10 ms·
Windows 8 Tells Microsoft Everything You Install, Not Very Securely.
- deleted 14y ago[deleted]
- deleted 14y ago[deleted]
- benologist 14y agoWhat's really scary is the entire industry is doing their best to make this normal and they've enjoyed phenomenal success so far. This is almost Microsoft playing catch up.
- refulgentis 14y agoBegging the question a bit here, so much so that I was tempted to just post '?'. I assume you mean Apple, but Apple's checks locally for code-signing, it doesn't phone home. Which is what the problem is.
- benologist 14y agoI'm not specifically meaning Apple although they're certainly part of it: - iTunes and App Store - Steam - Windows Phone marketplace, MSDN, upcoming software marketplace - Amazon App Store and Google's Play Store - Chrome Web Store and Firefox's add-on marketplace - Ubuntu Software Center, packet managers in general - Facebook's App Center - Github, Google Code and SourceForge I doubt there's anyone on HN who doesn't have a long history with a lot of names on that list. Almost every piece of software and game I have on every device I use has come via this list. But I'm sure all of these .. centralized installation hubs I guess .. are reasonably vindicated by their privacy policies - where everyone's idea of 'reasonably' is different and most of them aren't like ours.
- refulgentis 14y agoCentralized software distribution channel != phoning home every time any software is installed on a computer. You are citing examples of the first, the second is what the article is about.
- eludwig 14y agoAs others have already mentioned, it's a trade off. They remember it for you, wholesale. This works out great when you need to install an app that you bought already onto a new device, etc. The people who really care/need about this type of privacy are surely not "scared". They already know how to avoid these helpful service, right? It's not rocket science. If it matters to you, then you figure out how to do it. The paid app vendors (Apple, etc) really are trying to be helpful here, not nefarious, imo.
- eslaught 14y agoThe article would be a little more convincing if the author had checked that SmartScreen actually uses SSLv2, rather than simply running on a web server which happens to support the protocol.
- deleted 14y ago[deleted]
- redact207 14y agoAgreed. Personally I wouldn't care if anyone intercepted a message saying what app I just installed. The author also neglected to mention if the payload contains anything that identifies the user.
- magikarp 14y agoIt's SSL, how are you supposed to be able to read the Payload? The article also explicitly mentions that no tests were run to figure out whether SSLv2 is used by the client. You wouldn't personally care if messages were intercepted regarding the apps you're installing, but imagine the kind of leverage it would give someone trying to profile a network of activists in Syria. The exact version number of every app on every computer, perfect for studying the exploit surface.
- Bud 14y agohttp://en.wikipedia.org/wiki/First_they_came.. http://en.wikipedia.org/wiki/First_they_came... First they came for the socialists, and I didn't speak out because I wasn't a socialist.
- aik 14y agoOn a slightly different note concerning privacy: How much more of this will we take before enough people demand privacy again? What event has to happen? On our phones, applications can't even be downloaded until monitored and approved by the corporation (one step further than this). Our desktops have been moving in this direction for some time already.
- fl3tch 14y agoLinux from Scratch. Build it for the ones you love.
- slurgfest 14y agoWhy would I need to build LFS to get privacy? If my only purpose is privacy it's a ludicrous amount of work.
- Jare 14y agoIt sucks but the why is clear: because it's becoming the only way to get it (for some definition of "from scratch" ofc).
- deleted 14y ago[deleted]
- chacham15 14y agoEven that may not be enough: http://scienceblogs.com/goodmath/2007/04/15/strange-loops-dennis-ritchie-a/ http://scienceblogs.com/goodmath/2007/04/15/strange-loops-de...
- molmalo 14y agoThat was a very interesting and funny read! Thanks!
- Karunamon 14y ago
- 127 14y agoI'm confused. I thought Apple already did this? Also this is a norm in mobile phones.
- jpxxx 14y agoThose work the opposite way: a blacklist is downloaded nightly.
- yuhong 14y agoUnfortunately anyone on the web can publish EXEs. Look at how big anti-virus definitions are, for example.
- slurgfest 14y agoDo you really want some central organization dictating who can make software and who cannot? Who could you trust with that?
- yuhong 14y agoI don't think they are preventing apps from being run, just showing a warning message.
- stinos 14y agoseems likely. One reason I can think of: have you seen the amounts of crap the average I-think-I-know-how-pcs-work human installs, causing the OS to become totally unusable? And then they start blaming it on the OS?
- rblackwater 14y agoIf one company does something wrong it does not excuse other companies from doing the same thing wrong.
- 14y ago
- holri 14y agoI am not going to let anyone know the software that I have installed, nor will I trust or depend on a white list issued by a big private corporation with business interests.
