Slashdot Mirror
Windows 8 Tells Microsoft About Everything You Install
musicon writes "According to Nadim Kobeissi, Windows 8 is configured by default (using a new featured called Windows SmartScreen) to immediately tell Microsoft about every app you download and install. This is a very serious privacy problem, specifically because Microsoft is the central point of authority and data collection/retention here and therefore becomes vulnerable to being served judicial subpoenas or National Security Letters intended to monitor targeted users. This situation is exacerbated when Windows 8 is deployed in countries experiencing political turmoil or repressive political situations."
While SmartScreen is enabled by default, it's possible for users to turn it off. Also, it's worth noting that Microsoft is hardly alone in this regard, given the rise of app stores over the past several year. (Not that it exculpates this behavior.)
At the rate Microsoft is going, they might as well add a "Windows 8 opt-out feature."
I like your vision of a privacy-invasion free world.
Don't want to be videotaped? Don't go outside.
Don't want to be wiretapped? Don't use a phone.
Don't want medical records in the wild? Don't go to a doctor.
Visionary indeed.
No you won't. Quit trolling for +5.
Look, I'm just a regular user, albeit more technically capable than the vast majority, but not a developer, sys admin, etc., and it's starting to look more and more like it's time to consider making the move to Linux.
This private company invasiveness seems to be growing in parallel with government invasiveness, and I'm not happy about either, but at least I can choose one, for now.
If you are going to blame Microsoft for what third party software does on your computer, then you can't also blame them when they start to track and address such problems. With things like EAs Origin, Steam, etc, what you do on your computer is no longer just your business. At least Microsoft lets you turn it off.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
It seems from the MSDN link this can be avoided by simply not using Internet Explorer, as if you needed another reason not to
Dear Microsoft, don't try to be apple, we already have apple and you'd just be playing catch up and alienating your current customer base to try and get a customer base that already despises you more than your current one.
... to build an app that fakes the install of programs? In other words, overwhelm MS with hundreds of false install notices to them. As certain programs become 'of interest' to certain parties, we add that program to the list. Eventually, the information would become useless and would be abandoned.
Or am I missing something?
Also, it's worth noting that Microsoft is hardly alone in this regard, given the rise of app stores over the past several year. (Not that it exculpates this behavior.)
Can't compare this. If I download something from the Play Store, I know Google knows I install that app. After all I have to log in using my Google account, and use their app to download from their store. Afaik they do not know what I install from third-party sources, like alternative app stores. Nor do they have any right knowing that.
Apparently MS monitors what you install from third-party sources. Without telling you, and without asking explicit permission. That's simply evil. They have no business knowing what I install from third-party sources. The fact that this data is stored in some foreign country (the US is a foreign country to me, and some 95% of the world's overall population) with notoriously poor privacy protection only helps making it a lot worse.
Also, it's worth noting that Microsoft is hardly alone in this regard, given the rise of app stores over the past several year.
Come on. This is just excuse-making - sure in any given app store the store owner knows what you downloaded - by definition they had to for you to download it!
But here aren't we talking about a more general notion that ANY application installed from anywhere is known by Microsoft? When you use the Amazon app store on Android, does Google know what you have? When I use Cydia on a iPhone, Apple doesn't know what applications I install from there... on the Mac I can use the app store but if I get applications from elsewhere Apple doesn't know about those either.
Just because App Stores exist does not give Microsoft the right to track every app installed.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
What's wrong with sticking with Windows 7 for now?
It's not like Windows 7 is automatically obsolete as soon as 8 hits the market.
App stores will know everything you download from them for the same reason any other retailer would, you bought it there so there is a transaction record. This is tracking and sending to Microsoft information about EVERY application you download outside of their eventual marketplace. Apple doesn't know that I downloaded Handbreak from their site but with this Microsoft would, or to put it in a way that could cause an issue, Apple doesn't know that I downloaded LOIC, but Microsoft would. That is why it becomes an issue over and above something like the Mac App Store.
"I use a Mac because I'm just better than you are."
"While SmartScreen is enabled by default, it's possible for users to turn it off."
And this is what's wrong with this setup. Debian has popcon, which is a survey of what you use and how often you use it, and you can participate by having a cronjob send off the file.
http://popcon.debian.org/README
But it's not a privacy concern because it's opt-in.
If this equivalent of popcon on 8 was opt-in, this thread wouldn't be here.
--
BMO
There's no indication that Microsoft themselves keeps track of which individuals downloaded/installed which programs.
The issue this article seems to propose is that somebody could sniff the network traffic between yourself and Microsoft to grab the SmartScreen data and see what you'd installed when Windows contacts MS to see if the file is marked as safe/unsafe/unknown.
If they're in a position to do that, wouldn't they theoretically be in a position to have potentially snooped on the download of the software which is triggering the SmartScreen traffic? (Depending of course, on where in the network their sniffer is at.)
The only valid complaint seems to be that Microsoft is using a known-insecure version of SSL for the website all this data is sent to. If they fix that, I'm not sure what reasonable issue would be there.
