)
Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers
#38From https://www.windowsphone.com/en-gb/how-to/wp8/connectivity/w... > Your contacts don't see your WiFi network password. > When you share network access, your contacts get Internet access only. How can they ensure these two?
They could require "secure enclave" hardware. But that'd need cooperation with the NIC, too, eh? Most likely they mean "we disable the show password option".
Based on what I read on one of their FAQs, it is not as good as a secure enclave, but it is quite a bit better than simply not providing a show password option.
The password is not stored on the devices of the people you share with. It's stored on Microsoft servers. When the device someone you have shared with notices that a network you've shared is available, it gets the key to connect, then presumably forgets it.
I wonder if it is possible to do better? The idea would be that when setting up the connection (so, setting up session keys and authenticating) the device could pass these packet through to Microsoft's server. Microsoft's server could then calculate the response packets and give them to the device to relay to the access point. When the connection set up is all done, Microsoft's server could pass the session key to the device, and subsequent packets would be handled entirely on the device.
There are two (at least) things that could torpedo this kind of approach. (1) the protocols might work in such a way that you cannot hand off the setup/authentication, or they might require frequent enough re-keying that spotty cell access could prevent keeping wifi working, and (2) the connection setup and authentication might be handled in firmware that does not provide a low enough level interface to do the fiddling needed.
Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers
#39Just as I was starting to get excited about Microsoft actually seeming to generally 'get it', they go and do something monstrously stupid like this.
Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers
#40https://www.windowsphone.com/en-gb/how-to/wp8/connectivity/u... >... WiFi Sense can do a lot of things for you to get you connected to the Internet using WiFi, so you don't have to do them on your own. These include:... > - Accepting a WiFi network's terms of use on your behalf... That doesn't seem appropriate.
On the contrary, dealing with captive portals is quite annoying, especially since they just generate browser warnings with HTTPS. You have to go out of your way to open a plain-HTTP website so that it can be intercepted properly, just so you can click "I accept" again. Additionally, these things have short memories - if you're at a coffee shop you frequent, you might be clicking through the captive portal for the 150…
Yeah but, you're basically agreeing to assume risk. You still get a choice - you choose to ignore the TOS and click through.
Time and again courts have upheld click-through TOS and EULAs. Ignorance is rarely an excuse. So if something clicks through a captive portal for you, the defense of "I didn't know..." isn't going to hold much water.
The only defense might be that Microsoft accepted the terms and they should accept responsibility for any violations on their behalf. But good luck getting them to voluntarily indemnify you.