Slashdot Mirror
Test Version Windows 10 Includes Keylogger
wabrandsma writes From WinBeta: "One of the more interesting bits of data the company is collecting is text entered. Some are calling this a keylogger within the Windows 10 Technical Preview, which isn't good news. Taking a closer look at the Privacy Policy for the Windows Insider Program, it looks like Microsoft may be collecting a lot more feedback from you behind the scenes. Microsoft collects information about you, your devices, applications and networks, and your use of those devices, applications and networks. Examples of data we collect include your name, email address, preferences and interests; browsing, search and file history; phone call and SMS data; device configuration and sensor data; and application usage." This isn't the only thing Microsoft is collecting from Insider Program participants. According to the Privacy Policy, the company is collecting things like text inputted into the operating system, the details of any/all files on your system, voice input and program information.
I shall pray to my new overlord!!! How long till the goverment demands that data to protect our children from terrorists?
~^\-/^|-|^\-/^~ May the force be with me!
... er... I suppose.... YOU logging an OS ?
All your privacy are belong to us!
Do not let friends do windows.
STASI style OS is spying on you.
It's an early test program. The entire reason that it exists is to see how people use it, whether the UI decisions make sense, and what the designers overlooked. It is not intended for normal use and it is not intended for production environments.
I am TheRaven on Soylent News
Tell me what larger corporation concerned about information control is going to accept anything close to that?
Some of this stuff will probably just concern the free Technical Preview, but there's still a clear trend of Microsoft turning Windows into a datamining platform. It started with Windows 8 where they try to get the user to log into their own computer with a Microsoft account. It seems to be only getting worse.
Update: We must stress that the feedback being collected in the Windows Technical Preview will only occur within the Technical Preview period. Once Windows 10 launches to the public as RTM, the data Microsoft collects will be removed from the operating system. This isn't a permanent feature within Windows 10, and therefore should not be a concern to your average Joe.
Are the spyware makers now going to complain that MS is competing unfairly by bundling its own spyware product with the OS?
I would have no qualms about this practice if it were completely up front in it's entirety rather than have to read about it in a blog. Microsoft needs this extensive information (well, maybe not quite all of it) to make absolutely damn sure the don't fuck anything up or miss anything in how it's used. I just downloaded the beta and fully intend to go ahead and install it. I have not given a damn about Windows operating systems since Windows 2000. I have even been an outright hater but with this release I am officially excited and looking forward to it.
Brought to you by Carl's Junior.
The article mentions that this 'feature' will be turned off once Windows 10 reaches broad distribution. Makes perfect sense actually
First you prove that the back door you've installed in the OS operates as expected. Then you sell key logger access to your user base on a case-by-case basis to the FBI, CIA, NSA or any other agency that is shaking big wads of cash in front of your nose while holding a 'keep it all secret' and 'get out of jail free' card for good measure (see various sections of the patriot act and other anti-terrorism, save-the-children, etc. legislation that have been aggressively 'interpreted').
Thus, encryption and other defensive measures are easily rendered useless as no AV system will detect a key logger 'feature' that is part of the operating system.
More profit for MS, less security for it's users. Brilliant.
What else do you expect from anti-American company?
Use gpedit to disable those date retention services. "Oh, you say gpedit will not run" THAT WHY YOU BUY 'ULTIMATE' DUMBASS!
The whole intent of this kind of program is to gather data as to how real world users are using the software. What applications are they loading, what settings are they changing, where do they get hung up, do things crash, etc. Bringing people into a focus group or lab setting isn't going to give the same results.
I'm sure MS has a whole regression test suite and a formal QE process that's going to give them some idea that there aren't egregious faults with what they are shipping, but that's not going to entirely cover the semi-random ways which a real human being is going to be using the OS. If someone using the software encounters a problem, it can send a more complete picture of what was going on if it has more data.
I'd expect that this will not be shipping in the real product.
They are just burying it.
Windows 7 + the NSA.
And that just relegated it to only ever being in a virtual machine, trapped in a cage where it belongs. Sorry MS, a key logger is a few steps too far even for a preview, sure monitor the hell out of it but a privacy destroying key logger is a few steps too far. It's a shame as it does look like a nice OS even caged.
Windows is for the MS peeping toms to spy on you and everything you do.
I'd expect that this will not be shipping in the real product. ."
"I'd expect . .
