6 ms·

Windows is the most used desktop OS and Microsoft has a history of conspiring with nation state adversaries. It's not implausible that the NSA and GCHQ would as

Windows is the most used desktop OS and Microsoft has a history of conspiring with nation state adversaries. It's not implausible that the NSA and GCHQ would ask Microsoft to slip in a few bugs here and there that makes surveillance much easier. Remember: This is the company that took an end-to-end-encrypted communications platform (Skype) and completely turn it around into a mass surveillance platform by being the first to join PRISM. It's the same company that builds a full disk encryption system (BitLocker) that sends your encryption keys back to Microsoft's servers. And finally, it's the same company that pushed for an "always on" HD webcam and microphone bundled with an "always online" video game console.

Ntrails 11y ago
>It's the same company that builds a full disk encryption system (BitLocker) that sends your encryption keys back to Microsoft's servers Every time someone says that as though it's not the absolute correct thing for MS to do given it's standard home-user technical level/expectation I'm super confused. I would expect it to be possible to turn that off, but you can be damned sure that swathes of their users expect to be able to ring MS when they forgot their bitlocker key. >it's the same company that pushed for an "always on" HD webcam and microphone bundled with an "always online" video game console. They want you to always be able to use voice and gesture controls with your console - because if you have to stand up and press a button to turn the damned thing on then what's the value in half the functionality? I'm confident MS are actually more interested in their profit margins than they are by any conspiratorial opportunities with the security services. Casting the latter as their primary motivation all the time is disingenuous.
- babuskov 11y ago
  As long as convenience trumps security in people's minds, there won't be real security anywhere. I have to admit I'm lazy and still allow some stuff too. Making security both functional and comfortable is a really hard (impossible?) thing to do.
- EGreg 11y ago
  It's not either or.
- pjc50 11y ago
  ring MS How do you even do this? It was hard enough to report a bug as an MSDN subscriber. I don't think they have a vast array of consumer support phone agents, or if they do they keep the number very quiet.
  - caskance 11y ago
    Search google for something like "microsoft tech support phone number"?
cm2187 11y ago
It can't be a bug. I can't think that the designers when implementing a privacy mode would think, oh let's store all of that in the primary cache or let's store the history there. Unless Microsoft employs some complete idiots. Probably more that they never intended this mode to be secure.
- creshal 11y ago
  > oh let's store all of that in the primary cache or let's store the history there. It could be simply a bug that disabling the caches for private browsing didn't work as intended. Of course, barring a whistleblower, we'll never know. Yay closed source software.
  - cm2187 11y ago
    I would be surprised if private browsing meant no caching. I would have rather have implemented it as a separate / in-memory or encrypted cache.
    - therein 11y ago
      Is that what Chrome does? It seems like it has an in-memory session that stays intact unless all incognito windows are closed. When I login somewhere, close all but one incognito tab and then navigate to that website again, my cookies are still there. Also let's hope they aren't sending different headers like DNT etc. when in private mode, which would make fingerprinting a lot easier.
      - cm2187 11y ago
        I am pretty sure your authentication cookie isn't shared between your regular and privacy sessions.
        ptaipale 11y ago
        Yes, but it's shared between different sites within your "incognito" session. Open an incognito window, log in to Google, then go to some other place, and your Google login information is seen by that site.
nailer 11y ago
> Microsoft has a history of conspiring with nation state adversaries. Not doubting you, but do you have references? I haven't heard much directly about this stuff since the NSAKEY saga.
chrisseaton 11y ago
When you say 'nation state' do you mean the USA? Because the USA is pretty much the polar opposite of a nation state. Nation states are states which are also nationalities, with people generally sharing a common ethnicity and language. That's totally the opposite of the 'melting pot' of the USA. http://www.oxforddictionaries.com/definition/english/nation-state http://www.oxforddictionaries.com/definition/english/nation-....
- curt15 11y ago
  I can't imagine MS getting the approval to sell its products in China without kowtowing to the regime's censorship and surveillance demands.
- jessaustin 11y ago
  Nations and nationalities did not exist before the 19th century. Imagining that the people of any nation shared "a common ethnicity and language" required forgetting centuries of history.
finid 11y ago
> It's not implausible that the NSA and GCHQ would ask Microsoft to slip in a few bugs here and there that makes surveillance much easier. If a "bug" was intentional inserted into a code, then it's not a bug. It's a backdoor.
yread 11y ago
If you're relying on "private browsing" or "incognito mode" to protect you from nation state adversaries you're gonna have a bad time. This is a poorly implemented feature, not something meant to penetrate your tin foil hat.

