13 ms·

France orders Microsoft to stop tracking Windows 10 users

235 points by abhi3 10y ago

brudgers 10y ago
Announcement at CNIL: https://www.cnil.fr/en/windows-10-cnil-publicly-serves-formal-notice-microsoft-corporation-comply-french-data-protection https://www.cnil.fr/en/windows-10-cnil-publicly-serves-forma...
jld89 10y ago
Are there other countries as active as France is concerning the enforcement of user privacy laws and data protection?
- Sylos 10y ago
  Switzerland is usually pretty good at it, and Germany tends to also care, because of their Stasi-history, but the recent trend of "Terrorists killed a handful of people, let's throw away the fundamental rights of our population." hasn't left those two unscathed either...
  - pilif 10y ago
    Switzerland has horrendous data retention laws that just got even worse. Providers and services are forced to keep all user data for 2 years available for the state to access it So what you gain in privacy vs private entities you lose with regards to the state having complete access to all of your online life.
  - CatsoCatsoCatso 10y ago
    >Terrorists killed a handful of people 234 people dying from terror attacks in France in the last 18 months is not a handful. Don't just dismiss their deaths so heartlessly as a "handful". Shame on you.
    - chopin 10y ago
      3788 deaths in France in 2014 by road accidents alone. We're not going to dismiss fundamental rights for those, aren't we? I wish people would put things more into perspective. I personally fear state powers much more than terrorism.
    - cm2187 10y ago
      Realistically it's an average air crash. At the scale of a population like France it is almost meaningless. Drowning kills several orders of magnitude more. I don't see calls for changing the constitution to reduce the number of drownings. Or suicidal airline pilots...
      - leakybit 10y ago
        Typical Liberal broadsided thinking, We can't change the constitution just because terrorists are killing a marginal amount of people but we should change the constitution to ban guns because mass shootings are killing a marginal amount of people.
      - angry-hacker 10y ago
        But it's one airplane crash too many. I don't understand your point. We shouldn't care?
        EdHominem 10y ago
        Do you ban airplanes? Or the taxis that get people to the airport? Or apps that tell people when flights are scheduled? Right, of course not. It's not that you shouldn't care, it's that you should care in proportion to the seriousness. 234 death is fifteen days of 2014's driving fatalities. Why do you hate the children so much that you don't care to save them except from movie-plot deaths?
        smhenderson 10y ago
        Not to answer for the parent but IMHO it's not so much we shouldn't care. It's we should be very careful about what rights and freedoms we give up and how much power we give to a state to scrutinize our daily lives when the very thing we are trying to prevent has not had a major impact on our daily lives. Yes, it had a major impact on some people and their families and their pain is not to be dismissed lightly but on the other hand we should not give up our way of life to prevent these things from happening, especially when evidence supports that the new laws that are written after these events seem to do very little to actually further protect us. While a little sensational I think the graphic in this article concerning the TSA in the US does a pretty decent job of summing up exactly what we've gotten from "enhanced" security in the US. https://www.techdirt.com/articles/20120405/04390118385/tsa-security-theater-described-one-simple-infographic.shtml https://www.techdirt.com/articles/20120405/04390118385/tsa-s...
- rihegher 10y ago
  Make no mistake, CNIL is only active to reach out big companies such as Facebook, Google or Yahoo so that the medias can speaks about CNIL as active. Apart from that and from rewarding people by getting a well paid job inside it, CNIL is useless since 1978. I remember listening to my law teacher in IT school back in 2000 telling us that CNIL doesn't have the budget nor the will to ensure anything. Well now it's 2016 the commission has a 20M€ budget so they have to justify it by having some existence in the media. for those who reads french: http://www.20minutes.fr/societe/659250-20110126-societe-la-cnil-epinglee-cour-comptes-propos-certaines-derives http://www.20minutes.fr/societe/659250-20110126-societe-la-c... https://www.data.gouv.fr/s/resources/budget-de-la-cnil-1/20160414-180224/OpenCNIL_Budget_depuis_2000_20160414.csv https://www.data.gouv.fr/s/resources/budget-de-la-cnil-1/201...
  - Totoradio 10y ago
    This is anectodal evidence, but I personally saw a CNIL inspection at a previous workplace (semi-big company in France, ~2000 employees at the time). 2 inspectors came in unannounced one morning and snatched a DBA to see what personal info was in all of our databases (Dev,Staging and Prod). They also did other inspections regarding our handling of personal data.
