Slashdot Mirror
Windows 8 Tells Microsoft About Everything You Install
musicon writes "According to Nadim Kobeissi, Windows 8 is configured by default (using a new featured called Windows SmartScreen) to immediately tell Microsoft about every app you download and install. This is a very serious privacy problem, specifically because Microsoft is the central point of authority and data collection/retention here and therefore becomes vulnerable to being served judicial subpoenas or National Security Letters intended to monitor targeted users. This situation is exacerbated when Windows 8 is deployed in countries experiencing political turmoil or repressive political situations."
While SmartScreen is enabled by default, it's possible for users to turn it off. Also, it's worth noting that Microsoft is hardly alone in this regard, given the rise of app stores over the past several year. (Not that it exculpates this behavior.)
At the rate Microsoft is going, they might as well add a "Windows 8 opt-out feature."
I like your vision of a privacy-invasion free world.
Don't want to be videotaped? Don't go outside.
Don't want to be wiretapped? Don't use a phone.
Don't want medical records in the wild? Don't go to a doctor.
Visionary indeed.
No you won't. Quit trolling for +5.
Look, I'm just a regular user, albeit more technically capable than the vast majority, but not a developer, sys admin, etc., and it's starting to look more and more like it's time to consider making the move to Linux.
This private company invasiveness seems to be growing in parallel with government invasiveness, and I'm not happy about either, but at least I can choose one, for now.
If you are going to blame Microsoft for what third party software does on your computer, then you can't also blame them when they start to track and address such problems. With things like EAs Origin, Steam, etc, what you do on your computer is no longer just your business. At least Microsoft lets you turn it off.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
... to build an app that fakes the install of programs? In other words, overwhelm MS with hundreds of false install notices to them. As certain programs become 'of interest' to certain parties, we add that program to the list. Eventually, the information would become useless and would be abandoned.
Or am I missing something?
Also, it's worth noting that Microsoft is hardly alone in this regard, given the rise of app stores over the past several year. (Not that it exculpates this behavior.)
Can't compare this. If I download something from the Play Store, I know Google knows I install that app. After all I have to log in using my Google account, and use their app to download from their store. Afaik they do not know what I install from third-party sources, like alternative app stores. Nor do they have any right knowing that.
Apparently MS monitors what you install from third-party sources. Without telling you, and without asking explicit permission. That's simply evil. They have no business knowing what I install from third-party sources. The fact that this data is stored in some foreign country (the US is a foreign country to me, and some 95% of the world's overall population) with notoriously poor privacy protection only helps making it a lot worse.
Also, it's worth noting that Microsoft is hardly alone in this regard, given the rise of app stores over the past several year.
Come on. This is just excuse-making - sure in any given app store the store owner knows what you downloaded - by definition they had to for you to download it!
But here aren't we talking about a more general notion that ANY application installed from anywhere is known by Microsoft? When you use the Amazon app store on Android, does Google know what you have? When I use Cydia on a iPhone, Apple doesn't know what applications I install from there... on the Mac I can use the app store but if I get applications from elsewhere Apple doesn't know about those either.
Just because App Stores exist does not give Microsoft the right to track every app installed.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
What's wrong with sticking with Windows 7 for now?
It's not like Windows 7 is automatically obsolete as soon as 8 hits the market.
App stores will know everything you download from them for the same reason any other retailer would, you bought it there so there is a transaction record. This is tracking and sending to Microsoft information about EVERY application you download outside of their eventual marketplace. Apple doesn't know that I downloaded Handbreak from their site but with this Microsoft would, or to put it in a way that could cause an issue, Apple doesn't know that I downloaded LOIC, but Microsoft would. That is why it becomes an issue over and above something like the Mac App Store.
"I use a Mac because I'm just better than you are."
There's no indication that Microsoft themselves keeps track of which individuals downloaded/installed which programs.
The issue this article seems to propose is that somebody could sniff the network traffic between yourself and Microsoft to grab the SmartScreen data and see what you'd installed when Windows contacts MS to see if the file is marked as safe/unsafe/unknown.
If they're in a position to do that, wouldn't they theoretically be in a position to have potentially snooped on the download of the software which is triggering the SmartScreen traffic? (Depending of course, on where in the network their sniffer is at.)
The only valid complaint seems to be that Microsoft is using a known-insecure version of SSL for the website all this data is sent to. If they fix that, I'm not sure what reasonable issue would be there.
I would argue that for the average user, SmartScreen is a useful feature and having it turned on by default (assuming MS is tracking individual user downloads of software for some nefarious purpose) is a good thing.
