4 ms·

I can't believe how stupid Microsoft is. This is never a bug. You can't be that amateurish. They've just started earning some trust and respect from the users

I can't believe how stupid Microsoft is. This is never a bug. You can't be that amateurish. They've just started earning some trust and respect from the users and then this. Also, the Windows 10 privacy nebulosity. Why not just leave the user's privacy alone? There's still enough business with Windows itself. No need to be so greedy and try to compete with Google. How shall I trust Microsoft enough to put my data on Azure? Or by a Windows 10 phone? So stupid. What the hell did they want to do with private browsing data? Was it worth it?

baldfat 11y ago
> No need to be so greedy and try to compete with Google Google has been very upfront on exactly how their business model works with users since day one. I don't find this comparison warranted.
- KaterKarlo 11y ago
  It's more obvious now, but I think it has been quite a process from day one and still a lot of customers don't understand how they pay for the services google provides.
  - baldfat 11y ago
    I feel like this is a common Internet Legend. People were 100% aware of gmail and its privacy since day one. http://www.pcworld.com/article/115692/article.html http://www.pcworld.com/article/115692/article.html EDIT: Quote > But Google is planning to scan e-mail and add advertisements that it thinks are relevant to the messages. Additionally, the Gmail privacy policy warns that messages, even if "deleted" by a user, may still be stored in the system, even long after users have closed their account--something that some privacy campaigners believe may be in conflict with U.S. and European data protection and privacy laws. Article about privacy right there. I talk with people and they always say Google was forced into reviling they read people's gmail. Wasn't true.
    - throwawaykf05 11y ago
      Just because it's in some ToS doesn't mean people were "100% aware of its privacy". A large percentage of people still don't know about it.
      - jellicle 11y ago
        It's still not in the TOS today. You can read Google's privacy pages today in vain for a mention of "we read all of your incoming and outgoing email and sell the information to companies so they can target ads at you". The closest statements are mealy-mouthed ones along the lines of "we collect information about how you use our services and use that information to improve our services". Which is true of every single business in the history of the world.
        magicalist 11y ago
        > The closest statements are mealy-mouthed ones along the lines of "we collect information about how you use our services and use that information to improve our services". > Our automated systems analyze your content (including emails) to provide you personally relevant product features, such as customized search results, tailored advertising, and spam and malware detection. https://www.google.com/intl/en/policies/terms/ https://www.google.com/intl/en/policies/terms/
        jfuhrman 11y ago
        So, does that mean, for example, anything you type in a non-public Google Docs is auto scanned for advertising purposes?
    - wging 11y ago
      > People were 100% aware of gmail and its privacy since day one. I think that statement is too general. From where I was sitting, it looked like people didn't think about privacy at all, and the only thing they were saying was "Holy shit, this is free!" Are you sure the people you tend to talk to are representative of the general population?
  - deleted 11y ago
    [deleted]
    - baldfat 11y ago
      Well I fail to see HOW Microsoft makes money on browser history? I do find it VERY interesting that the first time we get to see the "New Microsoft" profits that the profits were down BUT higher for "cloud." > Under his leadership, Microsoft has been shifting its business towards cloud services, such as Microsoft Azure, Dynamics CRM and Office 365. http://www.computerweekly.com/news/4500272095/Microsoft-share-price-up-despite-fall-in-profits http://www.computerweekly.com/news/4500272095/Microsoft-shar...
      - scholia 11y ago
        The profits were down in the GAAP numbers which involved Microsoft deferring $1.9 billion in revenues. In the non-GAAP (traditional) numbers, revenues were down 2 percent but profits up by 8 percent. This is why the shares jumped in after-hours trading. Otherwise, yes, revenues in the More Personal Computing division were down (with the PC market) while Intelligent Cloud division revenues were up slightly.
- ntakasaki 11y ago
  >Google has been very upfront on exactly how their business model works with users since day one. I don't find this comparison warranted. That couldn't be further from the truth. How many people know Google using location data from Android phones to track which physical stores users visit? They were even mining paid Google Apps for Business accounts for tracking data. From http://www.edweek.org/ew/articles/2014/03/13/26google.h33.html http://www.edweek.org/ew/articles/2014/03/13/26google.h33.ht... Highlights: "As part of a potentially explosive lawsuit making its way through federal court, the giant online-services provider Google has acknowledged scanning the contents of millions of email messages sent and received by student users of the company’s Apps for Education tool suite for schools. In the suit, the Mountain View, Calif.-based company also faces accusations from plaintiffs that it went further, crossing a “creepy line” by using information gleaned from the scans to build “surreptitious” profiles of Apps for Education users that could be used for such purposes as targeted advertising." "A Google spokeswoman confirmed to Education Week that the company “scans and indexes” the emails of all Apps for Education users for a variety of purposes, including potential advertising, via automated processes that cannot be turned off—even for Apps for Education customers who elect not to receive ads. The company would not say whether those email scans are used to help build profiles of students or other Apps for Education users, but said the results of its data mining are not used to actually target ads to Apps for Education users unless they choose to receive them." ... "Student-data-privacy experts contend that the latter claim is contradicted by Google’s own court filings in the California suit. They describe the case as highly troubling and likely to further inflame rising national concern that protection of children’s private educational information is too lax." "Mr. Thiele said his district has used Google Apps for Education since 2008. Officials there have always been aware that the company does “back-end processing” of students’ email messages, he said, but the district’s agreement with Google precludes such data from being used to serve ads to students or staff members. As long as the company abides by those terms, Mr. Thiele said, “I don’t have any problem with it.” In an emailed statement provided to Education Week, Bram Bout, the director of Google Apps for Education, said that “ads in Gmail are turned off by default for Google Apps for Education and we