Slashdot Mirror
Microsoft Sued Over WGA
Hope Thelps writes "The Seattle PI is reporting on a lawsuit being brought against Microsoft in response to their WGA spyware. Groklaw is also covering the story. Although there are a lot of similarities to Sony's rootkit, the actual harm done is less concrete. It'll be interesting to see how this turns out."
A Microsoft spokesman, Jim Desler, agreed with the allegations. "Spyware is deceptive software that is installed on a user's computer without the user's consent and has some malicious purpose," Desler said.
Well, actually he claims to have disputed the allegations, but then he said what's quoted above, and finally (to the press corp's horror and astonishment), proceeded to shove his entire foot, ankle, and leg (up to his knee), firmly down his own throat.
Let's break this down:
[x] Deceptive software...check!
[x] Installed without user's consent...check! (Well, basically with as much consent as any other spyware package, so I think there's a good case to be made for this point.)
[x] Malicious purpose...check! It beams data back to the mothership every day and can be used to remotely break the computer. I think that qualifies as "malicious."
So apparently by Microsoft's own admission, WGA is spyware.
I'd personally argue for a more expansive definition of spyware (or malware, or scumware, etc...), but even given the relatively constrained definition proposed by Microsoft itself, WGA seems to qualify.
I'm sure that I'm not the only one who hates all of the BS you get when you buy a new laptop/desktop. First thing I've always done with my Dell laptops/desktops is format, reinstall xp + linux. However, I got frustrated with the activation when I didn't always internet or the activation insisted i make a 30 minute call to MSFT to get a rediculously long key. Long story short, I used the ever-so-famous corporate copy + key (generated with keygen) even though I have XP Pro COAs on the systems. Now, a few years down the road WGA is going to force me to reinstall--now that I have many important business apps installed. How many others are in the situation of "invalid keys" with legit COA licenses?
As covered in a blog posting by Ed Bott, the KB article Microsoft gave is a rush job and will confuse non-techies that may attempt it. He provides corrections but Microsoft is (at best) silly to have not had a third party verify the instructions.
Also realize that contrary to the warning in the Microsoft KB article, if you choose not to install the WGA notifications "update" or remove it, Microsoft Update will force you to run another WGA test before granting you access to their Windows Update website. They won't even allow access to critical updates through the web interface in my testing with the web-based (ActiveX?) test. From what I understand, the access to the promised critical updates are only provided with their built-in update provider which has been responsible for all the WGA notification auto-installs. In other words, you can't win either way.
As it stands, I've disable auto updates from System Properties->Updates and disabled the "security center" service from Control Panel->Admin Tasks->Services so it doesn't bother me about disabled auto-updates anymore. I have multiple Dell machines with OEM installations of Windows XP so I'm not concerned about failing WGA but I am concerned about all the reported crashes involving WGA across forums and blog around the internet and the private information sent to Microsoft.
Playing support-geek for family and friends only gets tougher with this stupid anti-piracy program. I'm disabling auto-updates and security center on every system while deleting WGA. Instead, once a month I ask my friends and family to run AutoPatcher on their systems for all critical and optional updates. I've told them that they may not be able to use WGA protected software such as Windows Defender, IE7 Beta, or WMP11 and any other Microsoft download. All of them don't care for that stuff as they have better freeware or open-source alternatives. So far so good.
Before anyone chimes in and says that people should switch to Linux, I'd say I agree in theory but not in reality. Educational software, scanner and digital camera software utilities, unique features presented in official IM clients such as VoIP and picture sharing, many Photoshop features, easy movie editors a la Roxio and Premiere, and desktop publishing software (i.e. Pagemaker) are not available for Linux nor do these people care to learn anything new after years of experience in many cases. For now there are workarounds and people will use them. If Microsoft implements a kill switch and starts nuking WGA-less but legal installations then many of these people will probably trash their computers and buy Apple before going to Linux.
Lastly, this doesn't hurt pirates one bit. Within hours the latest WGA crack is available and it works or people just disable auto-updates and go towards AutoPatcher. For protected apps, cracked copies are available. So who loses? The general public who follows all the rules. I'm glad someone filed the lawsuit and I hope people will sign up as parties when the chance is given.
This is typical. They implemented this a year and a half ago.
Microsoft feels that there is a significant problem with OEM licenses being stolen, via methods such as copying down a code at a store, library, school, or other public location. Since most OEM Windows XP licenses are pre-activated by the system builder, they see that there is rarely a need for the key to be activated with non-manufacturer specific install media. (Generic OEM licenses, that is, OEM licenses not custom made for a specific manufacturer are activatable at least once, as some of these are sold in retail channels.) Furthermore, they probably figure that in the event of a crash, most users opt to use recovery CDs instead of reinstalling the operating system directly.
The only reason Microsoft made you call them is because you did not use the Fujitsu CD. From MS's point of view, there are very few cases where a typical user would need to use a generic OEM media to install Windows (because of the recovery disks and/or partitions that come with most systems).
They probably would not be doing this if they did not view it as successful in deterring piracy. If the number of precieved foiled piracy attempts exceeds the number of calls for OEM serials that they allow to activate, then the program to them will be successful and will continue.
After all, if people weren't actually copying down CD keys from the sides of computers, this wouldn't have happened.
True story:
I sometimes use my university's wireless network (whenever I bring my laptop). Since the university's IT lab has no way of knowing who is using what laptop[1], they redirect all initial traffic to a portal where you must log in (using the username + password you use on all other university computer systems). Point being, you get a network connection, but must log in to actually get where you want.
Since I installed WGA[2] (at the point I was rather indifferent to it), every time I use the university's network I get 50 entries in the Application Log (error source: crypt32; description: "Failed auto update retrieval of third-party root list sequence number from: with error: [timeout/server cannot perform operation/error code]"). This happens before I have a chance to log in on the university network, which of course means that my laptop can't yet access said site. More annoying, though, is that svchost -k netsvcs starts eating memory like crazy; peaking at over 90 MBs and then falling down to 70-80 (used to stay at 20-30). This only happens when I use the laptop at the university; at home (where obviously no login is required) the process stays at 20-30 MB.
I personally think that some "advantage" component that, when unable to access some site, causes a process to eat up 3-4 times the memory it usually does, taking up an extra 10% of the computer's physical memory in the process, is rather a DISADVANTAGE. I don't know how much memory spyware typically consumes, so I can't reflect on the comparison between WGA and spyware. 50 MB seems a rather hefty price for failing to communicate with some server, though.
Maybe they should rename it WGD?
[1] I guess a) setting up individual users' connections, including keys, is too much work, b1) collecting MAC addresses is too much work, b2) Joe Average won't be able to figure out his computer's wireless' MAC anyway, and c) there are potential security leaks if wireless cards, or laptops, are stolen/sold to non-university users (both a and b1).
[2] Troubles started at that point. Could be something else, I SUPPOSE, but I think it is unlikely.