Did you check if it doesn't run with wine? You'd be surprised how much it has improved recently.
You know, I've been resisting Linux all these years, but with the current direction of Windows development and greater Linux game support (Steam, etc.) I may make the switch yet...
You sound like me about 5 years ago, when Vista was supposed to be Microsoft's hot new OS. I figured the way that was going, I might as well go Linux now and get over the hassle of switching. Long story short I spent 3.5 years on Linux as my primary desktop before I gave up the fight and switched to Win7. If you want to try Linux go right ahead, but if you're just think Win8 is a dead end I suggest just buckling down with Win7 and see if Microsoft comes to their senses. There's plenty time and being 64 bit I think it's even more of a stayer than XP, that and SSD support were really the only two "must have" features of Win7 for me. I expect the coming decade to have even less such "must have" features.
Live today, because you never know what tomorrow brings
Right, use Chrome as the example of a privacy-conscious application... it's not like it sends not only every URL you type in the location bar, or knows and pre-fetches every possible combination of the URL while you're typing it, or anything. It doesn't take URL's you're typing and try to suggest search results for those words either, no sir! And it definitely, definitely doesn't let Google store and analyze all of that information against your account, should you happen to be logged in to Gmail or anything.
Bow before me, for I am root.
Um, check the date on that blog post. March 22nd, 2011.
This was a feature added, by default, to Internet Explorer 9.0. It is a part of the browser. If you are running Windows 7 and have updated to Internet Explorer 9.0 then it is already doing this. All Windows 8 does is have Internet Explorer 10 installed by default.
Olds for nerds?
Is Windows 7 really that bad? I spent about 10 minutes customizing it and find it to be a much better experience than XP. The only thing that chews my balls is the lack of an included utility to password-protect .zip files, but aside from that, I can't think of anything I really dislike about it.
How do you people thing virus scanners work?
Erm, by checking against a local signature database of known viruses or running local heuristic checks?
Bow before me, for I am root.
You mean don't try to be Apple badly. Even though Lion and Mountain Lion added iOS features, they didn't force iOS as the default UI onto their desktop/laptop OS users.
Well, there's spam egg sausage and spam, that's not got much spam in it.
Where do we find companies that have respect for user/consumer rights, because I would be happy to use their products and services.
Just a dude. Stuck in IT.
Isn't that equivalent to the answer of 'If you don't want Windows SmartScreen to tell Microsoft about your installed apps, go into Privacy and turn it off.'?
It would seem to me that the point the parent was making is that Chrome's data reporting habits and this new one in Windows 8 are effectively the same. Both are enabled by default, and both report data back to their 'owners'. That both have an 'opt out' to turn them off really doesn't differentiate or describe either one as awesome with regards to privacy.
No, it's that it's opt-out and they don't tell you what they're sending.
I take this back. I just checked the windows install process, and on the page where you choose "Use Express Settings" or "Customize" there are two options to "Learn more about express settings" and "Privacy Statement" where Microsoft details each feature, what data they collect, and how they use that data.
For Smartscreen the text reads:
What this feature does
Windows SmartScreen helps keep your PC safe by checking files and apps with Microsoft to help protect you from potentially unsafe files and apps. Windows will ask you what you want to do if the file or app is unknown or potentially unsafe before it's opened"
Information collected, processed, or transmitted
If you choose to use this feature, information about some of the apps you use and some of hte files you download from the Internet will be sent to Microsoft. This information may include a file name, file ID ("hash"), and digital certificate information along with standard PC information and the Windows SmartScreen filter version number. To help protect your privacy, the information sent to Microsoft is encrypted.
Windows SmartScreen randomly generates a number called a GUID that is sent to Microsoft with your SmartScreen usage data. The GUID lets us determine which data is sent from a particular PC over time. The GUID does not contain any personal information.
Use of Information
Microsoft uses the information described above to provide warnings to you about potentially unsafe files and apps. We also use the information to analyze performance of the feature to improve the quality of our products and services. We use the GUID to determine how widespread the feedback we receive is and how to prioritize it. For example, the GUID allows Microsoft to distinguish between one computer experiencing a problem one hundred times and one hundred customers experiencing the same problem once. Microsoft doesn't use the information to identify, contact, or target advertising to you.
Choice and control
If you choose express settings while setting up Windows, you can turn on Windows SmartScreen. If you choose to customize settings, you can control Windows SmartScreen by selecting Use Windows Smartscreen Filter to Check Files and Apps with Microsoft under Help protect your privacy and your PC. After setting up windows, you can change this setting in Action Center in the Control Panel.