Slashdot Mirror
Deciphering Windows Product Activation
Stephen Lau writes: "Fully Licensed GmbH seems to have deciphered and analyzed the WPA code that Microsoft plans to use to protect from privacy in future products. They've got source and executables up on their site..." As well as an interesting paper which purports to describe the activation process but does not provide details on how these guys reverse-engineered it.
Not that easy. ...
P&P specs call for unique assigned IDs, names etc
...and you can't blame meteors for everything.
You are assuming that MS would actually be able to successfully prosecute these guys for reverse engineering. Here's a newsflash: reverse engineering is legal. Europe has neither DMCA nor UCITA. The world is bigger than US.
___
___
If you think big enough, you'll never have to do it.
When you re-activate, naturally you'll have to generate a new Installation Key and they'll be able to see exactly what components you changed out. Fun, huh?
Oh my yes! Of course, they won't necessarily know who YOU are, since product REGISTRATION is separate from product ACTIVATION -- and not required to use WinXP.
"And like that
if they used a simple usb (passthrough of course) hardware dongle in lieu of the registration process?
:)
I mean, which is cheaper, tossing in a $1.00 usb dongle or having a team of folks staff the phone lines to handle all of the requests?
Of course, the usual folks will cry about the pain of dongles, but such is life. get over it. (for a good time, try being a license admin with unix boxes that tie everything to the hostid, great fun when you upgrade your license server and have to contact 20 different vendors for new keys to half a million worth of software
When you re-activate, naturally you'll have to generate a new Installation Key and they'll be able to see exactly what components you changed out ------> I think that is a major part of the idea here.
You see, when you call in and say, "I need a new registration key" the drone on the other end will say, "What did you change on your system?" Your answer had better match the changes that are shown in your new registration number, else the "Pirate!" alert goes up.
It makes it harder (assuming that you don't have the handy-dandy program that starts this article off) to "fake" a reason to require a new registration key. When the drone asks, "What changed?" then which components do you pick?
Rather clever, actually.
If you're a zombie and you know it, bite your friend!
I am a thinking person, and can form my own opinion.
Reboot macht Frei.
Sure there is a difference.
If people don't want to pay for something they do not get to use it, while with pirated software, they do get the benefits of using software without paying for it.
If you think something is too expensive you either forget about it or save up money over a period of time and buy it.
With pirated software there is no incentive to save up at all.
...and you can't blame meteors for everything.
After a thick perusal of the paper, I'm still at a loss: can xpdec actually *crack* anything? I've used it on my Product Key, and it does produce a proper Product ID, but has anyone actually used this to try to crack one of the RC1 copies?
Registration by phone line, you'd think most people are/will be still stuck doing this.
Caller ID, plus a reverse phone number lookup and what more do you need to know?
Can a MAC adress be linked to your IP by going to a site or server (windows update active X controls?)?
Lookup a name and get a street adress, use public records to see who owns the home and it's value. you know they'll get the IP and know all about the computer, partner with doubleclick(or whoever) for tracking surfing habits..
it's not the information that's transmitted, it's what they can do to link it to you
who owns your data?
"The Most Fun Possible on 4 wheels" is at SunBuggy in Las Vegas
At the usual place. Click on my sig, go into the windows_product_activation directory.
-----
What is the phone number? If all they want is someone to read off 32 digits to them, I'm more than happy to play from time to time.
In the past I have obtained warez versions of Windows 95/98/ME(gave that one back) and NT because I couldn't afford to buy them, but when Win2k come out I went out and bought it because for the first time it was stable and I also had a job and could afford AU$600. Recently I decided that come october 25th I would go out and buy the upgrade to XP. But now I've decided that I don't like the idea of reactivating windows whenever I upgrade my pc, so instead I will get a warez copy instead without the WPA. So that's $400 MS will miss out on because of that and I imagine that a lot of home users would would normaly buy it will go and do the same thing. Mike
cut&paste jobs, i suppose.
Reboot macht Frei.
agree.. Here in my country, it's almost 99,95% of the time i saw illegal OS/software being used. And most of the people here just don't realize it. Why? because there are *plenty* of illegal windoze cd's and it's apps everywhere. If mikrosof want to sue, there's a LOT of people to sue.
So most of the people now using windoze, they like it. It's cheap (pirate cd's, remember). And EVERYBODY's using it. They laugh at me for using linux as desktop... pity isn't it.
how does it hurt MS when a home user borrows their friend's Win95 CD? The more times Win95 is installed, the more people are using it and the more likely that person is to become a valuable Windows-using consumer. Buying Windows software, perhaps purchasing a new computer with Win98 preinstalled. Requiring a Windows PC at work. Purchasing upgrades.
... and then you think that person is likely to want to pay $XXX for an upgrade later on? Not likely. They'll split the cost with one or more friends, or just out-and-out steal it one way or the other ("borrowing" a CD from work, downloading it off warez, whatever).
So you're saying someone installs windows by borrowing a friend's CD
Now Microsoft institutes a plan that makes these practices more difficult. They don't try to make it uncrackable, because that's impossible, but they prevent your average user from borrowing the disk from a friend or from work. I bet you'd be surprised how much money we're talking about.
Your idea that Microsoft's OS monopoly gains from piracy only has merit so long as you acknowledge that one day Microsoft must one day squeeze those pirates for their long overdue gold.
Today is that day...
"And like that
Am I the only person that smells a rat here?
/. (it will remain nameless, but was not MS or Apple) that was almost certainly an intentional plant designed to get some free PR. If it wasn't intentional, it should have been, it was f--king brilliant! I know the PR person for the product, saw her in the hall, confronted her, she denied it and turned away giggling.
You are not the only one. This does indeed sound a bit too "convenient". It certainly would not surprise me if this was an intentional leak. I think the same thing every time I see a leak from Apple prior to a launch, then the inevitable story that "heads rolled after Jobs had a shit-fit". This kind of thing makes great PR "buzz". I am quite confident MS has some of the top PR talent in the world at their disposal and they certainly earned their money if this is an intentional effort.
I saw a story a while back on
The only athletic sport I ever mastered was backgammon - Douglas William Jerrold
Mod this guy down (or the replies up), since clearly his main point has been shown to be false, yet it's getting more 'weight' than the truth of the matter, i.e. that you can cancel out of the MacOS registration and further it does not require a serial number like Windows does.
You have no clue?
You couldn't even guess why they'd want to make sure you spend 20 seconds writing a post? Do you think it could be a heuristic to filter out short and worthless posts??
Maybe they should up it to 60.
-Kevin
Claus
I'm sure that these guys probably do know how the key is done. If they were able to figure out some of the obscure techniques that was used here i'm sure that they took it 1 step further and using known wpa codes and keys provided by microsoft developed an algorithm.
:)
Well then...maybe not
Today we lost 4366.99 from people copying our software without us knowing.
In case you can't figure it out, there is no way for them to know. They know how many boxes they sold, because they can count them. Not so with unlicensed copies.
"Any connection between your reality and mine is purely coincidental." -Slashdot
Here is an account of what network connections Windows XP RC1 make when it is installing itself.
It does all this without prompting the user.
The box was isolated at 192.168.1.3 and had ALL outgoing traffic denied and logged, these are the highlights.
device eth0 entered promiscuous mode
device eth1 entered promiscuous mode
Packet log: input DENY eth1 PROTO=17 192.168.1.3:123 207.46.228.33:123 L=76 S=0x00 I=5 F=0x0000 T=128 (#5)
time.windows.com (207.46.228.33)
This one is rather obvious, it sets the operating system clock, but don't try using netdate on it, it's proprietary to Windows only (whoops!)
Packet log: input DENY eth1 PROTO=6 192.168.1.3:1027 207.46.197.100:80 L=48 S=0x00 I=88 F=0x4000 T=128 SYN (#5)
(microsoft.com, www.domestic.microsoft.com, and microsoft.net address pool)
Packet log: input DENY eth1 PROTO=6 192.168.1.3:1043 207.46.227.40:80 L=48 S=0x00 I=770 F=0x4000 T=128 SYN (#5)
(wpa.one.microsoft.com try https to it and see the certificate yourself!)
This is the Product Activation certificate, it attempted to connect to this server an incredibly large number of times.
Packet log: input DENY eth1 PROTO=17 192.168.1.3:1039 192.168.0.1:2869 L=48 S=0x00 I=673 F=0x0000 T=128 (#5)
Not sure what it did here, 192.168.0.1 is the gateway I don't have the packet data at all, I'll do that in the near future. MAD props to brewt for some of the info!
First, listing the limitations of a windows software program might take a while. Theoretically, they'd have to name everything it can't compute... NP complete problems?
Second, I don't think it's that ridiculous that MS doesn't want to publish how the security code works... it's asking people to hack it. Sure, they didn't build some locktight piece of code here, but they did want to keep people from stealing their software. Publishing how to pick a lock isn't going to keep the door locked long.
Reason, free market capitalism, and individualism
I'm sure one of you guys could do it. For the Fun of it of course. It would only be a tool for learning of course.
Someone want to prove me wrong?
Pete
The sole purpose of the Internet is to get porn and bomb making plans into the hands of children.
Apparently not. According the article you need to change 4 things, not just fuck around with the RAM.
This is a first, a businessman taking credit for something a politician did...
Shutting down free speech with violence isn't fighting fascism. It IS fascism!
Now, call me stupid if you want, but I really don't think we can set too much store by your experiences with a release candidate version of an OS.
Wait until you've got the real thing, then start telling people about how much better it is than they feared.
It would be so easy to check the build number, and if it contains "RC", say "Thanks for choosing Microsoft!" and set the system death timer ticking (they are time limited, after all...), else show compulsory "life history" registration form...
Cheers,
Tim
It's official. Most of you are morons.
Well if geeks could solve the busy beaver problem, they probably wouldn't have had time to come up with all that free software. Or am I thinking of the wrong beaver?
Special Relativity: The person in the other queue thinks yours is moving faster.
You know you can just bullshit that stuff and click "Register later" and it never asks you again. Stop bashing Apple without knowing the facts, they have a cancel button too. And, BTW, I think Apple is alot less likely to spam you than Micro$oft is, they just like to know their user base. But then again i don't work for either so i don't know the specifics of all that.
CAn'T CompreHend SARcaSm?
That doesn't look like it was done in the the name of "interoperability" at all ...
But of course it was:
"My copy of Windows XP didn't work any more after I changed my hardware, so I took it apart to find out why! Oh, and by the way, here's what I found out..."
