Windows 10 rolls out with a feature called “WiFi Sense”, the ability to cache WiFi passwords, and share them with your contacts.
There are arguments in both directions, but I feel that Microsoft has crossed the line. Here is why….
Table of Contents
Recap of WiFi Sense
Rolled out as part of Windows Phone 8, this “feature” allows you to save any WiFi password, and share it with any of your contacts on Outlook.com
So, Alice connects to a WiFi network called “NETWORK1”. She gets the password, saves the connection, and chooses to share it using WiFi sense.
Bob sees that Alice connected to “NETWORK1”, so he’s now able to connect to NETWORK1. Bob can’t SEE the password, nor can he share it with Fred… only ALICE can share it.
Microsoft stores YOUR WiFi passwords on THEIR server, encrypted.
There is a way to opt out. All you have to do is change your SSID from whatever to whatever_optout. In the example above, NETWORK1_optout.
“Opting out” doesn’t actually “opt out”, it signals Microsoft’s servers to remove your information which “might take a couple of days”, according to ARS Technica.
Arguments For and Against
For: It’s convenient
Argument: You’re able to share known WiFi networks with yourself across multiple devices. So, if you have a Windows 8 phone that has already been connected to NETWORK1, now, your laptop can automatically connect without having to obtain the WiFi password again.
Response: Every platform, including older versions of Windows, supports “cached” WiFi passwords that are stored securely: They can’t be reversed, and the operating system prompts if the password is required for some reason. Bypassing this control allows unreasonable use of the WiFi password. YES, you could write it down. If you did that, it’s still kind of unethical: Whoever gave you the password trusts you not to share it, nor use it liberally. For example, I would consider it rude, if I gave someone my WiFi password, and they immediately connected all 20 devices that they own.
Bottom Line: Using someone’s WiFi network to connect multiple devices is an abuse of trust, unless you explicitly discuss it with them.
For: Sharing with your Outlook contacts is no different than telling them in person
Argument: Bob shares Alice’s WiFi network password with Fred. That’s no different than what happens with WiFi Sense.
Response: It’s a breach of trust, unless Bob discusses it with Alice up front. Alice gave Bob her password, expecting Bob to use it. Maybe Alice doesn’t even KNOW Fred. Why should she NOT be able to control Fred’s access?
Bottom Line: It’s a breach of trust to share someone’s network password with someone else, without their knowledge and consent.
For: This has been available since Windows Phone 8
Argument: This feature has existed since Windows Phone 8 was released. No one complained about it then!
Response: No one bought a Windows Phone 8, and frankly, if more people knew about this feature then, they would have objected to it.
Bottom Line: Windows Phone 8 is NOT a legitimate precedent.
For: If you object, you can always opt-out!
Argument: You can rename your SSID to SSID_optout, to remove your information from Microsoft’s servers.
Response:
Emotional: Why should *I* have to make changes to accommodate some Microsoft standard? It’s MY WIFI, IN MY OWN HOUSE. I’m not changing ANYTHING, and if Microsoft stores my WiFi password on their server, I’ll simply sue them.
Logical: What if IBM requires me to rename my SSID to _noIBM tomorrow? Now what? Do I rename it to _optout_noIBM or _noIBM_optout? Oh… right…. Microsoft is the only operating system in existence. Yes, my IBM example is pretty feeble, but the point is valid: You can’t just *require* me to change my infrastructure, and update 30+ devices just to avoid Microsoft’s feeble attempt to unilaterally own the internet.
Factual: Renaming my SSID to SSID_optout doesn’t “opt me out”, it simply flags Microsoft’s servers to delete my SSID. Meaning, for whatever period of time it exists on Microsoft’s servers, *my security* is basically a free-for-all.
Burden of Configuration: If I rename my OWN SSID, then I have to reconfigure 30+ devices, just to “avoid” Microsoft. This leaves me with the “burden” of configuration.
Bottom Line: If I want to “avoid” Microsoft’s WiFi sense, I need to rename my SSID. This means reconfiguring 30+ devices, and there is the risk that some other standard will ALSO require some naming standard that conflicts. On an emotional level, my WiFi exists in MY HOUSE. This feels like Microsoft coming in to MY HOUSE, dictating MY NETWORK to me. All of this is unacceptable.
For: It’s Cool!