- shanelja 14y agoThe only real issue I have with them using this method is whether or not Microsoft will then have a legal obligation to report the downloading of any software which could in the future become illegal, I'm thinking packages like Tor whcih can be used to directly contravene law inforcement efforts regarding things like child pornography. I'm not saying I support it, but what I am saying is I would feel very uncomfortable knowing that my computer company would instantly inform the police if I downloaded "suspicious software" regardless of my purpose, but that's just a glimpse of where I see their next move being after the idiocy of ACTA and all the recent changes to privacy laws.
- rz2k 14y agoFurthermore, the intent of Tor is the empowerment of dissidents under oppressive regimes. I imagine there's little likelihood that this capability could have impeded the Arab Spring since Microsoft wouldn't have cooperated, but it seems like this would create a vulnerability for Microsoft doing business in China. If China decided they wanted to more actively monitor software intended to bypass firewalls and circumvent censorship policies, I wonder how effectively could Microsoft could resist.
- neilk 14y agoTor would be useless if it was only for dissidents! You should think of Tor as a tool for everyone, where we all cooperate to increase our privacy, and have anonymity when we need it.
- TazeTSchnitzel 14y agoTor's a bad example, Tor does not hide the fact you are using it usually. It simply hides what you are doing with it. Although I believe there is some sort of proxying system.
- timmyd 14y agoSure just turn it off http://www.howtogeek.com/75356/how-to-turn-off-or-disable-the-smartscreen-filter-in-windows-8/ http://www.howtogeek.com/75356/how-to-turn-off-or-disable-th...
- DASD 14y agoThe problem is that Smartscreen is on by default. Most users are going to have trouble enough trying to forget about the missing Start Menu even after watching the Welcome Intro let alone fumble through looking for some way to disable this option. Malware protection requiring surrendered privacy seems a pretty crappy "feature." Why can't Microsoft do better?
- krautsourced 14y agoHow? By constantly downloading the entire database of every application to your local drive? Where it would not only take up space, but could be modified to allow anything in? The author says nothing about _what_ exactly is being sent to MS, all he can say for sure that a request is sent to that URL. And about it being turned on by default - as long as it can be turned off, this is _good_. The main problem with security features (like Windows Update for a long time) that are not turned on by default is that your regular Joe user will never turn those on, thus ending up with a terribly out of date, insecure system.
- thinkingisfun 14y agoHow? By constantly downloading the entire database of every application to your local drive? Where it would not only take up space, but could be modified to allow anything in? Yes, and no. http://news.ycombinator.com/item?id=4427416 http://news.ycombinator.com/item?id=4427416 (besides, if you can just tamper with the filesystem you're kinda in already)
- kamjam 14y agoMost users are going to have trouble enough trying to forget about the missing Start Menu even after watching the Welcome Intro... Exactly, most users being the key point. You need to target all this stuff for the lowest key denominator and unfortunately for those of us on HN... but at least we have the knowledge that this exists. I think krautsourced point stands. Damn if you do, damned if you don't!
- itsbits 14y agoi feel its biased when people say all the information of apps that are being installed in our System will be known to Microsoft..is it ok to know Apple the information about Mac Apps???
- nico 14y agoIf you don't jailbreak your iPhone or iPad, then it's pretty much the same, and even worse, because the only way of getting the software is through the AppStore.
- dutchbrit 14y agoAll information that gets sent to Apple goes over SSL v3, not v2 (just checked). This is the cause however with Microsoft (v2). V3 is a lot more secure than v2. However, I still agree, it should be asked if the information can be sent to Apple in the first place.
- itsbits 14y agoas far as i know SSLv3 more secured over SSLv2 on outside manipulations coz of hash of all old messages..
- dthunt 14y agoFolks are focusing on this point unnecessarily. Large scale real-time collection and cracking of SSLv2 is still out-of-scope for everybody, I suspect. Large scale MITM, though, isn't, through compromised CA's, etc. That threat is much more severe and affects basically all software that relies on SSL/TLS (whatever version) for securing a connection or the CA system for validating the authenticity of downloads. That's a much more serious problem. If MSFT is indeed not honoring opt-out of CEIP and other programs, the issue is them not honoring that preference. The particulars of the encryption built on top of a broken model are not the issue.
- gitarr 14y agoWell, we'll see if this is legal in Europe. Website cookies are regulated already here, I guess this sort of abuse will have to be stopped as well. Shame on Microsoft for another outrageous decision.
- TazeTSchnitzel 14y agoOutrageous? And "Send Error Report" wasn't? And other security software vendors sending file hashes isn't? Please, explain why this in particular is so bad. It's tracking in a sense, but they are not going to use it to violate privacy.