Living better through chemicals
If you research the Handelsregister (trade register) of Berlin, you'll find this entry of Fully Licensed GmbH (information is incomplete, you need to pay for full information). One of their managers, Thomas Lopatic, was born in Unterschleißheim. What's wrong about that? Nothing, except it's where Microsoft Deutschland GmbH is located.
Also note that the trade register entry is from June 8, 2001. I cannot see if that was when they were founded or when the entry was last changed. Anyway, cracking a Microsoft product seems a bit strange as a company's first project to me.
Coincidence? Maybe, but given that they essentially said there would be no need for privacy concerns, I'd be careful with this source of information.
Sig (appended to the end of comments I post, 54 chars)
I think the problem with many of the replies here is that many argue "all you have to do is press CMD-Q". Like the registration process for XP, Apple seems to neglect giving you that information as well. People are comparing apples and oranges when really they're comparing apples and apples.
Also according to that court hearing, if they didn't see a liscence then they aren't to be held by it ( isn't that what it meant? if it isn't I with draw my comments )
They happen to work out the process.
Probably by starting to trace through the activation key function. Though this can be time consuming, it can be done. I personally have it dome with many games in my youth.
They incidently don't include the magic key to get their source code working.
They didn't include the key just to cover their behind. Without the key, the paper can be passed off as research and as useless for unlawful purposes. The compiled program can be passed of as a proof of concept. Anybody who can use a disassembler, can get the key out of the executabl eeasily. That way, they have published the key without exposing themselves. (Someone already posted the key, by the way).
They conclude this MS thing is not a problem, for us not to worry about it.
As surprising as it seems to you, this is a fair assessment. For each piece of hardware, only a part of the MD-5 derived from the equipment ID is transmitted. So Microsoft will be able to get only a very few things from the string. They will know if you have a laptop, what processor you have (not that many possible hash strings) and how much ram you have and if you have an IDE or SCSI controller. There may also be able to identify some very popular components. What they won't be able to get, is your processor ID and your MAC.
All in all, the data gathered is comparable to the information in the log file of a web-site you visited.
Am I the only person that smells a rat here?
If you bothered to read the article, you'd understand how they come to this conclusion. No need for obscure conspiracy theories.
The wheel is turning but the hamster is dead.
The wheel is turning, but the hamster is dead.
(I don't think blocking even works when calling 800 numbers, but I could be wrong)
I doubt it is that difficult to connect a phone number with an individual or company. Not that I care if anyone knows if I recently added a burner, athlon, and another couple hundred megs of ram =p
I agree.
Another interesting tidbit: Business are required to list losses on their financial statements, but they never list Piracy as one. Go figure.
Heaven forbid.
------
"It's time for some premeditated self-defense."
To clarify, the doc states that the the values are derived from the hardware information. Not much can fit in two DWORDs, and many devices will map to the same value. As if that wasn't enough, the two DWORDs are then put through an MD5 hash. MD5 is one way, there's no way to get back the original information.
Given this scheme it's absolutely impossible for Microsoft to decode your hardware information. That's one of the reasons the article concluded that WPA is not as problematic as some people think.
Now that we know WPA isn't violating anybody's privacy the main caveat is the inconvenience. I won't argue with that.
In MacOS 9.1 you can just force quit the registration and rebood. If you try that in MacOS X though it just restarts it.
-- 2 + 2 = 5, for very large values of 2
Isn't everything?
~~~
I read the article with great interest. I noted the meticulous care that these people used to decode every step of the process. That's a lot of work. And its very impressive.
Then I read the press release.
The experts discovered that ten different hardware components form the basis for a hardware ID, which is sent to the activation central during activation. However, due to the method employed to generate the hardware ID, it is very likely that many hardware configurations result in the same ID. Consequently, determining the actual hardware configuration corresponding to a given hardware ID is an infeasible task. In addition to the hardware ID only information derived from the product key - a kind of serial number accompanying each distributed copy of Windows XP - is transmitted.
Hmmm... sounds almost like propoganda. People are getting concerned about this 'draconian' registration scheme. Big corporate customers are getting upset at Microsoft. Messages on bulletin boards are starting to ask if identifiable information is being transmitted. All of a sudden, this group from Germany has completely decoded the mechanism, as well as put out a press release saying "Well guys, it's actually not that bad. This is all that it's doing. Don;t worry about it. Microsoft knows what's best for you".
I, for one, am a little concerned about the real source of this info. If they don't get prosecuted, then maybe I'm right...
BroadbandPig
The key they removed (from the source) is:
...stuff deleted...
...more stuff deleted...
/. doesn't allow <pre>'s)
void KeyedHash(unsigned char *Data, unsigned char *Result)
{
SHA_CTX Context;
unsigned char Digest[20];
static unsigned char Key[4] =
{
#error The key has been removed from the source code. Please obtain the executable.
};
SHA1_Init(&Context);
SHA1_Update(&Context, Data, 8);
SHA1_Update(&Context, Key, 4);
SHA1_Final(Digest, &Context);
memcpy(Result, Digest, 8);
}
Doing a quick disassembly of the code:
00401590 KeyedHash proc near ; CODE XREF: sub_4015F0+19p
00401590
00401590 var_74 = dword ptr -74h
00401590 var_70 = dword ptr -70h
00401590 var_60 = byte ptr -60h
00401590 arg_0 = dword ptr 4
00401590 arg_4 = dword ptr 8
00401590
004015AE push 4
004015B0 lea eax, [esp+88h+var_60]
004015B4 push offset dword_40A034 ; ********** MAGIC!
004015B9 push eax
004015BA call sub_402170
004015E8 retn
004015E8 KeyedHash endp
And the location they referenced:
0040A034 dword_40A034 dd 0D45EC86Ah
Thusly, the key should be 0xD45EC86A.
More than one can play this game.
Enjoy! (Sorry for the formatting,
If you call Microsoft, turn off the caller ID on your phone -> no reverse lookup.
Of the MAC and the processor serial number, just a few bits of their MD5 is transmitted. Further on, the MAC is transmitted only on the current LAN segment. After the first router, there is no link between the MAC and the IP-address.
Come on.. who's being bigger brother... MS have more than your name/address/email with their new Passport feature.
I haven't seen any of the license agreements concerning Windows installs that have WPA, but I assume that there's something against reverse engineering.
What if there is? Anything in an EULA which against the law is automatically void. Germany still appears to have laws protecting free speach in the area of software examination.
You know what happens when you press that button? It doesn't send the info and moves along its way...
Burn Hollywood Burn
Please also edit the links in the page to relative. Are you sure you got the actual files in your mirror?
Actully I haven't been brainwashed buy their markteting but I have been using a beta for a few weeks and it simply works much better for gaming than Win2k. Also with the silver colour luna theme I actully enjoy using doze again after using linux exclusivly at home for a few months. I now enjoy using both debian and Win2k/XP but XP just works much better for me. Mike
I was actually looking forward to the day when I could say, "Well, Grandma, I could change your busted hard drive for you, but that would mean that nice Gates man would want another $300. Maybe you should just buy another computer..."
"Buy another computer?! What's wrong with you, boy? I'll just shop around for a cheaper copy of Windows! Someone'll will have it on sale..."
I was so looking forward to listening to Grandma on MS tech support demanding another activation code, and chewing them out when they inevitably refuse to give it to her...
XP activation was going to be the wake-up call for Joe EndUser. Now that it's been publicly hacked, I'm really rather torn...
He put his boots up on the table and made a face. "The sig," he smirked. "You can waste your life in search of the sig."
Now that's I've read your message again I will say no it's proberly not worth $400 for the new features and I think the upgrade price from Win2k should be much cheaper. Mike
I think people really are missing this point. It's the same with the Comet cursor and Amazon monitoring where you go. Who cares if you can't tell who's who and it's not a privacy issue. IT IS a privacy issue for the GROUP of us users as a whole - and I don't think Microsoft has a right to know what hardware we have just because we use XP.
----- rL
Except for the fact that a random number is thrown in, altering the hash.
Okay, so the Ethernet card would be reported as changed in hardware database stored on your computer. What other hardware do you expect to change on a daily bases? Remember, you only have reactivate your copy of Windows when morethen three pieces of hardware change. Also, it seems that MS is more lenient towards laptop users.
Sig goes here
Some how or another I do not think that my 14 year old son's friends will beat the WPA this way. A couple of possibilites have crossed my mind already. 1st, I assume that volume licencees will get versions of XP that do not go thru this process. They do it for the older versions of Office and I assume that Bill does not want to be lynched by a rioting mob of IT managers. One of those will hit the web shortly after the XP roll out and every middle schooler in the country will have a CD in a week. 2nd, the system has to run this program during the boot process and it must give the system an OK code. Would it not be possible to replace the system checker with a program that does not check the system and then gives the OK code? 3rd, write a program that feeds the system checker bogus but unchanging information about the state of the system. I am sure that some of you have already thought of these and other hacks. I predict that WPA dies an ugly death by the time of service pack 1. Nuff Said
I may be talking out my ass here, but given a one way hash function H(), input M, and hash h, H(M)=h. Given M it is easy to compute h; Given h, it is hard to compute M such that H(M) = h; Given M, it is hard to find another message, M', such that H(M)=H(M'). from Applied Crytography by Bruce Schneier
So with that, it should be hard to figure out the input from the hash. But if the input is limited, one can figure out what the input is because of the fact that there is only going to be one input producing that ouput. So what this really means, who the hell knows, but just because the hardware configuration is hashed doesn't mean M$ can't figure out what you got...
I think there's other variables in M$ equation, but I don't want to think about it anymore...
"Karma can only be portioned out by the cosmos." -Homer Simpson
And then there's the user base argument. When people are pirating your software, they're strengthening your monopoly.
Well, now that Microsoft's monopoly position has become so strongly entrenched, the marginal value of piracy to them has been reduced. However, their stock price is now embarrassingly low, so pirate users represent a good untapped resource to help reinflate their stock bubble. (Doubling costs to businesses is another good strategy.)
In fact, this is urgently important to Microsoft, since it hasn't actually turned a profit on software sales in a while ("The Bank of Microsoft" is solely responsible for Microsoft's good looking bottom line), and since it can't use its stock price as currency like it used to. In many ways, Microsoft looks like a falling empire, which it likely is, and pumping up its stock price is a good defence.
Now be good c1t1z3n5 and pay your Microsoft tax! (Or use something else...)
On a similar note, check out a Salon article on MS's bullying tactics on poor schools: http://www.salon.com/tech/feature/2001/07/10/micro soft_school/print.html
FYI. MS has a cripled MP3 implementation because they are contrained by the license agreement with Fraunhofer.
In contrast to many critics of Windows Product Activation, we think that WPA does not prevent typical hardware modifications and, moreover, respects the user's right to privacy.
