Test Version Windows 10 Includes Keylogger

wabrandsma writes From WinBeta: "One of the more interesting bits of data the company is collecting is text entered. Some are calling this a keylogger within the Windows 10 Technical Preview, which isn't good news. Taking a closer look at the Privacy Policy for the Windows Insider Program, it looks like Microsoft may be collecting a lot more feedback from you behind the scenes. Microsoft collects information about you, your devices, applications and networks, and your use of those devices, applications and networks. Examples of data we collect include your name, email address, preferences and interests; browsing, search and file history; phone call and SMS data; device configuration and sensor data; and application usage." This isn't the only thing Microsoft is collecting from Insider Program participants. According to the Privacy Policy, the company is collecting things like text inputted into the operating system, the details of any/all files on your system, voice input and program information.

Comments

Yeah

[ceide2000]

I shall pray to my new overlord!!! How long till the goverment demands that data to protect our children from terrorists?

Re:Yeah

[Anonymous Coward]

And celebrities should provide Google with full body scans so Google can block any naked images....

Re:Yeah

[murkwood7]

I shall pray to my new overlord!!! How long till the goverment demands that data to protect our children from pornographic terrorists?

There. FTFY

Windows 1984

[Anonymous Coward]

All your privacy are belong to us!

In Soviet USA

[MarcosYXY]

STASI style OS is spying on you.

What do you expect?

[TheRaven64]

It's an early test program. The entire reason that it exists is to see how people use it, whether the UI decisions make sense, and what the designers overlooked. It is not intended for normal use and it is not intended for production environments.

Re:What do you expect?

[Anonymous Coward]

It's an early test program. The entire reason that it exists is to see how people use it, whether the UI decisions make sense, and what the designers overlooked. It is not intended for normal use and it is not intended for production environments.

The nature of the data collection will force the collected data to be skewed, because nobody in their right mind will put their "real" stuff on that machine, so they won't end up using it in a normal manner.

Re:What do you expect?

[wisnoskij]

This. What would even be the point of releasing a test version of windows if they were not tracking what you do?

Re:What do you expect?

[Anonymous Coward]

It's an early test program. The entire reason that it exists is to see how people use it, whether the UI decisions make sense, and what the designers overlooked. It is not intended for normal use and it is not intended for production environments.

There is no justification for this. The purpose of testing is to collect data about the system itself and how it operates in end user environments; this is collecting information about the end users themselves rather than just the machine, Microsoft has no business collecting that.

Re:What do you expect?

[Anonymous Coward]

Yes, it's a test version.
In final release this keylogger will be built in and hidden much better, so you won't find it that easily.

Re:What do you expect?

[TheRaven64]

purpose of testing is to collect data about the system itself and how it operates in end user environments; this is collecting information about the end users themselves rather than just the machine

How long does it take a user to find the correct button to dismiss a dialog? How many users use keyboard navigation rather than the mouse to navigate dialogs? How many times do the people who do use keyboard navigation hit tab without typing doing anything that would modify the field? All of these things require a keylogger (or a camera pointed at the screen) to find out and give valuable data when designing a UI. You'd hope that there's something client side that filters out anything that might be a password and aggregates some of the data, but it's all information about the end user that you need to collect to do a good job at UI design.

You can't collect it about all end users from production code without making the product unusable, so you put out testing releases that do collect it.

Re:What do you expect?

[nine-times]

I think there was even some notice when I downloaded it, I only remember it vaguely, but I did see it. It was a prominent warning that said something to the effect of, "We will be collecting data on how you use this, including pretty much anything we want to collect, but the data will be aggregated and anonymized, so we won't collect personally identifiable information." So it's not like they were secretive about it.

So you may not feel comfortable about it, but in that case, you should be able to just use production versions of Windows.

Re:What do you expect?

[Bob9113]

What do you expect?

