Hacker News Reader

Comment by fdahgrthkn | Hacker News Reader

"using this system from the start"

I don't use Windows, so I cannot use this system at all.

"add you neighbor on Facebook and get free access to their WiFi"

That's missing the much bigger downside. Give your neighbor your Wi-Fi password and they can share it with hundreds of their friends automatically.

Microsoft claims users will not be able to find the password and that users will only be able to access the Internet, but that assumes there are no security holes. I'm not comfortable putting my network security in the hands of a company I did not choose to associate with.

View on HN

> Microsoft claims users will not be able to find the password and that users will only be able to access the Internet, but that assumes there are no security holes.

You don't even need a "security hole": the machine needs to know the key to connect. From there, it's your machine -- you will be able to read it out of memory. Now, this is probably out of reach for most "average users", but for even a moderately capable attacker it provides little protection (and tools automating this will likely become available).

At best, if the Wifi network is using a passphrase it'll only send you the key (which is calculated by applying the PBKDF2-HMAC-SHA1 function to the passphrase using the SSID as a salt for 4,096 iterations), but this still lets the user get on the network and decrypt traffic.

> Give your neighbor your Wi-Fi password and they can share it with hundreds of their friends automatically.

Give your neighbor your Wi-Fi password, and they can trumpet it on the streets, distribute on pamplets, post it on HN, and update their Facebook status with it.

I am a little shocked at the HN reaction here. I've had a Windows Phone since January and I've thought the feature was not only useful, but a great idea. The only benefit for me has been the automatic TOS acceptance though since nobody else I know has a Windows Phone.

If you're running a "secure" wireless network and don't want anyone else to use it, well, don't give anybody you don't trust the password, and make sure they're not running services like Wi-Fi Sense. Generally speaking, the common man is going to want any of his friends he lets into his house onto his Wi-Fi anyway.

The problem is that it is automatic, it spreads without confirming anything and without any deliberate action.

The problem (with this post in HN) is that it _isn't_ actually automatic. Your device being receptive to automatically-shared networks is default-on/opt-out. Your device automatically _sharing_ a network is default-off/opt-in, as well as (I think) being on a per-network basis.

This is correct. None of this is automatic. It's all opt-in.

I don't believe Wi-Fi Sense is on at all by default (I am pretty sure I had to turn it on), and it explicitly shares only Wi-Fi networks you select, not all of them. You have to go in to your saved Wi-Fi networks and share each one individually. You also have to individually check each list of contacts (Outlook, Skype, Facebook, etc.)

It is absolutely not sharing all your networks automatically with all your Facebook friends.

Here are screenshots (note I'm 99% sure I turned on Wi-Fi Sense):

http://i.imgur.com/bzaK2aT.png http://i.imgur.com/vnbDkdj.png

I suppose it's ironic the FUD is directed against Microsoft now.

Router companies should get together with Microsoft and make some kind of Flag you can tick, so your router actively tells you can't share this, without the ridicules name of "_optout" as last part :)

That's one solution. I don't think it's ideal. Not everyone would know to tick that box. I would, but my friends would not and their networks would be vulnerable.

It could also require buying new hardware. Once again, I would know to look for a Wi-Fi Sense-proof router, but my friends would not.

I also don't think we should be expected to solve problems that Microsoft caused. Why should the industry adapt to Windows rather than the other way around?

Well, will at least be interesting to see what the future holds for Wi-Fi Sense :)

Maybe instead they could have router makers add a flag to opt in to this insanity. Then if people really thought it was important for their networks, they could ensure they have compatible hardware, and turn it on.

Reply on news.ycombinator.com