- NumberCruncher 10y ago
  Yes, see Denmark on data protection: https://news.ycombinator.com/item?id=12128410 https://news.ycombinator.com/item?id=12128410
dogma1138 10y ago
Windows 10 petite edition - coming soon.
- dingaling 10y ago
  Or perhaps the opposite; sell only the Enterprise edition in France, with its ability to disable telemetry... at a price.
  - throwaway7767 10y ago
    It's not possible to disable telemetry completely, even on enterprise. You can select between "Extended", "Normal" and "Basic" (I think those were the names anyway).
    - ryuuchin 10y ago
      Enterprise users get a 4th option called "security" for telemetry I think (which in gpedit is option 0 I believe). I think it sends even less than basic and as the name implies it only sends security relevant telemetry (Defender, MRT, etc).
  - tajen 10y ago
    ...and lose market share. Microsoft really needs to keep its product proeminent, especially today, especially in home products. So the EU commission actually has leverage to forbid certain behaviours. Microsoft, then Android, please ;)
    - Grishnakh 10y ago
      Oh please, what are people going to do, switch to Macs? Or Linux? People have shown over and over that they're willing to accept any treatment Microsoft sees fit to give them, and that they will not abandon the Windows platform no matter what. MS can do whatever they want and customers will just take it.
      - 10y ago
satysin 10y ago
Is there any accurate analysis of exactly what Microsoft collects in Windows 10? I understand you cannot totally disable the telemetry (with the exception of an Enterprise version) but when put down to the "basic" level is there any capture of what is being sent? Everything I have seen is bullshit anti-Microsoft fairy tale stuff. I understand text and voice data will be captured and sent if you use Cortana but that is pretty obvious, the same is true of Google, Bing, Siri, etc. [0] What I want to know is when I put things at the lowest setting possible what do MS get and how often? Edit: [0] I mean captured and sent for processing. I expect (perhaps wrongly) for it to be deleted from Microsoft's servers as soon as my request has been answered. Unlike Google which stores everything you say to Google Now for example.
- lucb1e 10y ago
  > I understand text and voice data will be captured and sent if you use Cortana but that is pretty obvious. Not really. I was surprised both by Google storing every voice recognition sample they've ever received, and I was also surprised that people weren't totally creeped out and outraged at discovering this. Most people admit to being a little creeped out, but get over it very quickly. Most people don't know this, and I didn't expect it either. Having used voice recognition in the past (like, 8 years ago) they were just programs that worked very badly, but they were the state of the art back then. That they now upload everything ever is recent news to me. It's not all "bullshit anti-{bigCorp} fairy tales" if it's something people genuinely didn't expect.
  - bad_user 10y ago
    IMHO, Google storing voice recognition samples does freak me out, especially because voice recognition is automatically activated by "OK Google" and maybe other triggers and maybe depending on version or the hardware used it's not that good - for example when my wife plays songs on her LG phone, she gets Google's voice recognition activated erroneously all the time. So basically random bugs can get your very private conversations recorded on servers that can be under the control of state agencies and disgruntled employees, possibly stored forever? That's a reason to freak out really.
Ping938 10y ago
I thought it was more than app usage data...
bad_user 10y ago
I would like laws that would force companies to disclose the bad side of what they are doing. When they ask if you want to share what you type or say with them, in order to improve the experience and for you to get more relevant suggestions or more accurate spell checking or whatever, they only focus on the positives. But that's not enough. I want them to say that your delicate and private conversations might leak and be used for nefarious purposes by disgruntled employees, state agencies, hackers or future owners of that data, because that's the truth. Much like how cigarettes packs have graphical warnings on them. I'd like that very much, because as an ex-smoker I can tell you that those work. But of course, it would hurt their business to admit it, so they'll never do it willfully.
- cm2187 10y ago
  Or like the financial industry, which products are deemed too complex to the average client. They must disclose and inisist on the risks of a product. Windows pretty much checks the box in term of complexity to the average user.
  - Kristine1975 10y ago
    >They must disclose and inisist on the risks of a product. By giving me a 50+ pages brochure. Just like EULA's hide the nasty stuff among huge amounts of text. Sure it's better than nothing, but still far from perfect IMO.
