The Ministry of Industry and Information Technology investigated that the "Internet-surfing" software was "voluntarily" shared by its own network, which caused concern.
China Economic Weekly reporter Yin Xin | Beijing Report
Editor: qi zhou
(This article was published in China Economic Weekly, No.15, 2018)
Since 2014, various mobile app stores have launched a series of softwares with WiFi free sharing and auxiliary connection functions, which can help users connect and use some shared networks without knowing the network password; In addition, some web browsers are also equipped with WiFi-assisted connection function. The reporter tried to log in to a strange network with a browser, and the connection was successful after a few seconds.
As people pay more and more attention to the protection of personal information, "surfing the Internet" software has aroused the concern of more and more netizens.
A few days ago, the Ministry of Industry and Information Technology announced that it would investigate mobile applications such as "WiFi Master Key" and "WiFi Key", which have the function of providing users with other people’s WiFi networks for free, and are suspected of invading other people’s WiFi networks and stealing users’ personal information.
"At this point in time, the Ministry of Industry and Information Technology is concerned about these ‘ Rubbing the net ’ The reason behind the software survey is that the relevant departments hope that the development of the industry will be more standardized. In addition, due to the birth of the Cyber Security Law, relevant departments also have laws to follow. " Zhang Cheng, CEO of Maiwaidi, an Internet service provider, told the reporter of China Economic Weekly.
Insufficient notification, the network was "voluntarily" shared.
Shortly after the announcement of the Ministry of Industry and Information Technology, the named "WiFi Master Key" responded that the company "always respects and protects the privacy of users, and the user information obtained is within the scope permitted by national laws and must be approved by users". "WiFi Master Key" indicates that the company has always emphasized sharing hotspots by WiFi hotspot owners, and increased efforts to investigate and deal with non-hotspot owners’ sharing, and will further optimize the process of canceling hotspot sharing. "The product only provides ‘ Share ’ Function, not ‘ Crack ’ Only networks that are shared in the form of hotspots can be used by users. We use 128-bit asymmetric encryption for passwords and never display passwords in plaintext. "
As for the difference between the two technologies, Zhang Cheng clearly told the reporter of China Economic Weekly that the "deciphering" technology is nothing more than a powerful calculation program that makes it try and make mistakes by exhaustive method, and arranges and combines them one by one to finally get the correct answer.
Xiang Ligang, an observer in the communication industry, said that it is more difficult to crack than to share. It is a trial and error without knowing the password at all, and there is a certain technical threshold. However, he stressed that it is not certain that all service providers have never tried to decipher. "Service providers only need ‘ Decipher ’ Just part of the network in the city, others can be shared in a hot way. "
Xiong Ge, secretary-general of China WiFi Industry Alliance, told the reporter of China Economic Weekly that from the actual situation, many WiFi passwords are the same (for example, 8 eights or 12345678), and even many WiFi users don’t have passwords. "Of course, it is not excluded that some service providers will use cracking technology, but the current mainstream practice is to share it through users." Xiong Ge said, "Some companies are more rational in details, while others are more rational ‘ Savage ’ 。”
The difference between rationality and "barbarism" mentioned by Xiongge lies in whether the founder and owner of WiFi have the full right to know and actively share their own network on the premise of being fully informed, or "voluntarily" shared their own network on the premise of insufficient tips and information.
Take "360 Free WiFi" software as an example. When a user logs in to a network with a password while knowing the password, "I am willing to share this network" will be checked in the lower left corner by default. Because the prompt position is not obvious, the user will "voluntarily" share his own network without paying attention, and then anyone who uses the same application can "rub" on this network through this application.
In addition, the "offline Wifi package" launched by a software called "Tencent WiFi Manager" has also attracted the attention of the market. According to Tencent, the service is to package some public WiFi in the city into offline packages to help users connect to secure public WiFi in scenes where there is no network or the network is poor. This function is based on the principle of "one network corresponds to one password", not "savage collision with the library". "Before users try to connect to WiFi, we have checked and identified the security of this part of public WiFi. The public WiFi in these offline packages is all public WiFi that agrees to share with others." A person in charge of Tencent told the reporter of China Economic Weekly.
How to determine who the network owner is?
According to common sense, the person who is qualified to share the WiFi password should be the creator and owner of the network, but in the current mobile phone application, there is no function to identify and check the network owner. Xiang Ligang told the reporter of China Economic Weekly that some private networks were "shared" by the above-mentioned software because some visitors used such software to log in after learning the password from the owner, and "voluntarily" shared the owner’s network without adequate information.
According to Zhang Cheng, judging whether a logger is the creator and owner of the network involves a series of complicated technologies and high costs. "It is necessary to judge whether he logs in to this network frequently or only occasionally through big data analysis, and also know whether he appears in the background of this router at the same time and actually controls this network." These are the unsolved problems of most service providers in the software industry. "This kind of identification technology is very difficult. What conditions are met to identify the login as ‘ Owner ’ It is a challenge, not a visitor. " Zhang Cheng said.
