pete Posted June 19, 2015 Posted June 19, 2015 Because I _really_ want my clients' WPA keys shared with their Facebook friends. Thanks, MS. (Win10 "Wi-Fi Sense") : sysadmin Spotted this on /r/sysadmin and it appears to be: If you join a friend's/business' WiFi and they're using keys (as opposed to RADIUS or captive portal), Windows 10 includes a mechanism by which you can share said keys with other people via Outlook, Skype and Facebook. Business who don't want people to re-share the credentials to their WiFi to all and sundry are asked to rename the SSID to SSIDName_optout. That's right kids, you need to opt out of this feature. This doesn't affect us (RADIUS or captive portal), but WTF Microsoft? (Yes, this isn't doing anything they couldn't already do *manually*, but if you're not running RADIUS do you want Bob from accounting sharing the WPA key with all his Facebook friends by simply clicking a button?)
JRowley Posted June 19, 2015 Posted June 19, 2015 Here's what I'm going to do, I'm going to wait and see if this applies to Enterprise/Education versions of Windows 10, because at the moment the assumption being made by everyone is that it applies to all versions. I honestly can't see Microsoft being that stupid, furthermore I honestly can't see them refusing to add GPO to control this.
pete Posted June 19, 2015 Author Posted June 19, 2015 I'm not particularly concerned about Win10 devices under the control of the organisation, I was thinking more in terms of: School uses WPA2-PSK for BYOD. Staff/student connects personal Win 10 device. Staff/student inadvertantly shares key on Facebook. It won't share RADIUS credentials, but there's a lot of schools just using WPA2-PSK.
JRowley Posted June 19, 2015 Posted June 19, 2015 (edited) I'm not particularly concerned about Win10 devices under the control of the organisation, I was thinking more in terms of: School uses WPA2-PSK for BYOD. Staff/student connects personal Win 10 device. Staff/student inadvertantly shares key on Facebook. It won't share RADIUS credentials, but there's a lot of schools just using WPA2-PSK. This is a concern for them, but this will force people to use better methods, such as guest portals and RADIUS. They shouldn't be using WPA2-PSK as the problem with sharing keys is already an issue, this doesn't actually change anything as you said, just makes the issue more apparent. Edited June 19, 2015 by JRowley
localzuk Posted June 19, 2015 Posted June 19, 2015 Yeah, BYOD shouldn't be just a WPA2-PSK setup any more. There's very little accountability etc... Our BYOD is a captive portal with RADIUS auth for users, so we know exactly who is on what IP and when etc... I don't really like this feature though! Sharing of WPA2 keys is the responsibility of a person or using something like WPS on a router. Not for random users to share!!
Arthur Posted June 19, 2015 Posted June 19, 2015 That's right kids, you need to opt out of this feature. Just like with Google Maps where you have to add _nomap to your SSID to opt-out of their Wi-Fi mapping system.
localzuk Posted June 19, 2015 Posted June 19, 2015 Just like with Google Maps where you have to add _nomap to your SSID to opt-out of their Wi-Fi mapping system. That's fun. So you can either opt out of sharing or opt out of mapping, but not both.
FN-GM Posted June 19, 2015 Posted June 19, 2015 I don't see any issues with this. Since Windows Vista, anyone with local admin rights to the device can see the WPA key of a connected WIFI network anyway.
chazzy2501 Posted June 30, 2015 Posted June 30, 2015 Going to have to bring back the old MAC filtering I've had similar issues with Win8.1 people with guest WiFi access on their Windows Phones are having the guest access WiFi on their school laptops causing me issues! (when they use their M$ accounts on their laptops (store etc))
Arthur Posted July 31, 2015 Posted July 31, 2015 Wi-Fi Sense in Windows 10: Yes, it shares your passkeys; no, you shouldn’t be scared Windows 10 comes with a neat new feature called Wi-Fi Sense, which lets your PC automatically connect to Wi-Fi networks that your friends and acquaintances have previously connected to, even if you don't know the network password. First, a bit of anti-scaremongering. Despite what you may have read elsewhere, you should not be mortally afraid of Wi-Fi Sense. By default, it will not share Wi-Fi passwords with anyone else. For every network you join, you'll be asked if you want to share it with your friends/social networks. 1
Blue_Cookeh Posted July 31, 2015 Posted July 31, 2015 This is a concern for them, but this will force people to use better methods, such as guest portals and RADIUS. They shouldn't be using WPA2-PSK as the problem with sharing keys is already an issue, this doesn't actually change anything as you said, just makes the issue more apparent. I don't think it's particularly fair to look at it like that. Primary schools for example don't have the infrastructure to support RADIUS. Sure I can deploy it and our kit is capable of it, but it aint gonna be pretty.