Typical hardware modifications....
If you change more than three things, you have to go through whatever hoops Microsoft wants to put you through to use something you've already paid for...
I don't know about you (or the guys who did this), but the last time I upgraded a machine, I increased the memory (1 change), added a hard drive (2 changes), replaced both the modem and the video card (3 and 4 changes)... Whoops... Went too far, must now cope with Mr. Bill and the XP nonesense...
I like you, Stuart. You're not like everyone else, here, at Slashdot.
No. Being in the monopoly position is advantangeous for Microsoft, whether or not MS ever get a dime from some dishonest home users.
Why is this so?
Software developers will concentrate their effort and resources developing software for the OS with the largest userbase. It doesn't matter if the users owns legal copies of the OS or not--they're still potential customers.
We also know that most people use Windows not because it's the best OS but because most of their favorite software runs on Windows.
This fact influences the people (and more importantly, businesses) who purchase legitimate copies of Windows.
The end result is that Microsoft profits and maintains its OS monopoly, allowing to continue to generate revenue for years to come.
Sure you only have to call in to get a new id when you install three or more items, but what does this say about Microsoft's bet on the stability/longevity of XP? Is Microsoft betting that most people won't have to replace/re-install XP before they replace hardware (in which case they'll have to call anyway)? Or they'll just wait until Windows 2005 comes out while their fragmented hard disk slugs around? Come on ...
...
<troll-material>If Win98 is an indication, the 32-bit (kinda) MS OSes benefitted from a re-install every year or so</troll-material>. If I had XP the last two years, I would have had to call them 3 times already!
But seriously, is the amount of Microsoft investing in over-friendly tech support people that dole out ids going to be worth it for all of this hassel to them and consumers? I could see the XP reg. tech. support staff getting quite large
----- rL
It'll take about five minutes for someone (probably many) to figure out that all you have to do to avoid M$ (re)activation hassles is let it figure out your "new" hardware configuration key, then replace the saved "original" with that, and you're nearly done - just cycle through all the possible combinations of a couple of "random" bytes, and all their fancy cryptography is finally toast - as it should be.
Asia will be cloning millions of copies of WinXP the morning after its released, and M$ won't be getting any product activation calls.
WinXP and OfficeXP CD's will cost about $1 each in Asia (and that's more than they're really worth). M$ code is just a commodity.
[OT I'm rather new to /., but I'm wondering why some messages are 'beneath my current treshold', while messages like this one are not.]
Obviously the above /.er didn't read through the article with his full attention, otherwise he or she would have noticed the fact you can (sequentially if necessary) upgrade your computer without reactivating.
On a side note: I believe companies have every right to protect their software in any way they seem fit (within the boundaries of applicable law, as enforced by governments). I also believe users have every right to choose the software they use. To put it shortly: if you don't like this new MS practice, don't use it.
I have used the same CD/key of Office 2K on 4 different computers. Each time it has required activation. It has never required dialing the 800 number. On my primary computer I have added ram changed CD drives changed harddrives multiple times(adding etc.) changed video cards rtemoved modems added lan cards...blah blah blah... Mine was the educational version so your milage may vary..
M$ is well aware that this will be cracked. So has pretty much every other piece of software or hardware (dongle) that has been popular. It's not the warez crowd that M$ want to hit.
;) but it just isn't up to the task yet.
It's the "Can I borrow your windows CD?" which is the way your grandma and the rest of the less technicly inclined pirate today. I have no doubt it'll increase M$'s sales, *and* piss off a lot of other (l)users who need to reactivate windows, but they'll look at the alternatives and find there isn't one (except installing some old windows version but then having trouble with new programs and the like), let's face it most ppl wouldn't like linux.
Win2000, and I expect WinXP too is pretty much all I'd want from an OS (and in some parts, *more than*...) apart from the awful price... I'm cheering for linux (I do want free as in beer
Kjella
Live today, because you never know what tomorrow brings
To be fair to the previous author, "WPA does not prevent typical hardware modifications" isn't necessarily the first conclusion you'd reach when you find your quantity of ram, serial id of graphics card and the serials from your IDE devices are encoded in it. Care to name which "typical hardware modifications" don't include upgrading your graphics card, adding more memory or getting a bigger hard-drive? Oh, I forgot, we can still go out and spend a fortune buying the latest iteration of Microsoft Mouse "Now with a 17.5% faster scan rate!"
"I Know You Are But What Am I?"
The leniency (sp?) they provide for laptop users is that you're allowed to add/remove IDE/SCSI units and the graphics board without having them register as 'different' (or rather, those bitfields are ignored when the profiles are compared)
If I wasn't cynical, I'd be wondering about the possibilities passing this
information to Microsoft opens up. Just think about this:
- Automatic notification of new firmware/drivers being available
- Communication of known issues from vendors via Microsoft
- Advice on potential interoperability issues provided each time
If I wasn't cynical, I would be really excited about the possibilitiesfor my hardware.
direct to end users.
I change some hardware out.
and potentially huge value for money from my software purchase.
But I am!
Have you seen anything about that little old anti-trust trial? Microsoft's lawyers won't be going hungry any time soon, storm troopers or no.
Privacy ??? Shouldn't it be Piracy ???
---
MOD THE CHILD UP!
This becomes annoying when upgrading machines or replacing them.
I had a $5 academic license for Office. When the new computer got built I couldn't install it since this copy was already registered. Even after a call to them, they said I had no way to prove I owned the license.
I think I got brushed off because I only paid $5 for it. The sick thing is, someone else paid big bucks for me to get it that cheap in the first place. Fuck 'em.
I just installed an older version, and really haven't used it since I started using star office and the like.
I actually backed up wma files and not realized that is was pointless since I could no longer play them. No one told me that a file I encoded needed a license to play it. Of course trying to play it got my information send to MS, along with the song name etc. Windows Media Player does this automatically.
I simple don't let that app access the internet anymore. With more MS software that wants to access the internet, the smaller that partition gets.
XP, not for me. Even if it's 'more stable', it's not going to touch my PC. The first time a window pops up saying I'll need XP, all of windows is gone. Adios Red Alert, adios Kazaa, I'll miss you.
Get your Unix fortune now!
I agree with you to the extent that we should hold all private information holders accountable, but if Microsoft is bad for exploiting trust, so is Apple, Blockbuster, Sun, and any other socially-irresonsible entity.
An often ignored concept ... is that most pirated copies would NOT have been purchased anyways.
While this may be true about the latest cool game, a computer without an operating system is a very expensive paperweight.
Microsoft's anti-trust punishment should be a compulsory and immediate donation of $5-billion to the Free Software Foundation. This would shortly spell the end of Microsoft's tyranny.
My god, think of how much those metrics alone are worth... A snapshot on DVD adoption, SCSI cards, % of laptops out there? Almost seems like the anti-copy stuff is just a smokescreen.
+++ UGUCAUCGUAUUUCU
If you were going to release this information to the world, would you do it under your real name?
He put his boots up on the table and made a face. "The sig," he smirked. "You can waste your life in search of the sig."
Watch for that to end soon.
CEE5210S The signal SIGHUP was received.
I have one thing to add and it may or may not be relevant.. the thing is microsoft arent the only company who do it and the XP asks for less info than the others.
Install PC anywhere or most virus scanners and they ask for more info, or as one poster pointed out try installing on a mac.
The fact is that WPA isnt the evil nemesis it is pointed out to be.... yet
the thing that worries me is not what might be in the product now but what they may have up their sleeve for later.. why not a product that wont work unless you enter a valid credit card (for ID purposes only) or a drivers license number, or a product that is only installable once without you going back and getting another software key (can be done easily you know)... what about a product that appends an invisible piece of code in a watermark that indicates the details of the machine and copy that made it (this is already being done or has been tried)
these are the things that make me worried - we should be fighting this not beacuse its MS or because it mayb a way to make money, we should be fighting it because it may be the last chance we can.
I refuse to argue with Anonymous Cowards - if you want a discussion get an account....
They ask you for _your_ email address. But all they require is _an_ email address. Besides, you have a throwaway webmail account for everything that asks for your address where there's a slight chance that they might actually need to use it to achieve something you want, right? What you basically advocating is that its ok to be asked this information because you can lie. I personally don't like to be forced into a situation where I must lie to protect my privacy.
Napster server was emulated, so was the Ultima Online server. Maybe someone will make an emulator for this server as well.
i have used microsoft premier tech support - this is the number that costs my company about $10k a year to have access to
And i have never got thru in as short a time as 10 minutes
Can i have the number you call... please
I refuse to argue with Anonymous Cowards - if you want a discussion get an account....
Very good work, but how long before we see a repeat of the DeCSS fiasco here?
Although judging by the techincal contact of their domain registration, they have some connection to America. Maybe M$ will bring pressure to bear on their ISP? Then again, given that the registration information was updated yesterday, maybe they already prepared for such an event?
Obligatory Simpsons reference. Sorry
As predicted, the CPU serial number has been integrated into the registration process.
Although intel has temporarily removed the CPU ID from some of the Pentium III line, there will soon be a need for processors to have a CPU ID in order for the 99%-of-the-market-monopoly OS to function.
Anyone want to bet that starting in about 1 year, the next generation of XP will require hardware that supports a CPU ID, and the newest generation of Pentium IV will just happen to meet that requirement? They will be using the excuse that it will cut piracy, and ensure lower license prices for all legal owners, and a bunch of other well spun bullshit.
Intel will love this requirement by their long time partner M$, because now every corporation in the world will have to upgrade from non-ID CPUs to the latest ID-enabled CPUs. M$ will probably also include code for AMDs processor ID. It may only start with servers, where businesses regularly upgrade to the newest processors, but within a few years the CPU ID will certainly be required in all machines.
I haven't fully digested the impact of this report yet, there isn't enough anti-acid in the building to do that. But the preliminary results of what is sent to M$ at every activation process is very frightening, and I'm beginning to understand why the European Commission may outlaw the process in the next few months. This type of data harvesting coupled with the registration process could lead to a very targeted marketing database of every M$ powered machine in the EU, and the privacy laws of the EU may need to be enforced before this gets out of hand.
the AC
Hemos is like...sci-fi fans;he thinks technology is cool, but he hasn't bothered to understand the science it's based on
Hehe, that's fast, congrats :-)
Anyway, I don't see why anyone would want to publish this key for, as it's most probably illegal to do so in most countries.
Interesting that they removed the key in their source, but included it in the binaries.
Kinda like: "Here are the plans to build a nuclear bomb, but we took out the part about where to get plutonium. But if you want one pre-made with plutonium ready to go, we can hook you up with that, too."
Isn't this whole thing just a matter of time and programmer determination anyway?
