Microsoft Denies Windows 8 App Spying Via SmartScreen

← Back to Stories (view on slashdot.org)

Microsoft Denies Windows 8 App Spying Via SmartScreen

Posted by timothy on Saturday August 25, 2012 @10:47AM from the wall-of-separation dept.

An anonymous reader writes "Microsoft has denied Windows 8 SmartScreen is spying after research by Nadim Kobeissi indicated otherwise." Whether it's "spying" or not, Microsoft is collecting certain information with SmartScreen — the key is what's done with it: The article quotes a Microsoft spokesperson: "We don’t use this data to identify, contact or target advertising to our users and we don’t share it with third parties."

44 of 198 comments (clear)

Min score:

Reason:

Sort:

Disable it! by zenlessyank · 2012-08-25 10:51 · Score: 5, Informative

There is a check box where you can disable this 'feature' before installation. Nothing to see here....
1. Re:Disable it! by menegator · 2012-08-25 10:53 · Score: 3, Informative
  
  There is a check box where you can disable this 'feature' before installation. Nothing to see here....
  Why is the parent moded -1?
2. Re:Disable it! by fnj · 2012-08-25 10:57 · Score: 2, Insightful
  
  Maybe because he completely misses the point.
3. Re:Disable it! by CrazyDuke · 2012-08-25 10:57 · Score: 5, Informative
  
  Look in his history: His Karma is negative. The comment hasn't even been modded.
  
  --
  Any sufficiently advanced influence is indistinguishable from control.
4. Re:Disable it! by Anonymous Coward · 2012-08-25 11:18 · Score: 4, Insightful
  
  There is a check box where you can disable this 'feature' before installation.
  Nothing to see here....
  Because at least 1% of Windows users are capable of installing the OS themselves.
5. Re:Disable it! by bloodhawk · 2012-08-25 11:30 · Score: 5, Informative
  
  FFS, where do these retards come from, read the damn article or better still read a non tin foil hat version from somewhere like Ars Technica. It is purely an anti malware prevention system that checks if the hash is a known malware when you go to install. There is a lot to hate windows 8 about, but this is actually one of the beneficial features that should help everyone, from the dumb users that install malware to the rest of us that get spammed by the botnets created by that malware.
6. Re:Disable it! by fustakrakich · 2012-08-25 11:45 · Score: 5, Funny
  
  The elevator has a "close door" button inside. Do you believe it actually functions?
  
  --
  “He’s not deformed, he’s just drunk!”
7. Re:Disable it! by king+neckbeard · 2012-08-25 11:55 · Score: 4, Insightful
  
  Most users do not install their own OS, and being on by default is problematic.
  
  --
  This is my signature. There are many like it, but this one is mine.
8. Re:Disable it! by Zero__Kelvin · 2012-08-25 12:00 · Score: 2
  
  Horrible point, since in many cases it does function.
  
  --
  Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
9. Re:Disable it! by ThatsMyNick · 2012-08-25 12:08 · Score: 2
  
  It does work in my workplace. I guess it depends on whether you trust your users to use the button properly. My workplace does, my apartment does not.
10. Re:Disable it! by Shining+Celebi · 2012-08-25 12:12 · Score: 5, Interesting
  
  Just read the Ars Technica article. The Slashdot headline is ridiculously slanted, as was the previous story.
  While I disagree with it in principle - I'd rather it be local, like how Firefox uses a local version of the bad-sites list, this is not in any way unusual or awful behavior, and it's mostly a good idea, and Microsoft has been completely open about how and why they're doing this and giving you an easy way to turn it off. It is not some privacy invading nightmare. Microsoft is not keeping track of what programs you download (unless, obviously, you get them through the Microsoft store.)
  Slashdot stories are becoming more and more ridiculous. The summaries are never even worth reading anymore.
11. Re:Disable it! by Missing.Matter · 2012-08-25 12:25 · Score: 4, Informative
  
  Not only do they allow you to turn it off during install, they provide a detailed explanation of what the feature does, what data they collect, how they use the data, and how you can turn the feature off during install and after install. This seems to be just about all the information a user needs to make an informed decision about whether or not to leave smart screen on. if the user opts not to read this information and clicks right through the express settings without caring about the consequences, perhaps that's exactly the kind of user this smart screen filter aims to protect; odds are they have the same lackadaisical attitude when install Ing random software from the internet. Its self selecting really.
  