have no plans to change that in the future.”" ... "Those plaintiffs in the California lawsuit allege that Google treats Google Apps for Education email users virtually the same as it treats consumer Gmail users. That means not only mining students’ email messages for key words and other information, but also using resulting data—including newly created derivative information, or “metadata”—for “secret user profiling” that could serve as the basis for such activities as delivering targeted ads in Google products other than Apps for Education, such as Google Search, Google+, and YouTube." "The plaintiffs allege that Google has employed such practices since around 2010, when it began using a new technology, known as Content Onebox, that allows the company to intercept and scan emails before they reach their intended recipients, rather than after messages are delivered to users’ inboxes, regardless of whether ads are turned off." "While the allegations by the plaintiffs are explosive, it’s the sworn declarations of Google representatives in response to their claims that have truly raised the eyebrows of observers and privacy experts. Contrary to the company’s earlier public statements, Google representatives acknowledged in a September motion to dismiss the plaintiffs’ request for class certification that the company’s consumer-privacy policy applies to Apps for Education users. Thus, Google argues, it has students’ (and other Apps for Education users’) consent to scan and process their emails." "In November, Kyle C. Wong, a lawyer representing Google, also argued in a formal declaration submitted to the court in opposition to the plaintiffs’ motion for class certification that the company’s data-mining practices are widely known, and that the plaintiffs’ complaints that the scanning and processing of their emails was done secretly are thus invalid. Mr. Wong cited extensive media coverage about Google’s data mining of Gmail consumer users’ >Mr. Wong’s inclusion of the following reference to the disclosure provided to students at the University of Alaska particularly caught the attention of privacy advocates: The University of Alaska (“UA”) has a “Google Mail FAQs,” which asks, “I hear that Google reads my email. Is this true?” The answer states, “They do not ‘read’ your email per se. For use in targeted advertising on their other sites, if your email is not encrypted, software (not a person) does scan your email and compile keywords for advertising. For example, if the software looks at 100 emails and identifies the word ‘Doritos’ or ‘camping’ 50 times, they will use that data for advertising on their other sites.” “The fact that Google put this in their declaration means we take it as true,” said Ms. Barnes of the privacy watchdog group EPIC. Google’s sworn court statements reveal that the company has violated student trust by using students’ education records for profit.” From a Google filing in court about Gmail privacy: >Indeed, “a person has no legitimate expectation of privacy in information he voluntarily turns over to third parties.” Smith v. Maryland, 442 U.S. 735, 743-44 (1979). >it's "inconceivable" that someone using a Gmail account would not be aware that the information in their email would be known to Google.
amelius 11y ago
I hate to say it, but 99% of users don't seem to care about online privacy, unless you ask them.
- onion2k 11y ago
  They may not care about the government snooping on them, or that they're tracked by ad retargeting companies, but everyone who uses private browsing mode does care about it being private and not leaking a list of the porn sites they've visited. This will put people off using Edge.
pweissbrod 11y ago
If you play devil's advocate and assume Microsoft's excuse then this seems to expose a staggering disregard for product quality. It lines up with similar things coming out their windows mobile department this year, it is a common sign in software companies with a lack of focus, working aggressively/quickly on too many things at the same time.
justaman 11y ago
... I mean.... I pretty much only use private browsing for porn...so......
zeta0134 11y ago
Really? This is an extremely easy bug to write, and given the way Microsoft APIs tend to work, I'd bet the layering of their code made it difficult to spot. You have a process that needs to work for, in its mindset, "all tabs," which tries to recover them after a browser crash. You have a different flag on these tabs which is supposed to signal that disk-writing and history are not stored. Sounds easy, but the reality is that there are probably dozens of parts of the code that could potentially write recoverable history. Cookies, cache data for images and resources, the normal history writing functions, those are all the obvious ones to check. The anti-crash feature? Yeah, I can see it being missed. Yes, their security audits should have caught this, but don't call it an amateurish bug simply because it seems obvious in hindsight. (Though to be entirely fair, this is also why I won't use Microsoft products. If a reporter hadn't called them out on it, would it ever have been fixed?)
- dragontamer 11y ago
  The only way security issues are ever fixed is when reporters call them out on it. Or do you think Stagefright on Android would have ever been fixed if the exploit wasn't publicly disclosed? The threat of public disclosure is the only thing security researchers have as leverage to get a company to do the right thing.
  - odbol_ 11y ago
    Oh, Stagefright was fixed? I wonder when someone will tell my phone manufacturer...
- na85 11y ago
  >Really? This is an extremely easy bug to write, and given the way Microsoft APIs tend to work, I'd bet the layering of their code made it difficult to spot. Their APIs work that way due to ineptitude.
drzaiusapelord 11y ago
>This is never a bug. You can't be that amateurish. As someone who has been a sysadmin for a decade in environments that are at least 50% MS, I can tell you that, yes, they can be that amateurish and usually are. In other words, Hanlon's razor. Microsoft, even at its best, is definitely a 'wait for SP1 before putting in production' company. Now with Nadella, they're even worse, and Win10 was clearly rushed to stop the poor publicity of Win8. Win10 won't be fully cooked until 2017-2018 at this rate. Also, history of this happening in Chrome and Firefox: http://www.ghacks.net/2016/01/11/chrome-incognito-mode-leak/ http://www.ghacks.net/2016/01/11/chrome-incognito-mode-leak/ https://bugzilla.mozilla.org/show_bug.cgi?id=709326 https://bugzilla.mozilla.org/show_bug.cgi?id=709326 Lastly, you have to be a fool to think private modes save you from any kind of snooping. At best, they just make purging history easier. At worst, they give people a false sense of security. Your stuff is sniffable all down the line unless you're using a VPN or Tor.
KirinDave 11y ago
If you are concerned about Windows 10 instrumentation and Privacy I strongly advise you to not use OSX. You can watch it send many of the same signals. EDIT: Very confused why this post was downvoted. The post above is clearly concerned about privacy and the topic is very relevant. It's also true, and trivially verifiable.