Informed consent; a condition not satisfied by something buried in dozens of pages of legal boilerplate. "We're watching everything you do" is not something that falls into reasonable expectation, even for an early test program. Requiring consent as a condition of use may be fine; failing to place a large, explicit notice on screen is utterly disrespectful to the user and an unconscionable violation of the most basic security practices.

Re:What do you expect?

[Anonymous Coward]

This. What would even be the point of releasing a test version of windows if they were not tracking what you do?

Like all previous software test versions. So that users could test their actual applications, especially with the private data that they can't hand over to Microsoft, and report back if there are problems.

The joy with which people defend the jackboot of their opressor as it pounds down upon their faces is a bit scary sometimes. Does nobody think "how did everybody live and produce software for the last 40 years before there was total surveillance" before they post this kind of explanation?

Re:What do you expect?

[X0563511]

You're testing. You're not using it in a normal manner.

You're bug hunting.

Re:What do you expect?

[r_naked]

Absolutely there is justification for this, and as has been pointed out MANY times on this thread already, THEY MAKE IT VERY CLEAR.

* Install it in a VM
* Don't visit your normal sites / "private" sites that you don't want MS (or whoever) to know about
* Create new accounts for any site that you don't care that they know you visit, but you don't want them to have your login credential.

I mean this is brain dead stupid obvious shit...

I am running it because I WANT MS to get that feedback. I don't want them to be tracking my normal usage though.

I have switched to Linux Mint after the Win8 fiasco, but I don't want to see MS fail. They keep me in business, so I want to give them as much feedback as possible.

This whole article is a non-issue if you pay attention to what you are agreeing to. *sigh*

-- Brian

Re:What do you expect?

[WaffleMonster]

No, you're testing. You have no expectation of privacy.

The fuck I don't.

This isn't a product they're selling or a service they're offering.

Last I checked they are offering it for download from their website.

If you don't want to be monitored the solution is simple: Don't test.

When there are problems at launch or the market rejects it the way it did Windows 8 the solution will also be simple: Don't buy Microsoft.

Re: What do you expect?

[jalet]

Simply log the commands launched then, no need for what is typed in everywhere.

Re:What do you expect?

[exomondo]

Like all previous software test versions. So that users could test their actual applications

That's not what the technical preview is for, the details have not been finalized yet so testing your applications against it now is pointless, they make that point quite clear:

Windows Technical Preview may be substantially modified before it’s commercially released.
http://windows.microsoft.com/en-au/windows/preview

So I'm not sure where you're getting any idea that testing on this version would be of any benefit.

Then they detail how they may work to resolve issues:
Also, if your PC runs into problems, Microsoft will likely examine your system files. If the privacy of your system files is a concern, consider using a different PC. For more info, read our privacy statement.
http://windows.microsoft.com/en-au/windows/preview-faq#faq=tab0

So if you've gotten this far and you're paranoid about privacy would you not think "ok maybe this technical preview is not something i want to be involved in?"

The joy with which people defend the jackboot of their opressor as it pounds down upon their faces is a bit scary sometimes.

As is the joy with which people who don't read come up with conspiracy theories about how everybody is out to get you! I'm sure this is all some big conspiracy (probably with the NSA?) to get people to install this technical preview and get their passwords to their email (though I thought the NSA already had all this stuff) so they can find out if you're a terrorist.

Re:What do you expect?

[Anonymous Coward]

Why would they possibly need to know all your key strokes to get feedback data?

Because it's easier than going through the whole system and adding feedback functionality to every control.

Re:What do you expect?

[exomondo]

Informed consent; a condition not satisfied by something buried in dozens of pages of legal boilerplate.

But it isn't "buried in dozens of pages of legal boilerplate", it's right there at the start of the privacy policy and linked to multiple times in the explanation of the program informing the user that data will be collected, in addition it is written in plain English.

Requiring consent as a condition of use may be fine; failing to place a large, explicit notice on screen is utterly disrespectful to the user and an unconscionable violation of the most basic security practices.