    - cm2187 10y ago
      No no. If you trade something on margin or borrow money, in many countries like in the UK, all the marketing material has to clearly state the risks. All mortgage ads have a big banner "if you do not make your payments your house may be repossessed". A derivative contract with a mid-size company is now deemed missold if the marketing material doesn't highlights adverse or worst case scenario. These are not font 6 footnotes in the terms and conditions.
      - 10y ago
sievebrain 10y ago
Ah, CNIL. What counts as "excessive"? Apparently whatever someone at CNIL thinks is excessive. I can imagine that Microsoft learning what apps you download is inevitable given their reputation based malware detection scheme: no way for that to easily work except by IE checking in with Microsoft to find out if a program is known malicious or not. And figuring out if a program is actually interacted with or not seems like a pretty good signal to determine if a new, unknown program is a silent botnet or not. "4-PIN limit is insecure, because there's no limit on the number of accesses" is exactly the kind of bureaucratic central-planning nonsense that France has so many problems with. You do not need absolute counted limits on a password/PIN system to make it secure. You just need to take other steps to make brute forcing infeasible, like throttling the rate of attempts. Why is CNIL attempting to micro-manage the code for the Windows authentication systems, something they are clearly not qualified to do? The details of Microsoft's security system is their concern alone: if users dislike the way Microsoft do it, then they have other alternatives they can easily switch to. I suspect Microsoft may do what other big companies do and simply ignore CNIL completely. They can only hand out relatively small fines and it's easy for big companies to just pay them off to make them go away. Their rulings have a long history of being completely unreasonable so it's usually the easiest path.
- zeroer 10y ago
  > if users dislike the way Microsoft do it, then they have other alternatives they can easily switch to. All evidence seems to suggest that the French are not big fans of the free market, because that would create winners and losers.
  - ionised 10y ago
    You know nothing about French history.
    - zeroer 10y ago
      What of it?
- liotier 10y ago
zamalek 10y ago
> Microsoft: users are in control with the ability to determine what information is collected > Microsoft: so enterprise customers will be able to completely turn off telemetry if they choose[1] Which is it, Microsoft? [1]: http://www.techrepublic.com/article/windows-10-now-lets-you-turn-off-tracking-but-only-if-youre-a-business/ http://www.techrepublic.com/article/windows-10-now-lets-you-...
- Piskvorrr 10y ago
  "Determine" also means "find out"; not necessarily "decide".
  - zamalek 10y ago
    > find out What is the wire format of the telemetry data? How do I access the UI that tells me exactly what telemetry has been sent to Microsoft?
    - Piskvorrr 10y ago
      Don't ask me, I'm not MS. Just pointing out that there's enough weasel words in there that the text can be twisted to be sort-of-not-entirely-false.
      - zamalek 10y ago
        I can agree on that point. The point of my comment wasn't necessarily the truthfulness of either quote, merely that they really need to follow through on what they are saying. Their hands and mouth seem to be in a state of disconnection.
acd 10y ago
I switched to Ubuntu because of Windows 10. Using Linux as a primary operating system works great as a developer. There is a saying which says if a product are free "you are the product". Microsoft made the upgrade to Windows 10 free a guess so that they can mine data about you and your habits. That data is valuable for marketing purposes. Wireshark traffic dumps show a lot of data going to Microsoft telemetery. I choose to say no to that data collection, instead wanting to keep a bit of privacy. Have some security wiz MITM the Microsoft telemetry server with their own cert to inspect the data collection traffic?
- Meegul 10y ago
  I recommend disabling some of the Amazon integration in Unity if you're concerned about your privacy. This shouldn't be too difficult, even if you're new to Linux. I 'd also suggest getting Unity-tweak-tool and playing around with some of the settings in there. EDIT: Just realized that since 16.04, Ubuntu no longer has online search results enabled by default in the Dash. Still though, play around with some of the settings!
  - 0xmohit 10y ago
    One doesn't really need Unity, does one? Openbox is awesome. It doesn't hog system resources either.
    - Sylos 10y ago
      Yeah, but Openbox isn't suitable for new users, at least not on its own. As part of something like LXDE or LXQt, it's definitely workable, but without a deeper understanding of Openbox, those are pretty much as good as any other Desktop Environment (except maybe that LXDE/LXQt are also among the lightest DEs around). I would rather recommend either Ubuntu GNOME, if you want a rather unconvential, but highly integrated, highly user-friendly interface, or Linux Mint Cinnamon, if you want a cleaned up Windows-like interface, or Kubuntu, if you want a Windows-like interface which just smothers you in options, tweaks and customizability.
