[finnyspade]

There's a lot of FUD & frankly inaccurate information floating around here.

When connecting to a password protected router you are given an UNCHECKED BY DEFAULT option to share the password with your friends. What this means is, the user can deliberately share the password they know.

This is just as secure as any other system because once you give a user a password they could share it if they chose. Nothing here is "automatic" no data is being proliferated without user consent. If your employees leak your password this way, then it's the same as leaking passwords otherwise.

Again this not an opt-in-by-default scenario. It requires a user knowing a password to actively choose to share for each router independently.

[tdicola]

Even if people opt into it, why should this happen automatically? If one of my friends told every single Facebook friend of theirs the password to my wifi I would have a very strong conversation with them and probably never invite them into my home or even consider them a friend anymore. Just because they _can_ share the password doesn't mean they _should_ share the password.

I don't see why this kind of automatic sharing should be a 'feature' or frankly should exist at all. I would wager it helps almost no-one (given WP8's miniscule adoption numbers) and just serves to stir up controversy like this that makes MS look bad.

[finnyspade]

This solves the problem of asking people the wifi password whenever you go over to their house. To a lot of people it's just a pain. When you tell your friends your password, just tell them not to share it. Done!

I would wager it helps the windows phone users and doesn't hurt other people. Also it's coming to windows 10 I believe.

[tdicola]

No, when you save the credentials of the wifi password locally that solves the problem of having to ask your friend for the password every time you go to their place. There's no need to broadcast the password to every friend to fix that scenario. This is your friend sharing out your credentials to everyone they know automatically--perhaps to people who you don't know or don't want to have the password.

What happens when a jealous ex or stalker that's still a mutual friend suddenly gets access to your wifi network? What about the security implications of MS' servers storing the passwords, and do they disclose whether those passwords can be subpoenaed by law enforcement? This seems like a hornet's nest of nasty privacy and policy issues. It boggles my mind why they think this would be worth doing.

[finnyspade]

It's not only your friends sharing when you don't want it. It's end users that own the router that want to share it. If you put yourself into your grandmother's shoes it may be less mindboggling. Security is all about securing content to the extent to which it is valuable. Many people would argue that their wifi password is not that valuable and therefore not requiring the greatest amount of security. Some people will find this feature convenient. It's for them and clearly not for you. You are no less insecure than you were previously. If you trust the people you give your wifi password to, then there's no issue.

[readme]

>solves the problem of asking people the wifi password whenever you go over to their house

Why is this such a difficult task that it even needs to be solved?

[memracom]

It is NOT a pain to tell people the password, just good security hygiene which everybody needs to learn and to do conscientiously. It is no different from using toilet paper after number 2, then flushing and then washing your hands. Want to live in a modern society? Then do your duty.

And if someone thinks it is a pain to always be asking, then they are free to use cellular connectivity or maybe even, sit and talk without damned devices in their hands.

[tripzilch]

> This solves the problem of asking people the wifi password whenever you go over to their house.

A little bit off-topic, but:

What would be nice is if NFC tags with the WiFi datatype/field would actually work out of the box.

I bought a bunch of NFC stickers online they're pretty cool (and real cheap, 25-50 cents a piece depending on how many you get). You can easily write data into them with an app called "NFC Tagwriter" (by a company called NXP)[0].

You can put roughly the same fields into an NFC tag as you can put into QR-codes: plain text, URL, email address, contact info, etc. But the cool thing is that I haven't seen any phone that came with a QR-scanner app pre-installed (which is I think one of a couple of big reasons why QR-codes aren't really taking off). However, it turns out that any phone with NFC capability can read NFC-tags without any additional software, you just need to enable it in the settings (like Bluetooth or WiFi, except that NFC hardly uses any battery at all because it's so close range).

A curious thing about using NFC is that when enabled, in many cases it does its "thing" without any prompt or confirmation. Plain text immediately pops up a message (that you can't copypaste, share or save, only dismiss). An URL immediately opens your default browser and goes there!! Only prompt you may get (on some phones) is to ask which browser to use (but it often seems to just pick Firefox, for some reason).

So far, best uses I came up with are silly pranks (but that may just be me).

Except the WiFi-network datatype. That one seemed really quite useful (as well as hilarious, like sticking the tag into a bible or such, "to get my WiFi password, put your phone on the bible and swear to not abuse my network").

... if it weren't for the fact that, out of all types of field that just seem to work reasonably well, the WiFi datatype just pops up a message with a MIMEtype-like string, no password, nothing. I tried a whole bunch of my friends' phones (mainly Android, though), and only a single Sony phone seemed to get it, while a very similar but slightly newer Sony phone did not.

On my own phone I can use the NFC Tagwriter app and configure the NFC settings to do the right thing with the WiFi datatype tags, but that puts you in the same place as QR-codes, having to get an app, and even change the settings. It would have been so cool if the WiFi datatype would work as frictionless as NFC tags with plaintext or URL fields on them.

Ah well, maybe next year's technology :)

[0] Sidenote/tip: my Samsung S4 phone is rooted, running Cyanogenmod. A few months ago the NFC Writer app autoupdated and told me it couldn't run on a rooted phone (not the app's fault, but the NFC library it uses). This was easily remedied with the Xposed framework and the "Rootcloak" module. After all I am root, which means I can also tell the app that I am not.

[johannitsa]

I have some friends in California who use the combination of their kids' names for wifi password. It would seem to be an easy one to remember. But in reality it's only the idea that stays remembered because it's not just names but Russian nicknames formed with suffixes and transliterated into English using inconsistent rules.

California is an awesome place! I'm always happy to visit my friends over there. Manage to do it once or twice every year. So far, wifi password never stayed saved in my phone for one reason or other. Failing to enter it correctly several times and asking for help has been a consistently awkward experience.

So I perfectly understand why this would be a nice feature. The drawbacks? Someone using your access point for something shady? How would they do that, parking on someone else's driveway in a residential district? That's too suspicious and would probably attract more unwanted attention than doing that from your own access point at home.

[manigandham]

Few major issues I see:

- Sharing is binary, it's all of the contacts or none. This is not what people really expect when thinking about a feature like this.

- The password really only has to be typed once. I don't have thousands of people coming over and even if I did, they put in the password the first time and it's saved locally. The benefit in skipping those few seconds in exchange for sharing with everyone else doesn't make sense.

- The FAQ also states that any public wifi spots that have been shared will be automatically connected to, including accepting the terms and even sharing some personal info like name, email, etc.

- The way it's worded is dangerous, mainstream users who don't know how this works will just go ahead and click this thinking its so much more convenient (and it is) but it doesnt properly reveal what's happening.

[Sleaker]

it also doesn't give the standard home user the ability to deny people the ability to share. This is a huge failure on Microsoft's part. Simply connecting to a wifi network should never give you the option to propogate that connection to unlimited number of other users automatically via digital methods unless you are also a network administrator. This is something that only the person with the router password should even be prompted to be able to do if they so choose. It's a violation of security to ask anyone that's connecting if they want to share the connection settings with all of their friends. Like you might as well just mark your network as public at this point if you're allowing anyone to connect with a windows 10 phone.

[Sleaker]

Actually it IS an opt-in by default because the option is given to the user connecting except when Network Admin has forced their SSID to _optout. So now I have to force a stupid SSID change on my network, something that I don't want to do, just to prevent users of my network from being able to auto-share the connection with everyone they know.