Security Concern - Wifi Sharing

[DaveSC]

The function that allows you to share wifi connections with your contacts has serious implications for businesses. Yes I know it doesn't expose the key to the end users but let me give an example.

In our facility we provide Cell Phones to employees in key positions only. Other employees have their own cell phone but we do not allow them on our wifi. If an employee with Windows Phone 8.1 can circumvent this by simply sharing the wifi connection with employees that have their own phone then we cannot control who has access to our network. Additionally people from outside the company could gain access to our network and resources.

Am I missing something here?

 

[hopmedic]

Sounds like a legit concern, to me. I don't have access to any of the enterprise tools, but I wonder if they allow you to prevent this sharing?

 

[JasonKruys]

I would suggest that if network security is that important, and is limited to few people as you suggest, then a wireless key would/should not be the only measure employed and you would be employing a Mac address filter as well, so there would not be a problem. If security of your network is that important that this feature would cause an issue, and you are not bothered employing other measures (particularly) something as simple as mac filtering, then you have much bigger problems!

Sent from my Lumia 1520 using Tapatalk

 

[DaveSC]

Don't be ridiculous.. Mac address filtering? This is a secondary network that hundreds of clients log into throughout the year, there is a carved out vlan for cellular wifi that is accessed by some of the production staff that do not need access to the primary network which is radius authenticated via ubiquity. What I don't want is 100 extra people that we elected to not provide internet access to because it's not required as a function of their job using our bandwidth to watch cat videos because one person shared access via this new "feature".

Having said all that it's still a gaping hole for lots of companies to allow employees to push the wifi key to other people.

 

[DaveSC]

Sounds like a legit concern, to me. I don't have access to any of the enterprise tools, but I wonder if they allow you to prevent this sharing?

We do have the ability to block specific applications or functions via exchange activesync policies but since this isn't a specific application that does not apply. I am only on Exchange 2010 at this point but I am up to date patch wise and there is no option to disable sharing of wifi access credentials under the policy options.

 

[JasonKruys]

Not ridiculous at all. You kind of missed the point. I was just suggesting it is not the gaping corporate security hole people are making out. Mac address filtering was one example, that I thought people on this site might be able to relate to. The point was, if security or restricting access is even remotely important, a simple WPA key would not be your ONLY form of defence. At the end of the day, it is not really any less secure than someone just telling someone else the key? This is more likely a problem than WiFi sharing on WP - it just makes it marginally easier for people who are already inclined to share the key to do so... Surely? The option to share the network has to be deliberately enabled for that specific network.

Sent from my Lumia 1520 using Tapatalk

 

[DaveSC]

Not ridiculous at all. You kind of missed the point. I was just suggesting it is not the gaping corporate security hole people are making out. Mac address filtering was one example, that I thought people on this site might be able to relate to. The point was, if security or restricting access is even remotely important, a simple WPA key would not be your ONLY form of defence. At the end of the day, it is not really any less secure than someone just telling someone else the key? This is more likely a problem than WiFi sharing on WP - it just makes it marginally easier for people who are already inclined to share the key to do so... Surely? The option to share the network has to be deliberately enabled for that specific network.

Sent from my Lumia 1520 using Tapatalk

While I kind of get what you are saying you are assuming that the end users actually know the key.

 

[Joel S79]

Not ridiculous at all. You kind of missed the point. I was just suggesting it is not the gaping corporate security hole people are making out. Mac address filtering was one example, that I thought people on this site might be able to relate to. The point was, if security or restricting access is even remotely important, a simple WPA key would not be your ONLY form of defence. At the end of the day, it is not really any less secure than someone just telling someone else the key? This is more likely a problem than WiFi sharing on WP - it just makes it marginally easier for people who are already inclined to share the key to do so... Surely? The option to share the network has to be deliberately enabled for that specific network.

Sent from my Lumia 1520 using Tapatalk

I agree. The corp I work for has very strict security around Wifi access. It's restricted to specific devices, and non-approved devices can access another network that requires a them to login via a portal using their Active Directory credentials, which they can obviously restrict by user. Wifi Sense's sharing can't beat either of those methods.

Oh, and you might be able to specifically block access to Wifi Sharing using the new enterprise tools with 8.1.

 

[primortal]

The function that allows you to share wifi connections with your contacts has serious implications for businesses. Yes I know it doesn't expose the key to the end users but let me give an example.

In our facility we provide Cell Phones to employees in key positions only. Other employees have their own cell phone but we do not allow them on our wifi. If an employee with Windows Phone 8.1 can circumvent this by simply sharing the wifi connection with employees that have their own phone then we cannot control who has access to our network. Additionally people from outside the company could gain access to our network and resources.

Am I missing something here?

There must be something to mark the wifi connection as not shareable. The Microsoft Store in my listing shows that as "can't share".

 

[DaveSC]

I wonder if that is just because it's an open network anyways.

 

[primortal]

I wonder if that is just because it's an open network anyways.

Good point....