- bad_user 10y ago
72deluxe 10y ago
I have LittleSnitch on my Mac and observe the requests that my Windows VM makes. I believe you can use an equivalent tool on Windows, such as GlassWire, or also the very useful tool O&O ShutUp10 with which you can disable telemetry settings.
- izacus 10y ago
  Of course seeing what OS X does over network by itself (and the apps installed) is kinda scary as well :/
- Sylos 10y ago
  Wireshark is most commonly used for packet sniffing. https://www.wireshark.org/ https://www.wireshark.org/
Taek 10y ago
People are giving special attention to the things that Microsoft is doing, but history shows that they will eventually accept it and live with it. Facebook has been doing this for a long time, to extremely high degrees of invasiveness. Google as well, and pretty much every single web startup in existence. Collecting data is how you compete in modern business. If you think this Microsoft stuff is a big deal you should have another look at the entire foundation of modern tech.
- frik 10y ago
  You are right, but I bag to differ. Giving out your personal emails or your private life to advertisers is one thing. But an operating system is the lowest dominator and the PC platform is where most data is stored and real work in being done. So Microsoft's 180 degree turn by the CEO from being a trustworthy company to a turning their customers to products is unheard of and very very concerning - especially given they still have a quasi PC monopoly (ca 90% market share). There is a long legacy history , some run up to 30 years old software on Windows and now are concerned with little option to move forward.
  - ocdtrekkie 10y ago
    I agree the OS is the lowest denominator. But given that mobile is predominantly the most common way people do a LOT of things these days, of which Android is also an OS, I think it's noteworthy that Google still manages to escape the level of criticism Microsoft often still gets. My hope is that France can get Microsoft to just enable Telemetry 0 for all licenses, and that maybe they let us here in the US do it too.
    - frik 10y ago
      Is this a calculated derailment technique? Why MS? Because MS is the subject of the article. Feel free to submit articles about others. As mentioned above, you simply cannot compare a smartphone operating system where one handles, emails (in the cloud anyway) some personal apps and a browser to a full desktop operating system where among many other things serious work is done as well as private and enterprise data is stored. Many people don't want to trade access to that data and act as a product - it's as simple as that. Sadly there isn't an Windows 10 edition free of the tracking stuff. Let's hope France gets Microsoft to stop that or offer a new edition without that stuff.
0xmohit 10y ago
With LinkedIn [0], Microsoft has much more in its arsenal. That said, who cares. I've hardly seen anyone use uBlock Origin, Ghostery or Privacy Badger. OTOH, people love tools [1] that read your email and notify about due bills and the like. [0] https://twitter.com/darylginn/status/590664399041519617 https://twitter.com/darylginn/status/590664399041519617 [1] Google Now
ionised 10y ago
This is a step in the right direction, but no fine they can levy will be sufficiently punitive. Companies like this will continue on and consider things like this simply the cost of doing business. Kind of like banks. They don't give a fuck.
- tajen 10y ago
  The EU commission levied a $2bn (yes, billion) fine for Microsoft antitrust problems, i.e. the stupid removal of the choice popup for the browser in XP SP3 and not giving the API documentation to some editor. Those two things were very stupid misgivings by Microsoft: They were almost going out unscattered, and they played with the fire towards the end of the trial. Since then, I like the EU commission. As long as they can bend the master plans of dominating US companies. However, I don't see how the forced Windows upgrade didn't lead to a requirement to reimburse every user of their stripped Windows 8 license.
VOYD 10y ago
Good luck with that.
serge2k 10y ago
> the four-character PIN system used to access Microsoft services is insecure, because there is no limit on the number of attempts a user can make. I just tried logging in with my pin. After a handful of tries I was given a string to enter before I could try again. I did that. After another try I got told to restart the device before I could try again. So it doesn't look like 10 tries and locked out forever, but rather increasing penalties for incorrect attempts. Which is fine. oh and my pin is 6 characters long. If they don't have this right why should we believe them about any of their other claims?