I would argue that for the average user, SmartScreen is a useful feature and having it turned on by default (assuming MS is tracking individual user downloads of software for some nefarious purpose) is a good thing.
While I am a linux user already, a friend of mine recently said something along these lines. He then qualified it with something like:
"But then, linux probably won't have AAA games until windows 9. Now it seems to me that every other version of windows sucks (2K/XP, Vista/7), and the version after it is just fine. So I'll probably continue using windows if 9 doesn't suck. At least, until windows 10, which will suck. I'll probably switch then."
Any sufficiently advanced incompetence is indistinguishable from malice.
Did you check if it doesn't run with wine? You'd be surprised how much it has improved recently.
You know, I've been resisting Linux all these years, but with the current direction of Windows development and greater Linux game support (Steam, etc.) I may make the switch yet...
You sound like me about 5 years ago, when Vista was supposed to be Microsoft's hot new OS. I figured the way that was going, I might as well go Linux now and get over the hassle of switching. Long story short I spent 3.5 years on Linux as my primary desktop before I gave up the fight and switched to Win7. If you want to try Linux go right ahead, but if you're just think Win8 is a dead end I suggest just buckling down with Win7 and see if Microsoft comes to their senses. There's plenty time and being 64 bit I think it's even more of a stayer than XP, that and SSD support were really the only two "must have" features of Win7 for me. I expect the coming decade to have even less such "must have" features.
Live today, because you never know what tomorrow brings
Right, use Chrome as the example of a privacy-conscious application... it's not like it sends not only every URL you type in the location bar, or knows and pre-fetches every possible combination of the URL while you're typing it, or anything. It doesn't take URL's you're typing and try to suggest search results for those words either, no sir! And it definitely, definitely doesn't let Google store and analyze all of that information against your account, should you happen to be logged in to Gmail or anything.
Bow before me, for I am root.
Um, check the date on that blog post. March 22nd, 2011.
This was a feature added, by default, to Internet Explorer 9.0. It is a part of the browser. If you are running Windows 7 and have updated to Internet Explorer 9.0 then it is already doing this. All Windows 8 does is have Internet Explorer 10 installed by default.
Olds for nerds?
Is Windows 7 really that bad? I spent about 10 minutes customizing it and find it to be a much better experience than XP. The only thing that chews my balls is the lack of an included utility to password-protect .zip files, but aside from that, I can't think of anything I really dislike about it.
I used to be a die hard Mac guy until the early 2000s when I realized none of the games I wanted to play were available for Mac. So I switched to XP and never looked back. Now I am on Windows 7 and it works for me, but like many 8 scares the hell out of me. I want my task bar, I don't want a tablet GUI, and now this. Will I switch to Linux in the immediate future? Nope. But I won't be "upgrading" to 8. And if MS doesn't see the light and fix it before 7 is no longer supported, then I'll certainly look to Linux. Prior to Windows 8 I would never have considered that. I could probably be forced to get used to the GUI, but privacy issues are a big deal to me.
How do you people thing virus scanners work?
Erm, by checking against a local signature database of known viruses or running local heuristic checks?
Bow before me, for I am root.
Ethically it is hard to support any company which obviously has zero respect for user/consumer rights.
The "Windows SmartScreen" referenced in TFA is nothing of the sort.
/. editors to generate traffic to their blog.
This is an IE9 feature, which would not be a huge surprise to find is still there in IE10. TFS links to an 18-month-old article talking about it in IE9. Not Windows 8. There is nothing to back up the wording used in TFS or TFA. It's a good feature I have enabled on my parent's machines for their protection, as it's one more layer against malware downloads.
The ONLY things this feature touches is executables which are downloaded from the Internet using IE. Install from a DVD? Download using Chrome/Firefox? USB drive? Copied from another disk? Compiled yourself? None of those things gets "sent to Microsoft".
Just someone (successfully) using a combination of inflammatory wording and gullible/lazy
Where do we find companies that have respect for user/consumer rights, because I would be happy to use their products and services.
Just a dude. Stuck in IT.
Isn't that equivalent to the answer of 'If you don't want Windows SmartScreen to tell Microsoft about your installed apps, go into Privacy and turn it off.'?
It would seem to me that the point the parent was making is that Chrome's data reporting habits and this new one in Windows 8 are effectively the same. Both are enabled by default, and both report data back to their 'owners'. That both have an 'opt out' to turn them off really doesn't differentiate or describe either one as awesome with regards to privacy.
I hope you realize Windows 8 has a the taskbar that behaves just like Windows 7. I am running W8 RTM and it haven't missed 7 one bit. I actually using 8 a bit more.
The major difference it the "start screen" takes up the whole screen instead of 1/8 of the screen. You can still hit start and then start typing, etc... And you can use Tablet apps on your desktop if you like them. Some of the apps from the App Store are games, etc... SoulCraft actually lets you use the 360 gamepad, etc...
Watch: http://www.youtube.com/watch?v=t4ooYKE4F-c&feature=player_embedded