"expect"
Your expectations are of utmost importance to MS, and they wouldn't possibly lie about having removed it in the retail versions./sarcasm
This is all speculation based on the privacy policy. To my knowledge no one has done any research to find out exactly what data. if any besides Crash Reports, Microsoft is actually collecting.
XP is the only Microsoft product that has DoD and DEA approvals and certifications
for use in critical-path installations. That's why I run it and have no interest in upgrading.
I'm switching to Google now! To heck with this!
No different than any other Winblows version out there.
The men from MS and NSA, leering thru your data looking for something special. Ah, there it is, your dick pix and pictures of your kids, cos they're all sick twisted psychopaths looking for ways to get off.
Clandestine data gathering serves many purposes, including that of providing sadistic adults with fantasies suited to their special tastes.
MS is catching up!
Well that could be because on one has a copy of Win10 as yet.
My karma is not a Chameleon.
Just you wait what they'll put into the real thing.
How's the weather under your rock? Windows 10 Technical Preview is officially available for download. Good thing they put this stuff out early, so users know what to expect from the finished version.
You now the technical preview has been release, right? Lots of people have it
It should also be noted that they promise to add/remove features all the time. This doesn't necessarily mean that they will also do it.
Besides -- if there really is a need to turn on keylogging and video capture, it should be under the explicit control of the user and only for as long as the user enables it for debugging purposes.
There is. of course, the problem that if the data is there, it makes life SOOOO Much easier on a malware author who no longer needs to install a key logger.. All they need to do is transmit the pre-existing keylogger 'debug' file to their C+C site to extract a (test) user's banking and password information.
OS Software is like love: The best way to make it grow is to give it away.
I'm running it on three computers right now. The Windows 10 preview came out last week. Virtually anyone who wants it can get it legally from Microsoft right this second.
In a couple of months somebody will be able to disable it. Microsoft's Achilles's heel is that there are hackers out there who try to break and investigate things all the time. There is no piece of "perfect code" that can't be hacked and I'm sure there'll be a registry file posted oh github that will disable all this shit.
Harrison's Postulate - "For every action there is an equal and opposite criticism"
Regular people won't care. (Us types here do.) They already spend most of their time typing their personal thoughts into google docs, their personal messages into google mail, and their personal searches into goole search. What MS is doing here is not much more.
Yay! Let me fork more money towards Microsoft so they can better protect my privacy.
Plenty of people have people are already running Windows 10. Anyone can signup and download it for free: http://windows.microsoft.com/e...
I'm running it on this 2008 laptop right now. This box was previously running Windows 7 and was running slow after several years without a clean OS install. Windows 10 seems pretty snappy and is much more intuitive as a desktop OS than Windows 8.
A few features I like better than Windows 7 in my first 24 hours of usage:
*Improved task manager detail (looks like the Windows 8 version at a quick blush)
*Improved file transfer speed information (same as Windows 8)
*The start menu is back, and it's easy to add/remove items from the quick access list
Features I don't like as much:
*I can see bars of strength for my wifi connection but I haven't figured out how to easily see whether I'm connected via G, N, or AC and current Mbps settings of the connection
*The news application has potential, but is so slow starting up most people won't bother with it
Do you say 'I putted it in the box' or 'I putted it on the table'?
No. Not since you were a toddler.
"Like text input into the system". Or if you don't like it, use a different sentence construction.
Because it could be almost impossible to know.
De-compiling or tracing Windows is not a small task, especially not if we're talking kernels, signed-drivers, etc. With TPM etc. you may not even be able to investigate much of the boot process.
And monitoring packets that go back over the network - well, that's what TLS was INVENTED to make safe from even packet-level snooping.
So it's one of those things that's almost impossible to do, probably can't be done with reverse-engineering (or otherwise breaking the EULA of the software itself), and may not ever reveal the true story (i.e. what if MS put a flag onto machines they are interested in, which then return more data than they normally would?).
Did you know that Windows after XP contacts an MS-controlled server with your IP to "check" whether you're actually connected to the Internet or not? http://technet.microsoft.com/e...
Most people don't. And it's only because the knowledge is public that we really know. And how easy it would be to detect what information was being sent home by something like that if, say, rundll32.exe was talking out to an MS port with a TLS connection? Your firewall would allow it, you wouldn't be able to sniff it, and it would look like nothing more than an NCIS login which you can't block if you want Windows to think it's actually "online".
Guess what? Every virtual keyboard on every phone and tablet already logs and uploads usage to improve word guesses and recognition rates. Total non-story.