235 points by abhi3 10y ago

Announcement at CNIL: https://www.cnil.fr/en/windows-10-cnil-publicly-serves-formal-notice-microsoft-corporation-comply-french-data-protection https://www.cnil.fr/en/windows-10-cnil-publicly-serves-forma...

jld89 10y ago

Are there other countries as active as France is concerning the enforcement of user privacy laws and data protection?

Sylos 10y ago
Switzerland is usually pretty good at it, and Germany tends to also care, because of their Stasi-history, but the recent trend of "Terrorists killed a handful of people, let's throw away the fundamental rights of our population." hasn't left those two unscathed either...
- pilif 10y ago
  Switzerland has horrendous data retention laws that just got even worse. Providers and services are forced to keep all user data for 2 years available for the state to access it So what you gain in privacy vs private entities you lose with regards to the state having complete access to all of your online life.
- CatsoCatsoCatso 10y ago
  >Terrorists killed a handful of people 234 people dying from terror attacks in France in the last 18 months is not a handful. Don't just dismiss their deaths so heartlessly as a "handful". Shame on you.
  - chopin 10y ago
    3788 deaths in France in 2014 by road accidents alone. We're not going to dismiss fundamental rights for those, aren't we? I wish people would put things more into perspective. I personally fear state powers much more than terrorism.
  - cm2187 10y ago
    Realistically it's an average air crash. At the scale of a population like France it is almost meaningless. Drowning kills several orders of magnitude more. I don't see calls for changing the constitution to reduce the number of drownings. Or suicidal airline pilots...
    - leakybit 10y ago
      Typical Liberal broadsided thinking, We can't change the constitution just because terrorists are killing a marginal amount of people but we should change the constitution to ban guns because mass shootings are killing a marginal amount of people.
    - angry-hacker 10y ago
      But it's one airplane crash too many. I don't understand your point. We shouldn't care?
      - EdHominem 10y ago
        Do you ban airplanes? Or the taxis that get people to the airport? Or apps that tell people when flights are scheduled? Right, of course not. It's not that you shouldn't care, it's that you should care in proportion to the seriousness. 234 death is fifteen days of 2014's driving fatalities. Why do you hate the children so much that you don't care to save them except from movie-plot deaths?
      - smhenderson 10y ago
        Not to answer for the parent but IMHO it's not so much we shouldn't care. It's we should be very careful about what rights and freedoms we give up and how much power we give to a state to scrutinize our daily lives when the very thing we are trying to prevent has not had a major impact on our daily lives. Yes, it had a major impact on some people and their families and their pain is not to be dismissed lightly but on the other hand we should not give up our way of life to prevent these things from happening, especially when evidence supports that the new laws that are written after these events seem to do very little to actually further protect us. While a little sensational I think the graphic in this article concerning the TSA in the US does a pretty decent job of summing up exactly what we've gotten from "enhanced" security in the US. https://www.techdirt.com/articles/20120405/04390118385/tsa-security-theater-described-one-simple-infographic.shtml https://www.techdirt.com/articles/20120405/04390118385/tsa-s...
rihegher 10y ago
Make no mistake, CNIL is only active to reach out big companies such as Facebook, Google or Yahoo so that the medias can speaks about CNIL as active. Apart from that and from rewarding people by getting a well paid job inside it, CNIL is useless since 1978. I remember listening to my law teacher in IT school back in 2000 telling us that CNIL doesn't have the budget nor the will to ensure anything. Well now it's 2016 the commission has a 20M€ budget so they have to justify it by having some existence in the media. for those who reads french: http://www.20minutes.fr/societe/659250-20110126-societe-la-cnil-epinglee-cour-comptes-propos-certaines-derives http://www.20minutes.fr/societe/659250-20110126-societe-la-c... https://www.data.gouv.fr/s/resources/budget-de-la-cnil-1/20160414-180224/OpenCNIL_Budget_depuis_2000_20160414.csv https://www.data.gouv.fr/s/resources/budget-de-la-cnil-1/201...
- Totoradio 10y ago
  This is anectodal evidence, but I personally saw a CNIL inspection at a previous workplace (semi-big company in France, ~2000 employees at the time). 2 inspectors came in unannounced one morning and snatched a DBA to see what personal info was in all of our databases (Dev,Staging and Prod). They also did other inspections regarding our handling of personal data.
NumberCruncher 10y ago
Yes, see Denmark on data protection: https://news.ycombinator.com/item?id=12128410 https://news.ycombinator.com/item?id=12128410

dogma1138 10y ago

Windows 10 petite edition - coming soon.

