Windows 10 Shares Your Wi-Fi Password With Contacts

gsslay writes: The Register reports that Windows 10 will include, defaulted on, "Wi-Fi Sense" which shares wifi passwords with Outlook.com contacts, Skype contacts and, with an opt-in, Facebook friends. This involves Microsoft storing the wifi passwords entered into your laptop which can then be used by any other person suitably connected to you. If you don't want someone's Windows 10 passing on your password, Microsoft has two solutions; only share passwords using their Wi-Fi Sense service, or by adding "_optout" to your SSID.

Comments

if that's true,

[unami]

no guests with windows laptops on my wifi - i'm not going to change my ssid, microsoft style. ugh. i guess this issue will resolve itself after a short shitstorm.

Re:if that's true,

[dinfinity]

It seems that there is room for convenient router functionality that asks you this: 'A device with MAC address x requests access to your network: GuestLAN. Allow?'

Handing out passwords to untrusted parties instead of tokens is archaic anyway.

Re:if that's true,

[sd4f]

Yea i don't get this idea, it absolutely crazy. While I'm sure security experts are going to say why this is a bad idea from the start, at least make it an easy opt out, not some crazy way to not do it.

Re:if that's true,

[Anonymous Coward]

Opt-in would be better.

Re:if that's true,

[Anonymous Coward]

The Slashdot summary is pure FUD. In the article itself you can see an image of the settings, with a large checkbox to enable/disable sharing with Outlook, Skype and Facebook independently and it also has a large slider above those where you can disable it entirely.

Re:if that's true,

[fuzzyfuzzyfungus]

What I would like to see explained in more detail is the claim that 'wifi sense doesn't reveal your plaintext password' during the sharing process.

My understanding was that(except WPA2 with RADIUS and a suitably chosen EAP) there isn't any provision for authenticating to a password protected AP without knowing the password. The AP itself might be able to destroy the password after it has been set, saving only a hash, as is good practice to keep more important sets of usernames and passwords from being compromised; but the client requesting authentication needs the password. The non 'enterprise' cases were designed to be easy to use, not particularly clever; and MS has limited room to get creative without causing nasty breakage on large numbers of variously dysfunctional legacy APs.

With a proper full WPA2 setup, or with one of the 'no authentication at the AP; but captive portal and/or VPN is the only way to access anything interesting' arrangements, you have more options; but how can you 'share' authentication to a WPA-PSK or WEP network without also sharing the key? Did they actually come up with something really clever, or does the UI just not show you the password, thus 'hiding' it?

Re: if that's true,

[TerryMathews]

Most people can't be bothered to look at what their computer is doing before clicking an UAC window, you really expect them to properly opt-out of SSID passkey sharing properly?

Re:if that's true,

[hawguy]

The Slashdot summary is pure FUD. In the article itself you can see an image of the settings, with a large checkbox to enable/disable sharing with Outlook, Skype and Facebook independently and it also has a large slider above those where you can disable it entirely.

Did you read the box?

Save on mobile data usage with Wifi Sense. Join in and get connected to WiFi. By using WiFi Sense, you agree that it can use your location.

Who doesn't want to save on mobile data usage!? How many people will opt-out? Where does it say that by opting in that they are sharing their Wifi passphrase with everyone they share to? It may be obvious to you, but not to 99% of the people that will run Windows 10.

Re:if that's true,

[Anonymous Coward]

Maybe it will change some more, but I just set up WiFi on a Windows 10 build today and it had an UNCHECKED check box for sharing the password. I would have had to check the box to allow it to share. How many people go around checking boxes?

Re:if that's true,

[MightyMartian]

I don't care about whether you can prevent sharing with your friends on FB it whatever, what I care about is me not having to alter my network settings so that if I give you access to my WiFi network, you sharing MY network information with the pwoe you're "friends" with.

Re:if that's true,

[Anonymous Coward]

Your password is stored and hashed on Microsoft's servers. The hash is sent to your contacts. When they try to connect, their computer sends the hash to yours, which then checks that hash against the one on Microsoft's servers. If they match, then access is granted.

Re: if that's true,

[Anonymous Coward]

Those people deserve everything they get then.

How many people can be bothered to check their car's oil level or brake fluid?

Re:if that's true,

[Anonymous Coward]

I don't know if the option exists in Microsoft Windows, but using Linux and WPA Supplicant you generate a PSK with wpa_passphrase and use that PSK to authenticate.

It doesn't really matter whether the third party can see the passphrase or not, though. If they are able to authenticate, they don't need it.

Re:if that's true,

[hawguy]

Maybe it will change some more, but I just set up WiFi on a Windows 10 build today and it had an UNCHECKED check box for sharing the password. I would have had to check the box to allow it to share. How many people go around checking boxes?

Probably the same number of people that want to save on mobile data usage with Wifi Sense?

Re:if that's true,

[Anonymous Coward]

For networks you choose to share access to, the password is sent over an encrypted connection and stored in an encrypted file on a Microsoft server, and then sent over a secure connection to your contacts' phone if they use Wi-Fi Sense and they're in range of the Wi-Fi network you shared. Your contacts don't get to see your password, and you don't get to see theirs.

http://www.windowsphone.com/en-us/how-to/wp8/connectivity/wi-fi-sense-faq

What's the difference between "encrypted" connection and "secure" connection?

Re:if that's true,

[Anonymous Coward]

And what's wrong with that? Lots of places already share their wifi. The way I see it, this might actually be the start of a ubiquitous internet mesh network, which is a positive thing. It would be community driven, just like open source software and crowdfunding.

I guess I don't worry about it because I'm not a neckbeard living in a basement with Cheeto and semen stained clothes. I don't mind allowing people access to my internet connection.

Re:if that's true,

[Anonymous Coward]

If I remember how WPA-PSK works correctly, the AP and the client do not send the pre-shared key in either plaintext or ciphertext. They derive keys from the PSK and certain identifying information that each uses to prove to the other that it knows the PSK. I believe the radio keys are part of the derivation, although they may be encrypted and sent separately. (I once implemented WPA, but it's been a while, so I may be a bit fuzzy on some details.)

However, a lot of public access points run with WEP, WPA, and WPA2 completely turned off. The local switch/router is set up to keep a client from communicating with the Internet until it completes some authentication process such as Web authentication. Of necessity, WEP/WPA/WPA2 must be turned off (or the password at that level must be well-known), or the frames that the, e.g., Web authentication process needs will never make it up to the network management layer.

Re:if that's true,

[jrumney]

This is per PC. And it is on by default. All it takes is one user with sharing via Outlook enabled, and Outlook automatically adding all the spammers' and phishers' mail addresses to his Contacts, and your network has been compromised.

Re:if that's true,

[Anonymous Coward]

The bigger issue is that you are sharing your password with Facebook Inc., and their affiliates.

Re:if that's true,

[Anonymous Coward]

Microsoft doesn't operate my wireless router. How do they grant access to it in this scenario?

Re:if that's true,

[maorb]

The problem is you can't enforce that you're friend didn't enable WiFi Sense without looking over his shoulder. He might end up accidentally distributing YOUR passphrase when he shouldn't be.

The only way to be sure that this doesn't happen is to add an ugly _optout line at the end of your SSID. Frankly Mr. Joe Person down the street shouldn't have to know about Microsoft's new feature to be confident that his passphrase isn't being passed around without his permission.

Re:if that's true,

[bondsbw]

The way I read it, they probably don't.

The FAQ seems to imply that it is only applicable to open routers:

What does Wi-Fi Sense do?

Wi-Fi Sense connects you to Wi-Fi networks around you to help you save cellular data. It can do these things for you to get you Internet access:

Automatically connect you to open Wi-Fi networks it knows about by crowdsourcing networks that other Windows Phone users have connected to. These are typically open Wi-Fi hotspots you see when you're out and about.

Still very questionable, but perhaps not nearly as pervasive. I'd think it would mostly apply to hotels, restaurants, and other places of business.

Re:if that's true,

[Anonymous Coward]

By sharing the connection over your computer's wifi. I'm guessing you've never heard of an ad-hoc network.

Re:if that's true,

[maorb]

After looking at it further and reading some more comments her on /. I'm beginning to suspect that, although WiFi Sense is enabled by default on the system, it does not include new networks by default unless you select them when connecting for the first time. If so, then this issue is much less of a problem since it effectively becomes opt-in, but I still don't like having to look over my friends shoulders to be absolutely sure he/she didn't select the wrong setting my MY home network.

Re:if that's true,

[bondsbw]

And I didn't mean to downplay how big of a problem this may be for the many people who have a password-protected open network for guest access.

I'm just keeping in mind, though, that guest networks are typically isolated from the main network and the guest network would only be shared with friends-of-friends*... probably not an actual issue for the vast majority of people, so much as a theoretical one.

* Actually, come to think of it, would the password also go to friends-of-friends-of-friends? Friends-of-friends-of-friends-of-friends? How deep can this go? The whole six-degrees-of-separation thing comes to mind... could this end up pushing almost everyone's network passwords to the entire connected internet? Yeah, I'd like more info, and the sooner the better.

Re: if that's true,

[Anonymous Coward]

Good thing it fucking isn't, then. I'm sick of these untrue, knee-jerk-reaction posts bashing something that was painstakingly designed.
Sincerely, a security engineer at Microsoft

Re:if that's true,

[Zontar The Mindless]

I don't live in a basement. But I am concerned about being held liable for what others do with my connection.

Re: if that's true,

[Anonymous Coward]

Sweet I'll be there at release. It's like your welcoming me to your network. while I'm here I'd like to install some software, don't worry it'll run in the background.

Re: if that's true,

[Anonymous Coward]

No, and I thank them for the free internet access.

Re:if that's true,

[Anonymous Coward]

That doesn't make sense, though. If it's an open wi-fi network, why would I need to get credentials from someone on Outlook or Facebook or wherever?

I use open hotspots in a lot of businesses, even the haircut place and the tyre rotation shops have free wi-fi now. A lot of them are wide open in the sense that they have no password at all, just a captive portal you have to click "I agree" to. The ones that do require a password have it posted on the wall or at worst you just ask your server. Microsoft didn't build an entire feature into Windows and Outlook just for that.

Re:if that's true,

[retchdog]

then you should be for this. if enough people do it (and get in trouble thereby), there might be pressure to get rid of that liability.

as long as you don't use it personally, it's a win. just chill, have a drink, and let stupidity work in our favor for once.

Re:if that's true,

[Rutulian]

I was curious about this too. But the AC below gave a nice hint, so I went looking for a better explanation. Here is the blurb from the Wiki,

Also referred to as WPA-PSK (Pre-shared key) mode, this is designed for home and small office networks and doesn't require an authentication server.[9] Each wireless network device encrypts the network traffic using a 256 bit key. This key may be entered either as a string of 64 hexadecimal digits, or as a passphrase of 8 to 63 printable ASCII characters.[10] If ASCII characters are used, the 256 bit key is calculated by applying the PBKDF2 key derivation function to the passphrase, using the SSID as the salt and 4096 iterations of HMAC-SHA1.[11] WPA-Personal mode is available with both WPA and WPA2.

So it seems the PSK can be passed around without revealing the passphrase. But if I also remember correctly, the PSK is supposed to rotate (or maybe that's WPA2).

Re:if that's true,

[whoever57]

I think that you are mis-reading the FAQ, I found this in it

When you share Wi-Fi network access with Facebook friends, Outlook.com contacts, or Skype contacts, they'll be connected to the password-protected Wi-Fi networks that you choose to share and get Internet access when they're in range of the networks (if they use Wi-Fi Sense).

What is even more interesting is that it apparently automatically accepts any terms of use and provides passwords to web-based WiFi access logins, which could create some interesting legal situations (did you really accept the terms, and are you logging in with someone else's username/password)?

Re:if that's true,

[Anonymous Coward]

You wouldn't be liable. How do you think Starbucks, McDonald's or the library provide access to people without having liability issues? You could also limit the sites and protocols any guests are able to use.

Re:if that's true,

[Anonymous Coward]

WiFi Sense is NOT enabled by default. It only gets enabled if you enable it.

Re:if that's true,

[Anonymous Coward]

You are full of shit. It is not enabled by default and if you do enable, it only grants access to your internet connect, not the LAN and not anything attached to the LAN.

Re:if that's true,

[Anonymous Coward]

Welcome to Windows 10, where "side-channels" are made official and out of control!

Re:if that's true,

[suutar]

can you point to evidence of this?

Re:if that's true,

[Anonymous Coward]

Yes, 20 years after the first group of people are convicted, and have finished serving their terms, the law makers will take the whole issue in to consideration. You seem to forget that a lot of the issues the original napster dealt with back in the late 90s are still being grappled with today, some 15 years later. Tech moves much, much faster than law.

Re:if that's true,

[Namarrgon]

Here's the thing: You can leave your box unchecked - but if ANY of your friends have access to your wifi, and *their* box is checked, then all their Facebook friends will also get access to your wifi.

And the only way you can prevent this is to append "_optout" to your SSID.

Re:if that's true,

[blang]

So, now your local coffee shop or motel that offers free wifi to their customers now will be serving these same customers, and any members of their rolodex, and colleagues, and facebook friends. Sounds like steeling to me. What happened to asking before taking?

Re: if that's true,

[Anonymous Coward]

Do your mommy and daddy know you are using the internet, son?

Re:if that's true,

[Anonymous Coward]

Wrong. If you have setup wifi access on a friend's machine the regular way, it will not share that connection.

Re: if that's true,

[Anonymous Coward]

Hey! I find that offensive... I don't eat Cheetos.

Re:if that's true,

[Anonymous Coward]

WiFi Sense can automatically connect you to open WiFi networks that other Windows Phone users have crowdsourced by connecting to them. These are usually open WiFi hotspots you see when you're out and about. When one of these crowdsourced hotspots is in range, WiFi Sense can connect you to it automatically to give you Internet access. When you first set up your phone, you can determine if you want WiFi Sense to do this, and you can change this setting whenever you want.

Source

When you share WiFi network access with Facebook friends, Outlook.com contacts or Skype contacts, they'll be connected to the password-protected WiFi networks that you choose to share and get Internet access when they're in range of the networks (if they use WiFi Sense). Likewise, you'll be connected to WiFi networks that they share for Internet access too. Remember, you don't get to see WiFi network passwords, and you both get Internet access only. They won't have access to other computers, devices or files stored on your home network, and you won't have access to these things on their network.

Source

Re:if that's true,

[fufufang]

The problem is you can't enforce that you're friend didn't enable WiFi Sense without looking over his shoulder. He might end up accidentally distributing YOUR passphrase when he shouldn't be.

The only way to be sure that this doesn't happen is to add an ugly _optout line at the end of your SSID. Frankly Mr. Joe Person down the street shouldn't have to know about Microsoft's new feature to be confident that his passphrase isn't being passed around without his permission.

If you are that paranoid, you might want to implement some kind of RADIUS server. I have never looked into it myself though.

Re:if that's true,

[Anonymous Coward]

If you offer something, it's not stealing. Don't like it? Put a password on it.

Also, I highly doubt that all of your Facebook friends are going to suddenly move to within wifi range of your local coffee shop or motel just to get free access.

Re:if that's true,

[Namarrgon]

Every time you give a friend your password, you have to make certain they don't have their Wifi Sense option enabled, or the same situation arises. It's also possible for them to opt into Wifi Sense for your network details any time afterwards too, so you better remain on good terms with them.

There's a reason that Microsoft added the ludicrous option of opting out via your SSID - it's because there's simply no other way to be certain this doesn't happen to you.

Re:if that's true,

[Anonymous Coward]

Thank you for defending the innocent. Clearly Microsoft doesn't deserve to be the target of a FUD campaign.

Re:if that's true,

[Anonymous Coward]

No, unchecking that box make YOU not spread the password automatically. The whole issue is this:

You give your password to your friend Anna.
Anna has Wi-Fi Sense active.
Anna's friend Beatrice come close to your network and is now granted access.

While Anna could have remembered the password and passed it on to Beatrice in the first place that would require active choice and effort. What the article claims is that you as the network owner cant stop Wi-Fi Sense from passing on passwords that you gave to someone else. However if you kept your passord secret and only Wi-Fi sensed a hash over to Anna then Anna would be able to access your network and Beatrice would have to become your friend to access it (which you want, since she's single and at least a 6)

Re:if that's true,

[mSparks43]

Much better plan imho is to just use a MAC address whitelist to "opt out"

I've been doing this for some time. "my" wifi, high bandwidth, load balancing, access to filesharing has the one whitelist.

If you aren't on that whitelist you get dropped into a virtual lan, with shared 150kBs max up/down bandwidth and a piratebox.

Re:if that's true,

[Dr. Spork]

Agreed. As an opt-in feature, it's actually a good idea. I've written down passwords on stick-it notes for visiting friends, and that sort of opt-in password sharing is also not without security issues. My stick-it notes don't self-destruct. I think it also makes it more concrete who really is a friend - a person with whom you're willing to share your wifi password. I think that's actually a pretty good minimum standard for friendship.

Re:if that's true,

[houghi]

"typically", so they can be anything, including the person next to you on the metro or you for the person next to you in Starbucks where the router is down.

So suddenly they are surfing on your limited data bandwith and you don't even know it. Nice.

I would think that I say who has access to my network. This goes far beyond 'we own your hardware our software is running on" and even that is not debatable.

Re:if that's true,

[wimconradie]

Your password is stored and hashed on Microsoft's servers. The hash is sent to your contacts. When they try to connect, their computer sends the hash to yours, which then checks that hash against the one on Microsoft's servers. If they match, then access is granted.

So if I am trying to connect how would I be able to send any hash to any computer while I'm not connected?