Yes. It's obvious Microsoft isn't making use of all that lovely data. American companies are famous for taking less than they can legally get away with. (snicker)
I've calculated my velocity with such exquisite precision that I have no idea where I am.
That is all.
"If any question why we died, Tell them because our fathers lied."
If you're a windows user in the US, this almost negates the need for law enforcement to obtain a search warrant.
The telemetry stuff can be removed with the brand new NTLite (formerly nLite).
There is also this handy hosts file with 4000 MSFT domains.
Wink wink, nudge nudge, say no more!
I doubt that all of these data collecting systems will be removed from the free to use final RTM version. Microsoft has finally heard the call and is from now on going to sell you their product in exchange for your behavior, like everyone else does nowadays.
Ignore the man behind the curtain, all your key belong to us!
This obsession with collecting data never improves sytems.
Use logic and talk things through carefully. Designs were much better when people thought and studied in-depth rather than going by volume.
As a sidenote, Windows 10 TP comes with a feedback button right in the Start Menu. If there are any nitches in the OS, you have an opportunity to voice them to Microsoft.
Will this help stop Windows 10 from being so freakin' annoying?
I figured as much, just based on my cursory review of the EULA. That's why I haven't even logged in to any of my accounts using the Win10 preview.
I'm not sure why they force people to post on a forum to provide feedback - include a feature right in the preview OS that lets you submit feedback (simple, like how Firefox does it).
Anyway, if I can't even enter any data without being spied on, there's not much I can do in the way of providing real usage scenarios. And since I'm not even being paid to evaluate Win10, then really it's a lose or don't win situation.
I used to be adamantly opposed to government involvement in the evolution of technology. But there are so many ways that technology companies abuse the privilege of having unprecedented access to every detail of your private life that I'm doing a complete 180. Enough already. Sure, more spying will help MS make a better product. For Microsoft. This nonsense has to stop.
This is a huge vulnerability. Microsoft's claim that the code "turns off" after the test period has to be viewed with scepticism. If they can turn it off, they can turn it back on. Or someone else can.
This is telling us that Windows 10 is totally unsuitable for any business with security requirements. Lawyers, banks, and medical service providers probably can't use it and be compliant with the regulations in their industry.
How many of you realize that many websites are now logging your keystrokes as you type in any input box?
The future is coming and you will not like it.
The whole intent of this kind of program is to gather data as to how real world users are using the software. What applications are they loading, what settings are they changing, where do they get hung up, do things crash, etc. Bringing people into a focus group or lab setting isn't going to give the same results.
Why not ask?
Remove Key Logger Remove IE Add Games
like MacOS X 10.9 was free.
In order to do that, you become the product they sell to other companies by logging everything you do.
This is really no different than what Dotcom companies do. Collect info on you when you use their website and then sell it to the highest bidders. It keeps their website free and targets you with ads and spam.
Remember, Slashdot does not have a -1 disagree moderation, and no, troll, flamebait, and overrated are not substitutes.
We complain about Google's data collection for demographics, but Microsoft is taking the next step: a version of Windows that can track your bank balances and most private fetishes. Profit!
I'll just stick witht Win 7 thankyou
I'm sure it's all right there, in ALL CAPS, plain as day in the 40 Page EULA.
The purpose of testing is to collect data about the system itself and how it operates in end user environments; this is collecting information about the end users themselves rather than just the machine.
I don't know how you even begin to build a machine or a system that responds properly to its users without studying its users "in the wild."
The TLS problem can be fixed with a custom CA and something like sslsniff and a reliable (non-windows) machine to do the mitm.
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion. -- Spazmania (174582)
Because it's explicitly a "technical preview" or "beta" or "pre-beta invite only" or "not intended for production" system. I've participated in numerous betas for other products like MMORPG games, and I always expected I was being watched and monitored. Not for evil reasons, but more for usability or analysis. I signed up to be in the beta, was accepted, so I'm seeking out this kind of experience.
I can't imagine that other vendors aren't collecting information in similar manner. Why send out a beta if it's not going to give you useful data back before you release the production version?
I have received a couple of prompts from Microsoft feedback after trying a feature or App. So I know they are monitoring what you are doing with Windows 10. But if you are testing it. You should be willing to give and take as you are a part of testing. If this was in a final product like Google sending crash statistics. Then you could argue privacy issues. But Google gives you a option to send statistics or not. Obviously if you feel Microsoft is over stepping with Win 10 then simply uninstall it.