dingaling 10y ago
Or perhaps the opposite; sell only the Enterprise edition in France, with its ability to disable telemetry... at a price.
- throwaway7767 10y ago
  It's not possible to disable telemetry completely, even on enterprise. You can select between "Extended", "Normal" and "Basic" (I think those were the names anyway).
  - ryuuchin 10y ago
    Enterprise users get a 4th option called "security" for telemetry I think (which in gpedit is option 0 I believe). I think it sends even less than basic and as the name implies it only sends security relevant telemetry (Defender, MRT, etc).
- tajen 10y ago
  ...and lose market share. Microsoft really needs to keep its product proeminent, especially today, especially in home products. So the EU commission actually has leverage to forbid certain behaviours. Microsoft, then Android, please ;)
  - Grishnakh 10y ago
    Oh please, what are people going to do, switch to Macs? Or Linux? People have shown over and over that they're willing to accept any treatment Microsoft sees fit to give them, and that they will not abandon the Windows platform no matter what. MS can do whatever they want and customers will just take it.
    - 10y ago

satysin 10y ago

Is there any accurate analysis of exactly what Microsoft collects in Windows 10? I understand you cannot totally disable the telemetry (with the exception of an Enterprise version) but when put down to the "basic" level is there any capture of what is being sent? Everything I have seen is bullshit anti-Microsoft fairy tale stuff. I understand text and voice data will be captured and sent if you use Cortana but that is pretty obvious, the same is true of Google, Bing, Siri, etc. [0] What I want to know is when I put things at the lowest setting possible what do MS get and how often? Edit: [0] I mean captured and sent for processing. I expect (perhaps wrongly) for it to be deleted from Microsoft's servers as soon as my request has been answered. Unlike Google which stores everything you say to Google Now for example.

lucb1e 10y ago
> I understand text and voice data will be captured and sent if you use Cortana but that is pretty obvious. Not really. I was surprised both by Google storing every voice recognition sample they've ever received, and I was also surprised that people weren't totally creeped out and outraged at discovering this. Most people admit to being a little creeped out, but get over it very quickly. Most people don't know this, and I didn't expect it either. Having used voice recognition in the past (like, 8 years ago) they were just programs that worked very badly, but they were the state of the art back then. That they now upload everything ever is recent news to me. It's not all "bullshit anti-{bigCorp} fairy tales" if it's something people genuinely didn't expect.
- bad_user 10y ago
  IMHO, Google storing voice recognition samples does freak me out, especially because voice recognition is automatically activated by "OK Google" and maybe other triggers and maybe depending on version or the hardware used it's not that good - for example when my wife plays songs on her LG phone, she gets Google's voice recognition activated erroneously all the time. So basically random bugs can get your very private conversations recorded on servers that can be under the control of state agencies and disgruntled employees, possibly stored forever? That's a reason to freak out really.

Ping938 10y ago

I thought it was more than app usage data...

bad_user 10y ago

I would like laws that would force companies to disclose the bad side of what they are doing. When they ask if you want to share what you type or say with them, in order to improve the experience and for you to get more relevant suggestions or more accurate spell checking or whatever, they only focus on the positives. But that's not enough. I want them to say that your delicate and private conversations might leak and be used for nefarious purposes by disgruntled employees, state agencies, hackers or future owners of that data, because that's the truth. Much like how cigarettes packs have graphical warnings on them. I'd like that very much, because as an ex-smoker I can tell you that those work. But of course, it would hurt their business to admit it, so they'll never do it willfully.