Downloading and running software like this when the information about it is clearly presented to you (even more clearly than in previous pre-release programs from Microsoft and other vendors) is an unconscionable demonstration of stupidity. I would hate for things to get to the point where everything has to be idiot-proofed such that everytime any application sends any data you have to agree to a large explicit notice on screen.

Re:What do you expect?

[doccus]

I am always amazed that anyone wouyld use a testbed version as their main OS. NAturally it's on a seperate partition, and only use it in ordser to allow improvements to be made, KNOWING that the data is being collected. So, no, of COURSE you wouldn't do your banking, or torrent all your movies and pxxn, or use something like a darknet, or.. the list is endless. Because it's a BETA..doh?

Re:What do you expect?

[Reziac]

But how can I find bugs that affect normal use if I'm not using it in a normal manner?

I've got nothing against a test build reporting everything I *do*, such as save a file; that's the whole idea. I do have a problem with them collecting info on what that file contains; that's none of their business.

--signed, the beta tester who can break anything

"This isn't a permanent feature"

[Constantin]

The article mentions that this 'feature' will be turned off once Windows 10 reaches broad distribution. Makes perfect sense actually

First you prove that the back door you've installed in the OS operates as expected. Then you sell key logger access to your user base on a case-by-case basis to the FBI, CIA, NSA or any other agency that is shaking big wads of cash in front of your nose while holding a 'keep it all secret' and 'get out of jail free' card for good measure (see various sections of the patriot act and other anti-terrorism, save-the-children, etc. legislation that have been aggressively 'interpreted').

Thus, encryption and other defensive measures are easily rendered useless as no AV system will detect a key logger 'feature' that is part of the operating system.

More profit for MS, less security for it's users. Brilliant.

Re:"This isn't a permanent feature"

[Delicious Pun]

The more that computer software "advances", the more I think about getting another hobby. Computers used to be so much fun. :(

Re:"This isn't a permanent feature"

[Anonymous Coward]

Any decent software company that does usability testing (and more companies need to be doing this) also tracks everything the user does. If it's done in a lab, there's also eye tracking and video recording of the subject. They'd be something wrong if Microsoft wasn't tracking these things. Even a lot of websites track mouse movements and clicks across their entire site, at least here it's a test release of the OS. Go back to college and retake your usability course, or are you a self taught master who didn't have time for that nonsense?

A dedicated firewall will detect any leaks. There's no indication that this feature is being abused and there's already evidence that those agencies have no problem dropping their own key loggers onto people's computers. They don't need this. The amount of info it's sending back would be too noticeable to anyone who looked.

People seem to forget that advanced features such as good handwriting recognition and voice recognition only work because of the massive user base that is actively providing samples every time they use the software. Check out any of the local versions, they all suck compared to the services with millions and millions of samples used to actively train and update them.

Re:"This isn't a permanent feature"

[BarbaraHudson]

Any bets that MS will "forget" to turn this off in the RTM?

If it weren't turned off in the RTM version, people would figure it out within a few hours. It's not like everyone's going to accept Microsoft's statement at face value, so they'll be logging packets, etc. Microsoft knows this.

Isn't that the whole point of this kind of thing?

[enjar]

The whole intent of this kind of program is to gather data as to how real world users are using the software. What applications are they loading, what settings are they changing, where do they get hung up, do things crash, etc. Bringing people into a focus group or lab setting isn't going to give the same results.

I'm sure MS has a whole regression test suite and a formal QE process that's going to give them some idea that there aren't egregious faults with what they are shipping, but that's not going to entirely cover the semi-random ways which a real human being is going to be using the OS. If someone using the software encounters a problem, it can send a more complete picture of what was going on if it has more data.

I'd expect that this will not be shipping in the real product.

Windows Ten! It's...

[guygo]

Windows 7 + the NSA.

Only in a box

[sensationull]

And that just relegated it to only ever being in a virtual machine, trapped in a cage where it belongs. Sorry MS, a key logger is a few steps too far even for a preview, sure monitor the hell out of it but a privacy destroying key logger is a few steps too far. It's a shame as it does look like a nice OS even caged.

