9 ms·
Windows 10 “WiFi Sense” automatically leaks your wifi password to strangers
Even if you personally disable it on your own computer, anyone else connecting to your network (example: non-technical friend) will leak your password to all of _their_ facebook friends.
The only way to opt out of this "feature" is to change the name of your SSID to include _optout at the end -- or force EVERY SINGLE PERSON connecting to your network to disable the feature on their PC before connecting.
There is no other way to opt out.
https://www.windowsphone.com/en-gb/how-to/wp8/connectivity/use-wi-fi-sense-to-get-connected
https://www.windowsphone.com/en-gb/how-to/wp8/connectivity/how-do-i-opt-my-network-out-of-wi-fi-sense
https://www.windowsphone.com/en-gb/how-to/wp8/connectivity/wi-fi-sense-faq
http://www.howtogeek.com/219700/what-is-wi-fi-sense-and-why-does-it-want-your-facebook-account/
- Zekio 11y agoyou have to select whether you want to share your WiFi with your contacts upon first time connecting there is a Check box which is by default unchecked. Edit1: Also, previous connections are by default not shared automatically either, you have to go to manage known networks and select them and press share before it gets shared. Edit2: If people connect through your shared network, then it shouldn't allow their friends to connect as well. (To my knowledge of this)
- fdahgrthkn 11y agoThat's true but kind of misses the point. I'm not worried about my machine using this. Hell, I don't even use Windows. I'm worried about the zillions of people who do use Windows and who will thoughtlessly enable this because it seems convenient. They will wreck the security of other people who have done nothing wrong.
- Zekio 11y agoThey will only wreck security, because you personally gave them the password, instead of using this system from the start, change your password upon windows 10 release and you are golden? :) Edit1: tho i can see the downsides of this, add you neighbor on Facebook and get free access to their WiFi xD Edit2: You can select whether, you want to share network with Outlook, Skype and Facebook friends, so what i wrote in Edit1 could be invalid if you simply uncheck Facebook.
- fdahgrthkn 11y ago"using this system from the start" I don't use Windows, so I cannot use this system at all. "add you neighbor on Facebook and get free access to their WiFi" That's missing the much bigger downside. Give your neighbor your Wi-Fi password and they can share it with hundreds of their friends automatically. Microsoft claims users will not be able to find the password and that users will only be able to access the Internet, but that assumes there are no security holes. I'm not comfortable putting my network security in the hands of a company I did not choose to associate with.
- Zekio 11y agoRouter companies should get together with Microsoft and make some kind of Flag you can tick, so your router actively tells you can't share this, without the ridicules name of "_optout" as last part :)
- fdahgrthkn 11y agoThat's one solution. I don't think it's ideal. Not everyone would know to tick that box. I would, but my friends would not and their networks would be vulnerable. It could also require buying new hardware. Once again, I would know to look for a Wi-Fi Sense-proof router, but my friends would not. I also don't think we should be expected to solve problems that Microsoft caused. Why should the industry adapt to Windows rather than the other way around?
- Zekio 11y agoWell, will at least be interesting to see what the future holds for Wi-Fi Sense :)
- mikeash 11y agoMaybe instead they could have router makers add a flag to opt in to this insanity. Then if people really thought it was important for their networks, they could ensure they have compatible hardware, and turn it on.
- morganvachon 11y agoThis is why the "guest login" feature on most Wi-Fi routers exists, to prevent untrusted persons (and by untrusted I mean anyone other than yourself and possibly-but-not-always your immediate family) from having access to your entire LAN when all they need is Internet access. Of course it works best when your guest login feature supports time-limited random passwords. Set up properly, guest accounts can make this Wi-Fi Sense bug a non-issue for your own network. That said, I think Microsoft made a serious blunder here; it's inherently flawed and I can't immediately think of a way for them to fix it without getting rid of its entire raison d'être.
- rmrfrmrf 11y agoHow convenient!