cm2187 10y ago
Or like the financial industry, which products are deemed too complex to the average client. They must disclose and inisist on the risks of a product. Windows pretty much checks the box in term of complexity to the average user.
- Kristine1975 10y ago
  >They must disclose and inisist on the risks of a product. By giving me a 50+ pages brochure. Just like EULA's hide the nasty stuff among huge amounts of text. Sure it's better than nothing, but still far from perfect IMO.
  - cm2187 10y ago
    No no. If you trade something on margin or borrow money, in many countries like in the UK, all the marketing material has to clearly state the risks. All mortgage ads have a big banner "if you do not make your payments your house may be repossessed". A derivative contract with a mid-size company is now deemed missold if the marketing material doesn't highlights adverse or worst case scenario. These are not font 6 footnotes in the terms and conditions.
    - 10y ago

sievebrain 10y ago

Ah, CNIL. What counts as "excessive"? Apparently whatever someone at CNIL thinks is excessive. I can imagine that Microsoft learning what apps you download is inevitable given their reputation based malware detection scheme: no way for that to easily work except by IE checking in with Microsoft to find out if a program is known malicious or not. And figuring out if a program is actually interacted with or not seems like a pretty good signal to determine if a new, unknown program is a silent botnet or not. "4-PIN limit is insecure, because there's no limit on the number of accesses" is exactly the kind of bureaucratic central-planning nonsense that France has so many problems with. You do not need absolute counted limits on a password/PIN system to make it secure. You just need to take other steps to make brute forcing infeasible, like throttling the rate of attempts. Why is CNIL attempting to micro-manage the code for the Windows authentication systems, something they are clearly not qualified to do? The details of Microsoft's security system is their concern alone: if users dislike the way Microsoft do it, then they have other alternatives they can easily switch to. I suspect Microsoft may do what other big companies do and simply ignore CNIL completely. They can only hand out relatively small fines and it's easy for big companies to just pay them off to make them go away. Their rulings have a long history of being completely unreasonable so it's usually the easiest path.

zeroer 10y ago
> if users dislike the way Microsoft do it, then they have other alternatives they can easily switch to. All evidence seems to suggest that the French are not big fans of the free market, because that would create winners and losers.
- ionised 10y ago
  You know nothing about French history.
  - zeroer 10y ago
    What of it?
liotier 10y ago

zamalek 10y ago

> Microsoft: users are in control with the ability to determine what information is collected > Microsoft: so enterprise customers will be able to completely turn off telemetry if they choose[1] Which is it, Microsoft? [1]: http://www.techrepublic.com/article/windows-10-now-lets-you-turn-off-tracking-but-only-if-youre-a-business/ http://www.techrepublic.com/article/windows-10-now-lets-you-...

Piskvorrr 10y ago
"Determine" also means "find out"; not necessarily "decide".
- zamalek 10y ago
  > find out What is the wire format of the telemetry data? How do I access the UI that tells me exactly what telemetry has been sent to Microsoft?
  - Piskvorrr 10y ago
    Don't ask me, I'm not MS. Just pointing out that there's enough weasel words in there that the text can be twisted to be sort-of-not-entirely-false.
    - zamalek 10y ago
      I can agree on that point. The point of my comment wasn't necessarily the truthfulness of either quote, merely that they really need to follow through on what they are saying. Their hands and mouth seem to be in a state of disconnection.

acd 10y ago

I switched to Ubuntu because of Windows 10. Using Linux as a primary operating system works great as a developer. There is a saying which says if a product are free "you are the product". Microsoft made the upgrade to Windows 10 free a guess so that they can mine data about you and your habits. That data is valuable for marketing purposes. Wireshark traffic dumps show a lot of data going to Microsoft telemetery. I choose to say no to that data collection, instead wanting to keep a bit of privacy. Have some security wiz MITM the Microsoft telemetry server with their own cert to inspect the data collection traffic?

Meegul 10y ago
I recommend disabling some of the Amazon integration in Unity if you're concerned about your privacy. This shouldn't be too difficult, even if you're new to Linux. I 'd also suggest getting Unity-tweak-tool and playing around with some of the settings in there. EDIT: Just realized that since 16.04, Ubuntu no longer has online search results enabled by default in the Dash. Still though, play around with some of the settings!
- 0xmohit 10y ago
  One doesn't really need Unity, does one? Openbox is awesome. It doesn't hog system resources either.
  - Sylos 10y ago
    Yeah, but Openbox isn't suitable for new users, at least not on its own. As part of something like LXDE or LXQt, it's definitely workable, but without a deeper understanding of Openbox, those are pretty much as good as any other Desktop Environment (except maybe that LXDE/LXQt are also among the lightest DEs around). I would rather recommend either Ubuntu GNOME, if you want a rather unconvential, but highly integrated, highly user-friendly interface, or Linux Mint Cinnamon, if you want a cleaned up Windows-like interface, or Kubuntu, if you want a Windows-like interface which just smothers you in options, tweaks and customizability.
bad_user 10y ago