"Gesellschaft mit beschraenkter Haftung"
Those nutty Germans! Always with the lots of words, when a single word would do!
Literally, it translates to "Society with More Limited Adhesion." I'm not sure if that's "more-limited adhesion" or "more limited-adhesion," mind you, but either way sounds like a run-in with a UHU glue stick...
--
--
Don't like it? Respond with words, not karma.
What if he had already made three previous hardware changes to his laptop since he last installed Office XP? Unbeknownst to him, his copy of Office XP would be due to become deactivated with just one more change.
So, he goes on the road, upgrades his RAM, and boom, Office no longer works.
I don't have a problem with Microsoft requiring that he call a toll-free number or use the Internet to reactivate application; however, I do have a problem when they require that he reenter the serial number to do it. What's the purpose of that? The solution, of course, is to always keep a list of your Microsoft serial numbers on both your computer and in paper form just such a situation happens to you.
Sig goes here
"(MAC address just changed - do token ring cards use MAC addresses?)" Of _course_ token ring cards use MAC addresses. The system still runs TCP/IP networking, just with a different networking protocol.
*** Where are we going? And what's with this handbasket?
No matter how many bits you chance, Metallica will never forgive you.
"Of course, they won't necessarily know who YOU are since product REGISTRATION is separate from product ACTIVATION"
And you completely trust MS to never cross-reference this information? We know how well that worked out with the ad agencies *cough*.
Anyway, even if they don't know WHO you are, they still can track what modifications and upgrades you've done to your system, and all the serial numbers of your equipment. That itself is alarming. I bet it's not that hard to find out from equipment manufacturers, where their products ended up, especially if those parts are individually registered.
It's 10 PM. Do you know if you're un-American?
MS will have difficulties to sue them in Europe. In European jurisdiction, it is allowed to modify and reverse-engineer your software to allow interoperability with your system, any part of a license that forbids this is void.
Given: Our friends in Seattle make money.
Given: Out friends everywhere pirate the software.
Fact: Our friends don't have BBB down their backs.
Fact: Companies such as, say PricewaterhouseCoopers has an insane number of employees. BBB will be on their backs if they do steal software. PwC buys 300,000 copies of MS's Win XP. MS makes lots of money.
PwC is just one company. MS simplay makes money because other people can't afford to screw up. Hey...if you got put in jail for "tax evasion," you know you must have done something really wrong. Think about it. MS would love to make an extra buck from our friends, but they obviously don't make their big buck from them.
"Time is long and life is short, so begin to live while you still can." -EV
You do realize that it said simply re-installing XP would necessitate re-activation. I'm one of the unfortunate few that has been stuck with Windows ever since 286's became obsolete, and I'll say that for some strange reason (maybe cosmic rays!) Windows becomes unstable after ~5 months of regular usage and needs a full HD format & reinstall in order to run properly
This brings up another point about Microsoft's licensing schemes: 'Upgrade' CDs. As many of you know, MS offers upgrade CDs in retail stores that upgrade you to the latest flavor of Win9x, and they offer them for less than the full version of the same flavor. While this is fine, of course, the install program checks your hard drive to see if you have a previous flavor of Win9x installed. If you don't, then you don't get the new flavor.
Here's where the problem comes into play -- what if a particular user has, through some sort of magically lucky stability, upgrade versions (and only upgrade versions) of everything up to, say, WinME? I.e. Win 3.1 upgraded to Win95 upgraded to Win98 upgraded to WinME. Or, in a more likely scenario (this one has happened to me personally), what if they have a full version of Win95 and upgrades up the rest of the chain? If they need to reinstall WinME, are they to start all over again by installing Win 3.1, and working their way up the chain? And, what if -- oops -- they lose their Win95 CD? Then, although they are legally entitled to install and use Win98/WinME, they cannot do so. I know of people this has happened to, and needless to say it was incredibly frustrating for them not to be able to install an OS they had a legal copy of.
---
I pledge allegiance to the flag...
of the Corporate States of America...
Bah, burn the contents of those Windows disks onto a CD (along with Win98, and Win95 if you need to, you've got plenty of room, the CABs only take up ~100MB for each, and 16-bit Windows of course takes up far less) and pop it in. Then install from the Win98 folder, and when it asks for the disks, point it to the WIN31 or WFW folder you made and you're off!
_______
Scott Jones
Newscast Director / ABC19 WKPT
FC Closer
An often ignored concept (that George Broussard from 3D Realms seems to have understood) is that most pirated copies would NOT have been purchased anyways. There are lots of users that will not use the software unless they can get it for free. So in effect, they can either not pay for the software and use it, or not use it at all. Note that such users dont give ANYTHING to the company anyway; it is just a question of whether or not they will use the sotrware. In this case, the software company enjoys a larger installed base.
This is most of the reason why I see the Y Company lost $X to piracy as a BS argument. I've always noticed that lots of people won't pay for software at all; if they had to pay they would do without. IN that case, the Y Company is losing $X in potential sales because their price is too high/marketing not good enough/etc... How different is that from any other company in the tangible good and services industries that loses sales because consumers dont want to pay that much for the product? Why, then, should we treat software companies any differently from those that have poor sales policies?
Now, it's not only the name of the law that will send Jenna Bush to jail if she looks cross-eyed at a cop, it's the new slogan for Windows! Cool.
Wow, you've taken uneducated comments to a whole new level. lol
I haven't seen any of the license agreements concerning Windows installs that have WPA, but I assume that there's something against reverse engineering. Not only have these people reverse engineered (part of) the WPA process, but they've published the source code. While they didn't put the cryptographic key in the source, they did put it in the executable, and even clearly proclaim this, almost a wink wink nudge nudge to the people out there who are sure to take the executable appart, get the key, put it back into the source code, and then re-publish the complete, non-crippled source.
Given all this, it seems like their really asking for MS to sue them. Is something like this covered under an "academic research" clause that allows reverse engineering for research purposes?
Suppose you were an idiot. And suppose that you were a member of Congress. But I repeat myself.
Give a man a fire, and he'll be warm for a day, but set him on fire, and he'll be warm for the rest of his life.
Do a search on the contact names and email addresses? Nothing!
Got Code?
What it does say is that someone knows Microsoft's code well enough to develop a "cracked" version of Windows that would either bypass the check entirely or always generate the same hardware ID number. This hardware ID could be an ID that someone previously had used to activate their copy of Windows. Therefore, if you used his serial number and the activation code that he was given, you could unlock your cracked copy of Windows without ever contacting Microsoft.
Sig goes here
I'm so surprised, copy protection that annoys the honest users, and doesn't do anything to stop piracy. Who could've seen it coming?
--
And how long do you think it will take MS to impose draconian measures on these activation key "new issues" when they find that (heavens no!) a couple have been used in an "unauthorized manner?"
What on Earth are you smoking (and could I please have some?) that you think this will only be a ten-minute inconvenience instead of the unholy clusterfsck it smells like?
He put his boots up on the table and made a face. "The sig," he smirked. "You can waste your life in search of the sig."
This is ridiculous. Out of all the so-called "mirrors" here, only one link actually bothered to copy more than one page.
If you're going to "mirror" something, do the whole thing, otherwise when MS forces them to bring their site down, you'll have more than just a page of broken links.
since they are a GERMAN company, and (contrary to the DVD CCAs assumptions in that california lawsuit) germany is not an american state, they are pretty much immune from DMCA-like bullshitting.
there are two things that could make things ugly for Fully Licensed GmbH. one is a license agreement, but so far, the validity of click-through, shrink-wrap or similiar licenses is highly doubted in germany. AFAIK, none has ever been enforced in a court.
second, there is a provision against reverse-engineering in the german copyright law. however, it also allows for a number of exceptions.
one way or the other, since they are a GmbH, the worst that can happen is that they'll be sued out of business, but with no loss to their private capital. so they'll immediatly start a new company under a similiar name and harvest all the free publicity advantages.
because lastly, sueing them would be the equivalent of saying "yes, we feel guilty. yes, we've done wrong. and no, we can't stand that you found us with the hand in the cookie jar." - a pretty dumb publicity stunt, even for M$ standards.
Assorted stuff I do sometimes: Lemuria.org
Well yeah its, uh, non-deterministic. You see that makes it a lot faster cause everything is already determined and it doesn't have to do all the determination.
Plus infinite linear storage space is a whole lot of RAM.
Tim
Omnia vestra castrorum habetur nobis.
Need I say more?
"Research is what I am doing when I don't know what I am doing." -- Wernher von Braun
such a crap VM that can only swap to files, not partitions
If that's how you feel, make a dedicated FAT partition for swap and throw your Windows swap file on that partition. Much of the slowness of Windows 9x swapping is due to a swap file on a fragmented disk; the thrashing you get one minute after you leave the input devices alone is the kernel's attempt to compact the swap file.
Will I retire or break 10K?
But also, imagine how useful it would be to have a database of the precise hardware used by each of your competitors' systems. Or the startups you were potentially interested in acquiring?
It sounds like script kiddie heaven- when any security vulnerability becomes known you have a nice map of the hundreds, thousands, millions of systems having the vulnerability.
I'm sure Microsoft is so ethical they would never use a black ops team to take advantage of such information.... ;)
--LP
Nightmare essay question for Bill Gates: Explain why new economy rules don't apply to software dot-coms, but do apply to software anti-trust enforcement. Describe what a hypothetical software monopoly's obligations would be under the Sherman Anti-trust Act, as you interpret it. Defend your interpretation with Supreme Court citations.
At this point I should admit that my knowledge of XP and its .NET antipiracy systems is quite limited. Could anybody tell me if MS links XP activation to its products, so that they cant give away the razor?
I Browse at +4 Flamebait
Open Source Sysadmin
It's always the same story : security through obscurity doesn't work. We already saw that with DeCSS.
When people need to close sources and algorithms of a crypto system, it's almost always because it's flacky. They don't trust their own algorithms. They don't want other people know how they are working, because they know the algorithms can easily be broken when you know their mechanics.
-- Pure FTP server - Upgrade your FTP server to something simple and secure.
{{.sig}}
Didn't I read more than one place that big customers and OEM copies would be free of WPA?
I am just curious but...
What is the plan for huge vendors (HP, Compaq, Dell, etc.. ) that Use the same product key for thousands of machines? Will this scheme work becuase usually the software is installed on the same hardware? And what is the end user supposed to do when he buys a brand new machine, then 2 weeks later it says. "You must re-activate"
Andrew
This page left intentionally blank.