Re:So no company is going to install it?

[benjymouse]

Tell me what larger corporation concerned about information control is going to accept anything close to that?

Don't install the preview version for production purposes then.

This is telemetry from the preview version. You explicitly accept the telemetry when you join the preview program.

If a larger corporation does not like that, even for testing purposes, then they can simply wait for the final (RTM) version.

Re: Friends

[ubsjasongw]

Windows is a great OS. What they're whining about is what a pre-alpha test version of the software collects. Test versions always deliver far more telemetry than would a retail release, as they should. Windows 10 right now is not for regular daily use or for consumers. It's purely about evaluation and helping designers test the new OS and improve it.

Re:Datamining

[benjymouse]

Some of this stuff will probably just concern the free Technical Preview, but there's still a clear trend of Microsoft turning Windows into a datamining platform. It started with Windows 8 where they try to get the user to log into their own computer with a Microsoft account. It seems to be only getting worse.

In Windows 10 you can choose not to use a Microsoft account - just like with Windows 8.

On top op that, Windows 10 will allow corporations to federate their own AD - which means that you will get the device-sync features *without* creating a Microsoft account.

Because they says they can doesn't mean they will

[Dorianny]

This is all speculation based on the privacy policy. To my knowledge no one has done any research to find out exactly what data. if any besides Crash Reports, Microsoft is actually collecting.

Re:I would not have a problem with this if...

[benjymouse]

I would have no qualms about this practice if it were completely up front in it's entirety rather than have to read about it in a blog.

This is quote from the page where you agree to the terms of the preview program (this is the top text - the first you read):

Accept the Terms of Use and Privacy Statement

This should be the most boring step. Accept the Terms of Use and Privacy Statement and we can finish up your registration.

By accepting the Terms of Use and Privacy Statement, you agree that:

* The experimental and early prerelease software and services might not be fully tested.

* You might experience crashes, security vulnerabilities, data loss, or damage to your device.

* Your detailed usage and device data will automatically go to Microsoft and our partners to improve our products and services. See the Privacy Statement for more information.

* You will receive communications about the program and related promotions. Once you’ve joined the program, to stop receiving such communications you must leave the program.

Re: Friends

[Anonymous Coward]

I don't know about you, but I don't think I could properly evaluate it if I had to avoid browsing to any website where I might need to enter a password, or unzip password-protected zip files, or, well, do anything that would involve me entering a password.

Re:I would not have a problem with this if...

[wonkey_monkey]

http://windows.microsoft.com/e...

For example, when you:

        install the Program, we may collect information about your device and applications and use it for purposes such as determining or improving compatibility,

        use voice input features like speech-to-text, we may collect voice information and use it for purposes such as improving speech processing,

        open a file, we may collect information about the file, the application used to open the file, and how long it takes any use it for purposes such as improving performance, or

        enter text, we may collect typed characters and use them for purposes such as improving autocomplete and spellcheck features.

Re: Friends

[atlasdropperofworlds]

If you read TFA, you'd notice the important bit that say "could include a keylogger", unlike that shitty title states.

Re: Friends

[Anonymous Coward]

Or you can download the ISO, enter the key (it's all over the net), and set up an entirely fake user account.

Well, now it is here too. The key is NKJFK-GPHP7-G8C3J-P6JXR-HQRJR. Microsoft is using this key for all W10TP installations.

The ISO can be grabbed from http://preview.windows.com/ by anyone who needs it.

Re: Friends

[BarbaraHudson]

It's the same key - there's only one. This is handy for people who didn't bother to write it down, screw up the install, and need to re-install without going "where did I put the **** key!" It's not like Microsoft is worried that people are going to pirate something that's free. Quite the contrary - they want to get it into as many hands as possible, since the preview is also a marketing tool.

Re:In soviet Russia...

[binarylarry]

in Soviet Russia old joke makes fun of you!

Re:I would not have a problem with this if...