- deleted 11y ago[deleted]
- fdahgrthkn 11y agoI don't believe it can go multiple "hops." If you connect it goes to your friends, but it does not go to friends of your friends. If your friends connect to the network using Wi-Fi Sense, it might spread to their friends. I'm not sure.
- d3rp 11y agoit better not go more than one hop, 99% of FB users are only ~5 hops apart.
- deleted 11y ago[deleted]
- molecule 11y agohttps://www.windowsphone.com/en-gb/how-to/wp8/connectivity/use-wi-fi-sense-to-get-connected https://www.windowsphone.com/en-gb/how-to/wp8/connectivity/u... >... WiFi Sense can do a lot of things for you to get you connected to the Internet using WiFi, so you don't have to do them on your own. These include:... > - Accepting a WiFi network's terms of use on your behalf... That doesn't seem appropriate.
- fdahgrthkn 11y agoThat's the only part that seems kind of cool. It's legally a bit strange, but terms of use on public Wi-Fi can be really annoying, especially when they don't work well. I've had networks refuse to let me on because their terms of use thing is broken. It isn't as though anyone actually reads the terms of use anyway.
- Zekio 11y agoI agree with you on this, I've had same problem when trying to connect to a Hotel Wi-Fi and my browser didn't render their properly because i didn't have Windows XP with IE 7... Probably the best feature of Wi-Fi Sense.
- superuser2 11y agoOn the contrary, dealing with captive portals is quite annoying, especially since they just generate browser warnings with HTTPS. You have to go out of your way to open a plain-HTTP website so that it can be intercepted properly, just so you can click "I accept" again. Additionally, these things have short memories - if you're at a coffee shop you frequent, you might be clicking through the captive portal for the 150th time. Apple deals with this somewhat by opening a Webkit view of apple.com (unsecured) and displaying it the user if it's not in fact apple.com. But an even further level of automation would be great. Let's be honest, no one reads these things anyway. If you're one of the handful of people in the world who would decide not to use a WiFi network because you didn't like its TOS, then you're 1) probably not running Windows anyway and 2) could turn this feature off.
- 11y ago
- totalrobe 11y agoLooks like this Wifi sharing app that's huge in China: http://technode.com/2014/11/17/wifi-hotspot-sharing-skeleton-key-falling-shanda/ http://technode.com/2014/11/17/wifi-hotspot-sharing-skeleton...
- NBo7I 11y agoFrom https://www.windowsphone.com/en-gb/how-to/wp8/connectivity/wi-fi-sense-faq https://www.windowsphone.com/en-gb/how-to/wp8/connectivity/w... > Your contacts don't see your WiFi network password. > When you share network access, your contacts get Internet access only. How can they ensure these two?
- MichaelGG 11y agoThey could require "secure enclave" hardware. But that'd need cooperation with the NIC, too, eh? Most likely they mean "we disable the show password option".
- ppuIndd 11y agoLet's assume that they have somehow secretly shipped this "secure enclave" with all machines that will support Win10, and that they have h4xXx0r proof-ed the code to make it impossible to RE the code and implement the protocol directly, presumably we'll still be able to emulate Win10 and have a virtual NIC which spits out the key when it's handed off to it.
- MichaelGG 11y agoYou won't be able to emulate the secure enclave, no. That'd sort of defeat the entire point. It is supposed to be impossible to RE the code for anything useful - the keys are encrypted using the public key of the secure enclave. You'd need to break the chip itself to win, and since Intel knows this, we can assume they'll make it incredibly hard. Of course, since MS wants this to work on current hardware, not "shipping sometime in the future" we can assume they aren't using Intel SGX. But in theory it's fairly strong DRM. https://software.intel.com/en-us/blogs/2013/09/26/protecting-application-secrets-with-intel-sgx https://software.intel.com/en-us/blogs/2013/09/26/protecting...