free780 Posted July 31, 2015 Posted July 31, 2015 Android shares your psk. But only when you login as your account. M$ have taken it a set further. Disable the use of Microsoft accounts to logon to PCs and ideally don't use PSK. You just need 2 NPS servers and a WiFi infrastructure that supports radius. Mac address filtering is kind of pointless as you can grab the mac address in the clear.
Arthur Posted July 31, 2015 Posted July 31, 2015 MS have taken it a step further. Sharing is optional though. Wi-Fi passwords aren't shared automatically. Windows 10's Wi-Fi Sense is not a security risk. Here's why ... you have to very consciously enable sharing for a network. It's not something you'll do by accident. I've been using Windows 10 since last October. And yet none of my networks are available for my friends and contacts to share over Wi-Fi Sense. Why? Because I never enabled sharing for any of those networks. http://vgy.me/bbwKaM.png 1
JRowley Posted July 31, 2015 Posted July 31, 2015 The paranoia about this feature has been phenomenal, it's been quite interesting to watch since if Apple produced something like this it would be heralded as a remarkable step forward for humanity.
Arthur Posted August 30, 2015 Posted August 30, 2015 KB3085719 - How to configure Wi-Fi Sense on Windows 10 in an enterprise IT administrators can also use Group Policy to create and set the following DWORD registry value to 0 to disable Wi-Fi Sense: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WcmSvc\wifinetworkmanager\config] "AutoConnectAllowedOEM"=dword:00000000 Note If you use Group Policy to disable Wi-Fi Sense, this also disables the following related Wi-Fi Sense features: Connect automatically to open hotspots Connect automatically to networks shared by my contacts Allow me to select networks to share my contacts
Michael Posted August 31, 2015 Posted August 31, 2015 What's a little confusing is you need a Microsoft account to use WiFi sense. I didn't think you could sign into a Win10 device which is associated with a network domain using a Microsoft account, or can you?
Arthur Posted August 31, 2015 Posted August 31, 2015 What's a little confusing is you need a Microsoft account to use Wi-Fi sense. I didn't think you could sign into a Win10 device which is associated with a network domain using a Microsoft account, or can you? At some point in the hopefully not too distant future it won't matter whether you sign in with a Microsoft Account or an Azure AD account. www.zdnet.com/article/microsoft-takes-a-step-toward-merging-microsoft-account-and-azure-ad-cloud-identity-services Microsoft has taken a first step toward its long-term goal of merging its Microsoft Account and Azure Active Directory cloud identity services. On 12 August, Microsoft made available a public preview of its converged programming model between the two. The Microsoft Account is Microsoft's cloud identity service for consumers; Azure Active Directory is Microsoft's identity service for businesses. Currently, developers have to integrate their apps differently with each stack. With the new app model preview, it is possible to sign-in both personal and work users with a single button, officials said. The new model supports OAuth 2.0 and OpenID Connect 1.0 and normalizes requests and responses across Microsoft Account and Azure AD. Not every application that currently interfaces with Azure AD or Microsoft Account is currently supported in the first preview. But the plan is to have a single authentication model and unified REST programming interface between the two different identity services, and to move Microsoft's own applications to the new sign-in experience over time. Until that happens, Microsoft plans to continue to fully support the existing protocols, software development kit and current app model tools.
rrrrr Posted August 31, 2015 Posted August 31, 2015 We use radius auth as well as dynamic pre shared keys. When a user registers a device using their AD username and password they are created a dynamic pre shared key. This key will only work on one device and has an expiry date. This way, the psk cannot be shared and avoids the need for maintaining mac address tables
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now