[SuiteSisterMary]

Why would you want to use a testing version, if you're not willing to participate in the testing?

Conversely, why would any company want you to have access to a test version if you're not willing to participate in the testing?

Re: So no company is going to install it?

[Lunix Nutcase]

This is TEST software.

I run test software all the time. Not a single one of them sends back all my keystrokes. Stop making asinine excuses for shitty behavior.

Re: Friends

[Le Marteau]

Write, compile and distribute code which bypasses integral security features in the software. What could go wrong?

Re: Friends

[93 Escort Wagon]

If it's a preview and they're using the same key for all the installations, why bother with a fucking key in the first place?

One thing that comes to mind is - perhaps they want to be sure their key logger is functioning properly. Having the user voluntarily type in a known string would do that.

Re: Friends

[Cassini2]

Words of warning from Microsoft. Be sure to read the third one:

Remember, trying out an early build like this can be risky. That's why we recommend that you don't install the preview on your primary home or business PC. Unexpected PC crashes could damage or even delete your files, so you should back up everything.

If you want to stop using Windows Technical Preview and return to your previous version of Windows, you'll need to reinstall your previous version from the recovery or installation media that came with your PC—typically a DVD. If you don't have recovery media, you might be able to create recovery media from a recovery partition on your PC using software provided by your PC manufacturer. You'll need to do this before you upgrade. Check the support section of your PC manufacturer's website for more info.

After you install Windows Technical Preview, you won’t be able to use the recovery partition on your PC to go back to your previous version of Windows.

Watch out! Installing this version of Windows disables the recovery partition.

Re: Friends

[SeaFox]

If it's a preview and they're using the same key for all the installations, why bother with a fucking key in the first place?

I'm sure the software phones home occasionally to validate the key. Once they reach commercial release (or maybe even the next major stage of development), they can revoke the key so folks can't just use this alpha release as a free copy of Windows.

Re: Friends

[ArcadeMan]

I'll just install it on a computer with a BIOS that isn't Y2K compliant. My free copy of Windows 10 will last 86 years!

Re: So no company is going to install it?

[WaffleMonster]

I could get in big trouble for this, they made me sign an NDA but here's the pseudo-code:

function gatherTextData(field) {
                  if (field.type == "password") {
                                  return ""

I think they've got a patent pending, it's pretty complicated stuff.

Then I would say we all have quite a lot to worry about. One small example many of us SSH into systems all day long and our passwords are not protected by your pseudo code there is no UI element explicitly marked password.

Anyway since your an insider with Microsoft you might want to have your team communicate algorithms and limits associated with collection activity clearly.

As it stands the only information publically available described in the privacy policy states:

"enter text, we may collect typed characters " it does not provide any qualifying limits of any kind on the *collection* activity although it does provide some qualification on *use* "and use them for purposes such as improving autocomplete and spellcheck features"

Re: Friends

[drinkypoo]

Why would you use a pre-alpha release of ANY os on your main computer?

So that you can do testing on the computer on which it will actually run. Normally you'd dual-boot the testing OS.

Or you can download the ISO, enter the key (it's all over the net), and set up an entirely fake user account.

But I can't log into any websites (etc.) while I'm using it, because Microsoft gets my keystrokes. So I can only perform superficial testing of that kind. I can't log into my actual network for the same reason.

Re: So no company is going to install it?

[WaffleMonster]

So what's your issue? It seems pretty clear.

The fact this is an unacceptable privacy violation is crystal clear.

Re: Friends

[demonlapin]

Who's foolish enough to install a time-limited technical preview as their main OS? I put it in a VM.

Re: Friends

[BarbaraHudson]

That simply won't work. Aside from running old versions of SimCity, I don't really *need* Windows (and I can always run SimCity in an emulator or a virtual machine running my old copy of Win9x or WinXP).

It also won't pass muster with OEMs, who will have to explain to customers that while they're buying a computer, they have to pay a monthly fee for the OS. They'll just sell androidbooks instead.