- deleted 11y ago[deleted]
- tzs 11y agoBased on what I read on one of their FAQs, it is not as good as a secure enclave, but it is quite a bit better than simply not providing a show password option. The password is not stored on the devices of the people you share with. It's stored on Microsoft servers. When the device someone you have shared with notices that a network you've shared is available, it gets the key to connect, then presumably forgets it. I wonder if it is possible to do better? The idea would be that when setting up the connection (so, setting up session keys and authenticating) the device could pass these packet through to Microsoft's server. Microsoft's server could then calculate the response packets and give them to the device to relay to the access point. When the connection set up is all done, Microsoft's server could pass the session key to the device, and subsequent packets would be handled entirely on the device. There are two (at least) things that could torpedo this kind of approach. (1) the protocols might work in such a way that you cannot hand off the setup/authentication, or they might require frequent enough re-keying that spotty cell access could prevent keeping wifi working, and (2) the connection setup and authentication might be handled in firmware that does not provide a low enough level interface to do the fiddling needed.
- Animats 11y agoThis is a lot like what got Google in trouble - mapping all WiFi access points while collecting StreetView images. Microsoft is just doing it in a distributed way. Does all the collected WiFi data go to Microsoft HQ?
- underwater 11y agoGoogle captured and stored traffic from unencrypted WiFi connections. It is not really similar at all.
- platinumdragon 11y agoThey grabbed MACs and SSIDs and paired them with GPS coordinates, not traffic. It is entirely the same.
- joosters 11y agoCould you actually design this feature in a way that didn't share all the raw WIFI passwords with Microsoft? I think it would be pretty difficult. Bear in mind though that Google probably knows your wifi password if you or a friend syncs their phone's authentication data. (Google's legal troubles were a separate issue btw)
- mikeash 11y agoI don't think it would be too difficult, design-wise. Have every Win10 installation generate a public/private key pair. Share the public key with MS. When you share a password with all your contacts, MS can send all of their public keys to you, where you then encrypt the password with them and send the results back to MS. MS can then send the encrypted passwords to the contacts, who can then retrieve the password with their private key. Something tells me they probably didn't do it this way, but it doesn't sound like a particularly hard goal to achieve if one thought it was important.
- joosters 11y agoAh, but it's a per-user secret, not per-device. So each user needs a keypair which gets shared across all of their devices, transparently but also in a way that protects the private key from MS. Which sounds an awful lot like the original problem of sharing secret WIFI passwords without MS being able to read them... I agree that it must be do-able, it's just tricky to make it work transparently and simply so every user benefits.
- michas 11y agoI'm lucky I don't have a Facebook account anymore :)
- dd9990 11y ago"The only way to opt out of this "feature" is to change the name of your SSID to include _optout at the end" Google requires you to have "_nomap" at the end of SSIDs to "opt out" of certain services...
- zzleeper 11y agoSo you are saying I can't opt out of both? Or will they take XYZ_nomap_optout ?
- wfunction 11y agoProbably the former.
- Nullabillity 11y agoThe Microsoft page says it has to contain _optout, not that it has to end with it.
- OJFord 11y agoPresumably for this reason; so XYZ_optout_nomap works. But this is just silly.
- sebastianavina 11y agoImagine SSIDs in a couple of years... COMCAST56B4_nomap_output_security_reinforce_superhappy_wifienable_security_ALLOW-P^[A-Za-z0-9\.]+$-_DISALLOW-P^[pet][0-9]$
- nly 11y agoWhy do they do this instead of just ignoring networks with hidden SSIDs?
- icebraining 11y agoI believe they also ignore hidden SSIDs, but those come with other problems, so they added a way to opt-out without hiding it.
- deleted 11y ago[deleted]
- angersock 11y agoSo, isn't this basically a massive distributed attack on wireless security by Microsoft/Facebook? Similar to what Google's done in the past? And of course, all this data is open to .gov subpoena, yes? EDIT: Oh boy! Some WiFi hotspots ask you to accept the terms of use in a web browser, provide additional information or do both before you can connect. WiFi Sense can do these things on your behalf to get you connected quickly. Yeah, this isn't a fucking trap at all.
