Ramblings of an old Doc

 

WiFi Sense is meant to be a quick and convenient way to connect to “Crowd sourced” WiFi networks…which might or might not be so good since “secure” rarely means the same as “quick and convenient”.

Crowd sourced? Well, MS has a huge database of open hotspots, about a million, from consenting MS users as they logged onto these hotspots.

“When Wi-Fi Sense is enabled, it searches for open hotspots. Upon finding one, Wi-Fi Sense will check the hotspot's beacon information against the database. If information about the hotspot is located, Wi-Fi Sense will send the required information automatically, removing the need for user intervention.” – TechRepublic

Well, open WiFi nets aren’t necessarily secure, even if they were when the database was developed. What makes this really not good is that the connection is made by default (to make it “easy”) instead of requiring a choice to opt in and connect or not with the appropriate warning.

"When you share Wi-Fi network access with Facebook friends, Outlook.com contacts, or Skype contacts, they'll be connected to password-protected Wi-Fi networks you choose to share and get internet access when they're in range of the networks." – MS

So…while you don’t see the password, it must be one that’s stored somewhere…and who says that’s secure, or for how long it will be?

"For networks you choose to share access to, the password is sent over an encrypted connection and stored in an encrypted file on a Microsoft server, and then sent over a secure connection to your contacts' device if they use Wi-Fi Sense and they're in range of the Wi-Fi network you shared. Your contacts do not see your password, and you do not see theirs."- ibid

So…you want to share passwords with people you don’t know all that well? Because it could be shared on Outlook.com, Skype and/or facebook. Once that is established, that person could (theoretically) park him/herself near your home, and connect to your wireless network with rights you gave them (albeit inadvertently).

There is a way to “opt out”: http://www.windowsphone.com/en-us/how-to/wp8/connectivity/how-do-i-opt-my-network-out-of-wi-fi-sense

Anyway, just to make you folks aware…

Source:

http://www.techrepublic.com/article/windows-10s-wi-fi-sense-draws-security-concerns-and-questions/?tag=nl.e101&s_cid=e101&ttag=e101&ftag=TRE684d531


Comments
on Jul 23, 2015

Good find Doc. My cable comes with a router for home plus access to all the hotspots courtesy xfinity.

on Jul 23, 2015

Meh, wireless is inherently less secure.  That said....

1)  Just turn WiFi sense off on your device to begin with.

2)  Get better WiFi security.

IE, it doesn't matter if I was to accidentally share my private home connection over WiFi sense because you're still going to be directed to a splash page to log in with a second set of credentials.  Plus I check the client list on a regular basis to make sure there's no unknown devices connecting to the network.

Also, if you choose to share it with your Facebook contacts, you deserve whatever hell rains down on your network as a result.  Sharing with your Facebook friends list requires 3 separate actions (Check the box, click the allow link, log into Facebook account).  If that didn't give you any pause, shame on you.

on Jul 24, 2015

First, I don't do facebook. Second, I know how to cover my backside. But thanks anyway. Good tips.

on Jul 24, 2015


First, I don't do facebook. Second, I know how to cover my backside. But thanks anyway. Good tips.

You put your pants on one leg at a time...just like the rest of us...

on Jul 24, 2015

I guess it pays to old and 'non-techy', we have wifi in the house available to three PC's, a laptop and three smart phones but we have no network set up.  Could never come up with a reason to set up a network.  Our wifi is set up with security and used only by those living in the house. 

Thanks for the information you post Doc, it's information that everyone needs to be aware of.