Ntrails 11y ago

>It's the same company that builds a full disk encryption system (BitLocker) that sends your encryption keys back to Microsoft's servers Every time someone says that as though it's not the absolute correct thing for MS to do given it's standard home-user technical level/expectation I'm super confused. I would expect it to be possible to turn that off, but you can be damned sure that swathes of their users expect to be able to ring MS when they forgot their bitlocker key. >it's the same company that pushed for an "always on" HD webcam and microphone bundled with an "always online" video game console. They want you to always be able to use voice and gesture controls with your console - because if you have to stand up and press a button to turn the damned thing on then what's the value in half the functionality? I'm confident MS are actually more interested in their profit margins than they are by any conspiratorial opportunities with the security services. Casting the latter as their primary motivation all the time is disingenuous.

babuskov 11y ago
As long as convenience trumps security in people's minds, there won't be real security anywhere. I have to admit I'm lazy and still allow some stuff too. Making security both functional and comfortable is a really hard (impossible?) thing to do.
EGreg 11y ago
It's not either or.
pjc50 11y ago
ring MS How do you even do this? It was hard enough to report a bug as an MSDN subscriber. I don't think they have a vast array of consumer support phone agents, or if they do they keep the number very quiet.
- caskance 11y ago
  Search google for something like "microsoft tech support phone number"?

cm2187 11y ago

It can't be a bug. I can't think that the designers when implementing a privacy mode would think, oh let's store all of that in the primary cache or let's store the history there. Unless Microsoft employs some complete idiots. Probably more that they never intended this mode to be secure.

creshal 11y ago
> oh let's store all of that in the primary cache or let's store the history there. It could be simply a bug that disabling the caches for private browsing didn't work as intended. Of course, barring a whistleblower, we'll never know. Yay closed source software.
- cm2187 11y ago
  I would be surprised if private browsing meant no caching. I would have rather have implemented it as a separate / in-memory or encrypted cache.
  - therein 11y ago
    Is that what Chrome does? It seems like it has an in-memory session that stays intact unless all incognito windows are closed. When I login somewhere, close all but one incognito tab and then navigate to that website again, my cookies are still there. Also let's hope they aren't sending different headers like DNT etc. when in private mode, which would make fingerprinting a lot easier.
    - cm2187 11y ago
      I am pretty sure your authentication cookie isn't shared between your regular and privacy sessions.
      - ptaipale 11y ago
        Yes, but it's shared between different sites within your "incognito" session. Open an incognito window, log in to Google, then go to some other place, and your Google login information is seen by that site.

nailer 11y ago

> Microsoft has a history of conspiring with nation state adversaries. Not doubting you, but do you have references? I haven't heard much directly about this stuff since the NSAKEY saga.

chrisseaton 11y ago

When you say 'nation state' do you mean the USA? Because the USA is pretty much the polar opposite of a nation state. Nation states are states which are also nationalities, with people generally sharing a common ethnicity and language. That's totally the opposite of the 'melting pot' of the USA. http://www.oxforddictionaries.com/definition/english/nation-state http://www.oxforddictionaries.com/definition/english/nation-....

curt15 11y ago
I can't imagine MS getting the approval to sell its products in China without kowtowing to the regime's censorship and surveillance demands.
jessaustin 11y ago
Nations and nationalities did not exist before the 19th century. Imagining that the people of any nation shared "a common ethnicity and language" required forgetting centuries of history.

finid 11y ago

> It's not implausible that the NSA and GCHQ would ask Microsoft to slip in a few bugs here and there that makes surveillance much easier. If a "bug" was intentional inserted into a code, then it's not a bug. It's a backdoor.

yread 11y ago

If you're relying on "private browsing" or "incognito mode" to protect you from nation state adversaries you're gonna have a bad time. This is a poorly implemented feature, not something meant to penetrate your tin foil hat.