This site may earn affiliate commissions from the links on this page. Terms of apply.

Windows 10

With Windows 10 finally launching this week, nosotros're going to see a slate of manufactures discussing the OS'south new features and capabilities. Some of these are significant upgrades compared with what came before, while others could be potentially controversial. One new choice, brought over from Windows Phone viii.one, is called WiFi Sense, but its debut on the desktop could be controversial given what the feature does.

WiFi Sense will automatically connect yous to detected crowdsourced WiFi networks, acquire network information and provide "additional info" to networks that require it (it'due south not clear exactly what constitutes additional info), and can be used to automatically share your WiFi password with your contacts on Facebook, Skype, and Outlook.

That last characteristic is the potentially controversial ane. WiFi Sense is enabled by default in Build 10240 of Windows 10; if yous choose "Express Settings," Microsoft enables the option and allows your device to acquire WiFi passwords from friends and shares your password with the same group of people. If you lot choose to leave the part enabled (or plow it on manually, equally shown beneath), it will request permission to connect to Outlook, Skype, and Facebook on your behalf. Other users on your friends listing who also run Windows 10 volition have their contact data shared with you too, assuming they too enable the feature.

WiFiSense2

Microsoft claims that this feature improves security and reduces frustration. Now, instead of painstakingly spelling or writing downwardly passwords for guests or friends, they can automatically acquire them as soon equally they come in-range of your home network. The company's FAQ states:

"When you share Wi-Fi network access with Facebook friends, Outlook.com contacts, or Skype contacts, they'll be continued to the password-protected Wi-Fi networks that you cull to share and get Cyberspace access when they're in range of the networks (if they use Wi-Fi Sense). Besides, you'll be connected to Wi-Fi networks that they share for Internet access too. Recollect, yous don't get to come across Wi-Fi network passwords, and y'all both become Internet admission just. They won't have access to other computers, devices, or files stored on your home network, and you won't have access to these things on their network."

WiFiSense

In theory, Microsoft could be correct, only the company is also creating a de facto database of WiFi data. Elsewhere in the FAQ, Microsoft notes that if you choose to share this information, it's sent via an encrypted link to Microsoft, who stores the data on their own servers (again in encrypted format). This isn't as foolproof equally information technology might have in one case seemed; nosotros've covered multiple bugs related to Net encryption standards in the past nine months.

The other concern we have with WiFi Sense is that the characteristic has no granularity beyond the service level. I can cull to share or not-share information with Facebook, Outlook, or Skype, just that's it. If you share your network information with anyone on your Facebook friends list, you're sharing it with everyone on your Facebook friends listing. That's something Microsoft really ought to have addressed when information technology brought the feature over from Windows Telephone; merely because I want to share this kind of data with some people doesn't hateful I desire to share information technology with everyone.

The continued degradation of privacy

The risk of exposing your network connection to ne'er-do-wells on Facebook or Outlook.com is small, but it's not zero. The bigger outcome I want to highlight, though, is how features like this indirectly erode the concept of user privacy and the perceived need for good security practices. This is something nosotros've talked about before in relation to Apple, but it's not just an Apple or a Microsoft problem.

On the ane mitt, we tell people that they need to secure their data with strong passwords while research shows how passwords are trivial to hack — fifty-fifty many strong passwords tin can be croaky adequately easily. Services like LastPass promise to offering protection, only to fall prey to hacks in turn. When companies get hacked, whether its Target or LastPass, the consequences of these failures are ofttimes trivial. Fifty-fifty Lenovo, which installed one of the nigh appalling breaches of user-security to ever ship on modern PCs, appears to take come through its Superfish debacle largely unscathed.

This tension is at the middle of all security systems, not merely the online ones. If designing secure systems is difficult, designing secure systems that are both fast and easy-to-use is deadline impossible. All the same, online companies oftentimes encourage users to share information that proper security practices say ought not be shared, while the consequences of security breaches for the companies that breach them are so pocket-size, information technology sends the bulletin that hey — privacy and security aren't actually things you need to care near. And it just so happens that this relatively lax mental attitude towards privacy underwrites the business model of multi-billion dollar corporations, many of whom seek ever-more lenient rules on what they tin can and cannot do with your personal information.

On a practical level, the risks from WiFi Sense are pocket-sized. Merely from a best-practices security standpoint, information technology's far from a dandy thought.