Re:if that's true,

[bondsbw]

Well, I agree that it's a solution looking for a problem. Really the only time I could see that being useful is if you go to a restaurant or coffee shop and want to get on their Wi-Fi, and a friend has already been there before and logged in.

Re:if that's true,

[Anonymous Coward]

Uhh when your computer is trying to negotiate a connection with the computer sharing the connection.

Re:if that's true,

[Anonymous Coward]

No, your friends can only share your connection with others if YOU have WiFi Sense enabled. If they connect directly to your router with a password, the connection is not shared with anyone they know (unless they physically tell someone). WiFi Sense does not send out your password, it sends out a hash of your password that will only work while your PC is turned on and has WiFi Sense enabled.

Re:if that's true,

[Anonymous Coward]

Wrong. WiFi Sense doesn't send out your password and the instant you turn it or your PC off, a connection can no longer be established.

Re:if that's true,

[Anonymous Coward]

How does microsoft know that I'm at a friend's house and that that particular passphrase should not be shared?

Re: if that's true,

[Stuarticus]

Just stop driving American cars and you don't even need to.

Re:if that's true,

[Anonymous Coward]

You can go ahead and share the authentication credentials, but if the PC with the connection has WiFi Sense disabled, there would be nothing for anyone else to connect to. WiFi Sense doesn't operate directly with your router, it's PC to PC.

Re:if that's true,

[Anonymous Coward]

I don't follow this. I connect at a friend's network and accidently share their passphrase. My machine has WiFi Sense enabled, theirs has not. Can my contacts access the WiFi network that is not mine?

Re:if that's true,

[twokay]

Unlikely considering the current success of Windows Phone ;) But on the face of it, yes it sounds pretty nuts.

Re:if that's true,

[Bert64]

The PSK *is* the passphrase... The only thing the passphrase gives you is access to the network, and the key does that too.

Re:if that's true,

[TheRaven64]

A better solution would be a standard form of QR code for WiFi configuration info, so you just point your camera at something and now you have WiFi credentials.

Re:if that's true,

[jrumney]

You are the one who is "full of shit", since you are getting all of your information on the implementation of this feature on Windows 10 from an old article about Windows Phone 8.

Re:if that's true,

[Bert64]

Limiting sites and protocols just causes problems, people will have their devices setup to connect to all manner of things (vpns, email, im, voip etc), and restricting what they can access will invariably block some stuff and render the connection unusable, causing a denial of service if the handset automatically connects to the wifi and loses its cellular connection where everything was working.

Re:if that's true,

[Anonymous Coward]

This is a half-assed explanation, and it would not work.

"if they match, access is granted"? really? magically?

And the computer sends messages *before* access is granted?
and they send the hash to *you*, and you, the one that created that hash, have to check it with microsoft servers?

Like, what?

you *need* a cleartext password to connect.

What you are describing *might* work if:
- you connect to an open network
- you check that a friend has connected to that bssid (so you check the bssid hash, NOT THE PASSWORD HASH)
- if ok you disable temporary firewall restrictions and let applications communicate.

Re:if that's true,

[dissy]

I think that's actually a pretty good minimum standard for friendship.

The new relationship standards:

A friend is someone you share wifi passwords with.
A best friend is someone that helps hide the bodies.
True love is when you merge your media collections.

Re: if that's true,

[Anonymous Coward]

You realize Mac addresses are visible to a sniffer right? Then it is just a matter of them using one of your authorized ones.

Re:if that's true,

[AmiMoJo]

TFA has the wrong screenshot. This is the important one: http://cdn5.howtogeek.com/wp-c...

When you connect to the network there is a box that very clearly says "share network with my contacts". It could be a bit clearer, but it does at least make it obvious that the network details you are entering are going to be shared.

Re: if that's true,

[Anonymous Coward]

Microsoft: Now with paid shills on /.

Re:if that's true,

[Anonymous Coward]

Or, you know, you can create a MAC whitelist on your access point. Pain in the ass, sure... but pretty effective nonetheless.

Re:if that's true,

[Pope Raymond Lama]

It looks like it is not /. editors who can't read things here, but you. This is the sitautionm - I own Wifi access point "A"; Friend "B" comes by, I physically pass A's password to B. Now "B" is the one with the option to share or not the passwords (and all of them) with all HIS contacts - not mine. And moreover, it will happen by default - if B has 2000 Outlook.com contacts, all those 2000 people will be automatically allowed to connect on my WiFi "A". And the ony means this not to happen is if `B` opt out __all__ his sharing (not just for WiFi "A") or if WiFi "A` SSID is formatted as dictated by Microsoft (i.e., ending in `_optout`).

This is so insanely ridiculous that there are no word to describe how ridiculous that is.

Re:if that's true,

[Anonymous Coward]

No it is not. Sharing with Microsoft is far worse.

Re: if that's true,

[BorgDrone]

A MAC whitelist provides exactly 0 additional security. Worse, people like you think they are secure when in fact they are not, making it less secure in practice.

Re:if that's true,

[Ol Olsoc]

Friends-of-friends-of-friends-of-friends? How deep can this go? The whole six-degrees-of-separation thing comes to mind... could this end up pushing almost everyone's network passwords to the entire connected internet? Yeah, I'd like more info, and the sooner the better.

Sounds like Kevin Bacon will have access to everything!

Re:if that's true,

[Anonymous Coward]

Is it on by default? Then it's a problem.

Re:if that's true,

[unixisc]

I think that you are mis-reading the FAQ, I found this in it

When you share Wi-Fi network access with Facebook friends, Outlook.com contacts, or Skype contacts, they'll be connected to the password-protected Wi-Fi networks that you choose to share and get Internet access when they're in range of the networks (if they use Wi-Fi Sense).

What is even more interesting is that it apparently automatically accepts any terms of use and provides passwords to web-based WiFi access logins, which could create some interesting legal situations (did you really accept the terms, and are you logging in with someone else's username/password)?

'You choose to share' is key here, so the headline is definitely misleading. I could choose to share my primary SSID, or I could choose to share just my guest SSID. If I did the latter, there shouldn't be a problem

Re: if that's true,

[Anonymous Coward]

Is it? What if they see not adding "_optout" to the ssid as "choosing"?

Re: if that's true,

[Anonymous Coward]

I Check fluid levels in my car around once a month or so. I cannot remember the last time i had to add anything besides windshield washer fluid.

Re:if that's true,

[Anonymous Coward]

I don't live in a basement. But I am concerned about being held liable for what others do with my connection.

Or TO it.

Re:if that's true,

[ultranova]

What is even more interesting is that it apparently automatically accepts any terms of use and provides passwords to web-based WiFi access logins, which could create some interesting legal situations (did you really accept the terms, and are you logging in with someone else's username/password)?

Did you really accept the terms if you clicked past the legal boilerplate without reading it? Because in the digital world, that's how things work. In theory, you can read and consider the consequences of the terms of use of every single service and program you use, but in practice that's a far too onerous requirement. So if your question is actually meaningful - if those "terms of use" are legally binding on the user - then the legal system is going to implode.

Re: if that's true,

[TemporalBeing]

A MAC whitelist provides exactly 0 additional security. Worse, people like you think they are secure when in fact they are not, making it less secure in practice.

MAC whitelist is a good first step, but it's just a first step. You always have additional security after that, such as WPA2 and/or a Radius Authentication Server. And honestly, if you had a Radius Authentication Server it wouldn't matter if the WPA2 cred was shared...they would still have to authenticate and you just rotate the password on the guest account.

Re:if that's true,

[Rutulian]

Did you read my comment? The key is derived from the passphrase, it is not the passphrase itself. Neither the key nor the passphrase is ever transmitted. There is a handshake protocol where both the AP and the client demonstrate they both know the key and then a unique session key is generated from the key to encrypt traffic.

Re:if that's true,

[Anonymous Coward]

Why should a third party be the gatekeeper to my network?

Re: if that's true,

[mSparks43]

that's not the only protection in that zone.
if they try that they are isolated from the entire network until the username/pass is entered for the network.

point is. if you aren't in the whitest you can connect to a low quality Internet access an file box for sharing movies and music. but anything "personal" is on a seperate network.

a bit like the cable companies do on their routers. only with file sharing.

lots of ways to do it. but my point is people should already be running at least two networks anyway. one for them and their devices and one for guests.

Re:if that's true,

[unixisc]

The Slashdot summary is pure FUD. In the article itself you can see an image of the settings, with a large checkbox to enable/disable sharing with Outlook, Skype and Facebook independently and it also has a large slider above those where you can disable it entirely.

I tried it out right now. In Windows 10, when you go into Settings and then 'Network & Internet' then under the list of WiFi WAPs, just under Properties, there is 'Manage Wi-Fi settings'. When you go there, there are 2 switches:

1. 1. Connect to Wi-Fi hotspots
2. 2. Exchange Wi-Fi network access with my contacts

You can disable the second item. Below it, there is a description that says 'You select the Wi-Fi networks you want to share with these contacts. They get internet access if they use Wi-Fi Sense, but they don't get to see the shared passwords. You'll also get Internet access through the networks they share

Regardless, I did a couple of things. So far, I had not been using the Guest network on the router, but I renamed it, gave it another password and enabled it. Most of my toys - my tablets, phones and this PC-BSD laptop that I am using are on my main WiFi network. I've put my Windows laptop and Winbook tablet on the guest network, and disabled the WiFi network access option. From now on, any guests I have would get access to the latter SSID, but I still am not sharing the network contents on my laptop. So I now have 2 networks - one for my Windows boxes, and the main one for everything else.

FWIW, Windows 8.1 too has the option of sharing network access, and they too make all the devices on that network visible on your computer.

If only people would see what the OS actually does, instead of spreading FUD just b'cos they loathe Microsoft (which today is a shadow of its former self)

Re: if that's true,

[unixisc]

My car is supposed to undergo a warranty service every 6000 miles: I do it at 5000. So I expect things to be fine as long as that happens. If it doesn't, Subaru would have to do some major warranty repairs.

Re:if that's true,

[unixisc]

The Slashdot summary is pure FUD. In the article itself you can see an image of the settings, with a large checkbox to enable/disable sharing with Outlook, Skype and Facebook independently and it also has a large slider above those where you can disable it entirely.

Did you read the box?

Save on mobile data usage with Wifi Sense. Join in and get connected to WiFi. By using WiFi Sense, you agree that it can use your location.

Who doesn't want to save on mobile data usage!? How many people will opt-out? Where does it say that by opting in that they are sharing their Wifi passphrase with everyone they share to? It may be obvious to you, but not to 99% of the people that will run Windows 10.

They are not changing the passphrase. The contacts would get Internet access, but would not get to see the passphrase. It says so clearly in Settings, under 'Network & Internet':

You select the Wi-Fi networks you want to share with these contacts. They get internet access if they use Wi-Fi Sense, but they don't get to see the shared passwords. You'll also get Internet access through the networks they share

Re: if that's true,

[unixisc]

The original cliche was 'The network is the computer', and that was a cliche of Sun, not Oracle.

Re:if that's true,

[retchdog]

i forgot no such thing. something is better than nothing.

by the principle of comparative advantage, stupid people can benefit the world by struggling and suffering through what should be minor annoyances for the more capable. and thus, there is equality.

Re: if that's true,

[Anonymous Coward]

There is no issue. Just turn off WiFi sense if you don't want to share your networks. Even if you do share your networks they can't see your password so I don't see the both deal.

Re:if that's true,

[Anonymous Coward]

There's nothing to resolve. It's not sharing your actual password and if you don't want to share anything just turn off wi-fi sense. I'm running Windows 10 on my phone now with wi-fi sense off. I'm still here with all 10 toes.

Re:if that's true,

[Solandri]

I've always wondered why wifi networks only allow a single password. Why can't they allow multiple passwords? That way you can create a temporary one when a guest needs to access something on your LAN but you don't want to give them permanent access. Right now the only way to do that is an ethernet cable, or change your password to something else, give him access, then change it back when he leaves.

Multiple passwords would also give you the ability to revoke passwords you consider to be compromised, without affecting the ability of others with "good" passwords to continue connecting. I used to give my parents and my sister my wifi password so they could connect when visiting. Then I learned my dad had given the password to a friend who came to visit with him once. I had to change the password, which meant entering the new password on all my devices plus all my sister's devices.

You could even give different privileges based on password. Internet-only. Internet-only at reduced bandwidth. Internet + LAN. LAN-only. Only one other device on the LAN. etc. Kinda like the guest network thing showing up on newer routers, except a lot more flexible.

Re:if that's true,

[ceoyoyo]

That seems silly. My phone is quite capable of finding open wifi hotspots all by itself. It's the ones where it doesn't know the password that are a problem.

Re:if that's true,

[StikyPad]

Spoiler alert: Kevin Bacon already has access to everything.

Re:if that's true,

[jakimfett]

This is the best explanation I've seen yet. Thank you, if I had mod points, you'd be getting an "informative".

Re:if that's true,

[bondsbw]

I'm talking about the open hotspots that are protected behind a password web page, such as many home guest networks, restaurants, and hotels.

Re: if that's true,

[geminidomino]

Might want to go easy on the self-righteousness there, MS Security Engineer AC. Just because the FUD is bullshit doesn't mean that the whole idea isn't a massive "painstakingly designed" misfeature that should never have seen the light of day.

Re:if that's true,

[Anonymous Coward]

I just want to know who the genius was at MS that thought that this would be a great idea at all. How fucking stupid was it for this feature to percolate up to this point without anyone saying WTF are you nuts?

Re: if that's true,

[Anonymous Coward]

well, the point is, that those people then share YOUR password/phrase/...

Re: if that's true,

[Anonymous Coward]

well then make it clear, that it isn't, explain, how it was designed and how it works and do this to everyone using it (and not only to the people who go looking after it, because that's about 5% of your users), and, by god, don't fuck up the translations into every other language your OS exists in (because you usually do).

sincerly, someone who does not use windows, but from time to time still has to to dig through your incredibly complicated UI, to solve windows-problems for people who are too stupid or unwilling to understand the fucking manual, even if they read it.

you can design security features as meticulous as anyone, but if your UI group makes them hard to use, your features are worth shit.

Re:if that's true,

[hucker75]

Do we care? I hand my wifi password out to my neighbours. All they can do is get free internet, which is there anyway.

Re:if that's true,

[ceoyoyo]

Oh, gotcha. Like the ones you pay for by the minute. Awesome.

Re: if that's true,

[Evan Langlois]

And we can count on Microsoft to make sure those phones are secure once the password reaches the destination. And no one can hack Microsoft's servers. But that's not the issue. It isn't Microsoft's right to share my passwords with Facebook. That is between me and an individual, not Microsoft, not all of that individual's Facebook friends. And this being a default means it will happen without most people knowing how to turn it off, or even knowing its happening. This will go to court. Watch how fast it gets turned off on the "Business Edition" of Windows! No company is going to let Windows X share the corporate security keys.

Re:if that's true,

[Anonymous Coward]

WiFi sense has been on Windows Phone for almost 2 years now.. I love it to be honest. Microsoft has been doing studies involving devices moving from Cellular to Wifi Networks... the result has been increased battery life for mobile devices that share this feature. The system is not displaying the wifi passwords to anyone, and users can easily opt out directly from their devices if it is a problem. I am the IT manager where I work and all of our employees have Windows Phones, they work great... we have multiple remote offices and the wifi information easily replicates to all of our end users.

Re:if that's true,

[farble1670]

When's the last time you encountered an open wifi network that didn't have a web-based authentication scheme in place?
I must be missing something.

Re:if that's true,

[bondsbw]

Perhaps, I don't know how those work. I've only used pay-by-the-day at hotels.

Re:if that's true,

[Anonymous Coward]

Boys, you better understand schizophrenia EXISTS and take out of the operating system all schizophrenics, otherwise they will end up making scrambled eggs of all computers in the network and losing all boundaries between YOUR computer and THE mess.

Re: if that's true,

[KGIII]

Nope. They are getting free wifi from their neighbor thanks to this sharing option.

Re: if that's true,

[Anonymous Coward]

BUT BUT Ellison is teh jesus of the network puters: One news story even headlined: "Ellison resurrects network computer"

Re:if that's true,

[Anonymous Coward]

"if they match, access is granted"? really? magically?

Yes, because PCs are nothing but magic boxes. It has nothing to do with one PC "asking" for access, providing authentication (in the form of a hash) and the receiving PC responding "OK". Nope, must be magic. Stupid fuck.

And the computer sends messages *before* access is granted?

If your computer tries to negotiate a connection with another computer that is sharing an internet connection, how the fuck do you think it does that if the computer sharing the connection simply ignores everything your computer sends to it?

and they send the hash to *you*, and you, the one that created that hash, have to check it with microsoft servers?

No, Microsoft creates the hash and stores it on their server so that no matter which Windows PC you are using anywhere in the world, you can login with a Microsoft account and share the connection. What you think computers you never used before somehow magically get the hash before you use it?

you *need* a cleartext password to connect.

Nope. Microsoft confirms that is false.

Holy fuck, you are stupid. Don't ever try working with computers because you'll only fail.

Re: if that's true,

[Anonymous Coward]

So then if everyday people do these kinds of things, then you can bet they know how to toggle an option for wifi sharing. I think people on Slashdot don't give the average Joe enough credit. Most people can use their computers just fine, but I guess some of the "techs" are angry because it shows that their job isn't all that special or hard to do.

Re:if that's true,

[Anonymous Coward]

Read these:
Internet Connection Sharing
Wireless ad hoc network

WiFi Sense is nothing more than modern connection sharing that has been around in Windows since at least Windows 98.

Re:if that's true,

[Anonymous Coward]

It's current information and the feature will be exactly the same in Windows 10. In case you hadn't noticed, Windows 10 isn't even out yet, so why the fuck would Microsoft be putting up FAQs for it?