- ppuIndd 11y agoFree Wi-Fi* * just friend my business on Facebook
- sehugg 11y agoA hotel already asked me to do this once (although they had to manually verify that I friended)
- deleted 11y ago[deleted]
- dagw 11y agoJust as I was starting to get excited about Microsoft actually seeming to generally 'get it', they go and do something monstrously stupid like this.
- benjin 11y agoAlternatively, you could actually go look up and understand how this works and realize that 80% of this thread is misinformation.
- themartorana 11y agoAny decent way to always deny Microsoft devices on our network?
- jacalata 11y agoNote that this has been a public feature since windows phone 8 was released, two and a half years ago.
- themartorana 11y agoI've developed an app that lets you log on to your friends' Windows machines without having to know the password! Don't worry, it's just Facebook friends. Someone has to realize how dangerous this is. How would ANY corporation EVER allow a single Windows 10 machine to connect to their wifi, let alone contractors, or... Do they not realize how paranoid network admins are to begin with? Windows XP forever, I guess.
- yuhong 11y agoI don't think WPA2 Enterprise with RADIUS is supported.
- lexicality 11y ago> Enterprise networks that use 802.1X can't be shared. If you connect to one of these enterprise networks at work or somewhere else, those network credentials won't be shared with any of your contacts.
- Aloha 11y agoIf you set up your network using radius, this becomes a non-issue radius is not horribly hard to set up either - its also not automatic, the user has to choose to share the wifi password - which they could do anyhow, as you've given it to them to connect. https://www.windowsphone.com/en-gb/how-to/wp8/connectivity/wi-fi-sense-faq https://www.windowsphone.com/en-gb/how-to/wp8/connectivity/w... - Section: "I'm concerned about sharing WiFi networks. Can you tell me a little more?"
- UnoriginalGuy 11y agoWhen home networking equipment start shipping with RADIUS servers you might have a point, but right now all they can do is forward RADIUS authentication requests to your RADIUS authentication server. RouterOS ships with one. But RouterOS/Mikrotik offers some pretty incredible functionality at a sub-$35 price point. It is very atypical of anything (even in the SMB space). However RouterOS isn't a "consumer" system by design. In fact you better have solid network knowledge or you'll struggle even as a power user.
- zyxley 11y agoRadius?
- burnte 11y agohttps://en.wikipedia.org/wiki/RADIUS https://en.wikipedia.org/wiki/RADIUS
- keeperofdakeys 11y agoRadius is an authentication protocol that is quite widely used, including in WPA-Enterpise. Here there is no fixed password, but a system that allows multiple users with separate passwords. By using WPA-Enterprise, this wifi sense feature will likely do nothing.
- Sodel 11y agoIsn't this the definition of "unauthorized access", as far as the law is concerned? I'd be less uncomfortable if you had to deliberately choose which friends to share a certain network with. "Share with this person", or something.
- OJFord 11y agoYou'd think - because presumably this could come about without you ever signing up to 'WiFi Sense' or any such EULA, if you give one Win10 friend the password, all his friends have it without you even realising WS exists?
- benjin 11y ago>if you give one Win10 friend the password, all his friends have it Only if he opts _in_ to sharing it.
- systemz 11y agoThis is wrong and should be stopped. Microsoft is another corporation after Google which gets and stores our WiFi passwords (android wifi networks backup).
- unsignedint 11y agoAsking people to change their SSID so the system won't share something they are not supposed to be sharing to begin with is very ridiculous. I really don't understand why this is not opt-in to begin with. Microsoft should be forcing people to put in _optin in their SSID to allow this feature to work if they are so inclined to use an SSID to regulate access. At least it would be semi-tolerable if there was a web form of some sort that I can simply put in BSSID so it gets blacklisted systemwide, but I don't think that's even there.
- RexRollman 11y agoAgreed. At my house, we have three laptops, a desktop, three tablets and two smart phones. I don't want to have to change the wireless settings of nine devices because of Microsoft. If this features truly works as stated, it is an incredibly arrogant thing for MS to do.
