Skip to main content

Windows 10 May Share Your Wi-Fi Password with Facebook

If you're taking up Microsoft on its offer of a free upgrade to Windows 10, you should know that the new operating system has a feature, called Wi-Fi Sense, that automatically shares your Wi-Fi passwords with others.

When Wi-Fi Sense is enabled, anyone you have in your Skype, Outlook or Hotmail contacts lists — and any of your Facebook friends — can be granted access to your Wi-Fi network as long as they're within range. Microsoft added this feature to save users time and hassle, but as independent security blogger Brian Krebs put it, some security experts see it as "a disaster waiting to happen."

MORE: Windows 10 vs. OS X El Capitan: Why Microsoft Wins

Krebs and others worry about the potential for strangers or untrustworthy friends being given access to users' home Wi-Fi networks. Microsoft has tried to reassure them by pointing out that you have to agree to enable Wi-Fi Sense every time you join a new network, that those people to whom you grant network access can't pass along that access to yet more people, and that the feature doesn't share an actual password, but rather an encrypted version of it.

Despite the safeguards, the issue is nonetheless dangerous for those users, and there are many of them, who agree to everything their computers ask of them. If they agree to share Wi-Fi Sense with their Facebook friends, then, yep, all of their Facebook friends will be given access to their networks. (We've already encountered this request from Windows 10, which didn't really explain what the feature entailed.)

Image: HowToGeek via Krebs on Security

Image: HowToGeek via Krebs on Security

Wi-Fi Sense makes sense if you're visiting a friend and don't want to enter a long string of random characters to get onto his or her network. But have you pruned your contacts lists down to just the people you trust? Are all of your Facebook friends really your friends? Probably not. Most people have many contacts or Facebook friends whom they barely know — would you really trust your Wi-Fi password with your second cousin's boyfriend or that guy in the neighborhood who once fixed your toilet?

The other problem is that Wi-Fi Sense lets you share access to more networks than just your own. You can share access to any network that you got onto the old-fashioned way — by typing in the password. Wi-Fi Sense doesn't distinguish between your home network, your office network or your grandmother's home network. If you typed in the password, they're all fair game.

Personally, we're going to ask that people never enable Wi-Fi Share if they bring a Windows 10 laptop or tablet — or a handset running Windows Phone 8, which also has the feature — into our house. We keep our password, which is somewhat complicated, taped to our home router for anyone who needs it.

Once Wi-Fi Share-enablers have typed that password into their Windows 10 devices, all of their friends can access our home network if they're within range. Even though we trust our friends and family, we haven't spent time with all of their contacts and Facebook friends, and we have no idea whether they're trustworthy.

How to Stop Wi-Fi Sense Sharing

If you want to disable Wi-Fi Sense on your computer and wipe its memory, that's not difficult. Go to Settings, select Network & Internet and then click on Wi-Fi. Select Manage Wi-Fi Settings, scroll to the Wi-Fi Sense section, and turn off each and every feature.

But that won't stop people who already have access to your network from sharing that access with others. You could just change your network password, but as soon as you share that password with anyone else, the problem starts all over again.

Microsoft offers a permanent solution to this problem, but it's somewhat insane. You have to change your wireless network's name, or SSID, so that it ends with the characters "_optout". So if it's called "joe-network", it'll have to be adjusted to "joe-network_optout".

There's another way to avoid this: Buy a wireless router that allows the creation of a guest network that has Internet access, but no access to other devices on the network. Many high-end routers already have this feature. Set up a guest network with an easy password, or no password at all, and sleep easy.

Now, you'll never have to worry whether that guy named Bob you met at the holiday party at the office you worked at seven years ago can lurk on your network.

Having issues with Windows 10? Our sister site, Tom’s Hardware, has a team of staffers standing by in the forums to answer your questions 24/7.

Henry T. Casey is a staff writer at Tom’s Guide covering security and music. In his personal time, you can find him at local concerts or tinkering with his cold-brew coffee process. Follow him at @henrytcasey.