The really appropriate thing here is that a new install is virgin. It's not officially f#@%ed until you've USED it for a short while. The solution to any Windows-related problem is one of two things: Re-install, or upgrade. Both painful. Want DirectX 7 back? Want USB support (real USB, not hacked like 98 non-SE)? Want a new FEATURE (aka bug fix) in Office? Reinstall for the first, upgrade for second. Can't uninstall DirectX with a first-party MS software. Now, if you do either, you're forced to go through telephone activation. It may stop piracy, it may have 24 hour support, it's still a stupid way to enforce it. WPA has secured my move to Linux, even though I had bought Windows liscenses before (NT4 and 2KPro). What happens to people who want to build their systems piece at a time? Base system initially, then add sound later, DVD decoder after that, etc? This is obviously a simple copy-protection for the normal OEM PC that never gets upgraded, and has all of two non-Motherboard devices (although NIC and/or Modem on MB is getting more common, esp in corporate desktop). For PC's like that, your system fingerprint doesn't change. For DIY'ers, we're screwed unless you stick to a hardware set from install on. On top of the hassle parts of it, I for one believe that MS has engineered it to gather system configs about their users. Maybe they don't tie it to your name/etc, but they will know more about the average PC configuration than anyone else, and probably not at the full knowledge of their users. I'm just not comfortable with forced disclosure here.
do you block caller id?
What does it matter? I'm already connected to the internet when I activate XP. Even people with dialup connections can just establish their connection first, and then start the activation process. Those without an internet account but with a modem can call Microsoft if they are really paranoid enough to think that Microsoft is going to track caller ID.
"And like that
- A.P.
--
"Remember when the U.S. had a drug problem, and then we declared a War On Drugs, and now you can't buy drugs anymore?"
You can also create a file C:\NTLDR (contents dont matter, I use "fuck microsoft")
that will make an "upgrade" version of Win95/98/ME pass the "previous version installed" check.
So, i format clean, create C:\NTLDR, copy the
Win98/ME install files to c:\WIN98, and run the
install off the hard drive. Works great,
and I've done this about 10-15 times.
--
When all you have is a hammer, everything looks like a skull.
Or they might not. VMWare is in bed pretty deep with MS--maybe they have to be, since it'd be pretty easy for MS to make the EULA invalid in a VM (legal or not, no corporation would run it in a VM if the EULA denied that right). Or MS could take technical countermeasures (see also DR-DOS and Windows 3.1) to keep XP from running in a VM, essentially putting VMWare out of business.
One thing I noted is that about a year ago, there was an announcement with much fanfare that VMWare would sell bundles of MS licenses with VMWare. At roughly the same time, OS/2 support, which had been worked on and tested for some time, was suddenly dropped. Can I prove cause and effect? No. Are there lots of other reasons support can have been removed? Sure. But the timing's awfully suspect.
Also, VMWare is hard coded to use a certain OUI (Organizational Unit Identifier) for VM network card NIC addresses--meaning they'll always start with a known prefix. VMWare provides no way to change this, meaning that MS or any other organization with access to the NIC address (or even a hash, probably) will know one is running a VM. (Imagine a typical Georgia network nazi reaction to seeing that with a sniffer.)
I'm not confident VMWare's going to be allowing anyone to change hardware serial numbers in VMs--I'll bet they randomize them just to avoid jepoardizing their "strategic relationship" with Microsoft.
CEE5210S The signal SIGHUP was received.
"...always keep a list of your Microsoft serial numbers on both your computer..."
right, i'll just open up the spreadsheet that they are in...
wait, no.
no problem, i'll just open the word docum...
that's all right, i've got another copy in an access datab...
hang on, it's sitting in a folder in outl...
hmm.
---
Imagine an out of work OSS coder who signed up with Microsoft out of despiration:
Blue DevilI used to have a nice life
I used to live by the right
But I've strayed from the good side of the Lord
And I flirted with the Devil and he dealt me a card
And he told me that you will never win
And he told me that I was his only friend
I had nothing to go home to
So I sold my soul to the Devil now I'm blue
I never thought it could be this bad
Hurtin' like this, Oh, it's killin' me bad
And now I've stuck in a life of pain
And I got the Devil takin me away
And he told me that you will never win
And he hold me that I was his only friend
I had nothing to go home to
So I sold my soul to the Devil now I'm blue.
- Shelton Hank Williams
Doesn't Microsoft already do this for us? Let's not forget about MSN passport so soon!
You're right. Piracy is still piracy. But you are going to get modded down as a troll like I did (if anyone actually sees your post).
Geekizoid: The Small Shiny Things Network ©
Gobble a dick!
And you completely trust MS to never cross-reference this information? We know how well that worked out with the ad agencies *cough*.
... registration is not required to activate the software.
I don't need to trust Microsoft -- I just won't register XP. That's the point
Anyway, even if they don't know WHO you are, they still can track what modifications and upgrades you've done to your system, and all the serial numbers of your equipment.
I don't think so. They just get a huge number that is generated from hashing the various ID's of your hardware. There is a big difference. They would not be able to tell the hardware installed, but rather, whether or not the hardware that is installed has changed since the last time you activated.
"And like that
Publishing how to pick a lock isn't going to keep the door locked long.
It may not keep the door locked for very long, but then again if you know how it works that means people have to build one damn fine lock. Rather than rely on a crappy lock with a small keyspace, it forces them to use a lock with a large and hopefully randomly generated keyspace. In the end this means better locks. The better the lock, the better the security for all concerned.
If the lock was too esay to pick in the first place, then keeping it secret just exposes this fact because if you publish how it works then you propose a challenge -- "I think I got you beat.Go ahead and try to break me!" About the only bad thing about telling how to break the lock is that it makes locks more expensive if you want to get real security. That said its usually better for the average consumer because it drives down the price of an ok lock. If your not to worried about security then your lock becomes easier to get.
He was not convicted due to "lack of evidence", and he is now working in a software company in the south of Norway :)
When Office goes down, you can still read documents. You just can't write new ones.
Windows XP activation is something else--but you knew that going in, so you checked everything *before* you went, right? I mean, that RAM was something that can wait until you get back to your office--and I suspect that there'll be something in the final version that doesn't count external devices (such as Zip drives) as a "change."
Hmm... How about Blizzard and their famous Battle.net key system? There are tons of key generators suitable for single player sessions, but none seem to work against BNet key authorization. Seems pretty fool-proof as the BNet players must contact a Blizzard server in order to play.
What if MS does something like that too? Imagine about tieing product key security so that for every bootup where network connection is detected Windows goes and asks for authorization from a MS server..?
-P--
I hate people who quote
MSFT looses $X Billion to piracy each year
Sort of a tangential point, but to fill in the $X: According to the SPA, software piracy has saved consumers worldwide over $59.2 billion in the last five years, and $12 billion last year alone. The linked document also details which regions saved the most.
They won't have to be attacked directly. All MSoft needs to do is court a powerful ally in Germany, stuff them full of company perks/exclusive deals/whatever and then lean on them to silence their noisome neighbors. Wait 'n see, and I'll bet you that if these guys get spanked, they'll get spanked by one of their own.
**>>BELCH
After reading the article, which half the time lost me, all I can say is "damn, those guys know their shit" and "how many different levels of encryption and checking does MS need to do?"
.Net and subscription based systems, with all data handled by MS, and suddenly you realize your are totally fucked, but it is a bit too late.
Really, checking the amount of RAM in a system? Of course, no one EVER adds RAM, right?
MS has perfected the art of "incremental monopoly." Each step is not too bad, and after 10 steps, you are used to the last 3 steps, so it still seems ok. Eventually, you have
Vote monkeys into Congress. They are cheaper and more trustworthy.
Doofus question:
I tried to compile the code they gave out. They seem to use an assembler called "ml" which I've never heard of. Can someone please point me in the right direction?
--
#include <malloc.h>
--
#include <malloc.h>
free(your.mind);
Cryptnotic
My other first post is car post.
Why don't they just include in the box a device you add to your computer (lets say it goes on to keyboard input, with a keyboard plugin on it, the keyboard only uses 3 of the six pins*) and this device could have the CD code hardcoded into it, and when windows boots it can check the inputed CD code agenst the hard coded one and if they are the same boot.
just my 2c
Michael P. O'Connor
* the keyboard using only 3 pins of the six is nice since the mouse does the same, I have on my laptop only one ps/2 port but I have a happy hacking keyboard and a nich logitech track ball that I like to use on it so I got a PS/2 port spliter and both go into one port, works great on linux, but when I boot to windows for games, well windows just complains that there is no mouse and the keyboard will not work, gee I thought windows was easer to use then linux, with linux I just pluged them in and they worked on windows, I have no idea on how to get them to work.
I work for a company with Macintosh computers, and their required registration is a LOT more big brotherly than MS's XP version. For example I just installed RC1 over the weekend, and It never asked me for my real name, address, email address, phone number or any identifying information... All I had to do to activate it was hit "activate" in the task tray, and it said "thanks for using a MS product" or something similiar. Now, I just installed OS X on one of my Macs recently, and here's what I had to fill out: First Name Last Name Address Phone Number Email Address Are you a business? Are you with the government? Then in order to download any updates, you have to give them your email address. So, in comparison Apple is being Big Brother Here, while Microsoft is just putting in a little check to try to save them a few bucks. Microsoft's XP RC1 at no time asks you to give them any information. Sure, it pops up a "optional registration screen" which you can just Click on the BIG RED X or click Cancel...
"How many bits of 'Metallica - Unforgiven.mp3' can you change out with identical bits before it isn't 'Metallica - Unforgiven.mp3' anymore?"
I thought M$ only cared about money...isn't this supposed to be about piracy not privacy?
They don't need you to give them your name. With Caller ID and other software, if you called from home, they've got your name and address. Doh!
----------------------------------
"We're sorry, but the website you're trying to reach has been disconnected."
Onstensibly, the paper's purpose is to analyze the privacy impact of the registraction procedure; i.e. how much information about YOU Microsoft can glean from the hashed system info.
;)
In this light, the paper itself is relatively benign; enough so that Microsoft shouldn't be overly worried about it.
The fact that it can be used to spoof WAP isn't even mentioned in the paper
I am guessing this is entirely intentional.
The actual report's conclusions are very kind to MS.
From the paper's conclusion:
"In contrast to many critics of Windows Product Activation, we think that WPA does not prevent typical hardware modifications and, moreover, respects the user's right to privacy."
I think that the real fear is that this WPA may work too well, making it difficult to use unauthorized copies but being fairly unobtrusive to paying users. I mean, why is every on here so up in arms about this. If it really sucks, won't that hurt MS and be for the good?