Also, you didn't even provide a single shred of information. Now you're angry because I exposed you for the fucking moron that you are.

Go read a book and learn something, junior.

Re: if that's true,

[Anonymous Coward]

How does the painstaking design prevent my friend from sharing access to my network with every Outlook, Facebook and Skype contact of theirs who happens to have WiFi Sense enabled? I have no idea who will be getting that access beyond that my friend happens to have their email address, and the only way to prevent it is not to give my friend access to my network, which might not be optimal for continuing that friendship (or append _optout to my SSID - how would I ever know to do that?)

Re:if that's true,

[bondsbw]

What you mentioned is what I was talking about, that it would only apply to open Wi-Fi networks with web-based authentication (as opposed to encrypted connections).

Re:if that's true,

[lsatenstein]

my Linux based router allows (accommodates) mac-address filtering. But the interface chip address can be bypassed to allow your system to report any desired mac address.

Re:if that's true,

[Namarrgon]

No, it really isn't. ICS lets a user connect to a PC and access the internet through that PC. The PC becomes an access point.

WiFi Sense lets your friends connect directly to your router, by securely sharing its details with them. Your PC doesn't even have to be on.

This is how it's possible for your friends to share those router details with their friends. Win10 doesn't know it's your router and not theirs, it will let anyone with the password enable WiFi Sense sharing.

Re:if that's true,

[daedalus2097]

From the FAQs:

"If you decide to manually enter your password on someone's Windows Phone instead of sharing access through WiFi Sense, make sure they can't see what you're typing when you enter it, then untick the Share network with my contacts checkbox before you tap Done to connect."

It means guest devices connected using your password will think your network is their network, and can share access with their contacts unless you untick the box.

No thanks.

Re:if that's true,

[Anonymous Coward]

The point Bert64 is making is that this hash is the actual authentication token. The 'passphrase' is just a convenient user interface for entering the long string of hex digits - this would be hashed on the client, then that result is sent to the server as the actual password.

It sounds like you're talking about something like session keys (I don't know the WPA terminology for it, that's what SSL calls it) - after authenticating with the PSK (which IS the password to the network), a temporary encryption key will be negotiated, then possibly rotated at regular intervals. This is just used for encryption, not for auth.

Re:if that's true,

[ceoyoyo]

There are some services where you can get an account and get charged by the minute. Skype Wifi does that, and Boingo I think.

I don't imagine the cell companies would be particularly pleased with people sharing their cell account wifi logins either though.

Re:if that's true,

[AK Marc]

PSK is Pre-Shared Key. The "key" in that is the passphrase. You pre-share it by putting it in both devices before you try to pair them. The PSK isn't the session key. As you say, that's generated for the session.

And nobody was talking about what is "transmitted" so unclear what that has to do with whether the PSK you enter on the "passphrase" space on the router is a [PS]Key, or a passphrase. It's both. The terms are used interchangeably for that setting. And yes, that's confusing as "key" is used elsewhere for a different purpose. But that doesn't make your car-key not a key because it doesn't look like your house key.

Re:if that's true,

[AK Marc]

MAC address filtering isn't very secure, but it's better than nothing. It's like the door chain. They are easily cut, can be kicked open easily, and don't really improve security, but it makes you feel better. Aside from brute force, the glaring hole is that someone can snoop your network and see all the valid MACs on it, even if encrypted. Then, when any of those devices are gone (like your cell phone on WiFi in range), clone the MAC of the missing device, and you are 100% in, if MAC filtering is your only authentication. At best, it will deter a casual snooper, but will only add a tiny delay to a targeted attack.

Re:if that's true,

[Rutulian]

Ok, since you are the second person to say this, I guess I was unclear. The way PSK works in WPA when you use a passphrase is:

(passphrase + SSID) * hash algorithm = pre-shared key (PSK)

The PSK is not the passphrase; it is a deterministic transformation of the passphrase, much like the way passwords on your local system are stored. Why is this distinction important? Well, for one the PSK is much less susceptible to dictionary-style brute-force attacks than the passphrase it is derived from. Second, if your key becomes compromised, you can do something as simple as changing the SSID, and that will generate a sufficiently different key without needing to change the passphrase.

So, the answer to the original question in this thread, "How do you securely share the wi-fi password with your contacts?" is "You don't, directly. You share the PSK, because that is all that is stored locally on your client." And the reason that works is because the way your computer authenticates locally with a password database is fundamentally different from the way your client authenticates with your AP.

Re:if that's true,

[AK Marc]

You've missed. It's not about the technical definition. The "key" is the passphrase. The passphrase is pre-shared. The shared secret is the key, and that is the passphrase.

The crypto key is what you are describing, not the pre-shared key the user uses.

The failure to communicate isn't our misunderstanding of the technological terminology, but your inability to put the technical terminology aside and listen to others.

Re:if that's true,

[Rutulian]

Um, sure ok, if you want to think about it that way. I see what you are saying, but the question relevant to the discussion is "How do you share a passphrase when its only representation on the system is as a hashed key?" That is the question that started off the whole discussion. For example, if I steal your desktop's hashed password list, I can't use that to break into your system (not easily) because you need to know the actual passphrase (not just the hash) to authenticate. With WPA-PSK this is not the case, but it's the risk everyone accepts when they use it.

Re: if that's true,

[AK Marc]

Brake fluid? Who needs brake fluid? Mechanically activated 4-wheel drum brakes works for me.

Re:if that's true,

[unixisc]

No, Microsoft specifically says that the connection is shared, but the password isn't. Anna can only share her own connection, if she has one, w/ Beatrice, not yours. Also, enabling that enables you to share Anna's connection, if she allows it

Re:if that's true,

[suutar]

Good to know, thank you for the pointers :)

Re:if that's true,

[Anonymous Coward]

You do realize that Android phones already do this, right? What they lack is built-in support but with a QR code reader, you can read a wifi SSID and password from a QR code.

Re:if that's true,

[TheRaven64]

No, I wasn't aware of this. A quick search shows a number of sites to generate them, but I can't find a spec of what they contain. It would be nice if this could be standardised.

Lol, what could go wrong.

[Anonymous Coward]

I can't wait

No

[Anonymous Coward]

ahhhh no, for networks you have SELECTED to share it can do it. Wifi sense being on doesn't suddenly expose all your wifi passwords. extremely inflammatory summary. still seems a stupid risky feature, just not as dumb as those writing the Slashdot summaries.

Re:No

[Anonymous Coward]

Or networks THEY have selected to share. Still huge hole if you tell some one your wifi password.

Re:No

[danomac]

However, just because I gave Person A access to my wifi, that doesn't mean I give everyone Person A knows access to my wifi. This could end up in legal hot water territory.

I guess that I just won't be giving any guests access to my network anymore. They can pony up and get their own mobile data plan for their devices.

Re:No

[MightyMartian]

Inflammatory Mode On: Why in the fuck would even want to opt-in to such a service? If it's private WiFi, it's likely to be at my home or my workplace, and in either case I absolutely do not ever want to share that over fucking Fuckbook, Twatter or whatever stupid lame-ass soshial neshworking crap site becomes the next biggest and greatest.

Rational Mode On: Now let's imagine that my organization has a private WiFi hotspot available for employees and a few others. I do not ever want to have those keys shared outside that group, nor should I have to change MY network with an "_optout" on the end of an SSID. I would consider that a breach of security. Sure, I'll probably be able to disable Windows devices that are domain members via GPO, but if they're not actually devices belonging to the organization, or "Pro" versions of Windows where it even knows what the hell Active Directory is, then MY network is being compromised by this service.

This is just a plain bad idea, whether you're being reasonable or inflammatory.

Re:No

[Harlequin80]

Serious question - who here is not running a guest wifi access point? I would never give full access to my network to an unknown device. So I run an open guest wifi which is on a different subnet and has its internet rate limited.

Re:No

[amicusNYCL]

Serious question - who here is not running a guest wifi access point?

I'm going to guess the vast majority of people running wifi at home. My office has a guest network, my house does not.

Re:No

[Anonymous Coward]

if you have given them a password you have already lost control of who has access to your network, even if it isn't shared automatically what is to stop them emailing it to everyone.

Re:No

[Anonymous Coward]

if you told someone your wifi password you have already introduced a massive hole that you no longer control. the sharing through sense is no different to them emailing it out which they can also do.

Re: No

[danomac]

I do in the manner you mention but now I am not so worried about it anymore.

Re:No

[Anonymous Coward]

ahhhh no, for networks you have SELECTED to share it can do it. Wifi sense being on doesn't suddenly expose all your wifi passwords. extremely inflammatory summary. still seems a stupid risky feature, just not as dumb as those writing the Slashdot summaries.

I was about to say...Still sounds like an incredibly risky feature...if that transmission was intercepted or a vuln was discovered...could get seriously ugly.

Re:No

[Anonymous Coward]

Then you click the little doodad that disables Wi-Fi Sense and go on about your business like you always have. This is a total non-story.

Re:No

[ewhac]

ahhhh no, for networks you have SELECTED to share it can do it. [ ... ]

ERROR: MISLEADING.

Wi-Fi Sense's default settings are to share everything, all the time. Indeed, Microsoft's rules for shipping Windows Phone 8.1 requires OEMs to turn this "killer feature" fully on. Expecting users to have the presence of mind to turn this off is willfully disingenuous.

Re:No

[Luthair]

From a security perspective you kind of do as Person A can give out the password to whomever. That said I agree, I don't like the idea of Microsoft automating it.

Re:No

[Balthisar]

I don't run an incubator in my house, so usually it's just friends' kids that want to connect their iPhones to my network, thus I have no reason to run a separate guest network, although Tomato on my AP's would make this trivial. The networked computers have passwords for VNC and keys for ssh, and I'm not overly concerned that my friends' kids will have compromised iPhones that want to brute-force anything.

Re:No

[Anonymous Coward]

So what, a guest AP/subnet doesn't stop somebody from connecting, downloading a car and having the RIAA come after you since it still comes out your gateway. It just stops them from being able to ping your laptop or whatever you seem to care about.

Re:No

[Chris Mattern]

Me--because my wifi router is entirely private. Only I use it.

Re:No

[fuzzyfuzzyfungus]

Just as they say, in the context of backups, that 'if it isn't automated it won't happen'; there is likely to be a considerable difference in the rate of unintended leakage between a 'yeah, I guess I did tell Bob the password, he could pass it on' and 'the password spreads through your entire social group like a bad chain email'.

This sort of 'friend/acquaintance' attack attack is also exactly where slightly-too-automatic automation makes it really easy to bypass what limited good sense about security humans do have.

If, say, Alice and Bob have just had a messy breakup; it would be fairly obvious to any mutual friend of the two that sharing one's wifi password with the other, or a known friend/agent of the other, is something that they wouldn't like. They might do it anyway; because people are assholes like that sometimes; but it would be deliberate. Social-engineering somebody in that situation into telling you the password might be vaguely tricky. Social-engineering them into making you enough of a contact/friend/whatever on the services that this 'wifi sense' system uses to receive the password should be absolutely trivial; quite possibly already done.

I suspect that it isn't for nothing that this 'feature' first appeared on Windows Phone; carriers adore the idea of getting the filthy customers off the cell data networks they pay for and onto wifi as often as they can, and don't much care about a bit of collateral damage inflicted by dumb implementations.

Re:No

[MightyMartian]

There's a doodad on my AP that let's me disable a feature on a connecting WiFi client?

Re:No

[Anonymous Coward]

My house has a guest network, so does my parent's house. Wireless routers these days almost invariably let you setup multiple SSIDs and let you specify whether devices on the guest one can see devices on the normal SSID. I know a lot of people run very old routers - yeah, those can't do it, but all of the modern ones can.

Re:No

[Anonymous Coward]

Where did I say anything about your AP? What kind of tenuous link are you trying to fabricate here?

I said disable WiFi Sense by clicking the little doodad slider thing right next to it.

Re:No

[Anonymous Coward]

And where is this doodad slider thing that allows me to uncheck that box on my employees personal laptop- which I allow them, and only them to use on my work wifi?

Re:No

[Anonymous Coward]

*facepalm*

If you're asking this question, you shouldn't be trying to admin a corporate network.

Re:No

[Anonymous Coward]

I meant to talk to you about that. Can you please stop downloading so much porn? It's getting in the way of me downloading torrents through your network.

- Your neighbor

Re:No

[Anonymous Coward]

Only friends and family get on my network, and I never host many at once for long (small apartment, we usually hang out elsewhere), so I never saw a need for it.

Now, though, I just turned it on.

Re:No

[the_B0fh]

OP is asking a very pointed question to which you have no answer, so you are avoiding the answer instead of owning up to it.

If you really don't understand OP's point, go read it again.

Re:No

[Anonymous Coward]

I not only have a guest network, I have another wlan used specifically by my neighbor, totally isolated on it's own vlan. Still doesn't mean I'm allowing a win10 device on either my WLAN or my guest wlan. Neighbor can do as he wants with his vlan, if it impacts the rest of my networks, I'll add rate limiting or just outright remove it.

Re:No

[I'm New Around Here]

If you don't get the AC's and MM's point, you can shove that facepalm up your ass.

The person running the router doesn't always have control of the devices connecting to the router. Even if that person was able to turn off the email-secret-password-to-the-world feature while the device is in the office, there is no way to ensure it doesn't get re-enabled two hours later.

Re:No

[tepples]

Yes. It's called rotating the WPA2 key.

Re:No

[Anonymous Coward]

It is because it defaults to enabled. Automating this at all is also a bad idea. It encourages stupid behavior.

Re:No

[Anonymous Coward]

Each and every fucking device now needs to have its own/dedicated account -- block Win10 devices across the board, and ban devices that attempt to connect using the same credentials.

Re:No

[Harlequin80]

Most newer routers come with guest wifi as an easy to setup option.. To me it is just one of those things you setup by default.

Re:No

[i.r.id10t]

After setting up the new device adn being prompted "Do you want to share your connection" how many users are gonna think to themselves "Well, yeah, I want to share this with my iDevice and tablet and the $housemate and ... " and click "Yes" ?

Re:No

[Harlequin80]

What do you mean by incubator? I have images of 100s of baby chickens running around....

I have NFS shares which share media between a freenas box and multiple kodi front ends. Also stored on that is all the digital photos and camcorders that we have taken over the past 10 years. I am less concerned about people being able to access them then having someone delete something. Yes I could change permissions and everything like that but given my wife uses a windows box that gets painful fast. So Samba has read & write privileges which means someone with a phone could be an arse. (And yes it's backed up but I still don't want the hassle)

I realise that it is probably overly paranoid but I just prefer to not give anyone access that I don't need to.

Re:No

[Balthisar]

By incubator I meant having 20 computer nerds living in my house while I foster their startup ideas. I would certainly give more thought to internal security controls in this or similar situations. On the other hand with physical access to the network hardware, there's probably not much I could do if they wanted to be malicious.

Re:No

[viperidaenz]

If you give Person A access to your wifi and they share it with Wi-Fi Sense, how is that any different than them emailing their friends your wifi password?

Re:No

[viperidaenz]

WiFi client already has your password. Nothing is stopping them sharing the password in plain-text via IM, Email or a post-it note.

Re:No

[Harlequin80]

Lol fair enough. If you have that situation you need to run Kerberos but setting that up just makes my head hurt trying to understand it.

Re:No

[Barlo_Mung_42]

I never really have guests so I just leave it off. Some may think that sounds sad but I'm happy and it's working okay for me.

Re:No

[Anonymous Coward]

Ever hear of GPE? IP filtering? MAC address filtering? Deep packet inspection? Hosts file? Adding outlook.com, skype.com and facebook.com to your DNS blacklist? Or maybe just turning off the computer that is sharing the connection when it's not needed?

Seriously, I shouldn't HAVE to answer the question because it's so basic. It's like asking how to keep people you didn't invite out of your house. Really, you are unqualified to admin any network.

Re:No

[Anonymous Coward]

You are fucking clueless. You don't even understand how this functionality works, talking about routers and shit that has nothing to do with it directly.

Re:No

[Anonymous Coward]

It looks like I'll have to ask everyone for their mac address.

Re: No

[firewrought]

How often do your friends immediately email the Wi-Fi password you just gave them to their entire contact list? The correct answer (unless you have really shitty friends) is never. Now all of your friends will do this by default, unless they are technically literate enough to disable the option. (And even if your friends are literate enough, your roommate/boyfriend/girlfriend/spouse's friends won't be.) It's very aggravating that Microsoft has chosen to so promiscuously share the secrets its users have entrusted to the OS. A Wi-Fi password that might have previously been shared with a handful of friends is now automatically spread to a network of hundreds, and exposed to possible interception by enterprise, underground, and state-sponsored hackers. One really has to question the legality of this feature, unless the wording is very clear and the user opts-in every time.

Re:No

[suutar]

if by "little doodad" you mean the "enable wifi sense" checkbox, you're making the assumption that he has access to it. In his stated scenario he does not; the checkbox is on a device that he does not own but does wish to allow access to wifi that he does own.

At present the only method he appears to have is to modify his ssid, which is (a) clunky and (b) similar to the "do not track" flag in that the observer has to choose to do the right thing, and that's not guaranteed.

Re:No

[Anonymous Coward]

define newer. Mine is probably about 6 years old. Just checked. Doesn't have that option.

Most people, nerds included, don't go out and buy a new router every year. They buy a new one when there is either a reason to get a new one, or because their old one broke, which is a subset of the first reason.

Re:No

[Anonymous Coward]

You misunderstand how this works. If your employee has configured the connection the standard way (ie. direct connection to a router and manual input of password), nothing gets shared, regardless of whether they have wifi sense on or off. They only provide access (but not password) to their friends if they connected to a computer which has wifi sense connection sharing enabled.

