5 ms·

you have to select whether you want to share your WiFi with your contacts upon first time connecting there is a Check box which is by default unchecked. Edit1:

by Zekio 11y ago

you have to select whether you want to share your WiFi with your contacts upon first time connecting there is a Check box which is by default unchecked. Edit1: Also, previous connections are by default not shared automatically either, you have to go to manage known networks and select them and press share before it gets shared. Edit2: If people connect through your shared network, then it shouldn't allow their friends to connect as well. (To my knowledge of this)

fdahgrthkn 11y ago
That's true but kind of misses the point. I'm not worried about my machine using this. Hell, I don't even use Windows. I'm worried about the zillions of people who do use Windows and who will thoughtlessly enable this because it seems convenient. They will wreck the security of other people who have done nothing wrong.
- Zekio 11y ago
  They will only wreck security, because you personally gave them the password, instead of using this system from the start, change your password upon windows 10 release and you are golden? :) Edit1: tho i can see the downsides of this, add you neighbor on Facebook and get free access to their WiFi xD Edit2: You can select whether, you want to share network with Outlook, Skype and Facebook friends, so what i wrote in Edit1 could be invalid if you simply uncheck Facebook.
  - fdahgrthkn 11y ago
    "using this system from the start" I don't use Windows, so I cannot use this system at all. "add you neighbor on Facebook and get free access to their WiFi" That's missing the much bigger downside. Give your neighbor your Wi-Fi password and they can share it with hundreds of their friends automatically. Microsoft claims users will not be able to find the password and that users will only be able to access the Internet, but that assumes there are no security holes. I'm not comfortable putting my network security in the hands of a company I did not choose to associate with.
    - Zekio 11y ago
      Router companies should get together with Microsoft and make some kind of Flag you can tick, so your router actively tells you can't share this, without the ridicules name of "_optout" as last part :)
      - fdahgrthkn 11y ago
        That's one solution. I don't think it's ideal. Not everyone would know to tick that box. I would, but my friends would not and their networks would be vulnerable. It could also require buying new hardware. Once again, I would know to look for a Wi-Fi Sense-proof router, but my friends would not. I also don't think we should be expected to solve problems that Microsoft caused. Why should the industry adapt to Windows rather than the other way around?
        Zekio 11y ago
        Well, will at least be interesting to see what the future holds for Wi-Fi Sense :)
        mikeash 11y ago
        Maybe instead they could have router makers add a flag to opt in to this insanity. Then if people really thought it was important for their networks, they could ensure they have compatible hardware, and turn it on.
    - ppuIndd 11y ago
      > Microsoft claims users will not be able to find the password and that users will only be able to access the Internet, but that assumes there are no security holes. You don't even need a "security hole": the machine needs to know the key to connect. From there, it's your machine -- you will be able to read it out of memory. Now, this is probably out of reach for most "average users", but for even a moderately capable attacker it provides little protection (and tools automating this will likely become available). At best, if the Wifi network is using a passphrase it'll only send you the key (which is calculated by applying the PBKDF2-HMAC-SHA1 function to the passphrase using the SSID as a salt for 4,096 iterations), but this still lets the user get on the network and decrypt traffic.
- morganvachon 11y ago
  This is why the "guest login" feature on most Wi-Fi routers exists, to prevent untrusted persons (and by untrusted I mean anyone other than yourself and possibly-but-not-always your immediate family) from having access to your entire LAN when all they need is Internet access. Of course it works best when your guest login feature supports time-limited random passwords. Set up properly, guest accounts can make this Wi-Fi Sense bug a non-issue for your own network. That said, I think Microsoft made a serious blunder here; it's inherently flawed and I can't immediately think of a way for them to fix it without getting rid of its entire raison d'être.

by Zekio 11y ago

fdahgrthkn 11y ago

That's true but kind of misses the point. I'm not worried about my machine using this. Hell, I don't even use Windows. I'm worried about the zillions of people who do use Windows and who will thoughtlessly enable this because it seems convenient. They will wreck the security of other people who have done nothing wrong.

Zekio 11y ago
They will only wreck security, because you personally gave them the password, instead of using this system from the start, change your password upon windows 10 release and you are golden? :) Edit1: tho i can see the downsides of this, add you neighbor on Facebook and get free access to their WiFi xD Edit2: You can select whether, you want to share network with Outlook, Skype and Facebook friends, so what i wrote in Edit1 could be invalid if you simply uncheck Facebook.
- fdahgrthkn 11y ago
  "using this system from the start" I don't use Windows, so I cannot use this system at all. "add you neighbor on Facebook and get free access to their WiFi" That's missing the much bigger downside. Give your neighbor your Wi-Fi password and they can share it with hundreds of their friends automatically. Microsoft claims users will not be able to find the password and that users will only be able to access the Internet, but that assumes there are no security holes. I'm not comfortable putting my network security in the hands of a company I did not choose to associate with.
  - Zekio 11y ago
    Router companies should get together with Microsoft and make some kind of Flag you can tick, so your router actively tells you can't share this, without the ridicules name of "_optout" as last part :)
    - fdahgrthkn 11y ago
      That's one solution. I don't think it's ideal. Not everyone would know to tick that box. I would, but my friends would not and their networks would be vulnerable. It could also require buying new hardware. Once again, I would know to look for a Wi-Fi Sense-proof router, but my friends would not. I also don't think we should be expected to solve problems that Microsoft caused. Why should the industry adapt to Windows rather than the other way around?
      - Zekio 11y ago
        Well, will at least be interesting to see what the future holds for Wi-Fi Sense :)
      - mikeash 11y ago
        Maybe instead they could have router makers add a flag to opt in to this insanity. Then if people really thought it was important for their networks, they could ensure they have compatible hardware, and turn it on.
  - ppuIndd 11y ago
    > Microsoft claims users will not be able to find the password and that users will only be able to access the Internet, but that assumes there are no security holes. You don't even need a "security hole": the machine needs to know the key to connect. From there, it's your machine -- you will be able to read it out of memory. Now, this is probably out of reach for most "average users", but for even a moderately capable attacker it provides little protection (and tools automating this will likely become available). At best, if the Wifi network is using a passphrase it'll only send you the key (which is calculated by applying the PBKDF2-HMAC-SHA1 function to the passphrase using the SSID as a salt for 4,096 iterations), but this still lets the user get on the network and decrypt traffic.
morganvachon 11y ago
This is why the "guest login" feature on most Wi-Fi routers exists, to prevent untrusted persons (and by untrusted I mean anyone other than yourself and possibly-but-not-always your immediate family) from having access to your entire LAN when all they need is Internet access. Of course it works best when your guest login feature supports time-limited random passwords. Set up properly, guest accounts can make this Wi-Fi Sense bug a non-issue for your own network. That said, I think Microsoft made a serious blunder here; it's inherently flawed and I can't immediately think of a way for them to fix it without getting rid of its entire raison d'être.