baldfat 11y ago

> No need to be so greedy and try to compete with Google Google has been very upfront on exactly how their business model works with users since day one. I don't find this comparison warranted.

KaterKarlo 11y ago
It's more obvious now, but I think it has been quite a process from day one and still a lot of customers don't understand how they pay for the services google provides.
- baldfat 11y ago
  I feel like this is a common Internet Legend. People were 100% aware of gmail and its privacy since day one. http://www.pcworld.com/article/115692/article.html http://www.pcworld.com/article/115692/article.html EDIT: Quote > But Google is planning to scan e-mail and add advertisements that it thinks are relevant to the messages. Additionally, the Gmail privacy policy warns that messages, even if "deleted" by a user, may still be stored in the system, even long after users have closed their account--something that some privacy campaigners believe may be in conflict with U.S. and European data protection and privacy laws. Article about privacy right there. I talk with people and they always say Google was forced into reviling they read people's gmail. Wasn't true.
  - throwawaykf05 11y ago
    Just because it's in some ToS doesn't mean people were "100% aware of its privacy". A large percentage of people still don't know about it.
    - jellicle 11y ago
      It's still not in the TOS today. You can read Google's privacy pages today in vain for a mention of "we read all of your incoming and outgoing email and sell the information to companies so they can target ads at you". The closest statements are mealy-mouthed ones along the lines of "we collect information about how you use our services and use that information to improve our services". Which is true of every single business in the history of the world.
      - magicalist 11y ago
        > The closest statements are mealy-mouthed ones along the lines of "we collect information about how you use our services and use that information to improve our services". > Our automated systems analyze your content (including emails) to provide you personally relevant product features, such as customized search results, tailored advertising, and spam and malware detection. https://www.google.com/intl/en/policies/terms/ https://www.google.com/intl/en/policies/terms/
        jfuhrman 11y ago
        So, does that mean, for example, anything you type in a non-public Google Docs is auto scanned for advertising purposes?
  - wging 11y ago
    > People were 100% aware of gmail and its privacy since day one. I think that statement is too general. From where I was sitting, it looked like people didn't think about privacy at all, and the only thing they were saying was "Holy shit, this is free!" Are you sure the people you tend to talk to are representative of the general population?
- deleted 11y ago
  [deleted]
  - baldfat 11y ago
    Well I fail to see HOW Microsoft makes money on browser history? I do find it VERY interesting that the first time we get to see the "New Microsoft" profits that the profits were down BUT higher for "cloud." > Under his leadership, Microsoft has been shifting its business towards cloud services, such as Microsoft Azure, Dynamics CRM and Office 365. http://www.computerweekly.com/news/4500272095/Microsoft-share-price-up-despite-fall-in-profits http://www.computerweekly.com/news/4500272095/Microsoft-shar...
    - scholia 11y ago
      The profits were down in the GAAP numbers which involved Microsoft deferring $1.9 billion in revenues. In the non-GAAP (traditional) numbers, revenues were down 2 percent but profits up by 8 percent. This is why the shares jumped in after-hours trading. Otherwise, yes, revenues in the More Personal Computing division were down (with the PC market) while Intelligent Cloud division revenues were up slightly.
ntakasaki 11y ago
>Google has been very upfront on exactly how their business model works with users since day one. I don't find this comparison warranted. That couldn't be further from the truth. How many people know Google using location data from Android phones to track which physical stores users visit? They were even mining paid Google Apps for Business accounts for tracking data. From http://www.edweek.org/ew/articles/2014/03/13/26google.h33.html http://www.edweek.org/ew/articles/2014/03/13/26google.h33.ht... Highlights: "As part of a potentially explosive lawsuit making its way through federal court, the giant online-services provider Google has acknowledged scanning the contents of millions of email messages sent and received by student users of the company’s Apps for Education tool suite for schools. In the suit, the Mountain View, Calif.