Re:No

[Anonymous Coward]

So what, he suddenly doesn't have access to his own PC? If you disable WiFi Sense on your PC, then it won't share your connection, so you just have the person connect to the router directly instead, just as it's probably currently configured. WiFi Sense creates an ad-hoc network where the computer or device provides the access, not the router.

Re:No

[SuricouRaven]

I have a device on mine - a WDTV box. Thing beneath the TV that plays media. When I connected it up, I discovered that it's search for network shares is quite aggressive: It actually portscanned the entire subnet range in search of NFS an SMB shares. All very well, except that I have some rather embarrassing media shared on NFS - as no-one else in the house uses linux, I hadn't seen reason to secure it in any way. An incident was narrowly avoided.

Re:No

[Demonoid-Penguin]

I meant to talk to you about that. Can you please stop downloading so much porn? It's getting in the way of me downloading torrents through your network.

- Your neighbor

Can Johhny Droptables come out to play?

Re:No

[Kirth]

I've set a different WPA2 passphrase for every MAC-address that's allowed to connect. So unless you start MAC spoofing, knowing the passphrase won't help.

Re:No

[Anonymous Coward]

Still, there's a difference between giving the password to a guest in my home and having it automatically distributed to the world.

It's the old fallacy of "I don't care whether the clerk at my local gas station knows what I'm buying, so I must also be OK with automated tracking of purchases in massive computer systems"

Re:No

[vux984]

. So I run an open guest wifi which is on a different subnet and has its internet rate limited.

Even my guest network is password protected. Its for my guests not for everybody. If I wanted it for everybody, there wouldn't be a password on it, and people wouldn't need a windows feature to shared with their contacts.

Many of my neighbors also have guest networks... none of them are wide open.

This feature is probably the worst/dumbest thing I've seen in Windows 10 so far. Actually no... the inability to disable bing searching the web when you use the search in the start menu is the dumbest hting I've seen in windows 10... if that shit isn't fixed by release nobody should upgrade. NOBODY.

(And the sad thing is I actually over all like windows 10... but its just stuffed with bloat I don't want. At least most of it I can shut off... live tiles, cortana, using microsoft accounts, etc... but its becoming more and more work to set the settings up right.

I'm looking forward to a windows 10 de-crapifier powertool shortly after release... hell I'm tempted to write one.

Re:No

[Hognoxious]

Except that they'd have to, you know, actually physically manually do that. As opposed to it just happening automagically.

Re:No

[Anonymous Coward]

Group Policy? Doesn't apply to the non-domain-member laptop. IP filtering? They get an IP on YOUR network, so you either have static IPs for everything with MAC matching or this won't work. MAC filtering ... because they cannot be spoofed, right? Hosts file (are you fucking serious?) DNS blacklists - explain how they prevent access when the user attaches to their own network 5 hours later?

Jeez. It's like you didn't even think before you spewed on the keyboard. You're asking about keeping people out of your house? The first step is not to give away the key.

Re:No

[Anonymous Coward]

Why would you end up in "legal how water". I hear this all the time and it makes absolutely no sense.

You're not responsible for the actions of someone else just because you let them use your wifi

Don't say "if you can't prove it wasn't you" - western countries all recognise due process and burden of proof.

Re:No

[TheRaven64]

The access point that my cableco gave me can do this. Of course, the router crashes after about 10 minutes of use if you actually enable it...

Re:No

[Stuarticus]

MAC address filtering is common on wired networks, on wireless you generally trust the client to look after their credentials that way you don't have to worry about maintaining a potentially huge list of every user's devices. I don't know if this would share radius credentials, if it does someone should be looking at the sack in Microsoft.

Re: No

[Anonymous Coward]

Well, at least in Germany, by "StÃrerhaftung" you are partially liable for copyright infringement, even if your wifi access is just insecure. If you are using sensible wpa2 keys, you will need to prove, that it could not have been you, as access from your ip is already proof. Open networks are currently difficult, as you need some pointer to all users, which you could handover on request, otherwise you might end up paying.

Re:No

[I'm New Around Here]

Again, shove that ignorant attitude up your ass. I'm talking about the devices that are 'router' and 'wireless access point' all in one unit. Like the one most home users have, and most small businesses have. Do you think I have a separate router, firewall, switch, and WAP all sitting next to my cable modem?

If you can't figure out references to basic standard hardware, turn off the 'box' that has 'blinking lights' on it before you contaminate us with more drivel. But of course, first pick up your coffee and make the 'cup holder' slide back into the 'box', so it doesn't get hurt.

Re:No

[pfleming]

It's like asking how to keep people you didn't invite out of your house. Really, you are unqualified to admin any network.

It's more like asking how do I keep people out of my house when they all have a copy of the key that I gave to one person.

Re:No

[pfleming]

But we want to control it at the router, by setting a password. Maybe it's indirect, but anytime someone gets close they get the password if some other person clicked (or left checked) the box sharing the password.

Re:No

[Anonymous Coward]

Are there any wifi routers which give full access and direct internet access to users with the password, and Tor-only access to guest users? I'd be afraid of neighbors torrenting movies (or worse) from my home network.

Re:No

[SuseLover]

Unless you're a Comcast Xfinity customer, which by default their WiFi routers have public wifi connection running. The end user can't even log in to disable it themselves, it takes a call to Comcast to have it disabled.

I had to call to disable it so it wouldn't interfere with my own wifi router(s) running DD-WRT.

Re:No

[Pyramid]

MAC spoofing is trivially easy.

Re:No

[Anonymous Coward]

define newer. Mine is probably about 6 years old. Just checked. Doesn't have that option.

Seriously, dude. If you need somebody to tell you that a 6 year old router does not qualify as a "newer" router, you gotta turn in your nerd card.

Re:No

[Anonymous Coward]

No, your statement is incorrect. I am looking at the WiFi sense settings on my Lumia ICON right now and I can turn it off by network by network without a problem.

Re:No

[viperidaenz]

You mean, as opposed to having to manually enable sharing on your particular network.

Re: No

[viperidaenz]

No they won't.
The service is enabled by default so you can automatically connect to other networks shared with you, but each network you want to share must be shared explicitly.

Re: No

[KGIII]

Except it is not the default behavior as has been shown, mentioned, linked, and linked again and again in this very thread. Why be dishonest?

Re:No

[Harlequin80]

I have physical security where I live in that I am too far away from the road for 99% of devices to see my network and my neighbours are further away than the road. So in my usage case an open network is easy and I'm extremely unlikely to have a random leach on my network.

I haven't played with Windows 10 yet but all the things you have listed are all things I would want to remove as well. If only Linux Mint was able to run all my games and photoshop.

Re:No

[Anonymous Coward]

Group Policy? Doesn't apply to the non-domain-member laptop.

That is your first mistake. All users on a corporate network should be required to go through the domain controller. Sounds like you don't have so much a business as a home office.

IP filtering? They get an IP on YOUR network, so you either have static IPs for everything with MAC matching or this won't work.

Dumbass. You don't filter their IP, you filter the IPs of places you don't want their computer contacting, like outlook, facebook and skype.

MAC filtering ... because they cannot be spoofed, right?

No, not by most people they can't.

Hosts file (are you fucking serious?)

Reroute outlook.com, facebook.com and skype.com to 127.0.0.1. Stupid fuck.

DNS blacklists - explain how they prevent access when the user attaches to their own network 5 hours later?

Again, to prevent access to outlook.com, facebook.com and skype.com. Stupid fuck.

Jeez. It's like you didn't even think before you spewed on the keyboard. You're asking about keeping people out of your house? The first step is not to give away the key.

You don't understand the first thing about network administration, as proven above.

Re:No

[Harlequin80]

The second you talk about tor routing you are stepping outside of off the shelf consumer grade routers. If you want that you will need to roll your own.

Re:No

[Anonymous Coward]

Again, shove that ignorant attitude up your ass.

Go fuck yourself, you worthless sack of shit.

I'm talking about the devices that are 'router' and 'wireless access point' all in one unit.

No fucking shit, Sherlock. But that has nothing to do with WiFi Sense. Ever hear of internet connection sharing and ad-hoc networking? That's how WiFi Sense works, stupid little shit.

If you can't figure out references to basic standard hardware, turn off the 'box' that has 'blinking lights' on it before you contaminate us with more drivel. But of course, first pick up your coffee and make the 'cup holder' slide back into the 'box', so it doesn't get hurt.

Oh, just shut the fuck up.

Re:No

[Harlequin80]

That is just too funny. Just be thankful you were the one plugging it into the network.

Re:No

[I'm New Around Here]

Oh, excuse me then. I thought you were simply too stupid to understand common hardware. You claim you do have that basic level of intelligence. You simply lack all ability to actually convey your knowledge to others.

No fucking shit, Sherlock. But that has nothing to do with WiFi Sense. Ever hear of internet connection sharing and ad-hoc networking? That's how WiFi Sense works, stupid little shit.

I just read the explanation on http://www.windowsphone.com/en... , and it doesn't sound like internet connection sharing at all. It sounds like credentials are being sent to people so they can join a network without the consent or agreement of the network owner/administrator.

Back to the original post I replied to;

*facepalm*

If you're asking this question, you shouldn't be trying to admin a corporate network.

At the very least (assuming that AC is you), you either are too stupid to understand the meaning of the post you replied to, or, as stated above, you are too stupid to make a coherent argument.

From prior experience, anyone who uses *facepalm* as their argument usually falls into the second category.

Re:No

[Anonymous Coward]

And now you're backpedaling because you finally see that you are a complete idiot.

I just read the explanation on http://www.windowsphone.com/en... [windowsphone.com] , and it doesn't sound like internet connection sharing at all. It sounds like credentials are being sent to people so they can join a network without the consent or agreement of the network owner/administrator.

Then learn to read, you illiterate fuck. It clearly states that passwords aren't sent to anyone.

It's a real shame that your mother didn't die during childbirth and take you with her. At least I can still hope for you die in a car accident or to get randomly shot in the face. The world would be a better place without a worthless little bitch like you around.

Re:No

[tezbobobo]

I don't really care what MS does - I filter mac addresses.

Re:No

[Harlequin80]

That seems like a seriously annoying way to deal with guest devices. Perhaps it is because I get too many through the house with kids friends and kids of friends but a guest network just seemed easiest.

Re:No

[Anonymous Coward]

Guest wifi is a different matter.

Sometimes you'd want your friends on your main network for gaming, streaming etc.

Re:No

[Anonymous Coward]

Would you not still be liable if some friend of a friend used your guest network to upload child pornography? In my country you would.

Beyond Stupid

[Mikkeles]

This is so moronic on so many levels.

Re:Beyond Stupid

[Anonymous Coward]

I'm rubber and you're glue, whatever you say bounces off me and sticks to you.

Re:Beyond Stupid

[Anonymous Coward]

You're hot and have massive sex appeal and a huge dick.
*bounce* *stick*
Why thank you.

Re:Beyond Stupid

[I'm New Around Here]

I think you just gave yourself big tits and a dildo.

Not that there's anything wrong with that. ;^)

who tha fu..

[Anonymous Coward]

..ck came up with THAT idea...?

I hope this isn't a representation of Windows 10 as a whole.

Re:who tha fu..

[Moheeheeko]

Probably the same guy who thought "no used games on xbox one" was a great idea.

Re:who tha fu..

[Known Nutter]

Now you can squirt your wi-fi passwords...

Re:who tha fu..

[fuzzyfuzzyfungus]

The 'feature' occurred on Windows Phone first, not sure exactly what version. I assume that it made a great pitch to prospective carriers, since they all love offloading customers onto anything that isn't their data network as often as possible, and typing passwords into your phone is a pain, so automating it likely increases network offload considerably.

Re:who tha fu..

[Anonymous Coward]

Probably the same asshole that thought the Win8 "metrosexual" interface (with included ball sack manscaping) was a good idea.

Re: who tha fu..

[Anonymous Coward]

It was a good idea asshole. But angry neckbeards complain about it and now xbox one users have fewer option and features.

Re: who tha fu..

[Anonymous Coward]

Yeah, taking the option of buying a used games means people have more options.

Stupid MS rectum eater.

There goes my SSID :(

[MAXOMENOS]

FBI Surveillance Van #1_optout just looks dreadful.

Re:There goes my SSID :(

[Gizan]

HAHA mines named FBI Surveillance Van #4, it used to be "Adult Toys_R_Us" till the neighbors complained

Re:There goes my SSID :(

[Anonymous Coward]

The neighbors complained of blatantly false advertising because you wouldn't sell them any of your adult toys?

Re:There goes my SSID :(

[PoopMonkey]

Why'd you cave? If they complained, you should've renamed it to Anal Fisting Funhouse.

Re:There goes my SSID :(

[Anonymous Coward]

FBI Surveillance Van #1_optout just looks dreadful.

How about:

FBI_Surveillance_Van_#1_don't_dare_to_optout

Re:There goes my SSID :(

[AmiMoJo]

How did the neighbours know it was you? You didn't leave Adult Toys R Us bags in your trash did you?

wut ?

[Anonymous Coward]

Are they f#cking stupid or something ? Why would I want to that ? And instead of opt-in, you have to OPT-OUT ? WTF ?!!?!

Re:wut ?

[Anonymous Coward]

And instead of opt-in, you have to OPT-OUT ?

No. RTFA.

Uh, no

[reboot246]

no fucking way. Somebody needs to be fired at Microsoft.

We all know how to handle this "feature", but most people won't have a clue.

This is right up there with their leaving file extensions hidden by default.

Re:Uh, no

[Anonymous Coward]

The best way to handle this is to avoid Windows 10 like the black plague!

Re:Uh, no

[Anonymous Coward]

headline is pure FUD. article is borderline fantasy. The register has resorted to bending facts to get clicks.

Re:Uh, no

[Anonymous Coward]

> no fucking way.

Exactly. If a story is about something so outrageous and stupid, it probably got it wrong or is leaving out a lot of details.

Re:Uh, no

[amicusNYCL]

This is right up there with their leaving file extensions hidden by default.

It kind of is, yeah, except it's actually nothing like that. You see, one of them is hiding file extensions, and the other one is giving out your password.

Re:Uh, no

[Pharmboy]

The problem is they are advertising a "free" upgrade to everyone with Win 7+ right now. Who doesn't want a FREE upgrade? Obvioously /. readers but most consumers think they are saving money with a free upgrade to an OS that is in fact pwning them.

Re:Uh, no

[Anonymous Coward]

no fucking way. Somebody needs to be fired at Microsoft.

We all know how to handle this "feature", but most people won't have a clue.

This is right up there with their leaving file extensions hidden by default.

Read the article. Slashdot summary is wrong and you have been trolled.

Re:Uh, no

[Anonymous Coward]

yeah, don't allow any devices running Windows 10 on your network and MAC filtering

Re:Uh, no

[Anonymous Coward]

Most none techies I've known didn't have a problem with sharing their connection. I've even offered to secure their WiFi, but then they say "how will my neighbours and guests use it then?"

The only people who are concerned with sharing their connection are tech nerds and we know how to turn this off.

Re:Uh, no

[Anonymous Coward]

No, it's giving out access to your internet connection, not the password nor access to computers on your LAN. WiFi Sense doesn't send your password to other people.

Re:Uh, no

[Anonymous Coward]

More related than you think! When your mom opens Cute baby.jpg.exe in her email with a hidden .exe extension, the virus will will be giving out her password.

Re: Uh, no

[Anonymous Coward]

Avoid it like the windows 8

Re:Uh, no

[gstoddart]

No, someone needs to be shot.

This is the most idiotic thing I've heard of in a long time.

Microsoft has said "fuck security", and once again have decided to "innovate" something which stupidly becomes a gaping security/privacy hole.

What shithead thought of this?

These passwords aren't Microsoft's to share, and decreeing that anybody who hasn't changed their SSID to opt out has consented.

Fuck that.

How bout we charge Microsoft with hacking and enabling unauthorized access to computer networks?

Fucking idiots.

Re:Uh, no

[gstoddart]

They're doing more than advertising it.

In Windows 8.1 they pushed out an update which put an icon in the task tray which said "upgrade to Windows 10, now or later?"

They're not pushing it as optional. They're installing stuff which is going to do it to you, and isn't giving you a way to decline. You end up needing to uninstall an update (KB 3035538).

I'm sure they'll do it again.

Microsoft seems to have decided they own the computers, and the networks they're attached to. Which is completely bullshit.

And, don't forget, once they have all those juicy passwords they can pass 'em off to law enforcement.

Microsoft have always been assholes, but this takes the cake.

Basically Windows Phone and Windows 10 are gaping security holes, and Outlook.com is now acting as malware.

Re:Uh, no

[Anonymous Coward]

MS got a little Clippy with the extensions...

Re: Uh, no

[I'm New Around Here]

Dude, you fucked up an insult. How fucking brain damaged are you? You are the "After" example in the pamphlet about meth, aren't you?

Re:Uh, no

[Zontar The Mindless]

Oh, well, that makes it perfectly okay, then. *eyeroll*

Re:Uh, no

[Anonymous Coward]

Sure, why wouldn't it be? I'm not a greedy fucker like you.

Re:Uh, no

[JaredOfEuropa]

They did no such thing. The Windows 10 upgrade thingy makes it crystal clear, several times, that the upgrade is optional. You can decline by not "reserving your copy", and even if you accept, you still get the option to not download and install the upgrade when it's there.

With that said, I agree that sharing WiFi passwords with your contacts is a monumentally stupid idea.

Re:Uh, no

[JaredOfEuropa]

These passwords aren't Microsoft's to share

Exactly. They are no one's to share but the owner of the access point, and when you give your house wifi password to a guest, most of them do understand that it's not ok to give that password to others. That changes when sharing passwords becomes a built-in or even automatic feature; if there's a button to share, it'll give the impression that it is safe and acceptable to do so.