- finnyspade 11y agoIt doesn't work as stated. Users have to opt to share the password when they connect to wifi router. This checkbox is empty by default meaning you don't share the password by default.
- unsignedint 11y agoIt doesn't make it much different whether that checkpoint is off or not, I basically see two problems with it: 1) Wi-fi access point owner is absent from that decision about sharing the password or not, other than the SSID name (thus, I suggested that Microsoft should have made this ins option basis. This way, at least that it would show that the owner of the AP is WILLING to participate in that.) 2) People do very stupid things. They may not even see a single implication before they "check" it. I've seen a lot of people enabled certain feature "because it sounds useful" without seeing further implication. Especially when they are not that tech-inclined, they may flip that switch "because everyone else's doing it," "that's the way I do in my home," or "I didn't know that's what it meant." I'd know if he/she is sharing my wi-fi password on Facebook by that person writing on their timeline (which I'll pick up my phone and start screaming at that person) but this seems to be much more discreet than that. Again, it doesn't really matter if that checkbox is checked or not. It's a bit of a different story if they had to drill down to several layers of menu (which I wouldn't change my opinion that it is still a bad idea) -- but it sounds like this option is presented right in their face everytime they are connecting to new networks.
- SomeStupidPoint 11y agoAfter thinking about it for a bit, couldn't a worm with fake Facebook accounts that are friends-of-friends with a high percentage of the population use this to spread virtually unimpeded? I suspect that the API is such that all of the friends of the fake accounts will relay to the fake accounts all of their respective friends passwords (given they had connected to said friend's network at least once), and that two steps should given sufficient coverage in dense urban areas to get worms that give near total wifi coverage of the area. Such a worm platform could of course be used to launch a wide range of attacks, as it has a relatively high concentration and a solid coverage of the area (for data relaying). This screams badness at every level: it's relying on the notion of a Facebook friendship to root security, despite that Facebook friendships have no such semantic meaning in the context of Facebook. You were doing so well Microsoft... but this... this is really, really bad, to the point it might pose an infrastructure risk for cities.
- deleted 11y ago[deleted]
- yuhong 11y agoIf they derive the PTK on the server from the stored PMK and sending that instead, this attack would not allow decryption of transmitted packets (other than group key broadcasts) because of the ANonce generated by the AP on each connection used in the key derivation. And the PSK uses PBKDF2 to generate the PMK, making mass cracking expensive.
- SomeStupidPoint 11y agoFor the usage I was thinking of, it doesn't need to decrypt mass packets, but rather, join a massive number of networks. My idea was simply a way to accelerate the spread of a worm through consumer wifi gear by using the set of fake profiles to always be friends-of-friends with the owner of the network (and thus friends with someone who has connected, thus allowing you to connect). The process would be something like this: 1. Find a vulnerability in consumer wifi gear, such that insecure default allow the default config to accept new code from only inside the LAN. (These types of vulnerabilities with default passowords are common; however, remote access is often disabled.) 2. Upload code to one router. 3. Infected routers look for neighbors who they can connect to the network of, then upload the attack code once they're masquerading as a device on the LAN. 4. Repeat 3. Normally, the reason that this attack doesn't really work is that there are simply too few open or insecure LANs of the same hardware type for the attack to have an effective spread rate, thus it's only a thin weak network and breaks quickly in the face of customers fixing, upgrading, or simply turning off their gear. However, in allowing friends-of-friends to get access to a LAN, Microsoft has removed this barrier to worms spreading across consumer networking gear for anyone that can amass a stock set of profiles with decent geographical coverage, making it a viable way to accelerate the spread of a worm through networking gear. Ed: Of course, once the routers themselves are infected, and you have good geographical coverage, the infected routers can be used as a platform to launch attacks. Again, the reason that we don't see this in practice is that it's too hard to get access to all of those LANs because of even the weak security that exists. Microsoft removed that, making the attack viable if people can infiltrate the Facebook social graph.