-based company also faces accusations from plaintiffs that it went further, crossing a “creepy line” by using information gleaned from the scans to build “surreptitious” profiles of Apps for Education users that could be used for such purposes as targeted advertising." "A Google spokeswoman confirmed to Education Week that the company “scans and indexes” the emails of all Apps for Education users for a variety of purposes, including potential advertising, via automated processes that cannot be turned off—even for Apps for Education customers who elect not to receive ads. The company would not say whether those email scans are used to help build profiles of students or other Apps for Education users, but said the results of its data mining are not used to actually target ads to Apps for Education users unless they choose to receive them." ... "Student-data-privacy experts contend that the latter claim is contradicted by Google’s own court filings in the California suit. They describe the case as highly troubling and likely to further inflame rising national concern that protection of children’s private educational information is too lax." "Mr. Thiele said his district has used Google Apps for Education since 2008. Officials there have always been aware that the company does “back-end processing” of students’ email messages, he said, but the district’s agreement with Google precludes such data from being used to serve ads to students or staff members. As long as the company abides by those terms, Mr. Thiele said, “I don’t have any problem with it.” In an emailed statement provided to Education Week, Bram Bout, the director of Google Apps for Education, said that “ads in Gmail are turned off by default for Google Apps for Education and we have no plans to change that in the future.”" ... "Those plaintiffs in the California lawsuit allege that Google treats Google Apps for Education email users virtually the same as it treats consumer Gmail users. That means not only mining students’ email messages for key words and other information, but also using resulting data—including newly created derivative information, or “metadata”—for “secret user profiling” that could serve as the basis for such activities as delivering targeted ads in Google products other than Apps for Education, such as Google Search, Google+, and YouTube." "The plaintiffs allege that Google has employed such practices since around 2010, when it began using a new technology, known as Content Onebox, that allows the company to intercept and scan emails before they reach their intended recipients, rather than after messages are delivered to users’ inboxes, regardless of whether ads are turned off." "While the allegations by the plaintiffs are explosive, it’s the sworn declarations of Google representatives in response to their claims that have truly raised the eyebrows of observers and privacy experts. Contrary to the company’s earlier public statements, Google representatives acknowledged in a September motion to dismiss the plaintiffs’ request for class certification that the company’s consumer-privacy policy applies to Apps for Education users. Thus, Google argues, it has students’ (and other Apps for Education users’) consent to scan and process their emails." "In November, Kyle C. Wong, a lawyer representing Google, also argued in a formal declaration submitted to the court in opposition to the plaintiffs’ motion for class certification that the company’s data-mining practices are widely known, and that the plaintiffs’ complaints that the scanning and processing of their emails was done secretly are thus invalid. Mr. Wong cited extensive media coverage about Google’s data mining of Gmail consumer users’ >Mr. Wong’s inclusion of the following reference to the disclosure provided to students at the University of Alaska particularly caught the attention of privacy advocates: The University of Alaska (“UA”) has a “Google Mail FAQs,” which asks, “I hear that Google reads my email. Is this true?” The answer states, “They do not ‘read’ your email per se. For use in targeted advertising on their other sites, if your email is not encrypted, software (not a person) does scan your email and compile keywords for advertising. For example, if the software looks at 100 emails and identifies the word ‘Doritos’ or ‘camping’ 50 times, they will use that data for advertising on their other sites.” “The fact that Google put this in their declaration means we take it as true,” said Ms. Barnes of the privacy watchdog group EPIC. Google’s sworn court statements reveal that the company has violated student trust by using students’ education records for profit.” From a Google filing in court about Gmail privacy: >Indeed, “a person has no legitimate expectation of privacy in information he voluntarily turns over to third parties.” Smith v. Maryland, 442 U.S. 735, 743-44 (1979). >it's "inconceivable" that someone using a Gmail account would not be aware that the information in their email would be known to Google.