Re:Uh, no

[gstoddart]

Horseshit.

When the tray icon appears, there is no dismiss. There is no "piss off and go away".

There "upgrade now" and "reserve your copy". There is no description of WTF not reserving my copy does, there is no dismiss. There is "I am going to sit here reminding you to upgrade to Windows 10 until you do".

The average user is going to read that and think "Oh, I guess I have to do this". It took me 20 minutes to identify the source and figure out what I had to remove.

When that crap is presented to you, there is NO indication it is optional, that you can cancel it, that you can choose not to do it .. in effect it presents itself with two choices "now or later".

And it means Microsoft is acting like they own the machine, and it's up to them to decide when to make changes to it.

Re:Uh, no

[Anonymous Coward]

Noone needs to be fired except for the person who wrote the summary and the editor that approved it. The summary doesn't represent in any way the actual functionality of WiFi Sense. It's simply bait to get some Microsoft bashing going on.

Re:Uh, no

[Anonymous Coward]

Or an "Autorun will be a great idea for all media, and people can turn it off if they don't like it" idea.

Re:Uh, no

[Anonymous Coward]

Well today I learned that not wanting to have your identity stolen is "greedy". What a scrooge I am trying to keep my network and the information transmitted on it secure.

Bad Summary, Only new part is the sharing option

[slacklinejoe]

First, we're only talking Windows 10 PHONE Secondly, it's only available on networks you choose to allow this on. Third, yes, your wifi passwords are being backed up to make it easier when you migrate devices - Apple, Google and Microsoft all do this on your mobile devices. This isn't new! I can't imagine that this won't be opt in only by the time it RTMs (or whatever the equivalent is).

Boon for penetration 'testers'

[Anonymous Coward]

1. Offer tender proposal to target - request being added to contacts to avoid the spam.
2. Drive by targets office with Yagi.
3. ???
4. Profit!

No worries

[msobkow]

No worries here. I always disable the WiFi on my routers. I prefer hardwired connections that don't give the router fits trying to perform encryption with their underpowered chips.

Re:No worries

[Anonymous Coward]

Because everyone has the ability to do hardwired connections throughout their homes, rented apartments, and don't have portable devices without Ethernet jacks built-in.

Seriously, get off that pedestal.

(Someone who has a wired home, but still uses WiFi all the time.)

Re:No worries

[msobkow]

Bozo, it's not a pedestal. It's a complaint about the pathetic CPU power on the typical home router and the fact that they choke traffic with even one device trying to use a reasonable amount of bandwidth.

WiFi is useless by design for anything but the most casual of surfing.

Re:No worries

[SinShiva]

AES acceleration has been integrated into the wireless chipsets for quite a while.

Re:No worries

[adolf]

AFAICT, the hardware encryption thing was solved eons ago.

Or at least, none of my routers suffer from high CPU utilization when doing Wifi things.

Re:No worries

[Anonymous Coward]

+1

Re:No worries

[drinkypoo]

No worries here. I always disable the WiFi on my routers. I prefer hardwired connections that don't give the router fits trying to perform encryption with their underpowered chips.

If you're worried about that, you can firewall off all non-IPSEC traffic... and still enjoy WiFi

Re:No worries

[Anonymous Coward]

I disable the ethernet ports as well. I prefer no connections rather than giving the router fits trying to perform packet filtering and NAT translation.

Possible solution: Get a real firewall, a real WAP and use switches for the network.
On the other hand that might only be a solution for nerds, not the general slashdot population.

a matter of days

[daniel23]

That feature will have a half life time in the range of days.
MS is so focussed to make 10 a winner they will flip the default faster than we can get really upset about it.

Thats okay

[coolmoe2]

I will download the upgrade but im not going to install it until I see a patch that disables this idiotic feature. I really don't fancy having to redo my wireless network because I do not want to share my wpa key.

Re:Bad Summary, Only new part is the sharing optio

[Anonymous Coward]

And we have now identified the NSA operative.

third solution the MS doesn't want to mention

[frovingslosh]

If you don't want someone's Windows 10 passing on your password, Microsoft has two solutions;

Not a problem for me, they missed the obvious third solution. Never ever use Outlook, Don't use Skype and don't use Facebook. Problem solved without having to change my SSID. And, of course, there is a fourth solution but that involves using Linux.

Re:third solution the MS doesn't want to mention

[ewhac]

ERROR: INCOMPLETE SOLUTION

There is no provision in this "killer feature" that establishes whether the person doing the sharing is the network administrator, i.e. the person who grants authorization to use their network. So if you share your WAP credentials with a friend, and that friend uses Windows 10 with Wi-Fi Sense enabled, than that friend has just compromised your WAP.

Re:third solution the MS doesn't want to mention

[frovingslosh]

Well, duh. If you give away your SSID to a 3rd party, YOU have compromised your security, not MS. That's why my guest room has a cat5 ethernet connection. And for special cases I do have an access point that I normally keep off but could turn on if someone shows up with a wifi only device such as a tablet. But the obvious solution for most users is simply be aware of this issue and never give your SSID password to a Windows 10 user. I have no problem explaining why if someone has Windows 10 they will not get access to my system wirelessly, if you do then go ahead and compromise your system.

Re:third solution the MS doesn't want to mention

[Anonymous Coward]

I wish I'd kept my Amiga.

Re:third solution the MS doesn't want to mention

[Jake Griffin]

The OP already said he is not on Facebook. Thus he doesn't have any friends. Problem solved.

Re:third solution the MS doesn't want to mention

[Anonymous Coward]

Now for the REAL third solution: Don't use Windoze 10.

Re:third solution the MS doesn't want to mention

[RichMan]

Then that friend has just compromised your WAP. But what about friends of friends? Now that friend has the Wifi Password, does it get passed onto their friends, and then their friends and ...

Re:third solution the MS doesn't want to mention

[Anonymous Coward]

There's a fifth solution: figure out a way to ban Windows 10 devices from your access point, and refuse people access to it if they ask for the password because you have no idea whether they're going to unintentionally share it with a zillion other people.

Re:third solution the MS doesn't want to mention

[Anonymous Coward]

If you don't want someone's Windows 10 passing on your password, Microsoft has two solutions;

Not a problem for me, they missed the obvious third solution. Never ever use Outlook, Don't use Skype and don't use Facebook. Problem solved without having to change my SSID. And, of course, there is a fourth solution but that involves using Linux.

None of this is a problem if you don't use Windows at all.

Re:third solution the MS doesn't want to mention

[TomH123]

, there is a fourth solution but that involves using Linux.

But then you're stuck with Linux. That's not a solution.

That's great news!

[Demonoid-Penguin]

I'm now revising my opinion of Outlook - especially in light of the recently passed Oz laws about pirating. In fact I'm about to order an external antennae for a laptop (trivial) hardware hack shortly.

There are times when M$'s drive to put stupid in the sysadmin seat make me very happy - this may be one of them.

No - I don't run Windows as my OS of choice. It's fine for some, in some situations (seriously). But rarely do I celebrate M$ stupid - and this "sounds" like both M$ stupid (I know - they really are catering to many of their "users" needs), and cause for celebration. I've always wondered whether Dallas Buyers Club was worth watching...

Thank you for your entry

[Anonymous Coward]

in the contest for the most braindead security 'feature' for the year.

Sadly you have serious competition, especially in the US govt.

Re:Thank you for your entry

[MightyMartian]

This is from the company that thought having users run as root user using a browser that would automatically install unsigned executables and libraries from the Internet was just the bestest idea ever.

I have another way

[Trailer Trash]

Microsoft has two solutions; only share passwords using their Wi-Fi Sense service, or by adding "_optout" to your SSID.

Or, just don't use windows 10. I think I may have found the answer there.

Re:I have another way

[swillden]

Microsoft has two solutions; only share passwords using their Wi-Fi Sense service, or by adding "_optout" to your SSID.

Or, just don't use windows 10. I think I may have found the answer there.

Also, don't give your SSID to anyone who does or might in the future use Windows 10, or have a Windows phone.

Re:I have another way

[swillden]

Also, don't give your SSID

I meant password, of course. Sorry, not fully awake.

Re:I have another way

[Anonymous Coward]

Fine if you don't run it - but for some the problem is more ensuring their friends, coworkers, whoever might possibly be given access to their WLAN doesn't run windows 10.

Not the most controversial default

[Anonymous Coward]

I think the default sharing of Confederate flag icons with your contacts will be more controversial. But if you add _trump to your ssid, the flags will only be shared to the dirty mexicans in your contacts.

Every SSD WIFI Password ?

[denisbergeron]

Including the one at my jobs ? University ? My City subscription ?

I can't change the name of the SSD where I paid for the service ???!!!!

Re:Every SSD WIFI Password ?

[MightyMartian]

Thank you for being a friend,
And sharing WiFi passwords there and back again.
You're giving me the WiFi key of your favorite restaurant.

And if they came to your dorm,
Invited everyone you knew,
You would see the ugly guy at the back downloading kiddie porn,
And the FBI would raid you singing "Thank you for filling our jail!"

Re:Bad Summary, Only new part is the sharing optio

[ArmoredDragon]

And if you give your wifi credentials to a guest who needs access to your network, they can opt you in without your permission or even your knowledge.

The only way then to prevent unknown people from having your wifi password is to forbid Windows 10 mobile users from accessing your network.

The password must be stored centrally by Microsoft

[Anonymous Coward]

i suspect that this is just another attempt by the TLAs to get corporations to do their bidding.... this time by compiling wireless network passwords in a central database that they, no doubt, will have full and unfettered access to

Amazingly stupid but funny for now.

[Anonymous Coward]

Hahaha this is so stupid it's kind of awesome. Now if you want to opt out of Google Maps and Wi-Fi Sense at the same time, you must change your SSID of, say, myhouse to myhouse_optout_nomap. I hope other vendors add further wifi based functions that required SSID opt-outs until we have at least 255 characters of crap on the end of all our SSIDs.

Re:Amazingly stupid but funny for now.

[sexconker]

There's not a chance in hell that "myhouse_optout_nomap" would work.
You can either do "myhouse_optout" OR "myhouse_nomap". And they'll still ignore your preference.

But if you don't use Facebook...

[Anonymous Coward]

...how will anyone know you even exist?

Re: But if you don't use Facebook...

[Anonymous Coward]

I Facebook, therefore I am

Re:Bad Summary, Only new part is the sharing optio

[sexconker]

And if you give your wifi credentials to a guest who needs access to your network, they can opt you in without your permission or even your knowledge.

They could also shout it from a mountaintop. There's no _optout option for that.

Not Exactly....

[nate_in_ME]

I've been running pretty much every build of Win10 since the preview first came out, and this isn't accurate at all....Yes, the Wi-Fi sense option is there, but when you connect to a new network, there's a "share with my contacts" checkbox that you have to turn ON for this network to be shared. The Wi-Fi Sense "master switch" may be on by default, but you have to specifically allow each individual network to be shared.

Re:Not Exactly....

[MightyMartian]

That isn't the issue. The issue is YOU being able to share MY WiFi key because I was dumb enough to let a Windows 10 user on my WiFi network. This is akin to me giving you the keys to my house so you can housesit, and you getting a hundred copies cut and distributing them to a bunch of people you know.

Re:Not Exactly....

[Anonymous Coward]

dumb feature, for sure, but all it's doing is automating something that could be done manually... so unfortunately, people will have to learn to change their Wifi password every so often, or create a guest network (which should change the password every so often...). wee....

Re:Not Exactly....

[nate_in_ME]

Fair enough....I haven't tested the "other side" of this (using a shared key to access a network) because I don't use FB, Skype, or Outlook, but I would hope that the option I mentioned earlier (that "share this network with my contacts" switch) isn't an option for networks that you got the key for through Wifi Share. Maybe someone who's actually used the new feature can weigh in on that part of it

Re:Not Exactly....

[ewhac]

...when you connect to a new network, there's a "share with my contacts" checkbox that you have to turn ON for this network to be shared.

If true, this would be a departure from the Windows Phone 8.1 OEM requirements, which requires OEMs to fully enable this, "killer feature:" https://msdn.microsoft.com/en-...

Re:Not Exactly....

[Anonymous Coward]

You can share access to password-protected Wi-Fi networks to give your Facebook friends, Outlook.com contacts, or Skype contacts Internet access without seeing each other's Wi-Fi network passwords. Your contacts and friends then get automatically connected to the Wi-Fi network you share if they're using Wi-Fi Sense on their Windows Phone. Likewise, your phone will automatically connect to Wi-Fi networks they share with you to give you Internet access.

http://www.windowsphone.com/en-us/how-to/wp8/connectivity/use-wi-fi-sense-to-get-connected

It sounds like everyone gets access to everyone else's network.

Select or clear the Provide a name, email, or phone number when required check box.

When selected, Wi-Fi Sense will provide the info you specify when a network asks for it in order to connect. (The network operator's use of this info is subject to their own privacy practices.)

http://www.windowsphone.com/en-us/how-to/wp8/connectivity/use-wi-fi-sense-to-get-connected

Apparently it will automatically share the personal info associated with the connecting device with the router too.

Re:Not Exactly....

[Anonymous Coward]

Fair enough....I haven't tested the "other side" of this (using a shared key to access a network) because I don't use FB, Skype, or Outlook, but I would hope that the option I mentioned earlier (that "share this network with my contacts" switch) isn't an option for networks that you got the key for through Wifi Share. Maybe someone who's actually used the new feature can weigh in on that part of it

Uh, it's not that either. If I tell a friend what the password is, and they enter it into their phone, they have the option of sharing it, possibly without even realizing what they're doing.

Re:Not Exactly....

[Anonymous Coward]

I'll be removing that entire section of the registry as soon as I find it.

Re:Not Exactly....

[Anonymous Coward]

The main problem is that this shouldn't even be an option. PERIOD.

If I want to let someone use my WIFI, I setup a temp key, and let them know it.
When they leave, I change it.

There is no way that the fucking OS should even offer to share it with anyone in any way, shape or form.

from now on my passwords will be something along the lines of

dieNSAkillFBIdestroyCIAuraniumTSAnukeObamaSecondAmericanRevolutionStartsNow!!!

Re:Not Exactly....

[Anonymous Coward]

And I suppose you'd blame the key cutting machine or service for this?

After all, you're blaming Microsoft for what is no different than emailing the password.

Re:Not Exactly....

[Anonymous Coward]

That isn't the issue. The issue is YOU being able to share MY WiFi key because I was dumb enough to let a Windows 10 user on my WiFi network. This is akin to me giving you the keys to my house so you can housesit, and you getting a hundred copies cut and distributing them to a bunch of people you know.

whoa. this is the dumbest thing I've seen Microsoft pull in a while.

Is this the death knell? Linux/Android/BSD is so obviously magnitudes better than Windows now that Microsoft is just laughing at customers? Hey have our Longhorn again?

This youngster had me laughing a while back. https://www.youtube.com/watch?v=5GU5uv28a3I

I don't intend to update to 10 on current hardware. I have uninstalled updates and adjusted the registry to not nag also. So stupid. adonbilivit. I already expect future Windows to suck even more.

distrowatch.com folks. Seriously fast and easy to install Linux. Google/YouTube for tips. nixiepixel has been doing YouTube video tutorials for noobs for years. She's easy on the eyes too.

I only keep Windows for "some" games. PS4 is BSD kernel and blows Xbox 1 away. YouTube the comparisons on that too. When game developers throw Microsoft under the bus and code for Linux, all my Windows go format c:\ Windows has cost me who-knows-how-much-time over the years since 3.1 doing rinkydinky troubleshooting. It's like buying a brand new car that is hooptie off the lot. To top it off it violates licenses to borrow a wrench. Metaphors gone mad. Piss on Windows.

inb4 some noob comments trying to explain how Microsoft are soooo good. b-b-b-ut muh platform. muh games. Oh, but what about every supercomputer (100's of billions of $ worth) all running Linux? Fortune 500's on Linux. Amazon on Linux. Google on Linux. Android is Linux. b-b-but those are serrrverrrrrs. derpderp

eg. the other day here http://it.slashdot.org/comments.pl?sid=7620131&cid=50015387

Come on, tell me how you don't have 10 minutes to install Linux. I guarantee there are stupid people around. The dumber you are the less you can hide it too.

If you can use a Mac already, the bash shell is right there on Linux. Pick any shell you want. On the other hand, Windows Powershell and command prompt are the weakest CLI's in the history of planet earth.

Windows, smh. Windows sucks, but game developers keep us stuck in the mud.

Re:Not Exactly....

[fisted]

Android

does the same, you pimply-faced fanboy.

Settings -> "Backup and Reset" -> "Back up my data" (Back up app data, Wi-Fi Passwords, and other settings to Google servers)

Yes, of course it's enabled by default, why do you ask?

Re:Not Exactly....

[davidleelambert]

And that MSDN page says exactly that the "master switch" must be turned on except in certain countries where it must be turned off. It doesn't say that the "share with my contacts" checkbox has to be checked by default. I have a coworker who owned a Windows phone (recently switched to Android), he notes "For XfiniityWifi, it would not work as it would require more credentials (i.e. Comcast Account Information)."

Re:Not Exactly....

[Anonymous Coward]

What is to stop said person from writing down your password and emailing it to all of his friends? You've already given them the keys to the castle.

Re:Not Exactly....

[Anonymous Coward]

How is that any different than me coming to your house, you telling me "You can connect to my wifi if you need, password is 'sharetheweb'". I now KNOW your password and am free to share it with anyone else I happen to know. I could leave your house and paint it on your garage door if I were so inclined. The morale is, don't let anyone on your network that you don't trust. As for Wifi sense, the advantage there is that you don't have to tell your friends what your password is, they 'magically' gain access (with your permission) and you never have to transfer the knowledge of your password selection algorithm.