- manigandham 11y agoHow do features like these even get thought up, planned out, implemented then released without anyone in such a massive company wondering if there might be some issues? Or building it as opt-in or at the very least giving easy settings to disable it. Automation like this is dangerous, I'm not sure saving 10 seconds is worth this kind of massive trust and security breach. When I give someone my wifi password, I know they can just post it on Facebook but at least that's a conscious decision. Same with accepting EULA, at least that was a choice, even if I didn't read it. Doing either thing automatically though is just ridiculous in terms of privacy, security and potential legality so how does a giant company with lots of smart developers and lawyers decide this is a good idea?
- lawnchair_larry 11y agoFrom my experience at big companies, plenty of people do bring things up, but the security minded people rarely have authority.
- deleted 11y ago[deleted]
- deleted 11y ago[deleted]
- giancarlostoro 11y agoSo a pedophile with a laptop will just drive up to a neighborhood and login to download all sorts of porn from your router just because you're running Windows 10? I apologize for sounding so extreme, but I've heard of this actually happening[1], but with an open wifi network. Edit: [1] : http://www.huffingtonpost.com/2011/04/24/unsecured-wifi-child-pornography-innocent_n_852996.html http://www.huffingtonpost.com/2011/04/24/unsecured-wifi-chil...
- userbinator 11y agoOn the other hand... https://www.schneier.com/blog/archives/2008/01/my_open_wireles.html https://www.schneier.com/blog/archives/2008/01/my_open_wirel... (This was 3 years before that. In some ways, it's a bit sad that we've closed ourselves off in order to avoid what might actually bit pretty small risks...)
- skorux 11y agoYou share with your contacts, but not their contacts. The networks you share aren't shared with your contacts' contacts. If your contacts want to share one of your networks with their contacts, they'd need to know your actual password and type it in to share the network. https://www.windowsphone.com/en-gb/how-to/wp8/connectivity/wi-fi-sense-faq https://www.windowsphone.com/en-gb/how-to/wp8/connectivity/w...
- finnyspade 11y agoThere's a lot of FUD & frankly inaccurate information floating around here. When connecting to a password protected router you are given an UNCHECKED BY DEFAULT option to share the password with your friends. What this means is, the user can deliberately share the password they know. This is just as secure as any other system because once you give a user a password they could share it if they chose. Nothing here is "automatic" no data is being proliferated without user consent. If your employees leak your password this way, then it's the same as leaking passwords otherwise. Again this not an opt-in-by-default scenario. It requires a user knowing a password to actively choose to share for each router independently.
- tdicola 11y agoEven if people opt into it, why should this happen automatically? If one of my friends told every single Facebook friend of theirs the password to my wifi I would have a very strong conversation with them and probably never invite them into my home or even consider them a friend anymore. Just because they _can_ share the password doesn't mean they _should_ share the password. I don't see why this kind of automatic sharing should be a 'feature' or frankly should exist at all. I would wager it helps almost no-one (given WP8's miniscule adoption numbers) and just serves to stir up controversy like this that makes MS look bad.
- finnyspade 11y agoThis solves the problem of asking people the wifi password whenever you go over to their house. To a lot of people it's just a pain. When you tell your friends your password, just tell them not to share it. Done! I would wager it helps the windows phone users and doesn't hurt other people. Also it's coming to windows 10 I believe.
- tdicola 11y agoNo, when you save the credentials of the wifi password locally that solves the problem of having to ask your friend for the password every time you go to their place. There's no need to broadcast the password to every friend to fix that scenario. This is your friend sharing out your credentials to everyone they know automatically--perhaps to people who you don't know or don't want to have the password. What happens when a jealous ex or stalker that's still a mutual friend suddenly gets access to your wifi network? What about the security implications of MS' servers storing the passwords, and do they disclose whether those passwords can be subpoenaed by law enforcement? This seems like a hornet's nest of nasty privacy and policy issues. It boggles my mind why they think this would be worth doing.
- tdicola 11y agoWhere are these passwords stored and who has access to them? Can they be subpoenaed by government and law enforcement?