But based on the conclusions in this report, WPA is actually a pretty good sytem that is gonna make MS a lot more money, without significantly harming market share.
evanchik.net
If I wanted to make sure that I wasn't just getting marketing hype, I'd by a couple of (10^n) shares of stock in the company, and have them send me a quarterly report.
Oh, wait... all these companies are already diversified into one another. This information is already theirs.
This is just paranoid fantasy. Score 4, insightful indeed.
That is different.
You can't take the hash and generate the original hashed string.
You can take strings and try them until you find the right hash.
For such a small hash, there are going to be a lot of possible matches.
--
Two witches watched two watches.
--
Two witches watched two watches.
Which witch watched which watch?
Your arguement is "As long as its free, I'll use it. If it is not free, I'll not use it."
The other side of that arguement is: "Why should I pay for it if I can get it for free."
You are correct, the first does no monetary harm to the creator of the software and maybe helps by increasing the user base. The second does monetary harm to the creator of the software.
Mirror of the site
Life is what you make of it.
Dockable computers are treated differently from desktops.
What prevents clone makers from making dockable desktop computers to circumvent product activation?
Will I retire or break 10K?
Nope, I'm the only one on my network, plus I actually do read all the other comments before posting.
I don't think Microsoft will mind this information being posted -- by itself, it is not enough to make a keygen.
Nowhere in the document does it say how to transform the activation code into the countercode that "registers" the program! This is what the registration process does on Microsoft's servers, and a keygen would need to duplicate this in order to come up with a valid countercode.
This would be almost impossible to reverse engineer, considering the algorithm for this isn't performed locally. The most likely attack will be on the registration validation itself: just fool Windows into thinking any random countercode is valid. This is what will probably be done.
The most that could be done with the information here is to make a program that spoofs the hardware information. It could somehow then force the Windows registration process to accept this spoofed information instead of actually querying your hardware for it. Then, you would be able to install Windows on an unlimited number of computers, by just re-entering the one registration countercode you got. Microsoft could detect this though, so you would probably need to copy someone else's Product ID. But then Microsoft would simply blacklist that PID after it's been used a few dozen times or so. The cycle continues. Maybe Microsoft could ask the author of CloneCD for ideas? (That program uses essentially the same idea, and it is still one of the most pirated programs on the net)
IMO, this paper has done a valuable service by describing where exactly each bit of information in the activation code comes from. It will make people feel a little bit more comfortable, knowing what is in each digit they are sending. Microsoft should have made this public knowledge to begin with.
Personally, I will never upgrade beyond Windows 98 Second Edition and Office 97. Microsoft is just getting too Orwellian with their latest products. When I'm not using Linux, I'll stick to the last known safe versions, thank you very much. I own a PII-450 (last Intel CPU made without Processor ID) for the same reason.
Now watch the entire PC industry crash, as people stop buying upgrades and new components, for fear of triggering Product Activation and breaking their Windows installation.... Watch desperate PC component vendors offer "WPA insurance" when you buy their products....
Super eurobeat from Avex and Konami unite in your DANCE!
Dr. Demento On The 'Net!
It's easier to do through social engineering. See my previous comment.
Insert obligatory reminder from Free Software advocates that "piracy" is a corruption of the language.
Insert obligatory rebuttal that those very same advocates often refer to Windows users as slaves, thus corrupting the language in the same fashion.
Insert obligatory cry for moderation and civility in public discourse.
Go AFK to ponder futility.
Return like you always do.
For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
If I run WTS or Citrix on a server somewhere deep in the network and Jane sysadmin unplugs one of the SCSI drives for maintenance or because it broke and now I need to run XP-ish office apps off the network for 30+ people who log onto that server, then what?
Couldn't this product activation be a major boost for Free OS'ses? A lot of people I know only have pirated versions of M$ products, and are not willing to pay for it. If they cannot pirate it, they have to stick to old versions or seek something else.
.Net pay-services replace the normal M$ programs (I don't know if this is the case), and people actually have to pay for their normally pirated programs, wouldn't they just look for something else?
And if
Like science? Comics? Wicked...
Funny By Nature
When you re-activate, naturally you'll have to generate a new Installation Key and they'll be able to see exactly what components you changed out. Fun, huh?
::TV ad starts:: "Hello, Mr. Thompson. We at ATI have noticed that you have not upgraded your display adapter to the latest in video technology as you did the last two times we released a new card. Please take this opportunity to review a special deal we've created just for you. Oh, looks like The Big Breakfast is coming back on. I'll be back at the next commercial break with more deals for you."
Just imagine the marketing research power of this knowledge. Microsoft could sell this information to hardware manufacturers so they can then specifically target markets worldwide. Here's an example: Analysis determines that people in the southeastern United States upgrade memory on average twice as much as people in the midwestern United States. Where is Kingston going to focus their ads? They are going to advertise the latest technology to the southerners and are going to preach the necessities of a memory upgrade to the midwesterners. Say WD learns that people in Scotland like to upgrade HDs by buying a second drive while the Germans prefer to upgrade HDs and CPU at the same time. The potential for targeted ads is staggering. Now combine this with cable boxes that send viewer information back to the cable company and Amazon's individual pricing and you get individually targeted computer ads.
Scary
---
http://www.flyingbuttmonkeys.com/mirrors/www.licen turion.com/xp/
- - - - -
Napster-to-go says "Fill and refill your compatible MP3 player", which is a lie. It's not MP3. It's WMA with DRM.
You forgot that that is what passport is all about!!!
DRM? No thanks, I'll just get it somewhere else...
> Did you say impossible????? Isn't that what
> they use to say about Win95 password lists, 40
> bit encryption and when pigs fly(I use FedEx
> for this)?
Bone head. Win95 passwords were encrypted. The information in WPA is hashed. Just like UNIX passwords. Once hashed, you can't get the original back.
> Nothing is impossible. Some things are
> difficult, some things are improbable and some
> things still elude us but, NOTHING is
> impossible!
No matter how hard I flap my arms, I'll never be able to fly.
That's quite an in-depth explanation. It surprises me that they could figure it out. How many hours did they sit there going: "Hmm... maybe if we added those numbers together and then added the odd ones again... no wait... lets do the even ones. And to finish it off lets to the sum % 3. Oh wait... that should be sum % 7... Yeah, that gives us the check digit!" -Sean
Will they change the algorithm before the next build? Probably not, their lawyers need the money.
Fight Spammers!
The Major Linux vendors today announced similar privacy invading tactics as Microsoft. Their reverse engineered configuration mining code was found to be...
/proc/cpuinfo | mail licensing@linux.com
cat
--
This is funny too...
http://linuxpr.com/releases/3925.html
As the game publishing companies have discovered a long ago any security system can be cracked given enough time. It is time Microsoft learned this fact as well. No amounts of law suits can put the genie back into the bottle once it is released which the MPAA has learned the hard way and at extreme cost. If any portion of the system is located on the users system, it will be able to be hacked. While I do not agree with software piracy, I also do not believe in copy protection whose sole purpose is to complicate the situation for the end users that buy software and expect specific uses from it.
:P
--
When I'm good I'm very good, when I'm bad I'm better, But when I'm evil you better run
"GET / HTTP/1.0" 200 51230 "-" "Mozilla/4.0 (compatible; Setec Astronomy)"
Processor serial number
I wonder where they keep the processor-serial number -> your name, address, email, and penis length data? IM thinking select *
from person, register_info
where person.serial = register_info.serial
Voila - you may not give your name && number when registering windows now, but who cares - they can retrieve your processor_serial_number now (in future - whenever).
People are really putting their head in the sand if they dont think this registration isnt a (another) nail in the coffin of private computing.
Who knows when/how they retrieve the serials of apps installed on PCs, how much email-traffic you have (rolling counters stored... ummm somewhere), maybe the percentage of your disk that are occupied w/ JPGs (in your c:/pr0n dir), whatever.
The point is, with this binary only model - how the *uck can you trust they aren't keeping this data - and managing it all somewhere. I know you can sniff the network traffic, but we all know that with a little obfuscation and some encryption - you can hide anything you want very well.
I have no interest in giving M$ any information about me or my computer - now or ever. I will not run WinXP or anything else Windows on the internet, i just cant trust that they havent trojaned all (some/most/whatever) of the applications.
P.S. I thought Intel disabled the unique-processor-serial...????!?
What is the purpose of the MS CD/product keys anyways? Are they individually serialized for individual copy of the product? If they are the same on the product level (not unique for distinct copies), then what is the point in preventing piracy with them?
There's 10 types of people in this world, those who understand binary and those who don't.
Yeah, but they did it, didn't they?
Why bring their effort down? At least now no one else has to do it.
Fortunately there are some operating systems which cost far less money than ones made by Microsoft.
I still have my original PC! Only the case, processor, RAM, MoBo, mouse and keyboard have been fixed or replaced when needed. The power cable is still the same.
" It is better to ask forgiveness than it is to ask permission. " Admiral Grace Hooper
A while ago I was talking to the regional manager of Adobe in my country, I was frank about my usage of pirated software - I pointed out that I had pirate Photoshop 3, learned to use it, become a designer and demanded my employer purchase 4.0, 5.0, and 5.5 - From one lost sale Adobe gained three legitimate ones.
He told me that the company was aware of this, and generally didn't take a hard line against home users, but at the same time they clearly couldn't be seen to promote that either, or no one would buy everything.
If there was not pirated software, it is nice to think that perhaps Windows would cost 1/2 as much, however it probably wouldn't. It is a circular arguement, the software companies claim prices are high because of piracy, pirates claim they do it because prices are two high.
What the hell makes you think .NET doesn't/can't run locally? Its just a framework... Wherever its installed, .net apps will run. By running "remotely" what is really going on, is SOAP, etc etc. You can have a remote .NET app not even being .NET For example I wrote .NET apps that interoperate with Java apps. Either can be local, either can be remote. It all works the same.
Its easy to tell...If MS does not sue them in the next 5 days, we know who is behind all of this...
Remember, when you are downloading MP3's, you are downloading communism!!!
badness 10000
Seems this is another difference between Europe and the USA. Here is Austria, disabled caller IDs will not be transmitted to toll-free numbers.
Only emergency numbers (Police, etc) have an override.
Think about focusing development efforts on mainstream hardware.
... I think all of this Microsoft babble (see: XBOX) is melting your brain. *grin* .. (just kiddin')
"Mainstream hardware." BWAHAHAHA
----- rL
...the encryption key (removed from the source code) is "\x6A\xC8\x5E\xD4". Since I do not have a Windows XP activation key to confirm this I can't be certain - perhaps someone could try this and let me know if it works? Email me - mad.nutter@mindless.com
Registration by phone line, you'd think most people are/will be still stuck doing this. Caller ID, plus a reverse phone number lookup and what more do you need to know?