"If it weren't turned off in the RTM version, people would figure it out within a few hours"
False. Everything going out is of course encrypted and you can bet that in this point it is using good encryption.
Examining packet data doesn't help at all.
Summary: Agument void.
Only thing people can see is that it's sending some encrypted packets to somewhere. Nothing more.
Assuming that Microsoft allows any CA to sign their internal certs....
Just like you don't officially know what data NSA is collecting.
It means they don't collect anything, right? By NSA-speak, data is only "collected" once someone looks at it even it's stored somewhere. I see the writer is using NSA-definition and, based on that, is a NSA-employee?
In a world where companies collect everything they can and wiping their asses with laws while doing it totally illegally, here we have someone who actually believes that a company isn't collecting _everything it can and much more it says it does_. In common meaning of the word and not the NSA-level of non-definition.
Just a like a thief steals only what he needs, right?
You don't need to actually know the content of the packets - just the destination. "I've got NO additional software installed, most services turned off, and yet every x minutes my computer contacts aa.bb.cc.dd ... anyone else notice this behavior?" would be enough to get people to start sleuthing.
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
... five stories about Win10 in 6 days.
Slashdot turned into just another Microsoft-shilling site so gradually that I hardly noticed. Now it's too late...
What part of "a well regulated militia" do you not understand?
It just isn't fair... I'm sitting here typing this post on my Linux desktop, with the keylogger feature. When will Linux learn that we want to be spied on and desperately need a fucked up user interface?
You don't need to actually know the content of the packets - just the destination.
All they need to do is send the data through Windows Update. They won't be able to hide much data through that channel, but it's still available. They can send the keys to all your other data through that means. Perhaps they'll use HTTP 2.0 with Windows Update in order to make it easier to hide such traffic.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Because it's explicitly a "technical preview" or "beta" or "pre-beta invite only" or "not intended for production" system.
If you don't have users doing what they normally do value of test is degraded. I get why MS throws those words around to set expectations and manage risk yet this does not change the fact they need users to be users for the public programs to be successful. Only finding out later your "production" software does not work on Windows 10 helps nobody.
Still a little foggy on the relationship to my simple question "why not ask?" and answer cuz its technical preview... I don't see the connection.. I don't understand why status alpha/beta/preview/whatever is related to asking users what kind of feedback they feel comfortable providing.
I've participated in numerous betas for other products like MMORPG games, and I always expected I was being watched and monitored.
A game is not an operating system it may not be prudent to lump all software into the same category.
For example suppose Tor network were to release a preview of next-gen Tor client with similar "telemetry" features which "enter text, we may collect typed characters" ... no Tor user would accept those terms even though it may be just fine for a video game.
The operating system is the foundation upon which all other computing tasks are performed.. This scale of data leakage to include all entered text significantly limits acceptable uses and by extension usefulness of public testing.
I can't imagine that other vendors aren't collecting information in similar manner.
Seriously other people collect "typed characters" without qualification and no ability to stop it? This frankly seems absurd and out of line with industry practices. Are you or anyone able to name names in this regard? Who has done this in the past?
Why send out a beta if it's not going to give you useful data back before you release the production version?
The question presupposes collecting typed characters is necessary to provide useful feedback.
Microsoft wants to look at your poop.
I was trying it out on my extra laptop but I guess I'll just put Mint 17 back on it. Not that crazy about the key logging feature or that they keep trying to get me to link everything to a Microsoft account. Linux was actually faster than either Windows 7 or 10 anyways. Upgrade.
I was getting really tired of going to those dodgy websites to get a keylogger installed on my machines.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
I see many posts worry about "what if the logger is still in the RTM version" and "what if they turn it back on".
Well, what is to stop Microsoft from burying a keylogger and/or root kits in any of their numerous security patches for Windows 7, 8, MS Office or whatever?
And if they has the moral turpitude to install keylogging and grab your passwords in Windows 10, why would you think they have not already done it?
If anyone is willing to watch the announcement and listen to what has been said about this enterprise preview they would see this is a non-story. 1st they are upfront about it. No one should install this if they are not willing to spend a little amount of time finding out what they are installing. They named it enterprise preview for a reason. They didn't name it Windows 10 alpha/beta or just preview. This isn't a version of windows that anyone should use other than testing for enterprise. It's there so corporations like I work at can test it. See if their employees can really be updated to it without training and to give feedback. Would you browse any of you password protected sites in the corporate office. I would hope not.