According to industry insiders, "WeChat connected with WiFi" is a way to protect both parties’ right to know. By paying attention to WeChat WeChat official account and other mechanisms, network owners and login users are very clear about the whole process of sharing or being shared.
Some insiders also suggested that changes should be made from the bottom of WiFi technology and the password login method should be fundamentally abandoned. "From a technical point of view, the best way is to start from the equipment manufacturer and no longer use the password authentication mode." Xiong Ge believes that compared with "surfing the Internet", the non-password login mode is relatively safe and suitable for public scenes. However, if it is used in home private networks, in order to prevent "surfing the Internet", you can only log in through the verification code, and the experience will be much worse.
Before the above-mentioned software has not completed self-correction and self-inspection, and the Ministry of Industry and Information Technology has not completed the investigation of this kind of software, how can private networks avoid being "rubbed"? Xiong Ge told the reporter of China Economic Weekly that there are many service providers and products in the field of WiFi connection at present. In the process of continuous competition and reshuffle, service providers are avoiding being labeled as "surfing the Internet" and increasing the function of protecting network security. "This industry has gone from more than 1,000 in the past to only two or three mainstream companies, and its product functions have also changed from simple ‘ Rubbing the net ’ It has become a network security management. "
For example, "Tencent WiFi Manager" has a home network protection setting. Once a user logs in with a real password and sets it as a home network, a stranger cannot unlock the home network through the "smart connection" function.
In addition to relying on network security management, can shutting down the external broadcasting of private networks prevent "surfing the Internet"? Xiang Ligang told the reporter of China Economic Weekly that after the radio was turned off, the stranger’s mobile phone really couldn’t search for the network signal, so he had to manually enter the network name and password to enter, which could ensure safety in principle. However, if a visitor has logged on to the network before the host shuts down the network for external broadcasting, his device will still have the network name and password, and he can still log on to the network.
Can network passwords be regarded as personal information?
In China’s current laws and regulations, the main basis for the protection of personal information security is the Cyber Security Law, which came into effect in June 2017. The Law on the Protection of Personal Information, which the legal profession calls for as soon as possible, is still in the draft stage. Although the Personal Information Security Code, which will come into effect on May 1, 2018, is valued by many people in the industry, it is only a national recommended standard in the industry and has no legal effect. In other words, the legal basis for the law enforcement of "surfing the Internet" software is only the Cyber Security Law.
Professor Li Junhui from China University of Political Science and Law told the reporter of China Economic Weekly that there is no special chapter in the Network Security Law on the protection of WiFi passwords, but as a network service, WiFi hotspot connection services such as "WiFi Master Key" also need to comply with the provisions of the Network Security Law on personal information protection and network security. "If password sharing is not voluntary, it is suspected of infringing the sharer’s right to know and the management and control of its assets by the WiFi hotspot setters."
Li Junhui introduced that the Cyber Security Law clearly states the protection of personal information: no individual or organization may steal or obtain personal information in other illegal ways, and may not illegally sell or provide personal information to others. "The crux of the problem lies in whether network passwords will be regarded as personal information in China’s judicial practice. Once ‘ Rubbing the net ’ If it is identified as an infringement of personal information, the relevant units should bear civil tort liability, even administrative responsibility and criminal responsibility. "
The insiders believe that the survival space of "CengNet" software lies in the demand of many people for "CengNet" itself. The more nonstandard the operation of the software is, especially the protection of the shared person’s right to know is not in place before sharing, and if the network owner is not given the right to stop or refuse to share, more unfamiliar networks can be connected, and users who want to "CengNet" will be more attracted.
Li Junhui said in an interview with China Economic Weekly that "bad money drives out good money" because of the failure of the supervision mechanism for a long time. "This requires the supervision means or methods of the supervision department to keep pace with the times and establish an effective supervision system before, during and after the event. Similar to ‘ WiFi master key ’ Products and services have been in the market for many years, and why the regulatory authorities have been slow to act is the key to the problem. "
From the formal implementation of the Cyber Security Law on June 1, 2017, to the Alipay annual bill incident after New Year’s Day in 2018, and then to the enterprises including Ant Financial, Baidu and Today Headline, they were interviewed by relevant departments for personal information protection. The Internet industry, which once advocated the concepts of "openness" and "sharing", has recently turned to "security" and "privacy". "The early Internet liked to emphasize openness, but many people in the mobile Internet industry no longer mention ‘ Open ’ Yes. " Xiang Ligang told the reporter of China Economic Weekly that the closer the development of the mobile Internet industry is to maturity, the more emphasis will be placed on security and privacy, rather than blindly opening up.
Laws related to personal information protection:
Article 111 of the General Principles of Civil Law: Personal information of natural persons is protected by law. Any organization or individual who needs to obtain other people’s personal information shall obtain and ensure the information security according to law, and shall not illegally collect, use, process or transmit other people’s personal information, or illegally buy, sell, provide or disclose other people’s personal information.
Article 41 of the Network Security Law: When collecting and using personal information, network operators shall follow the principles of legality, justness and necessity, make public the rules of collection and use, clearly state the purpose, manner and scope of collection and use of information, and obtain the consent of the collected person.