  Here is a link to my comment from yesterday, which has the exact text relevant to smart screen you encounter on install: http://slashdot.org/comments.pl?sid=3070309&cid=41111521
12. Re:Disable it! by Shining+Celebi · 2012-08-25 12:29 · Score: 2
  
  Should Linux repositories, the Apple App Store, the Google Store, and the Microsoft store provide a similar warning, since they actually glean more information from what you download there?
  I mean, all Microsoft gets from this is a filename and a hash. Unless Microsoft has a hash of every program in existence, that doesn't do them much good for spying purposes. On the other hand, they know everything about the app you're downloading from their store.
13. Re:Disable it! by hairyfeet · 2012-08-25 12:34 · Score: 2
  
  And if you get it pre-installed there is a checkbox in Action center that kills it, which if you are so clueless that you can't even uncheck a checkbox in a GUI? Really having a hard time feeling sorry for you.
  Besides frankly the whole subject is moot anyway, you are talking about an OS that gets articles like Windows 8...yes its THAT bad and is the subject of parody before its even released so I kinda doubt its gonna be seeing much use on anything but tablets. Hell the only reason it'll be seeing ANY use on tablets is because it looks like Ballmer is gonna shit another MSFT billion down the toilet by selling their $500 iPad knockoff for $199 thus taking the Sony way to profitability.../snicker/.
  Look its simple folks, anything Apple does MSFT does badly or half assed or just plain wrong under Ballmer...who doesn't know this? I mean you should have gotten the memo when Ballmer was squirting his shit brown Zune all over the place trying to ape iPod. Win 8 is so obviously a "Please God buy our tablets!" move it ain't even funny anymore, so why even care? Anyone with half a brain cell functioning is gonna stay with Win 7 anyway or at least make sure they get a "Win 8" system that is just Win 7 with a DVD in the bottom of the box that'll never get used except as a coaster.
  
  --
  ACs don't waste your time replying, your posts are never seen by me.
14. Re:Disable it! by Missing.Matter · 2012-08-25 12:41 · Score: 3, Informative
  
  The check box appears on first account setup, so any use buying a new PC will see it too.
15. Re:Disable it! by hairyfeet · 2012-08-25 12:50 · Score: 3, Informative
  
  Because then the malware will simply target this just like they do other Windows components? The problem with doing it on the local machine is 1.-The malware guys will know exactly where it is, and 2.- The dancing bunnies problem where the malware writer tricks the user into bypassing the check by offering the right cookie, thus compromising the entire system and allowing the malware writer full control.
  By hosting it remotely you've just bypassed both problems as the servers running this at MSFT is gonna be better protected than grandma's Dell is, and there isn't any users to trick with dancing bunnies to bypass the system. I work on Windows PCs 6 days a week and I can tell you that frankly since Vista drivebys and buffer overflows have gone WAAAY down, now its nearly all social engineering like Security Tool, "free porn" codecs, or getting the user to run some "free" program and bypass the checks, why? Because like all criminals malware writers are lazy creatures and will take the path of least resistance and that is PEBKAC in most cases.
  
  --
  ACs don't waste your time replying, your posts are never seen by me.
16. Re:Disable it! by Shining+Celebi · 2012-08-25 12:51 · Score: 3, Informative
  
  Nope. I'd rather have a local database, even though I assume that's more difficult to keep up-to-date with what I imagine are rapidly changing blacklists. Firefox, for example does this.
  But this behavior is (unfortunately) pretty bog standard, and in the case of IE, it's nothing new, so it seems a little bizarre to get all outraged about it now when all Microsoft has added is a check on file download hashes.
17. Re:Disable it! by Ol+Olsoc · 2012-08-25 12:54 · Score: 3, Interesting
  
  The check box appears on first account setup, so any use buying a new PC will see it too.
  The choice should be Opt-in, rather than Opt-out. This is just like their old "everything is enabled" features. It's not hard to have a screen pop up asking you if you want this info reported to Microsoft. Then you say "Yes or no. Then if you are okay, click on that yes, if not, nothing happens.
  