What I'm not 100% sure about is this, I believe wi-fi sense will only shares credentials for wi-fi networks where you manually key in the password. So if your friend grants you access via your "friendship", you automatically connect to their network, but you in turn don't share that network with your friends.

Re:Not Exactly....

[benjymouse]

That isn't the issue. The issue is YOU being able to share MY WiFi key because I was dumb enough to let a Windows 10 user on my WiFi network. This is akin to me giving you the keys to my house so you can housesit, and you getting a hundred copies cut and distributing them to a bunch of people you know.

So wrong.

If you *tell* someone your WiFi password *then* there's nothing stopping them from sharing it with whomever they want. So do not do that. Not if he brings OS X or Linux or Windows.

If you want to allow some friend onto your network but not allow him to share your network with others, then *you* tap in the password at his computer when it connects. On OS X or Linux or Windows. That what you would do today, and that's what you would do when your friends brings a Windows 10. On Windows 10 simply DO NOT CHECK the "share" checkbox. It is off by default. Your network will not be shared.

Nothing has changed. Neither your network nor your password will be shared with anyone. Your friend cannot go into settings and share the network after the fact - it has to be done when connecting.

But if *you* connect to some network which you would like to share with your friends, you can check the "share" checkbox. When you do that, your password will be stored encrypted in Microsofts servers. When one of your friends (if you share with - say - Facebook friends) is in range of that network, his Windows 10 computer can engage the network. The network will issue a challenge with must be hashed using the password as salt, and the hash returned. Modern password auth works like that to avoid sending passwords in cleartext. This means that the *actual* password hash is a one-time hash computed from the challenge.

The computation of the hash is performed on Microsofts servers, and your actual password is NEVER available on your friends computer - not even in encrypted form - only the challenge response hash. Your friends computer must obtain the response to the challenge from Microsofts servers - and when doing so it must prove that it belongs to a friend of yours.

Furthermore, Windows 10 which connects to a network in this way will *not* allow access to other devices on the network except for the internet gateway. I.e. it can only be used for Internet access - nor for local file or media sharing.

Re:Not Exactly....

[MightyMartian]

I get how it works. I disagree completely that any access to a third party WiFi network should be up to any permissions model put out by Microsoft, or that I should have to basically implement the kludge so that the network is excluded.

It's a shitty idea, pure and simple.

Re:Not Exactly....

[Anonymous Coward]

Android

does the same, you pimply-faced fanboy.

Settings -> "Backup and Reset" -> "Back up my data" (Back up app data, Wi-Fi Passwords, and other settings to Google servers)

Yes, of course it's enabled by default, why do you ask?

Let's see, slashdot-2 million-user-#-whatever named fisted initiates an acne debate. I am likely older than your dad and less ashamed of you than he is. I never even had acne when I was a kid because I'm not some greasy McWIndows fan slamming hot dogs like you surely are.

You defend windows like the real windows defender you are. ahhh man. Nice name for firewall software huh. It's as if it's your calling in life. Windows is a POS and although not my first computers (8 bit and earlier), I used Xenix when it first was released (still have the floppies) and spent much time with DOS and 3.1/NT etc. BSD was great even back then.

And, I outlift you. I outlift anybody fisted or named fisted. Not only you, but surely every male in your family tree. I guarantee that your offspring will never beat my records either. By your /. name, I doubt you breed though.

There is no comparison to backing up your WiFi password in the cloud on Android and sharing it with all of your contacts in Windows 10. On Android you have to implicitly decide whether to upload WiFi keys or not. Sure it's nothing more than an emergency feature. I don't use Google's cloud for anything. You will not even back up Android anything to Google servers unless you embark on that entire task intentionally. It is not just some whoops touched an icon and off to Google.

Microsoft thinks it's handy to enable WiFi pass sharing enabled by default via contacts. If you think this is smart, your ass is not.

Windows sucks. Always did, always will.

A quick glance at your previous posts is possible since you used Internet Exploder to create a /. account fairly recently. Dork, you are a kid. Slow your roll when you are that new. Not everybody who speaks fits your acne fanboy rant template.

Child, if Windows is all you can understand then you have nothing that needs to be said. Get your TechNet subscription out and hammer those keys, and find out the source of your Windows viruses.

I run Mac, Windows, Linux, BSD. You run your mouth and that's it.

Re:Not Exactly....

[Anonymous Coward]

I have win10 too and IT IS EXTREMELY EASY NOT TO NOTICE YOU ARE SHARING UNWILLINGLY THESE INFO !

The text the size and the general ergonomics of this SUCKS so unlessit is fixed A HUGE AMOUNT OF PEOPLE WITH POOR VISION or easily distracted people will MISTAKENLY agree to share these extremely private info....
We will let the lawyers do the rest...

THIS is exactly like having the safety of a hand grenade disabled by default....

Re:Not Exactly....

[fisted]

Let's see, slashdot-2 million-user-#-whatever named fisted initiates an acne debate. [some more gibbering giving away that you had serious acne problems in your youth]

Way to start with an ad-hominem.

You defend windows

No, I didn't. Please learn basic logic and practice reading comprehension.

[completely ridiculous and incoherent gibberish]

Yes, your age is showing indeed.

I run Mac, Windows, Linux, BSD.

Congratulations. I run just BSD, and Linux only when I get paid for it. I wonder what point you're trying to make here. If it was your goal to make yourself look like a complete idiot, I'd say you've reached it.

Have a nice evening, dear red-faced mouth-breathing AC

Re:Not Exactly....

[Anonymous Coward]

You are missing the point. This "share with my contacts" checkbox only applies to sharing the password which is already in Microsoft's server with you contacts. But where is the "don't share my password with Microsoft" checkbox?

After your password (or technically a master key derived from the password) has been sent to Microsoft it will be available to NSA and others. That's what I'm more concerned about.

Re:Not Exactly....

[Anonymous Coward]

The issue is YOU being able to share MY WiFi key because I was dumb enough to let a Windows 10 user on my WiFi network.

Yeah, clearly it's impossible to open my mouth and tell someone what the password is. Oh wait..

Dude, the only thing accurate about your comment is when you admit being dumb. Good job on that.

Re:Not Exactly....

[Anonymous Coward]

awww you're a poor little baby :(

did the facts hurt you precious?

The (useless) function of being able to backup WiFi passwords in Android to Google's cloud servers

is NOT the same

As windows 10 sharing WiFi passwords with Outlook contacts.

I run just BSD, and Linux only when I get paid for it.

You run this OS/that OS "only when I get paid for it". So you are a desk jockey grinding away at life to serve your corporate masters. Good job kid. Some people have been into tech before you were a twinkle in your mama's eye.

Android

does the same, you pimply-faced fanboy.

Way to start with an ad-hominem. You may have drank so much flouride and watched so many Big Bang Theory episodes in your youth that you suffer from generational pussification. So let me remind you, you came ad hom first. It was you. Idiot. If you can't comprehend what I said and think out of context quotes make you a genius, you should have just ran down to the sheets with your brothers and sisters.

Have a nice evening, dear red-faced mouth-breathing AC

It is very good to be AC. ahh man... AC is love.

Re:Not Exactly....

[fisted]

does the same, you pimply-faced fanboy.

[tl;dr]
Way to start with an ad-hominem.
[tl;dr]

That, my dear confused friend, was an insult, not an ad-hominem. Please inform yourself about the words you're using lest you risk looking like a compl -- oh wait, you already did that. Nevermind.

Re:Not Exactly....

[Anonymous Coward]

You talked shit on the internet.

You got called on it. You are wrong. Nothing you said was right.

Do it on a daily til you get slapped silly. Don't just be an internet tough guy.

Re:Not Exactly....

[fisted]

Yawn.

Re:Not Exactly....

[Anonymous Coward]

Yawn.

Exactly. You have a habit of opening your mouth but nothing profound comes out.

yawn yawn blink blink fart blink sigh

You lost again kid.

What is the actual point of this?

[fahrbot-bot]

...which shares wifi passwords with Outlook.com contacts, Skype contacts and, with an opt-in, Facebook friends.

How many of those people will ever be in close enough physical proximity to your access point to actually need your WiFi password? Seriously? Unless I'm missing something, this has to win "Stupidest Idea of the Year".

Re:What is the actual point of this?

[Anonymous Coward]

Hi. Aren't you the dopey kid in like, _every_public_school_ that said "why do we have to learn this stuff?!!!
The good news is, we don't have to explain anything to your substandard, dopey ass anymore. If you can't figure out the utility of this, don't worry. It's not for you. Go play with your Systemd log files. Windows is getting out of your grasp.

Re:What is the actual point of this?

[Zontar The Mindless]

"The good news is, the school bully can steal your lunch money only once today."

Deal breaker?

[Anonymous Coward]

Is this a good reason to wait for Win 11?

Re:Deal breaker?

[Anonymous Coward]

This is a good reason to leave Microsoft (like I did) and NEVER go back.

So "_optout" of what?

[fahrbot-bot]

If you don't want someone's Windows 10 passing on your password, Microsoft has two solutions; only share passwords using their Wi-Fi Sense service, or by adding "_optout" to your SSID.

Does adding this also prevent Microsoft from storing said WiFi password on their servers, or just instruct them to not share it out?

Re:So "_optout" of what?

[Anonymous Coward]

If it works like my Windows Phone (mine and the 3 or 4 others out there), WiFi Sense can be left OFF and it still works on WiFi networks that are manually set up.

This thread DID get me to look deeper into the help for WiFi Sense on the phone. And it's bad, really bad, if you use FB, Outlook.com, or Skype and you have it on. So when setting up Win10, along with all those other tweaks that are usually needed when setting up Windows, have to make sure to turn this off. Just in case others in the family DO use one of those services (and at least one does). And again, this is in Windows Phone 8.1, and presumably already in Win 8.1, so it may be nothing new; just newly advertised.

Re:So "_optout" of what?

[Anonymous Coward]

Does adding this also prevent Microsoft from storing said WiFi password on their servers, or just instruct them to not share it out?

Allways assume the worst. Of course they will store all WiFi passwords regardless of settings.

I have a better solution.

[Lumpy]

Dont use the craptastic poorly designed outlook for email.

sigh...

[Anonymous Coward]

stop_stealing_my_shit_kents_optout_nomap

Re:sigh...

[ewhac]

stop_stealing_my_shit_kents_optout_nomap

ERROR: SSID TOO LONG

You did know SSIDs were limited to 32 characters, didn't you?

Re: Bad Summary, Only new part is the sharing opti

[Anonymous Coward]

I've always assumed your WiFi information is stored on your phone. As such, it's available to anyone who has access to that stored data including backups.

I don't trust my phone at all. I use no apps on it, nor do I log into any website that requires a login / password through it. I assume all data passing through it is available to anyone who flashes a badge or has the skills to hack it.

My wireless network is a private vlan. The devices on it are allowed out on the net and that's it. No talking to other devices on the local networks of any kind. Ever.

So other than possibly free WiFi, nothing would be gained by compromising my WiFi credentials and that's how it should be.

Just hope....

[idji]

..that no-one in your contact lists is a secret pedophile or selling stuff on silknet....

Re:Just hope....

[Anonymous Coward]

Why? You aren't liable for anyone else's criminal activity.

Re:Just hope....

[fisted]

Hahahahahahah.

90 Days Late

[Anna Merikin]

Is there now a Fools' Day every three months?

I refuse to believe this.

Re:90 Days Late

[Anonymous Coward]

That's what I thought until I googled it. I wonder if I'd get different results if I bing'd it.

huh?

[Anonymous Coward]

And how do I or the average Joe do this with my ATT gateway? First _nomap for Goggle horrors. Now, optout. I wonder if the NSA will provide something or will the SSID simply get too long to be able to enter it?

OK, I'll add the _optout on my SSIDs

[Bryan Bytehead]

although since I run open APs, I don't think that it's going to matter.

Re:Bad Summary, Only new part is the sharing optio

[ewhac]

First, we're only talking Windows 10 PHONE

ERROR: INCORRECT

First: This is in Windows 10 desktop, as detailed here, complete with screenshots: http://www.howtogeek.com/21970...

Second: Even if this were only confined to Windows Phone 10, it would still be monumentally stupid.

Alarmist headline is alarmist

[Anonymous Coward]

More bogus and inaccurate clickbait bullshit.

If you're going to troll and bash Microsoft, at least do it accurately.

Re:Alarmist headline is alarmist

[MightyMartian]

So, instead of posting multiple times hire they article misrepresents the feature, quit being a shill and explain how exactly it works.

This will stick it up to the Movie Companies

[rebootaus]

This will stick it up to the Movie Companies. Now how are they going to do you for downloading there movies. Everyone (with 6 Deg of separation) will have your key and can use your link. Imagine them trying to blame you with this on by default. Thanks Microsoft. I never thought i would ever say that. Anyone could be using your wifi to download and you will never know.

Re:Bad Summary, Only new part is the sharing optio

[BitZtream]

Apple backs up my passwords with an encryption key which is also protected by a separate password.

Apple CAN NOT read my passwords, so they can not share them.

Not sure about Google, but I hope it does the same.

Microsoft is uploading passwords clear text or in some other equally dangerous form thats decryptable so they can be shared.

Re:Bad Summary, Only new part is the sharing optio

[Anonymous Coward]

So then don't enable it. You have explicitly grant access, it's not enabled by default.

It's like you're whining that there is piss in your beer when you're the one who pissed in it.

Re:Bad Summary, Only new part is the sharing optio

[Anonymous Coward]

Apple does not back up passwords, only SSIDs

Re:Bad Summary, Only new part is the sharing optio

[flink]

Secondly, it's only available on networks you choose to allow this on.

I don't have any choice. If I give my friend my WiFi password, and he happens to be running a Windows 10 phone, suddenly my WiFi password is shared with all of his contacts. So now every time someone is over my house and asks for the WiFi I'll have to ask them if they currently own, or ever intend to own a windows phone. And then, assuming they understand the question, I have to sound like a paranoid asshole and say "no" if they answer in the affirmative. My other option is to rename mySSID to end in _optout and update all of my devices because Microsoft chose to implement a ludicrous, criminally insecure, "feature"?

Third, yes, your wifi passwords are being backed up to make it easier when you migrate devices - Apple, Google and Microsoft all do this on your mobile devices. This isn't new!

Apple's encryption is end-to-end. They do not hold the encryption keys and thus can't share your passwords with anyone: Even if some brain dead middle manager had the idea to clone this feature, it would be impossible for them to implement without totally changing their security model.

Microsoft is widely misunderstood.

[Anonymous Coward]

What I would like to see explained in more detail

Explanation: Microsoft is widely misunderstood. People think that Microsoft is a software company that does evil. That's not true. Microsoft's main purpose is delivering evil. The software is just a means of doing that. (My opinion, shared with others.)

Re:Microsoft is widely misunderstood.

[Anonymous Coward]

What I would like to see explained in more detail

Explanation: Microsoft is widely misunderstood. People think that Microsoft is a software company that does evil. That's not true. Microsoft's main purpose is delivering evil. The software is just a means of doing that. (My opinion, shared with others.)

So you mean evil as a service, rather than evil as a platform?

Re:Microsoft is widely misunderstood.

[Darinbob]

Evil as a user experience.

Re:Microsoft is widely misunderstood.

[MightyMartian]

iEvil? Or perhaps in this case XEvil One, the perfect gift for someone stll using XEvil 360.

Re:Microsoft is widely misunderstood.

[chipschap]

Evil as a touch-screen app, of course.

Re:Microsoft is widely misunderstood.

[willworkforbeer]

I'm waiting for the release of the Evil SaaS model

Re:Microsoft is widely misunderstood.

[camperdave]

Evil as a touch-screen app, of course.

I thought Windows 10 was getting rid of Metro.

Re:Microsoft is widely misunderstood.

[Anonymous Coward]

This is some Mr.Robot - Evil Corp shit right here

Re:Microsoft is widely misunderstood.

[Anonymous Coward]

Did you mean EaaS?

Re:Microsoft is widely misunderstood.

[Anonymous Coward]

Leading to pay per evil in a few years.

Re: Microsoft is widely misunderstood.

[drunk_punk]

You mean to say I can switch Evil providers?! I doubt Verizon would be game.

Re:Microsoft is widely misunderstood.

[chilenexus]

IE 11 really stands for Internet Evil ^11

Re:Microsoft is widely misunderstood.

[f. finglerund]

EaaS! Oh my gosh that's perfect!

Re:Microsoft is widely misunderstood.

[ahodgson]

Well, they have PaaS covered with Azure.

Re:Microsoft is widely misunderstood.

[KGIII]

EITC - Evil In The Cloud. We used to call it "the network" or "the mainframe." We accessed it with dumb terminals. Today we are doing the same thing only claiming it is new. So instead of a BOFH we have EITC. It is new and you will like it. Also, get off my lawn. (Not really, you can chill on my lawn. It would be cooler if you came inside though. My lawn has not been as much fun since I gave someone my set of lawn jarts.)

Re:Microsoft is widely misunderstood.

[Anonymous Coward]

What I would like to see explained in more detail

Explanation: Microsoft is widely misunderstood. People think that Microsoft is a software company that does evil. That's not true. Microsoft's main purpose is delivering evil. The software is just a means of doing that. (My opinion, shared with others.)

Now that you have shared this opinion, Microsoft will automatically pass it on to all of your contacts (if they use Opinion Sense).

Holy fuck ...

[gstoddart]

So Microsoft has taken it upon themselves to share the network credentials with anybody it sees fit?

Fuck you, Microsoft. How about you help us make networks more secure and not less?

Not only will I stick with my Windows 8.1 install, but no Windows 10 device will ever get my network credentials.