amelius 11y ago

I hate to say it, but 99% of users don't seem to care about online privacy, unless you ask them.

onion2k 11y ago
They may not care about the government snooping on them, or that they're tracked by ad retargeting companies, but everyone who uses private browsing mode does care about it being private and not leaking a list of the porn sites they've visited. This will put people off using Edge.

pweissbrod 11y ago

If you play devil's advocate and assume Microsoft's excuse then this seems to expose a staggering disregard for product quality. It lines up with similar things coming out their windows mobile department this year, it is a common sign in software companies with a lack of focus, working aggressively/quickly on too many things at the same time.

justaman 11y ago

... I mean.... I pretty much only use private browsing for porn...so......

zeta0134 11y ago

Really? This is an extremely easy bug to write, and given the way Microsoft APIs tend to work, I'd bet the layering of their code made it difficult to spot. You have a process that needs to work for, in its mindset, "all tabs," which tries to recover them after a browser crash. You have a different flag on these tabs which is supposed to signal that disk-writing and history are not stored. Sounds easy, but the reality is that there are probably dozens of parts of the code that could potentially write recoverable history. Cookies, cache data for images and resources, the normal history writing functions, those are all the obvious ones to check. The anti-crash feature? Yeah, I can see it being missed. Yes, their security audits should have caught this, but don't call it an amateurish bug simply because it seems obvious in hindsight. (Though to be entirely fair, this is also why I won't use Microsoft products. If a reporter hadn't called them out on it, would it ever have been fixed?)

dragontamer 11y ago
The only way security issues are ever fixed is when reporters call them out on it. Or do you think Stagefright on Android would have ever been fixed if the exploit wasn't publicly disclosed? The threat of public disclosure is the only thing security researchers have as leverage to get a company to do the right thing.
- odbol_ 11y ago
  Oh, Stagefright was fixed? I wonder when someone will tell my phone manufacturer...
na85 11y ago
>Really? This is an extremely easy bug to write, and given the way Microsoft APIs tend to work, I'd bet the layering of their code made it difficult to spot. Their APIs work that way due to ineptitude.

drzaiusapelord 11y ago

>This is never a bug. You can't be that amateurish. As someone who has been a sysadmin for a decade in environments that are at least 50% MS, I can tell you that, yes, they can be that amateurish and usually are. In other words, Hanlon's razor. Microsoft, even at its best, is definitely a 'wait for SP1 before putting in production' company. Now with Nadella, they're even worse, and Win10 was clearly rushed to stop the poor publicity of Win8. Win10 won't be fully cooked until 2017-2018 at this rate. Also, history of this happening in Chrome and Firefox: http://www.ghacks.net/2016/01/11/chrome-incognito-mode-leak/ http://www.ghacks.net/2016/01/11/chrome-incognito-mode-leak/ https://bugzilla.mozilla.org/show_bug.cgi?id=709326 https://bugzilla.mozilla.org/show_bug.cgi?id=709326 Lastly, you have to be a fool to think private modes save you from any kind of snooping. At best, they just make purging history easier. At worst, they give people a false sense of security. Your stuff is sniffable all down the line unless you're using a VPN or Tor.

KirinDave 11y ago

If you are concerned about Windows 10 instrumentation and Privacy I strongly advise you to not use OSX. You can watch it send many of the same signals. EDIT: Very confused why this post was downvoted. The post above is clearly concerned about privacy and the topic is very relevant. It's also true, and trivially verifiable.