  --
  The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
18. Re:Disable it! by Shining+Celebi · 2012-08-25 13:12 · Score: 2
  
  Microsoft doesn't "scan your computers for apps." They compare the filename and hash of executables downloaded with Internet Explorer with a known blacklist.
19. Re:Disable it! by Zero__Kelvin · 2012-08-25 13:19 · Score: 2
  
  You just don't want to get it. Installing software that reports what you install outside of the company's install channel is the issue. There is no way to install software inside a given install channel without knowing the IP address and software title. They are two completely different scenarios. Stop comparing them and acting like they are similar.
  
  --
  Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
20. Re:Disable it! by ThatsMyNick · 2012-08-25 13:34 · Score: 2
  
  Because then the malware will simply target this just like they do other Windows components?
  
  What makes you think service cannot be targeted just because the list of hashes is stored remotely? The service still has create the hash locally and query the remote hash list. This service would be as effective if the hash list is local.
21. Re:Disable it! by Anonymous Coward · 2012-08-25 14:23 · Score: 2, Insightful
  
  That happens here when you legitimately defend Microsoft.
22. Re:Disable it! by swell · 2012-08-25 14:34 · Score: 2
  
  "Look in his history: His Karma is negative. The comment hasn't even been modded."
  Don't believe the history of zenlessyank, or anyone else. At least in my case, every comment score is wrong, on the low side. How's yours? The history function should be fixed or removed- it's been broken far too long.
  OTOH, zenlessyank is remarkably fond of exclamations--used in most titles. Those exclamations tend to be rants, many with a religious undercurrent. Zenlessyank is not given to subtlety which may have something to do with his low ranking by a thinking population.
  
  --
  ...omphaloskepsis often...
23. Re:Disable it! by Penguinisto · 2012-08-25 15:01 · Score: 2
  
  And if you get it pre-installed there is a checkbox in Action center that kills it, which if you are so clueless that you can't even uncheck a checkbox in a GUI? Really having a hard time feeling sorry for you.
  Normally I would agree with you, but having done a whole lot of Windows support over the years? There are way too many people out there (I daresay a majority among the consumers) who doesn't even know what an Action Center is, or what the smartscreen feature really does, let alone know to go there and uncheck the box. To top it off, odds are good (disclosure, I haven't looked) that disabling the feature will come with a pop-up window warning dire consequences if the user goes through with opting-out. (similar to the way HP warns that the printer will probably no longer work if you remove their stupid HP Shopping application.)
  That alone will scare off most folks, keeping them compliant.
  
  --
  Quo usque tandem abutere, Nimbus, patientia nostra?
24. Re:Disable it! by rtfa-troll · 2012-08-25 18:42 · Score: 5, Interesting
  There are a whole load of "suddenly technically knowlagable" people dissembling here (I'd hate to say shills; but somewhere someone is feeding in disinformation).
  
  the application sends checksums to Microsoft
  
  those checksums correspond one to one to applications
  
  Microsoft will normally know which application is which
  
  that information will be discoverable by the Police / authorities etc.
  
  the application is no by default and does not ensure the user knows how it functions.
  
  Now let's have a look at some of the language being used in the Ars Technica article.
  
  This would allow the company to make some estimates of which IP addresses were running which software.
  "some estimates" implies that there wold be uncertainty; that Microsoft wouldn't be able to say 100% that you were using a piece of software. Maybe it is Tor; maybe it's actually Tornado the game. The implication is a humal level of uncertainty which just doesn't apply.
  "which IP addresses" implies that Microsoft would not know who you are. This shows an even greater level of deception. It's even trying to imply that your information may not be linked, if, for example, you change IP addresses. Microsoft has your software registration. Microsoft knows about your usage of Bing. Microsoft has your passport account. If any company other than Google can link your IP address to a particular person; that company is Microsoft.
  Compared to this Ars Technica article, Slashdot is a haven of technical superiority and higher journalistic ethics and integrity. Maybe Anonymous Coward could set up a journalism course for the guys at Ars Technica.
  Finally let's look at Microsoft's statement in the article (N.B. we don't get told what question this is an answer to; note that it might potentially be Microsoft answering to a question about their web sites in which case Ars Technica is again doing the deception; let's take it at face value however).
  
  We can confirm that we are not building a historical database of program and user IP data. Like all online services, IP addresses are necessary to connect to our service, but we periodically delete them from our logs.
  
