Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers

news.ycombinator.com

Post reply on HN
Print view View original

81–90 of 116 posts

Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers

#81

Post by yuhong »

SomeStupidPoint wrote: post #65

After thinking about it for a bit, couldn't a worm with fake Facebook accounts that are friends-of-friends with a high percentage of the population use this to spread virtually unimpeded? I suspect that the API is such that all of the friends of the fake accounts will relay to the fake accounts all of their respective friends passwords (given they had connected to said friend's network at least once), and that two st…

If they derive the PTK on the server from the stored PMK and sending that instead, this attack would not allow decryption of transmitted packets (other than group key broadcasts) because of the ANonce generated by the AP on each connection used in the key derivation. And the PSK uses PBKDF2 to generate the PMK, making mass cracking expensive.

Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers

#82

Post by giancarlostoro »

So a pedophile with a laptop will just drive up to a neighborhood and login to download all sorts of porn from your router just because you're running Windows 10? I apologize for sounding so extreme, but I've heard of this actually happening[1], but with an open wifi network.

Edit:

[1] : http://www.huffingtonpost.com/2011/04/24/unsecured-wifi-chil...

Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers

#83

Post by Bjartr »

tzs wrote: post #38
MichaelGG wrote: post #18

Earlier quoted context omitted.

They could require "secure enclave" hardware. But that'd need cooperation with the NIC, too, eh? Most likely they mean "we disable the show password option".

Based on what I read on one of their FAQs, it is not as good as a secure enclave, but it is quite a bit better than simply not providing a show password option. The password is not stored on the devices of the people you share with. It's stored on Microsoft servers. When the device someone you have shared with notices that a network you've shared is available, it gets the key to connect, then presumably forgets it. I…

>When the device someone you have shared with notices that a network you've shared is available, it gets the key to connect, then presumably forgets it.

So you still need minimal internet connectivity in the first place In order to ask MS' servers? Suddenly sounds less useful for things that aren't phones.

Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers

#84

Post by userbinator »

giancarlostoro wrote: post #82

So a pedophile with a laptop will just drive up to a neighborhood and login to download all sorts of porn from your router just because you're running Windows 10? I apologize for sounding so extreme, but I've heard of this actually happening[1], but with an open wifi network. Edit: [1] : http://www.huffingtonpost.com/2011/04/24/unsecured-wifi-chil...

On the other hand...

https://www.schneier.com/blog/archives/2008/01/my_open_wirel...

(This was 3 years before that. In some ways, it's a bit sad that we've closed ourselves off in order to avoid what might actually bit pretty small risks...)

Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers

#85

Post by skorux »

You share with your contacts, but not their contacts. The networks you share aren't shared with your contacts' contacts. If your contacts want to share one of your networks with their contacts, they'd need to know your actual password and type it in to share the network.

https://www.windowsphone.com/en-gb/how-to/wp8/connectivity/w...

Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers

#86

Post by finnyspade »

There's a lot of FUD & frankly inaccurate information floating around here.

When connecting to a password protected router you are given an UNCHECKED BY DEFAULT option to share the password with your friends. What this means is, the user can deliberately share the password they know.

This is just as secure as any other system because once you give a user a password they could share it if they chose. Nothing here is "automatic" no data is being proliferated without user consent. If your employees leak your password this way, then it's the same as leaking passwords otherwise.

Again this not an opt-in-by-default scenario. It requires a user knowing a password to actively choose to share for each router independently.

Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers

#88

Post by tdicola »

finnyspade wrote: post #86

There's a lot of FUD & frankly inaccurate information floating around here. When connecting to a password protected router you are given an UNCHECKED BY DEFAULT option to share the password with your friends. What this means is, the user can deliberately share the password they know. This is just as secure as any other system because once you give a user a password they could share it if they chose. Nothing here is "…

Even if people opt into it, why should this happen automatically? If one of my friends told every single Facebook friend of theirs the password to my wifi I would have a very strong conversation with them and probably never invite them into my home or even consider them a friend anymore. Just because they _can_ share the password doesn't mean they _should_ share the password.

I don't see why this kind of automatic sharing should be a 'feature' or frankly should exist at all. I would wager it helps almost no-one (given WP8's miniscule adoption numbers) and just serves to stir up controversy like this that makes MS look bad.

Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers

#89

Post by finnyspade »

tdicola wrote: post #88
finnyspade wrote: post #86

There's a lot of FUD & frankly inaccurate information floating around here. When connecting to a password protected router you are given an UNCHECKED BY DEFAULT option to share the password with your friends. What this means is, the user can deliberately share the password they know. This is just as secure as any other system because once you give a user a password they could share it if they chose. Nothing here is "…

Even if people opt into it, why should this happen automatically? If one of my friends told every single Facebook friend of theirs the password to my wifi I would have a very strong conversation with them and probably never invite them into my home or even consider them a friend anymore. Just because they _can_ share the password doesn't mean they _should_ share the password. I don't see why this kind of automatic sh…

This solves the problem of asking people the wifi password whenever you go over to their house. To a lot of people it's just a pain. When you tell your friends your password, just tell them not to share it. Done!

I would wager it helps the windows phone users and doesn't hurt other people. Also it's coming to windows 10 I believe.

Re: Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers

#90

Post by tdicola »

finnyspade wrote: post #89
tdicola wrote: post #88

Earlier quoted context omitted.

Even if people opt into it, why should this happen automatically? If one of my friends told every single Facebook friend of theirs the password to my wifi I would have a very strong conversation with them and probably never invite them into my home or even consider them a friend anymore. Just because they _can_ share the password doesn't mean they _should_ share the password. I don't see why this kind of automatic sh…

This solves the problem of asking people the wifi password whenever you go over to their house. To a lot of people it's just a pain. When you tell your friends your password, just tell them not to share it. Done! I would wager it helps the windows phone users and doesn't hurt other people. Also it's coming to windows 10 I believe.

No, when you save the credentials of the wifi password locally that solves the problem of having to ask your friend for the password every time you go to their place. There's no need to broadcast the password to every friend to fix that scenario. This is your friend sharing out your credentials to everyone they know automatically--perhaps to people who you don't know or don't want to have the password.

What happens when a jealous ex or stalker that's still a mutual friend suddenly gets access to your wifi network? What about the security implications of MS' servers storing the passwords, and do they disclose whether those passwords can be subpoenaed by law enforcement? This seems like a hornet's nest of nasty privacy and policy issues. It boggles my mind why they think this would be worth doing.

Post reply on HN