That I'm activating my notebook computer's copy of Windows XP from a pay phone. This is the real reason the Amish don't own phones: because they value their privacy.
Will I retire or break 10K?
FreeNet this. I mean, that's pretty much exactly what FreeNet is for, right? Ther'd be no way to have it taken down.
In case you can't figure it out, there is no way for them to know. They know how many boxes they sold, because they can count them. Not so with unlicensed copies.
There is a way to roughly estimate piracy. Take number of CPUs manufactured by Intel/AMD/Transmeta. Adjust for multiprocessor boxes and propriotary devices and you have more or less quantity of new computers on the market. Use Windows market penetration data to figure number of machine running MS OS. Compare with number of lincenses sold.
Man, is anyone really surprised that someone cracked this? It was bound to happen anyways... everyone goes out after M$. I'd be interested to know how they did it, however.
Look for:
"Windows Product Activation Reversed Enginnered (XPDec).zip"
"Windows Product Activation Reversed Enginnered (XPDec).rar"
Sorry I don't have a gzip/tar.
This program IS NOT a crack, as far as my knowledge goes, it's more like a keygen program. But it's still cool, just wish that the crypto key that they left out in the source, wasn't.
I think we know all too well that Microsoft would never use their hardware information database in a user-benevolent fashion. They would use it to increase their profits (like most corporations would, btw).
But couldn't an OS like Linux or FreeBSD really benefit from this kind of hardware tracking? Think about focusing development efforts on mainstream hardware.
Or does something like this exist?
It looks like something someone wrote without looking through an algorithms book. The encryption is just a random algorithm of the same general type as DES, but almost certainly weak (your average similar algorithm is not secure). The checksum thing is also error-prone; it doesn't notice if you transpose a 1 with an 8 or replace a 2 with a 9, for instance.
I can see a lot of frustrated sys admins using this instead of calling M$ each and every time they deploy XP, though that being said my first defense against XP activation frustration is going to be "don't" when asked about upgrading/deploying.
You're using her as bait, Master!
What is really interesting is that now that Windows has copy-protection, why haven't they lowered the price? Although it's not hack-proof (nothing is), it's still strong enough to curb the majority of casual "piracy".
I guess that line about Microsoft having to overcharge the honest user to subsidize the pirates was just a line of shit.
Various strings are run through a hashing function and are stored in the key you read to the Microsoft rep over the phone (the Installation key). They are:
- Your network card's MAC address
- Amount of RAM installed
- Processor model
- Processor serial number
- Volume serial number
- Hardware ID strings from
- Your CD-ROM drive
- Your hard drive
- Your video card
- Your SCSI host adapter
- Your IDE controller
These values are thrown together (along with some other values) into a huge bit field. Also, a three-digit random number is thrown into the mix. Because the end result that you read to the phone rep is encrypted, this three digit number causes your code to be entirely different on each install.Here's the real fun part: The OS also stores a snapshot of your hardware configuration. If you change more than three of these hardware components out? It's time to call Microsoft and re-activate your license.
When you re-activate, naturally you'll have to generate a new Installation Key and they'll be able to see exactly what components you changed out. Fun, huh?
XP recently hit RC1. Microsoft, of course, still has time to change the hashing mechanism before release, if they so choose.
If you don't like the idea of smart tags: Don't upgrade.
If you don't like the idea of WPA: Don't upgrade.
If you don't like the idea of being held accountable for licensed software, stay in your little OSS world and stop telling everyone what we should think.
Slashdot something useful.
Management is not a tunable parameter.
In contrast to many critics of Windows Product Activation, we think that WPA does not prevent typical hardware modifications and, moreover, respects the user's right to privacy.
Typical hardware modifications....
If you change more than three things, you have to go through whatever hoops Microsoft wants to put you through to use something you've already paid for...
I don't know about you (or the guys who did this), but the last time I upgraded a machine, I increased the memory (1 change), added a hard drive (2 changes), replaced both the modem and the video card (3 and 4 changes)... Whoops... Went too far, must now cope with Mr. Bill and the XP nonesense...
and you cannot use this to get an activation key.
Don't know if anybody is still reading this topic on Slashdot, but it's happened.
http://www.tecchannel.de/betriebssysteme/746/index .html
http://www.theregister.co.uk/content/4/20433.html
Super eurobeat from Avex and Konami unite in your DANCE!
Dr. Demento On The 'Net!
"Those nutty Germans! Always with the lots of words, when a single word would do!"
German has a lot of long words which translate into multiple small words in English!
"Rub her feet." -- L.L.
Okay, let's all type:
wget -m http://www.licenturion.com/xp/
So that tomorrow, when a mistargeted Nato Missile will have destroyed Fully Licensed's building, we can still access the site.
You're missing one.
"If I can get it for free I will use it, and if I cannot I will not use it. In no case will I ever pay for it."
A sale is only lost if someone was actually going to purchase the product and was dissuaded from doing so by free availability.
The end-user's position in this case is of course immoral, but all the same it's stretching the bounds of reason to define this as a "lost sale".
Many commercial software developers like to list piracy as a reason for high costs. Microsoft included.
:-) .
But when did Microsoft ever sell, say Win95 for $35 ? So, how has piracy raised the price? It's always been sold for one price (~$80) and hasn't gone up or down depending on how many copies are purchased.
And then there's the user base argument. When people are pirating your software, they're strengthening your monopoly. Just as it's good for FreeSoftware everytime a Linux/*BSD CD is given to someone new, how does it hurt MS when a home user borrows their friend's Win95 CD? The more times Win95 is installed, the more people are using it and the more likely that person is to become a valuable Windows-using consumer. Buying Windows software, perhaps purchasing a new computer with Win98 preinstalled. Requiring a Windows PC at work. Purchasing upgrades.
Now, I must admit that most people who are going to borrow a Win95 CD will be unlikely to turn 100% legal overnight. But then, when has Microsoft ever been struggling. Well, only when EVERYONE ELSE has been struggling. Back when the economy was booming, Microsoft wasn't struggling to survive due to piracy. Only when everyone else has been struggling has MS even started to feel the pinch.
Like I said, it's the same old cookie-cutter answer to "MSFT looses $X Billion to piracy each year", but it's always a fun argument
kickin' science like no one else can,
my dick is twice as long as my attention span.
Withdrawal before climax is very ineffective and those who try this are usually called "parents."
Their phone cost is next to nothing; if they don't just purchase their WATS access at a flat $XX,XXX/month (which I'm sure they do), they purchase it in bulk for less than $0.03/minute. It's cheaper for them to leave you on hold for 10 minutes than to hire another person to actually answer your call.
And as for getting your info via "Caller ID" (actually ANI for 800 service); can't you still make IP phone calls via MSN's site?
Funny you mention that. I get the "slow down cowboy" when in fact it was ONE WEEK since my last submission.
WOW. I just finished reading it and was amazed that they figured that out. I also like to see that they did it before xp shipped. Security through obscurity isn't a good idea. Just publish the damn protocal microsoft :)
How long before they have programs where you enter your xp code and it gives you what the ms people would? This'll be interesting.
Unfortunately, if you're calling a toll-free number, there's no way to disable caller ID. In fact, the 800-number caller-id can contain (depending on whether they're willing to pay for it) not only the number you're calling from, but your name as well. All they have to do is suck it into their database. Ever wonder why your new credit card wants you to call an 800 number to activate it? That's so they can harvest the phone number you do it from. I always do it from payphones now, just to be difficult.
MS Rep: "...Yes, sir, please wait a moment while I pull up your system configuration..."
H1 0: 0x119
H1 10: 0x154
H1 20: 0x1a
H1 27: 0xb
H2 0: 0x2
H2 3: 0x32
H2 9: 0x4f
H2 16: 0xa
H2 21: 0xa
H2 25: 0x2
H2 28: 0x0
H2 31: 0x1
MS Rep: "....Uhh...sir..."
It's 10 PM. Do you know if you're un-American?
Step 1: Load debugger (SoftICE is a probable favorite).
Step 2: Breakpoint on the WinXP code entry screen.
Step 3: Trace code (perhaps lots of code). Look for interesting tidbits.
Step 4: Lather, Rinse, Repeat.
Really, this is not such a difficult thing to do...
BTW, this kind of software lock-out isn't all that uncommon--software written for certain classes of businesses have been using it for some time (and yes, I've actually written some--ah, the seduction of the dark side).
-- Shamus
This space for rent. EZ terms!
VMware 'in bed with Microsoft'? Pure hooey.
VMware corp. has products that are enhanced for non-MS operating systems in ways that it isn't for MS operating systems. They've even bundled different distributions (Suse?). It works well, though futzing with the setup each time the kernel changes is a pain.
A firewall can not protect you from yourself. Turn off what you do not need. Do not use the firewall to do your work.
You, in your infinite wisdom, must know better than the author, eh?
I'm sure the submitter meant "piracy" - but maybe not so inaccurate?
sulli
RTFJ.
Ethernet card
CDROM Drive
Graphics adaptor
CPU
Harddrive
SCSI controller
IDE controller
RAM
Changing any of these items will result in you needing to call up Microsoft and beg for a new key. Of course, the people answering those calls will be behind a 1-900 number and only available from 11am to 1pm (excluding an hour long lunch) PST.
I'm not sure about others, but in the last month I have upgraded my system drive, graphics card and ethernet adaptor at three different sittings. While I could probably convince them that this was a legitimate upgrade path, what happens when I do it all at the same time?
Truely worst case is when you buy a whole machine in parts, so it doesn't come with windows, and then 'recycle' your old machine into an alternate OS. Now you will need to buy Windows for the new machine -anyways-, so you may as well keep the old machine running Windows also. Yet another way to discourage Linux/BSD/etc usage.
Any sufficiently advanced technology is indistinguishable from a rigged demo.
Am I the only person that smells a rat here?
They happen to work out the process.
They incidently don't include the magic key to get their source code working.
They conclude this MS thing is not a problem, for us not to worry about it.
They conclude that the information sent out is okay.
I would not be surprised if I found out they weren't as.. independant.. as it seems.
So, do you have to enter your serial number in reverse order to register in the Southern Hemisphere?
/.
/. If the government wants us to respect the law, it should set a better example.
Now, I swap out video cards, CD's, NIC's, and CPU's fairly often. I also use removable HDD chassis to ease swapping drives in my primary box.
This really will be a pain for those who have rigs used for a lot of testing.
+++ UGUCAUCGUAUUUCU
Go back and look at the DOS/Windows original suit.
DOS and Windows was going for $10.50, yet list was almost $200.
