Ed Bott On Windows 10 'WiFi Sense'
If you know you’re in my Skype contacts list feel free to park in front of my house with your Windows 10 PC. But you’ll have to bring your own Wi-Fi, because Wi-Fi Sense won’t let you connect to my network. That option is off by default for every network, as you can see by the Not Shared status message under each one.
And you have to very consciously enable sharing for a network. It’s not something you’ll do by accident.
For those not clued in, WiFi Sense is a feature in Windows 10 that shares WiFi network passwords with friends if you explicitly request to share the password of a particular network. WiFi Sense has been part of Windows Phone for a while but, naturally, nobody cared.
In his piece, Bott correctly addresses the fact that the sharing service does not happen without permission as some tech sites misreported when this blew up. However, it does have a security hole.
The person who gives permission does not have to be the WiFi network owner. Any person who is (or has) connected to the network can enable the sharing. This is the opening for abuse as the control of the setting is heavily diluted amongst clients. It might not be obvious why this is a problem.
A mostly harmless example is a coffee shop that gives the WiFi password when you buy something. With WiFi Sense, it is incredibly easy for someone to accidentally enable sharing and then all Windows users can free-ride on the internet without paying the cafe a cent. Similarly, in a residential setting, a hypothetical friend comes round to use my WiFi on his Windows 10 laptop. My entire block can now access my internet without ever talking to me without me even being told it was happening. It’s not out of the question that this then blows through my monthly data cap and I get foot with a costly bill. I’m sure you can extrapolate to find some more criminal examples.
There are limits to who receives the shared password, usually limited to the person’s Skype or Facebook friends, so it’s not like the whole world can suddenly join in. Still though, it’s the principle. It’s just weird that the network owner does not get ultimate control over this.