72deluxe 10y ago

I have LittleSnitch on my Mac and observe the requests that my Windows VM makes. I believe you can use an equivalent tool on Windows, such as GlassWire, or also the very useful tool O&O ShutUp10 with which you can disable telemetry settings.

izacus 10y ago
Of course seeing what OS X does over network by itself (and the apps installed) is kinda scary as well :/
Sylos 10y ago
Wireshark is most commonly used for packet sniffing. https://www.wireshark.org/ https://www.wireshark.org/

Taek 10y ago

People are giving special attention to the things that Microsoft is doing, but history shows that they will eventually accept it and live with it. Facebook has been doing this for a long time, to extremely high degrees of invasiveness. Google as well, and pretty much every single web startup in existence. Collecting data is how you compete in modern business. If you think this Microsoft stuff is a big deal you should have another look at the entire foundation of modern tech.

frik 10y ago
You are right, but I bag to differ. Giving out your personal emails or your private life to advertisers is one thing. But an operating system is the lowest dominator and the PC platform is where most data is stored and real work in being done. So Microsoft's 180 degree turn by the CEO from being a trustworthy company to a turning their customers to products is unheard of and very very concerning - especially given they still have a quasi PC monopoly (ca 90% market share). There is a long legacy history , some run up to 30 years old software on Windows and now are concerned with little option to move forward.
- ocdtrekkie 10y ago
  I agree the OS is the lowest denominator. But given that mobile is predominantly the most common way people do a LOT of things these days, of which Android is also an OS, I think it's noteworthy that Google still manages to escape the level of criticism Microsoft often still gets. My hope is that France can get Microsoft to just enable Telemetry 0 for all licenses, and that maybe they let us here in the US do it too.
  - frik 10y ago
    Is this a calculated derailment technique? Why MS? Because MS is the subject of the article. Feel free to submit articles about others. As mentioned above, you simply cannot compare a smartphone operating system where one handles, emails (in the cloud anyway) some personal apps and a browser to a full desktop operating system where among many other things serious work is done as well as private and enterprise data is stored. Many people don't want to trade access to that data and act as a product - it's as simple as that. Sadly there isn't an Windows 10 edition free of the tracking stuff. Let's hope France gets Microsoft to stop that or offer a new edition without that stuff.

0xmohit 10y ago

With LinkedIn [0], Microsoft has much more in its arsenal. That said, who cares. I've hardly seen anyone use uBlock Origin, Ghostery or Privacy Badger. OTOH, people love tools [1] that read your email and notify about due bills and the like. [0] https://twitter.com/darylginn/status/590664399041519617 https://twitter.com/darylginn/status/590664399041519617 [1] Google Now

ionised 10y ago

This is a step in the right direction, but no fine they can levy will be sufficiently punitive. Companies like this will continue on and consider things like this simply the cost of doing business. Kind of like banks. They don't give a fuck.

tajen 10y ago
The EU commission levied a $2bn (yes, billion) fine for Microsoft antitrust problems, i.e. the stupid removal of the choice popup for the browser in XP SP3 and not giving the API documentation to some editor. Those two things were very stupid misgivings by Microsoft: They were almost going out unscattered, and they played with the fire towards the end of the trial. Since then, I like the EU commission. As long as they can bend the master plans of dominating US companies. However, I don't see how the forced Windows upgrade didn't lead to a requirement to reimburse every user of their stripped Windows 8 license.

VOYD 10y ago

Good luck with that.

serge2k 10y ago

> the four-character PIN system used to access Microsoft services is insecure, because there is no limit on the number of attempts a user can make. I just tried logging in with my pin. After a handful of tries I was given a string to enter before I could try again. I did that. After another try I got told to restart the device before I could try again. So it doesn't look like 10 tries and locked out forever, but rather increasing penalties for incorrect attempts. Which is fine. oh and my pin is 6 characters long. If they don't have this right why should we believe them about any of their other claims?