So, the 'price' of M$ poducts IS variable. Just like Oracle will sell their stuff at 90% off list. (WSJ got the price list faxed almost 2 years ago....remember?)
If it was said on slashdot, it MUST be true!
You can quit the setup program by hitting command-Q. The OS won't complain if you do, and you can run the Internet setup assistant separately.
-jcr
The only title of honor that a tyrant can grant is "Enemy of the State."
Good Grief people don't you know it has been cracked all ready? Check IRC some nit wit admin set it so if you tried to download it using download manager you didn't have to pay for the download. Two the hack has been available for days now. Heh some security....broken before it's out.
seems if you(MS) build it... they will hack it.. :)
At the airport I buy some DIMMs in the duty free (Memory just changed).
I get into Aus and visit the Client's office and find that my net card doesn't work with their system. So I frantically buy a new token-ring PCMCIA card and plug it into my laptop, removing my ethernet card (MAC address just changed - do token ring cards use MAC addresses?).
Did I mention that I normally plug in a parallel port ZIP drive back in Canada, but I didn't bring it on this trip. So the IOmega Parallel2SCSI driver tries to load and fails, so it diables my virtual SCSI address (I don't know if that really happens, but let's assume that it does. My SCSI subsystem has just disappeared).
So there, I'm ready to do my presentation in the Client's office, and XP coughs and demands that I type in my 27 digit code on the back of the CD.
Did I mention that the CDs are on my desk back in Vancouver?
-AD
Google for "Thmoas Lopatic" (the guy behind FullyLicensed and think again. He knows way too much about Linux, FreeBSD, Firewalls and Cryptography to be a Borg.
I was just thinking that one authorization code would work for all VMWare Virtual machines, but that isn't necessarily the case. I don't know anything about VMWare's code internals but something are likely to be different:
- Volume serial number (based on creation date)
- Processor serial number (if enabled, VMWare probably allows these instructions to run natively)
- Amount of RAM (possibly - but is not very unique)
The rest of the IDs should look the same because they are emulated hardware devices.
But, since this is 3 things, you couldn't necessarily use someone else's code (unless you run the cracked copy).
-- Virtual Windows Project
If there is a rat in this, one way it could work would be for the software to phone home to Redmond and let them know who is running the program.
All in all, I would only run this on a machine that was not able to get to the internet, and after running and verfiying, delete and reinstall a fresh copy of my OS before putting that machine back on the net.
KSK@xpdec-exe.zip KSK@xpdec-src.zip KSK@fully-liscensed-wpa.txt KSK@wpa-eng.txt
Consider us poor blokes who are responsible for recovering dozens of WinXP servers on leased hardware for business continuity excercises--or for real disasters. Those DR test hours cost thousands of $ each, and I anticipate spending several of them on the phone begging for product activation keys. Has MSFT thought of that legitimate consumer need?
Look at this example of all the hardware they're keeping track of...
dw | |
offset | value | derived from
H1 0 | 0x1C5 | '1234-ABCD'
H1 10 | 0x0A5 | '00C0DF089E44'
H1 20 | 0x37 | 'SCSICDROMPLEXTOR_CD-ROM_PX-32TS__1.01'
H1 27 | 0x15 | 'PCIVEN_102BDEV_0519SUBSYS_00000000REV_01'
H2 0 | 0x1 | (unused, always 0x1)
H2 3 | 0x00 | (CPU serial number not present)
H2 9 | 0x37 | 'SCSIDISKIBM_____DCAS-34330______S65A'
H2 16 | 0x0C | 'PCIVEN_9004&DEV_7178SUBSYS_00000000REV_03'
H2 21 | 0x1 | 'PCIVEN_8086&DEV_7111SUBSYS_00000000REV_01'
H2 25 | 0x1 | 'GenuineIntel Family 6 Model 3'
H2 28 | 0x3 | (system has 128 MB of RAM)
H2 31 | 0x0 | (system is not dockable)
I wonder how often you will have to re-authenticate your license?
And I wonder if they can track stolen systems? I know they only know a hash-type value of your system's components, it's still a "fingerprint". If a subpoena of this information could find a stolen system, that would be an interesting "anonymity test".
I have yet to see anyone citing or discussing this tidbit at the end....
/. crowd...
Looking at the technical details of WPA, we do not think that it is as
problematic as many people have expected. We think so, because WPA is
tolerant with respect to hardware modifications. In addition, it is
likely that more than one hardware component map to a certain value
for a given bit-field. From the above real-world example we know that
the PX-32TS maps to the value 0x37 = 55. But there are probably many
other CD-ROM drives that map to the same value. Hence, it is
impossible to tell from the bit-field value whether it is a PX-32TS
that we are using or one of the other drives that map to the same
value.
In contrast to many critics of Windows Product Activation, we think
that WPA does not prevent typical hardware modifications and,
moreover, respects the user's right to privacy.
No need to wonder why such published opinions are ignored by the
Personally I don't think so. Yeah it'll be a pain for those of us who upgrade regularly, but that's the minor part. The real killer's the fact that you have to reactivate every time you reinstall the OS. Think about it. How often is the "solution" to a Windows problem "Reboot, and if that doesn't solve it get your Windows CD and reinstall."? Joe Sixpack's not gonna like it when he's gotta go through the activation every time something goes sour on that shiny new system he paid good money for dammit.
> When is a computer no longer the same computer, after swapping out parts?
FYI, philosophers have been asking essentially the same question for at least 25 centuries. The original version that we have runs something like "How many planks can you change out on Jason's ship Argos before it isn't the Argos any more?"
--
Sheesh, evil *and* a jerk. -- Jade
When is a computer no longer the same computer, after swapping out parts?
Apparently Microsoft has defined a 'new computer' as three new components. For most of the general public, this is probably the case: think about it, most of the computing populace probably doesn't even know how to open their cases, let alone change out harddisks, memory, etc. However, for the rest of us, this could be an issue. I have a computer that, ever since I set it up about 6 months ago, I have changed out every component except the hard drive. And that hard drive (a puny 1 gb) will be replaced shortly... yet I still think of it as the same computer I originally put together.
Is Microsoft's definition of a 'new computer' sufficient? Will 'power users' who change components often get hassled by Microsoft? I hope not.
Personally, I hope to never have to deal with Microsoft products again :)
-Karl /dos]# file msdos.sys
--------------
[root@kgutwin
[root@kgutwin
msdos.sys: fsav (linux) virus (17518-87)
I've been running the same 600MHz Athlon for about a year and a half, and, really can't see the benefit of running a 1.5 GHz processor given the cost. With 2 13GBytes IBM 7200 RPM drives (primary for Slack/secondary for 2k Pro), it shouldn't run out of space in the foreseeable future. Memory's really cheap right now so sticking 256MBytes of RAM in the machine should be sufficient.
Can't see moving to WinXP, though, since I'm not sure if it will work as seemlessly in the VMWare virtual machine as 2K. I might have to turn off setiathome, and, I definitely can't afford that.
vanboers@sedona:~$ uptime
9:17pm up 25 days, 4:20, 2 users, load average: 1.04, 1.14, 1.18
Whoops! I forgot that we were talking about XP as the primary workstation. Well, if it stays up for any useful amount of time, perhaps even power users (whatever that means) won't have to phone home too often.
Linux rocks!!! www.dedserius.com
www.dedserius.com
VB != VisualBasic
Weh have alreddy mooved to ze mine-schafts. Vat are yoo doing stiel above graund? Ze Microsoft Doomsday deevice wil aktivahte any moment!
- Also Sprach Doktor Merkwurdigliebe
I don't know about the online activation (haven't run a sniffer on it, yet), but I tried the telephone activation today, and there was no personal information exchanged. I called the toll-free number, waited on hold for about 10 minutes (and we're still in the beta stage--just wait until this thing hits mainstream), then finally talked to a patronizing tech support drone. He asked me for the product activation key, a numeric string that makes MS CD keys look sane--32 digits, IIRC. He then read back a 36-digit numeric string to be entered in the activation window. That was it--no e-mail address, no name, phone number/address, etc. I suppose it could have been a hash code containing my name, but that's all it could have contained, as I had not entered any other information to that point. Probably just a hardware ID.
Incidentally, I recommend everybody register every copy of Windows by phone. First of all, you know what you're telling them, at least directly, but more importantly, it costs them more money. Think about it: ten minutes on hold on a toll-free line (their expense), five minutes of techie-time. Even at a modest $10/hr for the techie, that's almost a dollar spent on him, plus the phone charge. Now, imagine ten million copies of Windows being registered by phone. The infrastructure cost alone would be enormous--you know they haven't planned for that many people to call. Just one more example of my favorite form of vengeance: use their own weapons against them.
"Make it ten--I am only a poor corrupt official."
--Captain Louis Renault (Claude Rains), Casablanca
If these guys are for real how come I am unable to find them on google or the search engines. I would think people with such brain would post a message from time to time in the news groups but guess what? Nothing.... You can search on almost any internet user and at least get one or two hits but noting on these guys... I strongly suspect foul play is in the air.... Registrant: Fully Licensed 805 25th Ave. Vero Beach, Florida 32960 US Domain Name: fullylicensed.com Administrative Contact: Jacobsen, Keith keith@absolutenet.com 805 25th Ave. Vero Beach, Florida 32960 US 561-778-0017 Technical Contact: Domain, Jump hostmaster@jumpdomain.com 4041 SW 10th Street Suite 212 Topeka, KS 66604 US 650 618 1462 Billing Contact: Jacobsen, Robert keith@absolutenet.com 805 25th Ave. Vero Beach, Florida 32960 US 561-778-0017 Record last updated on 25-May-2001. Record expires on 30-Jan-2002. Record Created on 30-Jan-2001. Domain servers in listed order: NS.JUMPSERVER.NET 128.241.199.8 NS2.JUMPSERVER.NET 128.241.199.9
Got Code?
Bit 31 of H2 specifies, whether the bit-fields represent a notebook computer that supports a docking station. If docking is possible, the activation mechanism will be more tolerant with respect to future hardware modifications.
It has been reported that Microsoft officials took a recent poll of Supreme Court justices, and found that 3 out of 4 justices owned notebooks, and that these court members either already owned or was interested in owning a docking station.
Religion is the opium of the people. Evolution is the opium of scientists.
And if you believe that I have some Nazi memerobelia to sell you on eBay.
It was France, not the US, which stopped memorabilia on eBay. Not being former fascist supporters, the US would have no problem with such 'freedom of expression.'
Mr. B.
I have a laptop - I switch between ether card and wavelan card all the time (home and work) - I can see if I were using windows I'd be calling MS twice a day .....
This may very well be legal in Germany. The world is bigger than America!
Slashdot 's editors are dickheads