  The entire point of this service is to build up a "historical" database of executables. It works by identifying those downloads which are known and safe by how often they are downloaded and builds up a "reputation". Ars Technica describes this as "anonymised" without going into details. If you think that they don't at least have the IP network address then I have a bridge to sell you. Let me explain a simple exploit for you: before releasing your malware, repeatedly download it on each of your computers Microsoft will sign it as as having a good reputation. Microsoft's only possible defence against this is to ensure that it knows, at least to some level, which IP addresses used which software.
  --
  =~ s,(.*),<sarcasm>$1</sarcasm>,g if any_point_you_wish();
25. Re:Disable it! by ThatsMyNick · 2012-08-25 18:57 · Score: 2
  
  If a hacker can modify its files, he can easily make it to not submit the hash at all (or always submit a different hash for a specific set of hashes). Unless you have hardware support (like trusted computing device), you have no way of verifying your own program has been modified. If the hacker cannot change any of your files, he cannot change your local hash list file either. So I dont see the benefit of having the hashes remotely.
  
  My question still is why do they opt to do this. If I submit a completely file for unidentified hashes, I can understand. It would help them investigate it and update the hash list. I still dont see the purpose of having the hash list remotely.
26. Re:Disable it! by rtfa-troll · 2012-08-26 01:29 · Score: 2
  
  Maybe if I read the Microsoft blog linked from the original Sladot article about this or if I searched for the word "reputation" in the Ars Technica article, however that would involve reading the fine article and nobody on Slashdot does that; so I can't. Sorry. It would be immoral.
  
  --
  =~ s,(.*),<sarcasm>$1</sarcasm>,g if any_point_you_wish();
27. Re:Disable it! by Hatta · 2012-08-26 02:30 · Score: 2
  
  Around here the crosswalk buttons are at least hooked up and responsive. I will get a walk signal if and only if I press the button, otherwise the traffic lights change but the don't walk signal stays lit. I do still doubt that they affect the timing of the lights, but they are connected to something.
  
  --
  Give me Classic Slashdot or give me death!
28. Re:Disable it! by fast+turtle · 2012-08-26 02:36 · Score: 2
  
  Yet no one cares that Firefox and Google do exactly the same thing, plus that they do it with a unique key for every Firefox install. That key allows Google to identify a firefox session, even when it's "In Private"
  If you block the connection to Google's Safe Browsing service at either the firewall or proxy server, then the firefox installs silently fail. You Must disable the check in about:config (safe) to do so and there are six entries and every one has to be reset to off otherwise safe browsing is not disabled. At least MS offers a straight forward method the first time IE starts up to not use the Smart Screen/Safe Browsing filter unlike Firefox/Google where they don't even tell you that they use it. Because of this, I'm more willing to trust MS instead of the Firefox/Google folks.
  
  --
  Mod me up/Mod me down: I wont frown as I've no crown
29. Re:Disable it! by cayenne8 · 2012-08-26 05:51 · Score: 2
  
  If you block the connection to Google's Safe Browsing service at either the firewall or proxy server, then the firefox installs silently fail. You Must disable the check in about:config (safe) to do so and there are six entries and every one has to be reset to off otherwise safe browsing is not disabled.
  Interesting....do you by chance have any links to instructions on how to disable all of this in FF?
  
  --
  Light travels faster than sound. This is why some people appear bright until you hear them speak.........
use of information doesn't matter by sylvandb · 2012-08-25 10:58 · Score: 4, Insightful

Collecting the information IS spying.
How the information is used after being collected does not matter for determining spying, only the motivation for spying.
Re:Sounds lke the same thing as Google by toolo · 2012-08-25 10:59 · Score: 2

Yep.. when you get a new 'droid, iPhone or iPad, all of your apps automatically reinstall...wonder how that happens. Just because it's Microsoft this is an issue. Actually SmartScreen on Windows 8 is a good way to see what my kid is doing on the Internet without some 3rd party crapware that is definitely using your shit in ways you don't know about. And as other posters have said you can just turn it off.
Sensationalism by Altanar · 2012-08-25 11:08 · Score: 5, Insightful

I see /. is in for another round of anti-Windows 8 sensationalism. Please read the Ars Technica article talking about this before commentating.
1. Re:Sensationalism by LateArthurDent · 2012-08-25 11:42 · Score: 4, Insightful
  
