A Windows 10 feature, Wi-Fi Sense, smells like a security risk: it shares Wi-Fi passwords with the user's contacts.
higglty piggeltey that makes good sense

Wi-Fi Sense has been on Windows Phone since 8.1

Those contacts include their Outlook.com (nee Hotmail) contacts, Skype contacts and, with an opt-in, their Facebook friends. There is method in the Microsoft madness – it saves having to shout across the office or house “what’s the Wi-Fi password?” – but ease of use has to be teamed with security. If you wander close to a wireless network, and your friend knows the password, and you both have Wi-Fi Sense, you can now log into that network.

Wi-Fi Sense doesn’t reveal the plaintext password to your family, friends, acquaintances, and the chap at the takeaway who's an Outlook.com contact, but it does allow them, if they are also running Wi-Fi Sense, to log in to your Wi-Fi. The password must be stored centrally by Microsoft, and is copied to a device for it to work; Microsoft just tries to stop you looking at it. How successful that will be isn't yet known.

"For networks you choose to share access to, the password is sent over an encrypted connection and stored in an encrypted file on a Microsoft server, and then sent over a secure connection to your contacts' phone if they use Wi-Fi Sense and they're in range of the Wi-Fi network you shared," the Wi-Fi Sense FAQ states.

Microsoft also adds that Wi-Fi Sense will only provide internet access, and block connections to other things on the wireless LAN: "When you share network access, your contacts get internet access only. For example, if you share your home Wi-Fi network, your contacts won't have access to other computers, devices, or files stored on your home network."

That sounds wise – but we're not convinced how it will be practically enforced: if a computer is connected to a protected Wi-Fi network, it must know the key. And if the computer knows the key, a determined user or hacker will be able to find it within the system and use it to log into the network with full access.

In theory, someone who wanted access to your company network could befriend an employee or two, and drive into the office car park to be in range, and then gain access to the corporate wireless network.

The feature has been on Windows Phones since version 8.1. If you type the password into your Lumia, you won’t then need to type it into your laptop, because you are a friend of yourself. Given the meagre installed base of Windows Phones it's not been much of a threat – until now.

With every laptop running Windows 10 in the business radiating access, the security risk is significant. A second issue is that by giving Wi-Fi Sense access to your Facebook contacts, you are giving Microsoft a list of your Facebook friends, as well as your wireless passwords.

In an attempt to address the security hole it has created, Microsoft offers a kludge of a workaround: you must add _optout to the SSID (the name of your network) to prevent it from working with Wi-Fi Sense.

(So if you want to opt out of Google Maps and Wi-Fi Sense at the same time, you must change your SSID of, say, myhouse to myhouse_optout_nomap. Technology is great.)

Microsoft enables Windows 10's Wi-Fi Sense by default, and access to password-protected networks are shared with contacts unless the user remembers to uncheck a box when they first connect. Choosing to switch it off may make it a lot less useful, but would make for a more secure IT environment.

Yes, wireless passwords can be written down and trivially passed along to others: we know network security shouldn't end at the Wi-Fi login prompt. But there's nothing like an OS automating the practice of blabbing passphrases to your mates, eh? ®

(So if you want to opt out of Google Maps and Wi-Fi Sense at the same time, you must change your SSID of, say, myhouse to myhouse_optout_nomap. Technology is great.)

Microsoft enables Windows 10's Wi-Fi Sense by default, and access to password-protected networks are shared with contacts unless the user remembers to uncheck a box when they first connect. Choosing to switch it off may make it a lot less useful, but would make for a more secure IT environment.

Reinstalling Windows 10 after upgrade

We understand that you may have some questions regarding what to do if you have to reinstall Windows 10 at some point after you take advantage of the free upgrade. Here are some basic questions and answers regarding the free upgrade offer:

Q: After doing a free upgrade to Windows 10, how do I clean install Windows 10 subsequently?

A: Once your device upgrades to Windows 10 using the free upgrade offer and activates online automatically, you will be able to clean install (i.e. boot from media and install Windows 10) the same edition of Windows 10 that you upgraded to on the same device during and after the free upgrade offer. You will not be required to purchase Windows 10 or go back to your prior down-level version of Windows.

To enable clean installation of Windows 10 on devices that upgraded and activated online using the free upgrade offer:

• You will be able to download and create installation media on a USB drive or DVD for the appropriate Windows 10 Edition
• You will be able to skip entering the product key during Windows 10 Setup. Windows 10 will activate online automatically on such devices. The skip option is only available when booting from media and launching setup

The automatic online activation will occur seamlessly after clean installing Windows 10 if the device had previously upgraded and activated online the same Edition of Windows 10. No product keys are required.


Q: What happens if I change the hardware configuration of my Windows 10 device?

A: If the hardware configuration of your Windows 10 device changes significantly (e.g. motherboard change) Windows may require re-activation on the device. This is the same experience as prior versions of Windows (e.g. Windows 7 and Windows 8.1). The free upgrade offer will not apply to activation of Windows 10 in such scenarios where hardware changes reset Activation.

When I upgrade a preinstalled (OEM) or retail version of Windows 7 or Windows 8/8.1 license to Windows 10, does that license remain OEM or become a retail license?

If you upgrade from a OEM or retail version of Windows 7 or Windows 8/8.1 to the free Windows 10 upgrade this summer, the license is consumed into it. Because the free upgrade is derived from the base qualifying license, Windows 10 will carry that licensing too.

If you upgrade from a retail version, it carries the rights of a retail version.

If you upgrade from a OEM version, it carries the rights of a OEM version.

Full version (Retail):

- Includes transfer rights to another computer.
- Doesn't require a previous qualifying version of Windows.
- Expensive

Upgrade version (Retail):

- Includes transfer rights to another computer.
- require a previous qualifying version of Windows.
- Expensive, but cheaper than full version

OEM :

OEM versions of Windows are identical to Full License Retail versions except for the following:

- OEM versions do not offer any free Microsoft direct support from Microsoft support personnel
- OEM licenses are tied to the very first computer you install and activate it on
- OEM versions allow all hardware upgrades except for an upgrade to a different model motherboard
- OEM versions cannot be used to directly upgrade from an older Windows operating system

What happens if I change my motherboard?

As it pertains the OEM licenses this will invalidate the Windows 10 upgrade license because it will no longer have a previous based qualifying license which is required for the free upgrade. You will then have to purchase a full retail Windows 10 license. If the base qualifying license (Windows 7 or Windows 8.1) was a full retail version, then yes, you can transfer it.