Argument: What a COOL feature!! People who don’t like this are just stifling progress.
Response: It’s an unethical breach of trust, no matter how you slice it.
People called the Windows 8 anti-start-button “progress”, but it wasn’t what the market demanded: The market demanded a “start” button. I think people demand security.
Bottom Line: It’s an unethical breach of trust, no matter how you slice it. It’s not what the market wants.
For: Corporate Networks are Excluded
Argument: Networks that use enterprise authentication, such as 802.1x, requiring a user / device to authenticate itself, are excluded automatically.
Response: This is biased against small business owners and home users who don’t have ready access to enterprise authentication, don’t have Access Points that use it, and don’t have the technical knowledge to implement it.
Bottom Line: If you switch your network to use enterprise authentication, WiFi Sense will ignore it. However, this is difficult, and possibly expensive.
Against: It’s a Security Breach
Response: Correct! It’s also an ethical breach. Sharing passwords is the #1 DO NOT do, of computer security. Yet Microsoft, despite touted “beyond password” security enhancements, seems to be OK with sharing passwords! Biometrics is known to be weak, and has some pretty serious side effects — you could lose a limb, a finger, or an eye if someone thinks that your body is the key to your access. BUT IT’S OK to steal your WiFi password.
Against: It’s an ethical breach
Response: This is the main argument against WiFi Sense. Because someone shares something with you, does not entitle you to share that secret item with someone else.
Why I Feel that Microsoft has Crossed the Line
With Internet Explorer 8, Microsoft declared that it had been supporting “loose standards”, introduced by convention, but that didn’t apply to the HTML standards. In IE8, Microsoft introduced “compatibility mode” to deal with websites that didn’t “conform to HTML standards”.
I have news for Microsoft: “Convention” = Standard
In one fell swoop, Microsoft declared that it owned the internet, and that the internet was wrong.
Microsoft continued to make a series of bone-headed blunders based on FOISTING a decision on the user community:
- Windows 8 had no start menu. The prophets of technology called this “innovation”. The market called this “crap”. The market won.
- XBox One. Originally, XBox One was going to charge for EACH USER to play a game… even if you live in the same house. Borrowed games would require a registration fee, and every “XBone” console would be required to check in each day, via the internet. “You have no internet”, Marie Antoinette said, “Then you should eat cake!”
ONLY the competition from Sony Playstation reversed these absurd, unilateral decisions prior to launch. - WiFi Sense. Microsoft Owns your Wifi. Just ask them! In retrospect, this will prove to be a horrible decision, but Microsoft doesn’t listen to the market, and doesn’t care. They want to “innovate” to the point that we bleed for it.
Your WiFi sits in your home
It’s personal. Why would Microsoft consider sharing something personal and trusted with someone YOU, personally, don’t know?
They don’t care!
This is clearly an ethical breach of trust, but Microsoft has rationalized it away, just like all of their other bad decisions.
My answer is simple: I use MAC filtering. I have two guest Wifis, one of which is called “AT&T Sucks”.
I’m renaming it tonight, to “Microsoft Sucks_optout”
<drops the mic>
Recommendations
You know what? SCREW Microsoft and their crap.
Here is what you need to do:
- Configure your “secure” WiFi network with MAC filtering. Despite what people say, your MAC address is only broadcast in an encrypted state. MAC FILTERING IS SECURE. Set up MAC Filtering to allow ONLY trusted devices on your “inner” WiFi network.
- Devices such as Netgear and Linksys (Cisco) allow a “guest” cleartext network. This takes the form of a web page, where you sign in with the guest ID, but the traffic is not encrypted. This seems to be the best approach to defeating Microsoft.
- Change your guest WiFi password every week. If you have devices that depend on your guest network, spend the measly $20 for a cheap AP, and configure the new AP as your guest AP. CHANGE IT EVERY WEEK. This gives you a trusted network, semi-trusted, and “true guest”.
- Don’t buy Microsoft Products. Buy a Chromebook, or a Mintbook, or a Debian Linuxbook. Don’t support a company that trades your secrets, as well as your ethics, so that they can make a buck. As stated previously, any company that fails to listen to its constituents isn’t in the market to serve its constituents: it’s in the market for profit, only.
Do I hate Microsoft? No, I pity them. An asshole with a typewriter could design a far superior operating system. Oh, wait, that’s how we ended up with Linux!