This has to be one of the stupidest things I've heard of. And, of course, since Microsoft will centrally store your passwords, law enforcement can subpoena them.

Microsoft are too fucking incompetent at security to be trusted with this. And then to have the nerve to suggest we have to change our network names to opt out of their shit?

Fuck you, Microsoft. Fuck you very much.

Re:Bad Summary, Only new part is the sharing optio

[Anonymous Coward]

Which explains why I don't have to re-enter passwords after restoring from backup. You moron.

Google gets a free pass?

[Anonymous Coward]

Google stores passwords in the clear on your android phone. If it's rooted you'll find them in a file on your device. It also uploads them to your active Google account. Has been this way for years.

I wish these companies were held to account.

Re:Google gets a free pass?

[mark-t]

There's kind of a difference between storing passwords in clear text on a device that you still need to have physical access to in order to learn what those passwords are and actually broadcasting such passwords to absolutely everyone who happens to have a particular social network connection to you

Re:Google gets a free pass?

[Anonymous Coward]

Microsoft doesn't send out your password. Also people have to be physically close to the computer or device that the connection is being shared from.

Re:Google gets a free pass?

[mark-t]

FTA:

it shares Wi-Fi passwords with the user's contacts.... Those contacts include their Outlook.com (nee Hotmail) contacts, Skype contacts and, with an opt-in, their Facebook friends

So it seems that it *DOES* send out your wifi password... and I see this as less of a problem for myself, since I am neither a windows user nor do I have a large online social network, than it is for me to let specific people use my wifi while they are visiting my place, since if they have not set their own security settings appropriately, something which I cannot administrate, my wifi password would end up getting propagated to everyone on *THEIR* contacts lists. While they may only be able to use it if they are nearby, that is entirely beside the point.... these would still be people that I did *NOT* authorize to use my network.

Re:Google gets a free pass?

[Bert64]

Any device that connects to wifi has to store the passwords either in the clear or in a retrievable form...

If you compromise the device, you can extract the keys (and a lot of other stuff too). Other devices just obfuscate the keys, but they are still retrievable (e.g. try wirelesskeyview or gsecdump for windows).

That's why virtually all platforms offer device encryption these days to lessen the chances of the device being compromised at all.

Okay....

[Anonymous Coward]

....that's just stupid, Microsoft.

Fix it.

Ferret

Re:Okay....

[slacklinejoe]

Let 'em know: http://windows.microsoft.com/e...

Re:Holy fuck ...

[Anonymous Coward]

Oh, you might want to downgrade(upgrade) to Windows 7 if you want a proper "Computer OS" anyways, Windows 8.1 is pretty much Windows 10 already with a few less customisations and options.

DMCA violation?

[Anonymous Coward]

Seems to me that MS is opening themselves up to potential federal prosecution for deliberately circumventing a copy protection device. I.e. I don't want my friend's uncle's cousin's daughter's Facebook "friend" being able to copy the contents of my network folders just because MS decided to give them access to my network. If *I* want to give them access *I* will give the password.

This whole scheme looks ripe for abuse. The most troublesome aspect is MS is going to store EVERY windows network access password centrally. I give this about an day before there is a friendly NSA agent knocking at the corporate headquarters's door with a warrant demanding a tap be put in place for government use (along with a gag order preventing disclosure). About a month later the FBI will clue in and do the same, and sometime between the two Chinese/Russian/British/French/Australian/etc. government backed hackers just break in and install a rootkit (giving free access to all).

Re:DMCA violation?

[viperidaenz]

It would be your friends fault, for selecting your network to be shared.
WiFi Sense may be enabled by default, but you need to specifically share each network.

Re:DMCA violation?

[Anonymous Coward]

Are you people fucking stupid? WiFi sense only shares your internet connection. It does not provide access to your LAN or any devices attached to it.

Re:DMCA violation?

[suutar]

for now. I can see this being quickly targeted as something to hack, so that "share this network" defaults to true, or even so that "share this network" and even "activate wifi sense" is treated as true regardless of actual user setting.

Re:DMCA violation?

[Anonymous Coward]

That doesn't seem to be true according to https://msdn.microsoft.com/en-us/library/windows/hardware/dn790058%28v=vs.85%29.aspx , they specifically require allWiFi Sense settings to be on by default, i.e. all networks will be shared by default.

Re:DMCA violation?

[Anonymous Coward]

Or it would be your fault for having a friend.

Re:Bad Summary, Only new part is the sharing optio

[Anonymous Coward]

if you are giving guests your wifi password then you have already opted in to whatever that guest decides to do with it, they could publish it on facebook, email all their other friends. once you hand out access you have already lost control regardless of the device they are using.

Re:Bad Summary, Only new part is the sharing optio

[ArmoredDragon]

And if they're doing it in public, you'll probably be aware enough to change your password.

Not only that, but I don't want my passwords being stored on Microsoft's servers.

Oh wait a minute, you're that moron who thinks layer 3 switches are merely "bad routers." Go back to whatever high school you dropped out of, and for the good of the world NEVER go into IT or anything else besides janitorial work.

Re:Bad Summary, Only new part is the sharing optio

[sexconker]

Mad cuz bad? Yeah, mad cuz bad.
Fuck off retard.

Third Option:

[steevo.com]

OPTOUT of Windows 10.

Re:Third Option:

[slacklinejoe]

Or just ask them to change the defaults on a checkbox: http://windows.microsoft.com/e...

Re:Third Option:

[Anonymous Coward]

New router name: No_Windows10_devices_allowed_optout

Re:Third Option:

[slashways]

Taking into account the new absurd secureboot policy - Opt out Microsoft is the right way.

Alternate optout

[Anonymous Coward]

You can also opt out by appending _fuckoff to your SSID.

Re:Bad Summary, Only new part is the sharing optio

[Anonymous Coward]

You miss the point. It's not about people deliberately sharing your WiFi credentials (which, let's face it, you can't do anything about short of (a) not giving the credentials out, or (b) changing the credentials on a regular basis.) It's about people inadvertently, without realising it, sharing your WiFi credentials to a bunch of people you probably don't know.

Combine that with the fun of explaining to prosecutors that, yes, the illegal traffic came from your network, but you don't know who was responsible for it, and you're left with a gaping chasm of "well, it seemed like a good idea at the time.."

Illegal?

[Anonymous Coward]

IANAL but this sounds to me like a violation of the federal Computer Fraud and Abuse Act which prohibits unauthorized access to a computer and the "trafficking in
computer passwords and any other information which can be used to gain access to a protected computer".

My SSID is clearly off limits - getoffmywlan

[Anonymous Coward]

I keep seeing attempts - but so far, not a single connection that wasn't authorized in 15 years.

No, just no

[Anonymous Coward]

Microsoft should never code a password sharing feature. This creates infinitely more problems than it solves.

Where is the password ?

[RichMan]

Either Microsoft will have a database of all users and all Wifi passwords.
Or some automatic process will slurp it from your machine when needed.

I can't quite figure out which is worse.

Re:Bad Summary, Only new part is the sharing optio

[abhi_beckert]

Which explains why I don't have to re-enter passwords after restoring from backup. You moron.

You do have to re-enter your passwords after restoring from a backup with Apple devices.

I just had to go through it earlier this week.

Lawsuit

[grahamtriggs]

If Microsoft are stupid enough to ship this "feature" - and have it turned on by default - what are the chances that they will be hit with a massive lawsuit?

No doubt there will at least be group policies - if not it disabled entirely - on professional editions of Windows, because corporate customers are going to run a mile from having external guests authenticating on to protected networks with confidential material, just because they happen to be a contact of the person they are visiting.

Easier steps

[slashmydots]

1. set up an offline account by not connecting to a network while setting up Windows
That's actually the only step. It avoids all that Outlook.com bullshit.

Re:Bad Summary, Only new part is the sharing optio

[ArmoredDragon]

Why would I be mad? I'm not the one of us who has to wake up every morning to a brain dead existence.

Problem Solved

[Nyder]

I have the problem solved, I am not running Windows 10 on my gaming PC.

Re:Problem Solved

[freeze128]

I'm sure it's just another service that you can simply disable. You don't have to sacrifice your Halo 15 or whatever. Just go into services and turn it off.

Re:Problem Solved

[Bert64]

Until games start requiring it...

Re: Bad Summary, Only new part is the sharing opti

[Anonymous Coward]

If you backup to a specific computer instead of iCloud and choose to encrypt the backup, then and only then will iTunes backup your passwords and other keychain data.

You can also use the iCloud Keychain to store/share keychain data without using iCloud: don't set a password, and sharing works only among devices that belong to the circle of devices that you authorize, without storing anything on iCloud servers. Apple actually got that right, although it's an option hidden in the iCloud keychain dialog boxes.

It's still shared with Microsoft/ NSA

[Anonymous Coward]

Even if you add _optout its still shared with Microsoft, its just not passed on automatically.

Sounds like a certain out of control agency has paid them to harvest all your Wifi passwords.

*Encryption Key* not password!!!

[Anonymous Coward]

For the love of all that is unholy can we stop pretending that WiFi encryption keys are 'passwords.'

Each serves a very different purpose; just because a side effect of a WiFi encryption key resembles the purpose of password doesn't mean that they are one in the same...

The primary function of a password is to provide access control. You add passwords to your accounts in an attempt to restrict access to your accounts. No password - no access.

The primary function of an encryption key is to encrypt information in an attempt to keep third parties from snooping on the information being transmitted. No key - no snooping.

Not surprisingly, when you are transmitting information over a wireless connection, it is vitally important to have the information sent over that connection encrypted, either at the transmission level or the application level.

By giving out your encryption key (either for primary or guest access) you are allowing that person to snoop on *any traffic* flowing over that connection as if it were unencrypted; not to mention that the owner can also snoop on any information sent over the connection.

Just remember that the next time you access the internet over your local coffee shop's WiFi that everyone else using that connection can see everything you send and vice versa. Make damn sure that you have application level encryption for everything you do over a wireless connection.

Now rethink the article and decide if default sharing of *Encryption Keys* which allow anyone with the key to snoop on the connection traffic is as good or as bad as you thought when you read it as being *Password* sharing.

Re:*Encryption Key* not password!!!

[Anonymous Coward]

For the love of all that is unholy can we stop pretending that WiFi encryption keys are 'passwords.'

The primary function of a password is to provide access control.

The primary function of an encryption key is to encrypt information in an attempt to keep third parties from snooping on the information being transmitted. No key

So you are saying that both are a form of access control and are thus identical. Got it.

Re:*Encryption Key* not password!!!

[Anonymous Coward]

That's not how WPA and WPA2 work. WEP, yes, but that should not be used under any circumstances anymore.

Apparently nobody can read

[Anonymous Coward]

Kinda disappointed, but expected on the internet.

This service only shares OPEN WIFI -- i.e. routers that had no passwords on them to begin with.

I seriously don't see the big deal here. You could have logged in yourself anyway by hitting your wifi settings and connected by clicking on the AP and nothing else...

Re:Apparently nobody can read

[grahamm]

This service only shares OPEN WIFI -- i.e. routers that had no passwords on them to begin with.

So what is it sharing? If the connection is open, then there are no credentials for it to share? In the case of open WiFi, the only thing I can think of that it could share is the list of Open SSIDs to which the user has connected?

Re:Apparently nobody can read

[Anonymous Coward]

Apparently YOU can't read:

When you share Wi-Fi network access with Facebook friends, Outlook.com contacts, or Skype contacts, they'll be connected to the password-protected Wi-Fi networks that you choose to share and get Internet access when they're in range of the networks (if they use Wi-Fi Sense).

Re:Apparently nobody can read

[oh_my_080980980]

Because you didn't read the article. Try again Zippy.

Re:Bad Summary, Only new part is the sharing optio

[ArmoredDragon]

if you are giving guests your wifi password then you have already opted in to whatever that guest decides to do with it, they could publish it on facebook, email all their other friends. once you hand out access you have already lost control regardless of the device they are using.

Yes because having it stored in reversible crypto on Microsoft's publi facing servers is so much better.

It just means that the only safe and sane thing to do is to forbid Windows 10 devices from joining your network.

Re:Bad Summary, Only new part is the sharing optio

[Namarrgon]

The problem is, if I let any of my friends near my beer, they could easily end up inviting all their Facebook friends to whizz in my ale. And the only way to scare them off is to write "_OPTOUT" in large letters on my favourite beer mug.

Re:Holy fuck ...

[freeze128]

Look at it this way: At least when Windows 10 is finally released, they won't be able to say "It's the most secure windows ever".

Re:Bad Summary, Only new part is the sharing optio

[Anonymous Coward]

I'm covered regardless, no one I know is stupid enough to ever run anything past Windows 7 or even consider using Windows Mobile of any version.

Awesome!

[Anonymous Coward]

Another reason to stay with Windows 7...

Re:Bad Summary, Only new part is the sharing optio

[Anonymous Coward]

Even if this were only confined to Windows Phone 10, it would still be monumentally stupid.

But we would be statistically unlikely to ever be affected by it.

Re:Bad Summary, Only new part is the sharing optio

[WaffleMonster]

First, we're only talking Windows 10 PHONE Secondly, it's only available on networks you choose to allow this on.

Quoting TFA:

", and access to password-protected networks are shared with contacts unless the user remembers to uncheck a box when they first connect."

Is this saying that choosing to allow requires users to take a non-default action to uncheck a box or is there something missing or being intentionally distorted?

If you have to uncheck a box to prevent sharing as TFA implies then that's crap.

Third, yes, your wifi passwords are being backed up to make it easier when you migrate devices - Apple, Google and Microsoft all do this on your mobile devices. This isn't new!

So? What does it matter who else is doing it or how long it has been done?

Maybe let's share account passwords as well

[Anonymous Coward]

Last time I checked the calendar, today isn't the April's fools day...

Assumption is I trust all my contacts equally

[n0ano]

Do I understand this `feature` correctly? If I enable it then all of my contacts now have access to my wifi credentials. I can imagine that I might want this feature for my wife and kids but there is no way in hell I would want to do this for every contact in my list. My wife I trust but the friend of a friend that I just added to my contact list - not so much (although thinking about it maybe that should be reversed).

If that is truly the way this thing works then this is one of the more brain dead ideas some clueless program manager came up with (ranks right up there with the idiot that decided that email messages should be HTML formatted and should contain active content).

Re:Assumption is I trust all my contacts equally

[Anonymous Coward]

I think this is a mistake by Microsoft, but I don't think some of the hyperbolic nonsense being posted on /. (like MS doing this because it is their purpose to be evil) helps.

I can see what this is intended to do, and why it is intended to do it, and even why that is attractive to a lot of people. I have no issue giving my guest wifi password to friends when they visit, allowing them to automatically get it without having to ask would be fine, and I think most home users think that way. Yes, there's a clear downside to this and I'm not sure most people would be aware of it, and that is my main issue.

If they made it so that contacts didn't pass on passwords they'd got from other contacts then I'd probably be happy to allow this on my network.

Re:Assumption is I trust all my contacts equally

[Chelloveck]

No, you misunderstand. You're right that it goes to all contacts indiscriminately. You don't get to pick and choose who. But it's so much better than that. You don't enable it. You don't even have to have any equipment that runs Windows 10. Say you have a guest that you give access to. If they have a Windows 10 machine with this "feature" enabled, the password is shared to all of their contacts. Brilliant!

Re:Assumption is I trust all my contacts equally

[Anonymous Coward]

If you don't use Outlook.com, Skype or Facebook, what will Wifi Sense actually share?

If a tree falls in a forest and no one is around to hear it, does it make a sound?

Re:Bad Summary, Only new part is the sharing optio

[Anonymous Coward]

The problem is, if I let any of my friends near my beer, they could easily end up inviting all their Facebook friends to whizz in my ale.

Considering you've already pissed in your beer, additional piss isn't going to make it worse. It's already as bad as it can be.

And the only way to scare them off is to write "_OPTOUT" in large letters on my favourite beer mug.

Or by simply not enabling WiFi Sense in the first place.

NOPE!

[Anonymous Coward]

I'm sorry but my paranoia level long ago prevented any device without a whitelisted MAC from accessing my personal fortress of solitude. If Windows 10 wants to share WiFi access I've gained at other, non-home locations with my contacts then M$ can deal with the related collateral damage in court. I may not be wealthy but that doesn't mean I won't lawyer up in a heartbeat if my financial prosperity has wrongly been put into jeopardy.

Re:Holy fuck ...

[houghi]

Have you been in a coma for 15 years? Let me give ypu a short history lesson:
Some idiots flew into the twin towers on purpose. Afganistan was invaded to kill the terrorrists.
Irak was invaded to kill the same terrorists, but it was really about weapons of mass distruction, but actually about oil.
We have always been at war with Terrorism.
For our own safety; subpoenas do not excist anymore.
War is peace, freedom is slavery, ignorance is strength.

Wiretapping Law?

[Anonymous Coward]

I wonder if there is a way that this would run afoul of federal wiretapping laws. We already know with the recent google map cars that WiFi is not considered "easily/ readily available to the public" even if there is no password. This meant Google did run afoul of federal wiretapping laws, even for things without a password. Just makes one wonder. It seems, from my little knowledge of computer security, to be fundamentally insecure.

Just waiting for hackers to exploit and even ....

[MxMatrix]

I think this might even facilitate wardriving on a huge scale. And M$ to blame for it. Storing a password via outlook on a M$ server? Even hashed it's just a matter of time and GCPU power before its cracked. Using cheap 2n hand Titan cards and some nifty written piece of cuda software ...

Or is this the new NSA backdoor?

Re:Bad Summary, Only new part is the sharing optio

[Namarrgon]

And making sure nobody who has access to your wifi ever enables it either. Best of luck!

