4 ms·

But if the friend who got the password via Wi-Fi Sense has access to the network, that means that at some point, the password had to be in clear text on their c

by Spoom 11y ago

But if the friend who got the password via Wi-Fi Sense has access to the network, that means that at some point, the password had to be in clear text on their computer (since otherwise it wouldn't be able to authenticate to the network). This means that at best, they use reversible encryption, and at worst, it's just stored in cleartext somewhere (this being Microsoft, my guess would be in the registry). I guarantee that someone will create a tool to get wi-fi passwords shared to them if there isn't one already.

Amezarak 11y ago
> This means that at best, they use reversible encryption, and at worst, it's just stored in cleartext somewhere (this being Microsoft, my guess would be in the registry). The status quo is that your password is already stored on their computer with nothing better than reversible encryption.
- VLM 11y ago
  The status quo is that random business acquaintances and whoever gets automatically added to contact lists via some vulnerability (just wait, it'll happen) do not have my wifi password. Not on their machine, not to share, not access at all. I like it that way. We have something-guest as a SSID for a reason, after all.
MichaelGG 11y ago
You'd need to look up the details, but I think the key derivation for WPA allows you to store a hash of the password. It's almost just as valuable, but technically means you don't have the plain password.
- yuhong 11y ago
  Yea, I have described the details in another HN comment before.
- Spoom 11y ago
  Hmm, interesting. It sounds from your comment like you would still be able to replay the hash in order to connect though, unless there's a bigger system at play that I don't know about.