  I see /. is in for another round of anti-Windows 8 sensationalism. Please read the Ars Technica article talking about this before commentating.
  Ah, sweet irony. Your Ars Technica article links to a wired article that argues cryptocat is no more secure than using no crypto at all, because it relies on host security, and then proceeds to defend Smart Screen using a host-security argument.
  If you don't care Microsoft gets access to which programs you run / trust that they will keep the data anonymized and periodically delete the logs as you claim, by all means, don't turn off Smart Screen. That said, they have all the data they need to keep a record if every program you run, and I'd rather not take them at their word that they won't do anything bad with it.
Re:Sounds lke the same thing as Google by kwark · 2012-08-25 11:17 · Score: 3, Informative

"Yep.. when you get a new 'droid....automatically reinstall...wonder how that happens."
Not much to wonder about, on Android you have to opt-in to this service.
Settings -> Privacy:
Back up my data [ ]
Um.. They didn't exactly deny it. by Ransak · 2012-08-25 11:26 · Score: 2

TFA just says they aren't doing anything with the information... for now. That doesn't mean the FBI or whatever 3 letter agency can't put a shunt between the Internet and their SmartScreen servers. It's a sniffing vector.

--
"Powers. I have them."
A more reasonable story by MSTCrow5429 · 2012-08-25 11:30 · Score: 3, Informative

http://arstechnica.com/information-technology/2012/08/windows-8-privacy-complaint-misses-the-forest-for-the-trees/

--
Slashdot: Playing Favorites Since 1997
Re:Could use it in the future by Ultracrepidarian · 2012-08-25 11:34 · Score: 4, Insightful

and if they collect it, our government will demand access to it.
However by Anonymous Coward · 2012-08-25 11:35 · Score: 3, Informative

Apple knows not only what applications you have, when you use them, how many times you use them, but where you are down to a resolution of 10m anywhere on the planet you are, at anytime.
doesnt matter if you are a politician, gangster or regular joe
and you are worried about Microsoft ? lol
bottom line is:
do you trust an "American" multi national company with your personal data ?
Is it possible to downmod an entire submission? by 93+Escort+Wagon · 2012-08-25 11:44 · Score: 2, Interesting

Because this particular story needs to be marked "-1, Flamebait".

--
#DeleteChrome
Re:Sounds lke the same thing as Google by Shining+Celebi · 2012-08-25 12:20 · Score: 2

Do you opt-in to Chrome sending your URLs to Google?
Because that would be the equivalent analogy. SmartScreen sends URLs and file hashes to Microsoft, the exact same way Google's anti-malware sends URLs to Google to compare against a blacklist.
And besides, that, Google "collects" information about what you download through their store, in the same sense - you can't download the app without them knowing your IP, which is the same information Microsoft is getting. If you really cared about this kind of privacy, the app-store model is a much bigger threat than some file hashes being sent to Microsoft.
Re:Sounds lke the same thing as Google by kwark · 2012-08-25 12:35 · Score: 2

-you opt to install/use chrome, it doesn't come standard. I presume people read the EULA if they install software! Same goes for Firefox BTW.
-Google collects info on what you download from the Google store. Flip the checkbox to install from other sources, Google doesn't get that info. So not exactly the same as all downloads are send to OS manufacturer.
Re:Question? by cbhacking · 2012-08-25 13:40 · Score: 2

Yes. It can be turned off at install, at first boot (for pre-loaded images), or at any time while logged in. There are even instructions from Microsoft for doing so!

--
There's no place I could be, since I've found Serenity...
They said "don't", but not "won't" by AliasMarlowe · 2012-08-25 20:14 · Score: 2, Insightful

From TFS and TFA:

The article quotes a Microsoft spokesperson as saying: "We don’t use this data to identify, contact or target advertising to our users and we don’t share it with third parties."
Now, if they had said "don't and won't", then that would mean something. Just saying "don't" means they don't do it today with no guarantee about what they might do with all that data at some future date. Color me unimpressed.
A quibbler might also note that the spokesperson only mentioned the data itself, not results extracted from it. Color me unimpressed yet again.

--
Those who can make you believe absurdities can make you commit atrocities. - Voltaire