Re:Bad Summary, Only new part is the sharing optio

[Anonymous Coward]

Or you could just not enable the feature or disable it if you already did. No WiFi Sense running, no connections being made.

Re:Bad Summary, Only new part is the sharing optio

[Anonymous Coward]

Why would that matter? If you don't have WiFi Sense enabled, nobody can connect through it. What don't you understand about that?

Re:Holy fuck ...

[Anonymous Coward]

Exaggerate much?
It isn't selling your mother into sex slavery.
It's a piece of software. Buy it, don't buy it.

Re:Bad Summary, Only new part is the sharing optio

[Anonymous Coward]

You were that kid that ate glu in grade school, right?

The problem is that your regular semi-computer-illiterate friends come over with their Windows 10 laptops and ask to use your wifi for ten minutes, you give them the passphrase and their laptop now shares it with everyone they know.

Options

[verd02]

So available options include:

* Per the Wifi-sence FAQs, 802.1x networks will not be included. So we can enable WPA2-Enterprise security, for which a Radius auth server is required. Evidently easy enough to do with dd-wrt or the like but much more work to allow guests in.
* MAC address filtering? Won't prevent the password hash from being stored on servers and passed around to contacts, but will prevent non-registered devices from authenticating. More work than previous option.
* Use the _optout thing. Not a lot of work but sort of offensive.
* Not give out password to any guests, because even if they're using their Android phone one day, they might pass on the password to their Windows-phone-using buddy.

I guess option #1 it is. At least it lends some nerd cred? This is annoying.

Re:Options

[Bert64]

MAC filtering will stop random users from connecting automatically, but won't stop someone who is intentionally trying to gain access... Changing your MAC is trivial.

Agreed that _optout is offensive, why should i have to change the name of *my* network to cope with this crap, and where would it end? I shouldn't have to explicitly opt out of things i never have any intention of using and might not even be aware of.

The only real solution is a dedicated (isolated) guest network, with regularly changing keys... I don't have guests visiting all the time so i could easily generate a new key each time...

The only real solution to this...

[Anonymous Coward]

...is to rotate your key daily or maybe hourly using a key generator and some scripting to push it. At least openWRT would allow this programmatically but no way off the shelfs would unless you want to automate a browser AND take into account the constantly changing interfaces for all the different brands.
Does anyone know if there's a way to fingerprint a win10 device from their broadcast? Because that needs to happen

Re:Bad Summary, Only new part is the sharing optio

[rseuhs]

The point is that with Windows 10 this will happen automatically without them knowing it.

So when I invite a Win10 user and give him/her the password, that password may be shared to anybody that Win10 user is connected to - without that Win10 user knowing or realizing it.

And of course a lot of people use the same password for their WIFI as for other stuff, so Win10 seems to be a quite nice password sniffer.

That is the problem. People screaming passwords from mountaintops isn't.

Re:Bad Summary, Only new part is the sharing optio

[rseuhs]

So when I invite Win10-users I have to debug and reconfigure their devices on the doorstep? Are you serious?

This is nothing new

[Anonymous Coward]

Some Intel laptops have this ability for some time. In fact sharing a wifi connection was originally created for times when only a LAN was available and rather then connect every PC to a cable you could use just one and share that connection via WiFi. Now of course in a wireless world Microsoft has decided to make this a on all the time default. You can turn it off and public connections are off by default like the Xfinity hotspot connections. So don't worry if your using a public wifi. This is for known private connections not public. Still I understand the concern and how this feature is kind of buried and many users will not even know its there. Again, Microsoft is getting like Apple and Google making choices for the end user that may not be always correct for everyone. This is similar to Bluetooth allowing a connection all the time form other devices. PC makers might offer some sort of value added software to be able to turn this off and on, or may even distribute their PC's with it disabled? Still early yet, to know how Microsoft and its partners will use it. Beta versions tend to default everything on to test the OS fully. So just because Preview is on, means very little.

Contacts

[DanJ_UK]

Make sure you don't have any contacts in your Outlook address book.

Re:Bad Summary, Only new part is the sharing optio

[slacklinejoe]

You're friends (acquaintances) with someone who uses Windows PHONE?

Re:Bad Summary, Only new part is the sharing optio

[slacklinejoe]

The sync my Password to Microsoft has been part of Windows 8 and newer from day one. It's just this poorly implemented guest access that's stupid.

Re:Bad Summary, Only new part is the sharing optio

[slacklinejoe]

Eh? I didn't. I demo mobile device management and nuke my demo iPad daily. I've never had to re-enter my corp wifi. Way back both Google and Apple had breaches about some users' wifi passwords being lost, but I think it was only a tiny subset of users. Maybe they have changed practices.

Re:Bad Summary, Only new part is the sharing optio

[slacklinejoe]

Why thanks! It's always nice to be recognized... No, just a MS consultant that works in the systems management space. I'm paid to clean up MS's mess, so I'm usually pretty busy :)

Re:Bad Summary, Only new part is the sharing optio

[slacklinejoe]

Thanks for the correction! Seems the product teams weren't talking internally, I got bad intel from Redmond. It's still opt-in though, so I don't see the controversy. The save to server isn't new, only applies to MS accounts - not local only, and I had to be stupid enough to click a checkbox to share it before this works.

Re:The password must be stored centrally by Micros

[slacklinejoe]

Not saying it's not used for that, but the users I support complain constantly about having to re-enter wifi credentials. When I spot to MS over Win 8, the idea was to make it easier to support wiping devices and device migration. MS was in the middle of moving to the whole user model where my data is the same on phone, laptop, desktop regardless of where I go - isn't entirely there yet, but that's the framework they want to have in place. Still, it only applies if you bothered to link your account to a MS account.

But what about google maps?

[Anonymous Coward]

Didn't Google already claim ownership of my SSID in case i wanted to opt out of google maps WIFI scanning ?

Re:Bad Summary, Only new part is the sharing optio

[slacklinejoe]

Looks like I was wrong about this being PHONE only, that said, I think changing the checkbox to default unchecked would be sufficent. How about letting MS know your thoughts: http://windows.microsoft.com/e...

Re:Bad Summary, Only new part is the sharing optio

[Superdarion]

I wonder, though, if you give your pass to a guest who is using win10 (unbeknownst to you) and your router is set to not allow win10 devices (is this possible? I'm not techie enough), would their win10 machine still save the pass and share it?

If so, you would need to do the banning personally. If your guest asks for your pass, you will need to personally check that they're not going to use it with a win10 device before you hand it over.

lolwut?!?

[Dekonega]

This Microsoft Wi-Fi Sense thing is a joke, right?

NSA Malware spy tool disguised as O/S

[Anonymous Coward]

Step 1. Make Encryption Obsolete by getting all the keys to all the locks.
Step 2. NSA Secretly imposes requirement on Microsoft.
Step 3. Get Microsoft to give away windows 10 to every one on he planet
Step 4. Get Microsoft to set up a server that every Windows 10 install reports your access credentials to.
Step 5. All your privacy belong to us.
Step 6. World Screwed.
Step 6. A. Server malfunctions shares everyone's credentials with everyone, World Screwed.
Step 6. B. Server shares with your contacts, then cascades sharing from your contacts their contacts and so on and so on until everything shared with everyone, World Screwed.
Step 6. C. Server hacked by China, World Screwed.
Step 6. D. Server hacked ransom-ware installed every ware, World Screwed.
Step 6. E. Because on an "Over-Site" everything just a Google search away, World Screwed

Non-issue

[Anonymous Coward]

I'm looking at current window 10 build: Manage Wi-Fi Settings shows checkboxes to share or not with outlook.com contacts, skype contacts, facebook friends.
Additionally you MANUALLY select networks to share. None are automatically selected on my laptop.

give phone numbers to idiots spreading passwords?

[bingoUV]

WHAT ??? Sign up with "insider", which must know your phone number? So share my phone number with the idiots who thought sharing passwords is a great idea?

You must be a moron.

Overly complicated, utterly insecure.

[Charcharodon]

Or you just look at the post it note on my wall by the door with the guest logon Wi-Fi password. You can connect to the internet, but you still have no access to my network..

It is...

[Anonymous Coward]

It is The Register so take it lightly. Seen a bunch of stuff on The Register that been reported wrong or miss reported.

Painful Work Around?

[Anonymous Coward]

So if I turn on MAC Address checking on my wifi router I'm assuming it will stop this nonsense as relatively
annoying as it might be.

The Most Practical At Home Solution I Can Think Of

[Anonymous Coward]

I could change my WPA-PSK WiFi password now on my Linksys router and on all the PCs and smart phones in my house and keep track that no one brings in a Windows phone and then after anytime I give someone else the current password go through all the bother of changing the password again on the Linkys and all the house's devices. Yuck.

Ahh, I know, I can use Tomato or DDWRT on my Linksys router and have two SSIDs can't I? I could change just the password on the guest SSID and not have to change the password on all of the house's devices. What about having the guest SSID have the _optout on it and never changing its password? Naw, if that's okay might as well just put _optout on the main SSID.

I'd rather Microsoft not have my password - or even a hash of it. Do you think an SSID with _optout keeps my password safe from Microsoft (or their partners).

Really Dumb Microsoft

[Anonymous Coward]

This is poorly thought out and criminally stupid. What about contacts you are required to maintain by court decree (my ex for example) which I certainly don't want to have access to my wireless. Actual friends are OK, but what about friends of friends of friends? I don't know them, so why would I want Microsoft to give them access to my network?

Good news for apple!

[Anonymous Coward]

This is good news for Apple!

I knows for certain that there won't we any windows 10 devices on my home network.

Don't worry about sharing

[Anonymous Coward]

My wifi has chlamidia :)

So sick of this crap

[gregroush]

This is an old sentiment, but I am SO sick of software companies having the arrogance to think that because I've installed their software I want them to mess with my environment.  They try to change my default browser, add tool bars or other software, change my settings, and now, I guess, share my wi-fi.  HOW ABOUT YOU JUST DO THE THING I AM INSTALLING YOU TO DO?!  Not more, not less.

Any changes to my environment beyond "your software is now on my computer" should require clear and explicit OPT-IN from me.  It should not be hidden in a EULA, nor sneaked through as an opt-out in a dialog box.  All that garbage does is tell me I should not trust you as a software company, and I should immediately research alternatives.

It's OK to ask if I want to do it, if you explain in plain English what exactly you want permission to do, how it may benefit me, and what the potential risks are.  I can see how some of these things may be beneficial, but it should be my (informed) decision.

both solutions are unacceptable

[NonSenseAgency]

This is one of the most lame-brained ideas I have ever heard. Even the two solutions offered by Microsoft are unacceptable. It needs to either default to "OFF" or be removed from Windows. This is an epic privacy and security failure in the making. I cannot believe a sane engineer came up with this it had to be a marketing drone with zero clues.

Holy shit

[steveo777]

Microsoft also adds that Wi-Fi Sense will only provide internet access, and block connections to other things on the wireless LAN

So I'm reasonably certain all this will do is block access to your subnet and only allow traffic to your gateway. Which in any corporate environment is a massive security risk because if they're doing it right, employees are sitting on different subnets (RFC1918 or otherwise). So, yes, random guy who happens to be a contact in Outlook.com (which literally BEGS to let you make every you ever emailed a contact) now has access to every normally permissible network node as long as he's not interested in the wifi subnet.

Yes, most corporations should be using per-employ authentication, and hopefully Sense engineers are dumb enough to share out AD/LDAP credentials (well, maybe they're not smart or interested enough to go into *nix authentication). But that's not always the case.

Can't wait until this is called "Wifigate"

Coming soon to a router near you

[Anonymous Coward]

All new routers will allow users to connect without a password... but it won't grant any access and the first port 80 request will redirect to a page where you type in the password. Voila! The password isn't shared, it's stored on your web browser instead of the desktop environment, and everyone has a huge pain in the ass whenever they want to do something that isn't browsing web pages.

OR by waiting for Windows 10.1

[Anonymous Coward]

Doesn't EVERYONE know that version X.0 of any software is a bug-ridden mess?

Why anyone, anywhere, ever, agrees to beta test, or use an early version of software, is beyond me.

It's like volenteering to test home made explosives, before they have figured out how to make fuses with dependable burn times.

So, look, the 10.0 version of windows has a mind-bogglingly dumb setting for password security. Everyone will freak, MS will fix it. And in 2-3 years, when the non-insane people switch from windows 7 or 8, up to Windows 10.1, it won't be a problem anymore.

The Kevin Bacon game,

[Anonymous Coward]

except this involves the NSA. How far removed are you from the NSA knowing your password?

Sounds a lot like theft

[JDWilsonJr]

Hmmm ... Microsoft does not own my wireless access point, nor my router, nor pay my ISP bill. Sounds like this will eventually be resolved with criminal charges for theft and/or tresspass. I wonder whether it will be a class action suite or some lucky plaintiff is able to set it in motion and keep all the money.

Hidden SSIDs and MAC addressing?

[Lawrence_Bird]

Clearly MAC address blocking can prevent most unwanted access but is a pain to setup every time you have a guest. Wonder how this "feature" handles hidden SSIDs? normally you need to check an extra box to connect to a hidden network. That wouldn't prevent those determined to get acces but might stop the random casual use by neighbors.

So that's how you want to play?

[The Eight-Bit Link]

Set up your router so any unauthorized MACs are monitored via MITM. Strip away SSL, kill any SSH pipe or VPNs, log all traffic. Be sure to put up a warning in the middle saying what is happening and why. Something along the lines of "One of you rbuddies gave you my password. Therefore, I am going to record and save all data transmitted across this connection. If you do not consent to this, please opt-out by disconnecting." To be honest, someone's going to find a clever way to prevent this.

Then you should share it, for a simple reason:

[Anonymous Coward]

Plausible Deniability

Re:Bad Summary, Only new part is the sharing optio

[sexconker]

LOOOOOOOOOOOOL
You're SO MAD!

WILL NARDELLA BE ARRESTED FOR FEDERAL FELONIES ?

[Anonymous Coward]

HEI NARDELLA ARE YOU AWARE YOU WILL ! BE SUED FOR BILLIONS AND BILLIONS OF DOLLARS OF DAMAGES FOR AIDING AND ABETTING FEDERAL FELONIES ? THEFT !? WIRE FRAUD !? WORSE CRIMES ?

are YOU MISGUIDED Microsoft manager awareyou WILL ! Be sued for wilfully allowing federal and national security crimes ?

Maybe not ....but read the fine print in a bunch of documents you Microsoft signed before the NSA starts knocking at Nardella's door at midnight.....

Nah, won't help em'

[Anonymous Coward]

They can have that password all day long. It won't put them on my whitelist.

Re:Bad Summary, Only new part is the sharing optio

[Namarrgon]

Because if your friends can connect to your network, and they have WiFi Sense enabled, then access to your network is shared with all of their Facebook friends.

So you have no control over who now get access to your network. Is that clear enough yet?

Re:Bad Summary, Only new part is the sharing optio

[TomH123]

> Apple CAN NOT read my passwords, so they can not share them. Do you honestly believe this? You probably also believe it when Apple says that Macs can't get viruses.

Re:Bad Summary, Only new part is the sharing optio

[ArmoredDragon]

Nononono.

See, mad is what happened to you after you saw a Google bus, because you believe that it was responsible for you having to take out a second mortgage on your cardboard box, even though in reality it's because you're so dumb that nobody will pay you more than minimum wage to clean the scum off of the bottom of a McDonald's fryer.

This is total bullshit.

[Kickasso]

If I can successfully connect to a hotspot, this doesn't mean I own that hotspot or have any right to grant access to it to third parties. Someone's being an idiot, and this time, for a change, I suspect it's not Microsoft.

Re:Bad Summary, Only new part is the sharing optio

[ArmoredDragon]

I wonder, though, if you give your pass to a guest who is using win10 (unbeknownst to you) and your router is set to not allow win10 devices (is this possible? I'm not techie enough), would their win10 machine still save the pass and share it?

I don't know of any AP's that support this feature, but I'm sure you could have the router issue deauth packets to any MAC address that you've identified as belonging to a windows 10 device, that way it isn't able to communicate with any other devices on the node (e.g. for hacking purposes.) I suspect such an AP would exist, because I know that Marriot was using the same attack to prevent people from using their own private APs near their hotel.

As for how you might identify a windows 10 device to begin with, I wouldn't be at all surprised if any of its 802.11 frames included any bits that could be uniquely linked to that OS version. One way I could think of would be to look for MAC OUIs that are used on Lumia devices. It seems this feature is only for Windows 10 mobile devices, so that alone would keep out at least 90% of them.

Friends of friends do *not* get automatic access

[partofthepuzzle]

From the MS Windows Phone Wi-Fi Sense FAQ:

"You share with your contacts, but not their contacts. The networks you share aren't shared with your contacts' contacts. If your contacts want to share one of your networks with their contacts, they'd need to know your actual password and type it in to share the network."

Re:Holy fuck ...

[Anonymous Coward]

Microsoft only centrally store your credentials if you let it.

Not using a Microsoft account (don't give in to them nagging you to enjoy the 'full Windows experience'), and avoiding anything Microsoft for mobile (tablets and phones) will do the trick.

It seems like even a fresh install of Windows 10 on a desktop PC needs to be kept on a tight leash: Installing Classic Shell, disabling Quick Access on File Explorer, get rid of all preinstalled Metro crap with "Get-AppXProvisionedPackage | Remove-AppxProvisionedPackage", and settling this wifi thing.

Ravinder Singh

[Anonymous Coward]

Learn online & practice Russian by Skype lessons provided by tutors available on preply.com....

Very easy and a much effective for improving and learning the language from some very experienced tutors....

Also one can learn any international language from the tutors available on it....

Must join this here... http://preply.com/en/russian-by-skype