If you wish to have the keylogging software, then you'll need to upgrade from Windows 10 Home to either Windows 10 Professional or Enterprise.
Still a little foggy on the relationship to my simple question "why not ask?" and answer cuz its technical preview...
They do ask, in fact you have to opt-in to this by actually applying for the technical preview program. The fact that you applied for something without reading the website so you know what it is you are applying for is just your own phenomenal stupidity. A technical preview is not a software or hardware testbed nor is it a commercial product. The website makes all the information almost painfully clear to even the most dimwitted fool and they even go to great lengths to weed out those to whom this program would not be applicable, at some point you can't blame them for not being able to cure your stupid.
... we can't have nice clouds.
Because it's explicitly a "technical preview" or "beta" or "pre-beta invite only" or "not intended for production" system. I've participated in numerous betas for other products like MMORPG games, and I always expected I was being watched and monitored. Not for evil reasons, but more for usability or analysis. I signed up to be in the beta, was accepted, so I'm seeking out this kind of experience.
I can't imagine that other vendors aren't collecting information in similar manner. Why send out a beta if it's not going to give you useful data back before you release the production version?
Yes, but other vendors let the user opt-out of the data collection process, pledge to remove identifiable info, and provide a clear, non-legalese privacy policy regarding any personal info that does come their way.
like MacOS X 10.9 was free.
In order to do that, you become the product they sell to other companies by logging everything you do.
This is really no different than what Dotcom companies do. Collect info on you when you use their website and then sell it to the highest bidders. It keeps their website free and targets you with ads and spam.
Not in the case of Apple, they don't.
They sell another MacBook, iMac, Mac mini, or Mac Pro to pay for that free OS. Not the same business model.
Trust Microsoft. No gpedit is not Open Source but believe me it doesn't have a backdoor.
shhhhhh, don't teach them stuff
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion. -- Spazmania (174582)
because with a beta other people can test *their* programs, drivers etc and tell you what doesn't work (and you missed). One of the many reasons Vista tanked was that (nearly) no one got early access, so quite a bit of device drivers didn't work at first - which is a showstopper for many people.
Are diagtrack.dll and diagtrack_win.dll part of this backdoor?
Windows Technical Preview isn't available
Thank you for your interest in updating to Windows Technical Preview. Unfortunately, you can't install the preview on your operating system.
Get info about installing the preview on another device.
I can't upgrade to the newest Windows? Linux is a piece of shit. I want my money back!
Your careful, unambiguous language means you have an agenda against Microsoft.
So I have to lump you in with the crazies.
I have to ask.
But what's with all these slashdot morons defending keylogging?
...Windows GUI macro capabilities seem to be off the table. Seriously, MS-DOS was the last really useful operating system. I'd go back to a command-line interpreter in a heartbeat if MS (or Apple) would support one that was Internet-friendly.
Why does it need to know my email address?
3 days after I installed this, my laptop died. I am a computer pro so I know what I'm doing. It just DIED.
From Microsoft:
"We use a variety of security technologies and procedures to help protect your personal information from unauthorized access, use or disclosure. For example, all data sent from the Windows 10 Technical Preview to Microsoft is encrypted in transit and we store the personal information you provide on computer systems that have limited access and are in controlled facilities."
In other words: "We transmit the data using SSH and store it in a datacentre."
Not the same thing. Apple makes the bulk of its money on hardware sales. If they give you an OS update free, they're making it more likely that you'll buy another Mac. Microsoft makes very little on hardware sales, and it's not obvious how giving away an OS profits them in any other way. I'm not saying you should trust Apple, but you can make good guesses about a company by looking at what makes it the most money.
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
Microsoft was seeking a way to dominate and control the keylogger software market?
I predict that their version of keylogger (also known as Clippie the Keylogger) will be unpopular much like Windows Internet Explorer.....and soon the Google, Symantec, and McAfee versions- all downloaded when you forget to click that stupid check box on your weekly (or is it daily now?) Java and Adobe Acrobat updates will soon replace it. Everyone will get keylogger software!!! Freeee!!!!
I think this version is designed to survey users Perhaps Microsoft will offer immediate release 11.
Need I say more?
there must be a law against this.
if i use bisniss versions who should not be logged, this would break all my respect to all whomi send info too.
microsoft need to make a patch to turn off this little key logger SAP.