  • HEXiT
    iv'e literally turned off all the spyware features in windows 10 (i hope) including this.
    there was an awful lot of allow microsoft to see this and send microsoft that. now im all for them improving there products but really it does seem like we traded privacy for a free o.s. and if it wasnt labelled microsoft it would likely be labled spyware in some respects...
    Reply
  • junkeymonkey
    its to make you personal computer a public computer - how else can they keep tabs on your activity's ?? heck you maybe a member of isis and they need to know for your protection ..

    is that not the trend of things these days ?? privacy = you must be doing illegal acts and if your not then why are you worried about it , right ??

    like keeping records of your phone and e-mails , think on who really cares about them ?? hmmm... folks who are looking to do you some kind of harm . unless you were looking to dig up dirt then why would anyone care or need them ??
    Reply
  • Lanfall
    Stop spreading FUD and running around like Chicken Little.

    You missed the part where it says "For networks I select.." Nothing gets shared even if Wi-Fi sense is on unless you physically share it YOURSELF.
    Reply
  • junkeymonkey
    as long as you feel that way then your fine and it all good ?? main thing is why is it there to start with ?? is turning it off just to give you piece of mind ??
    or is it when you online its still active? you have no way of knowing.. if any security was of issue then none of that would be built in the software to start with . I'm sure if needed to they can override your setting to take a peek.. is windows 10 near a live os anyway ?? I don't recall xp vista or 7 needing internet or Microsoft account in order to use them and activate it ??
    Reply
  • henrytcasey
    16357130 said:
    iv'e literally turned off all the spyware features in windows 10 (i hope) including this.
    there was an awful lot of allow microsoft to see this and send microsoft that. now im all for them improving there products but really it does seem like we traded privacy for a free o.s. and if it wasnt labelled microsoft it would likely be labled spyware in some respects...

    While I wouldn't exactly call it spyware, considering the data isn't transmitted back to Microsoft, you're right to be skeptical of a free update. Then again, Apple's made their OS updates free as well. Maybe people just don't value a system update, especially one that could break/change the features they are used to.
    Reply
  • junkeymonkey
    -''data isn't transmitted back to Microsoft'' ok show me what guarantees you have to back that up ??

    think on this - 911 when the planes hit the towers Microsoft was at the Whitehouse as fast as the president -- look at 10 security features - facial -fingerprint - iris scan sign in -- now who uses that and would love to add the there data base ?? homeland security .. 2+2 still = 4 .

    maybe I'm wrong but to many coincidence adding up here like I said above about the phone and e-mail collecting whats to stop them here collecting these things as well ??? just seems pretty suspect to me ..

    you don't have to use it but how many will and that's wht there counting on .... best just dont run it on your hard drive to start with ...

    Reply
  • henrytcasey
    16357845 said:
    -''data isn't transmitted back to Microsoft'' ok show me what guarantees you have to back that up ??


    Microsoft is vague about its role in sharing passwords through Wi-Fi Sense. It's not clear from the official FAQ http://windows.microsoft.com/en-nz/windows-10/wi-fi-sense-faq whether a password, or a hashed version of that password, is transmitted to the network's user-to-be, or what exactly is used to log onto a Wi-Fi network for the first time.
    Reply
  • junkeymonkey
    well for me i'll stick with my old xp-vista- and 7 its not the greatest but it don't leave me wide open it don't need the internet it don't need a windows live account or what ever 10 requires - nothing
    Reply
  • Pat D
    I was on the reserved list for Win10 but after reading many articles to get a clearer & hopefully unbiased opinion I took myself off the reserve list for many reasons & stayed with my Win7Pro.. From what I read in the articles & from those that commented on them "you cannot change any functions & you must take all of the updates M/Soft sends . If you change any functions or refuse updates you void the license for the free upgrade".. I wasn't keen on the 'must take all updates' for one thing & others felt the same & I was more interested in the end users interactions then in M/Soft sales pitch.. My son the IT took the upgrade so he can review it for me & I trust him.. I still have a year to take the *free* thing & during that time all the end users that took it day one can be the live testers & clean it out I'll hang for the time being..
    Reply
  • Johnnygatt
    Had this on Windows Phone for 3+ years with no problem... Just and Idea Don't tick the Box to turn it on!!
    Reply