Windows 10 Wi-Fi Sense is a bad idea
-
@anonymous said:
So you don't trust your friend? Or you don't trust yourself to keep up in your contact list?
You have a very different definition of friend than I do. "Person with access to an account that is a 'friend' with mine on a communications system" is not what I call a friend. My contact list includes business associates, people who want to chat with me, etc. The security of my Facebook or Skype list, all of which is just public info, is now a weak link in the security of any wifi to which I have access, not necessarily my own.
This has nothing to do with friends, this has to do with an arbitrary usage of one data set for a purpose for which it is not and never was intended. It's a massive security vulnerability, it's that simple. Even the idea that the association via FB or Skype somehow means friends is a fundamental flaw - the connection on Skype in no way suggests that I know that person, like that person or am friends with them.
The leap between "random list A" and "people you want to grant access to your network" is huge.
-
@anonymous said:
Or you don't trust yourself to keep up in your contact list?
Do you trust 100% of the people on your contact list? I certainly do not. I have people on various contact lists in order to maintain contact. That does not insinuate a friend. Just because a tool like FB calls them a friend, it does not mean they are.
-
@JaredBusch said:
@anonymous said:
It's encrypted.
Doesn't matter.
You are my FB firned and gain access to my network.
Your FB friend that lives across town drives by my house and pulls the password from you while at a stoplight.
His FB friend is my neighbor (that I don't know except to see in passing sometimes int he parking lot) and now has unlimited access to my private wifi network.
There is no way for the person to see your password, so how are they going to give it to someone else?
-
@JaredBusch said:
@anonymous said:
Or you don't trust yourself to keep up in your contact list?
Do you trust 100% of the people on your contact list? I certainly do not. I have people on various contact lists in order to maintain contact. That does not insinuate a friend. Just because a tool like FB calls them a friend, it does not mean they are.
My Skype account is not even my own!! It's a company account that I do not control.
-
@anonymous said:
Take off your tin foil hat. There is no way for the person to see your password, so how are they going to give it to someone else?
Who said they were going to give it away? That's not the concern. Not the big one, anyway.
But they DO have your password, physical breach is the biggest portion. That part is already done. They have your password.
-
BTW I am sharing my personal wifi password using this
-
@anonymous said:
Take off your tin foil hat. There is no way for the person to see your password, so how are they going to give it to someone else?
The linked article specifically stated that the sharing was automatic. no need to give the password.
@linked_article said:
Once Wi-Fi Share-enablers have typed that password into their Windows 10 devices, all of their friends can access our home network if they're within range. Even though we trust our friends and family, we haven't spent time with all of their contacts and Facebook friends, and we have no idea whether they're trustworthy.
-
I'm not saying that this is a completely crazy idea, I'm saying that without warning sharing security data with completely unrelated and arbitrary lists of people by default is insane. Completely insane.
Not only that, it is potentially illegal. Do you know that everyone on your list should have access to every network you have been granted access to?
-
are we sure it is enabled by default? I think I was asked to turn it on....
-
@anonymous said:
BTW I am sharing my personal wifi password using this
Go for it. That's perfectly fine. YOU are AWARE that you are sharing it with whole social networks. You can take the time and delete anyone that you don't want having access. It is perfectly fine for you to not just trust the people on that list but trust Facebook and Skype to be secure with their accounts and for you to trust those people with the security of those accounts.
But what about people who don't understand those things?
-
I use Apple's SSID sharing built into iOS to let all my devices connect after one has. but that does not come close to sharing it with someone else.
-
@anonymous said:
are we sure it is enabled by default? I think I was asked to turn it on....
See the screenshots above. that was on a brand new Windows 8.1 to Windows 10 upgrade.
Enabled by default. The only "choice" is to grant FB access. -
@JaredBusch said:
I use Apple's SSID sharing built into iOS to let all my devices connect after one has. but that does not come close to sharing it with someone else.
What if someone hacks one of your devices?
-
Think about this.... have you ever had any friend had their Facebook account hacked? I see people I know have that happen all of the time. It's not a secure system. Nothing in the use of Facebook suggests that the person using FB takes it seriously. Sure some people do and that is great for them. For other people it is just a completely casual account.
Now you are by association granted access through all of those allowances of lack of security.
And more importantly, allowing it to other networks, not just your own, just because you are nearby.
-
@scottalanmiller said:
Think about this.... have you ever had any friend had their Facebook account hacked? I see people I know have that happen all of the time. It's not a secure system. Nothing in the use of Facebook suggests that the person using FB takes it seriously. Sure some people do and that is great for them. For other people it is just a completely casual account.
Now you are by association granted access through all of those allowances of lack of security.
And more importantly, allowing it to other networks, not just your own, just because you are nearby.
How does the hacker know I have wifi sense on? How do they know where I live?
-
@anonymous said:
What if someone hacks one of your devices?
Different scenario. Risk yes, and a risk I have chosen to accept. But that is a completely different level of risk than publicly sharing on a social network.
-
So let's just imagine this scenario of total innocence...
- You are granted access to a secure wireless network at a business where you are doing some consulting.
- You have a friend on Facebook.
- Friend thinks FB is a joke and doesn't secure it because, why should they, it isn't important to them.
- Someone easily gets access to their FB account.
- That person now has access, when you are nearby, to a network you don't have the right to give out access to.
-
@anonymous said:
How does the hacker know I have wifi sense on? How do they know where I live?
Facebook shares a lot of that information. Some of this will be automatic. In a casual attack, yes, this is pretty minor. In a targeted attack, it's quite powerful.
-
@scottalanmiller business networks aren't allowed to be shared.
-
@anonymous said:
How do they know where I live?
You mean, like with this publicly available wifi database?
