EPIC Urges State AGs to Pursue Microsoft Passport

An anonymous submitter sent: "The Electronic Privacy Information Center has sent a letter to all state attorneys general urging them to pursue Microsoft Passport under state consumer protection laws."

Comments

Holy cow

[AT Tappman]

The letter says that Microsoft has 200 million passport registrations already. That must mean 200 million Hotmail accounts, or something like that, and of those I'm willing to bet that a good number of them are unused or were used once to gain access to something else. Like MSN Messenger, which requires you to sign up for a Hotmail account.

Hopefully most of those accounts aren't tied to active users, because of this. But if they do really already have 200 million users, all of whom are active, then that really is scary. That's around 3% of the world's population. (If I knew what percentage of the world's population used computers on the internet regularly, this would be more meaningful, but I'll take a guess and say 33%. Then 10% of users online would have active Passport accounts!)

Re:Holy cow

[guttentag]

The Washington Post ran an article about two years ago on a study of internet usage in major metropolitan areas in the U.S. It claimed that the Washington, DC area was the most "wired" region in the country, with about 50% of adults having some access to the Internet.

IIRC, the expected techie cities followed, but the percentages quickly dropped below 30%. Outside those areas, the percentage of adults who have internet access was much lower than that.

In industrialized nations with relatively strong economies, the average internet access rate is probably below 20%. China and India each have populations around 1 billion, but what miniscule fraction of a percentage of their citizens have internet access. Most of the world's population doesn't even have electricity.

I think the percentage of people who (1) have electricity, (2) can afford a computer, (3) have the training to use a computer, (4) and have access to the Internet is probably less than 5%. In fact, I suspect it's closer to 1%.

Still, I think Microsoft's 200 million figure is exaggerated... the result of convenient accounting. Personally, I have at least a dozen Passport accounts that MS automatically gave me when I signed up for Hotmail accounts I only used once. I have never given MS my credit card number or even my real zip code, and I never will, yet I am over a dozen Passport users. Heck, my imaginary dog has two Hotmail accounts (he complained that the first one was full of spam, so I signed him up for a second account).

Aside from users like me (and my imaginary dog), I had a friend who wrote a commercial script to log into Hotmail. To test it, he wrote another script that created thousands of Hotmail (and Passport) accounts. He did the same thing with Yahoo, and apparently this phenomenon is common enough that Yahoo now requires new users to use "Word Verification" to "prevent automated registrations."

Similarity

[mirko]

In addition to the unwarranted collection of consumer data, Microsoft offers no method to delete a Passport registration. Microsoft claims
that Passport gives users control of their personal information. However, the most basic aspect of control--the right to take back one's
personal information--is not accommodated by the Passport system.

Note that one can't delete his Slashdot account either. which could actually be the source of some trouble as if he suddenly changes his mind about whichever opinion or way to express it he has, there'd be a way to track his former behaviour if the account he opened was named like him and we know for sure how much we change over the time (maybe from the pro-patent to anti-patent or from the extremist to the moderate).

Though I dislike to add such disclaimer in my Slashdot post, I'd like to point out that I don't want this comment to be considered as a troll neither it is off-topic.

This is just a way to point out that we should ensure that noone may reproach us with the sam ethings that are being reproached to Microsoft or whoever else.

Back to the article, now: what sort of effect does such a letter have?

Passport Roach Motel

[Alderete]

I once signed up for a Passport account, because Microsoft was giving me 20% off the price of a TiVo (or any electronics item at 800.com) if I paid for it with Passport (then called something else).

Now I'd like to get out of the system, because I don't trust it to be secure, but because I've forgotten my password, I can't.

Go to the Passport site (http://www.passport.com) and look; there's no FAQ or other document that tells you how to cancel your account. Nor is there any e-mail address of anyone who might be able to help you do it manually.

So, when you hear Passport adoption statistics, subtract at least one. I've never used my Passport a second time, but can't get rid of it, after trying for weeks.

Re:Passport Roach Motel

[toriver]

Now I'd like to get out of the system, because I don't trust it to be secure, but because I've forgotten my password, I can't.

Sure, just wait for a quantum event, like this one (from their agreement):

"Microsoft reserves the right, in its sole discretion, to terminate your access to the Passport Services or any portion thereof at any time, without notice."

But you're correct that the agreement doesn't open for you, the consumer, to end the contract. Surely that must be against some contract law somewhere?

Future tense

[_ganja_]

To me, you average geek, most of the letter refers to what Microsoft could possibly do in the future. I could possibly go out and rob a bank in the next week but does this mean the police should arrest me? Actually, isn't that what the homeland (fatherland) security acts is all about, I digress.

I'm on EPIC's side and I agree with most of the point of the *potential* problems with Passport but if M$ haven't done anything wrong yet ot EPIC offers no proof except the potential for harm then this isn't going to get much notice.

Kids Passport? *shiver*.

Re:Customer's Information

[at_18]

Yes several countries in Europe have this already. The problem is, if you don't check that box you ain't gonna get the service. So this remedy is not a right to privacy, but a right to inform you you don't have it.

Well, this is not correct. In at least one country (Italy), the law acts in a way that you have TWO separate agreements: one for the service, and one for spreading out your personal data. Both have the "no" option checked by default.

You have to check on the first "yes" to have the service activated, and nothing else. Checking the second "yes" will grant permission to the service provider to use your data for ads, statistics etc. Using your data without this specific agreement can cause big penalties for the companies.

Everything is explained on every form, and it's so common that everyone knows that they must check only the first answer.

remember: When giving private info

[bluGill]

You are born in 1998, your zip code is 82312, your gender is none of their buisness (and if they instist use a coin to decide). Nor is your race, religion, or the type of car you drive their buisness.

Reasons for the above: In the US only minors have privacy protection, so by putting down a birthdate of 1998 you are under those laws as far as they know. Your physical address is none of their buisness, unless you are buying something from them. (and so far I've never had a problem with the venders who I buy from though there are bad apples out there). Your gender, race, religion, etc is none of their buiseness, on the net nobody knows you are a dog! Refuse to answer, or anser randomly. Randomly means sometimes you give the right answer, because if you always gave the wrong answer that in itself would be a clue.

Remember invalid data that they have is less valiuable then not having data at all in many cases.

Re:Customer's Information

[reemul]

What I'd like is some 'Personal Privacy License' to be drawn up. It would lay out in extremely explicit and legally binding terms the permitted usages of a given person's data. When I go to a website using the license, it is formally acknowledged that I'm not *giving* the site my data, I am instead *licensing* them to use my data under strict limits which may not be changed without my formal permission in advance. It would say so right on the page where I fill in the blanks. My data remains mine, forever.

If a site that got my data under the license gives it out to someone else, it isn't a regrettable incident that might possibly get a brief mention on Wired or C:net, it's a legally actionable event under the same draconian IP laws that all those media companies have spent millions of dollars lobbying for. Selling a database won't just get you a bunch of angry emails from /. regulars, it would be the basis for a class action with thousands of easily identified persons in the class. (Just look them up from the database.) And as a capper, if your data was ever sold, you could use that fact as the basis for discovery motions to every other bastard in the personal data trade, demanding to know exactly who gave them their data and under what circumstances, to make sure none of them had any of the *tainted* data. Think the EFF and the ACLU would be willing to help out? Yeah, me too.

Oh, and for the folks that would want to stick a "Gnu" in the name of the license - sorry. The whole point is that my data remains proprietary, with myself as the owner. Not all data wants to be free, my personal info likes its dark little box just fine, thank you.

-reemul