- lawnchair_larry 14y agoThis guy has a habit of trying to be a grandstanding security expert but being wrong a lot. In this example, he is wrong because although IIS will answer a SSLv2 connection, it will not actually process the request. Anyone who has done basic scanning for an audit is well aware of this false positive. See here: http://billing.handsonwebhosting.com/knowledgebase.php?action=displayarticle&id=221 http://billing.handsonwebhosting.com/knowledgebase.php?actio... As he says: "I haven’t checked whether Windows SmartScreen does in fact use SSLv2, but the fact that the Microsoft servers support it is concerning." Yeah, maybe check next time before you shout that the sky is falling. If you are concerned about the privacy issue (MS getting requests indicating what was installed - not the bogus MITM claim), disabling this is offered in the privacy settings, and it is even put in front of your face during OS install. Also, all major AV products do the same thing, except they're not as transparent about it. Nothing to see here.
- magikarp 14y agoAuthor here. Let me ask you something: Have you checked if SSLv2 connections are actually dropped? The point of my article isn't SSLv2, it's privacy concerns. Also, I did actually check and disabling SmartScreen doesn't seem to be offered during OS install, did I miss something? Thanks for the disgusting ad-hominem! It totally aids your missing the point. Edit: Whoa, I think I've figured out why this guy is being so personal; his submission history includes promoting a security company I left after a brief stint. Small world!
- cyberl0l 14y agoYou're concerned about privacy but you didn't even check what kind of data was being sent by the server before writing this article...
- magikarp 14y agoThat's a follow-up that anyone can do and corroborate. You're more than welcome to, I'm sorry my article was lacking in that regard. Edit: Just updated the article with information on that!
- nivla 14y agoIsn't SmartScreen's job to validate the signature of the executable file with Microsoft? So it might just be sending the executable's signed public key to check for validity/revocation. Since OP hasn't posted the unencrypted communication we may not know. Doesn't Google do something similar with chrome, it sends a part of the hash of every site you visit to its servers for comparison to a list of malwares and phishing sites?
- magikarp 14y agoAn IP address sending a public key could still be enough to identify that IP address x is trying to install software y.
- nivla 14y agoNot with a 100% accuracy I must say. If you are a company developing products, you would have many different product and all of those products end up being signed using a single private key. So assuming that it only sends a company's public key for validation, it would still have to take a guess as to which product was downloaded.
- deleted 14y ago[deleted]
- deleted 14y ago[deleted]
- mdb31 14y agoThe SmartScreen connection uses SSLv3 just fine on my machine. Here's an example payload: https://gist.github.com/3448961 https://gist.github.com/3448961 (I initially posted this on HN directly, which broke the site layout, so I deleted that post -- sorry about that!) The base-64 encoded strings in the request are the HTTP referrer and the download location, respectively. The "client key" and "MAC" seems to be API key-like authenticators. Not sure what the GUIDs are about. Anyway, the use of this data has been explained in quite a bit of detail a long time ago already: http://windows.microsoft.com/en-US/windows-vista/smartscreen-filter-frequently-asked-questions http://windows.microsoft.com/en-US/windows-vista/smartscreen.... As said elsewhere already, the feature is easy enough to turn off. And there is definitely an opt-in question somewhere, as I had to enable the feature on my machine in order to test it...
- yread 14y agoIs there any actual demonstration of a succesful attack on sslv2? I've found only http://seclists.org/pen-test/2010/Jul/14 http://seclists.org/pen-test/2010/Jul/14 which implies it is possible. It would be a nice exercise to actually try to MITM the MS servers here.
- dakimov 14y agoNot sure what this guy is trying to say, but basically any kind of 'protection' based on connection to a server compromises your privacy. For example, an anti-phishing feature that is turned on by default in most browsers essentially reports EVERY page you visit to the anti-phishing protection server (obviously, in order to check whether a site is 'good', you must pass the site URL to the server, hence the server can log the URL, what would have stopped it from doing this?). Does not it concern anybody?
- gcp 14y agoNot necessarily. It may be what Internet Explorer does for their malware protection, but Firefox certainly does not work this way. The SafeBrowsing protection in Firefox downloads the entire malware/phishing database from Google in a highly compressed format, through incremental updates, and this is completely uncorrelated to what you visit. If an URL you browse to is found as a match in that local database, then and only then is a lookup to a remote server done to check if the compressed URL was not a false positive, and if it's still up to date. This lookup isn't even of the URL you visited, but of the SHA-256 of it. This allows to verify if it was a known malware URL, but it is not possible to reverse it and obtain your URL if the hit was a false positive (due to the compression). Firefox has some additional privacy protection here in that it will check a whole bunch of random entries from the local database whenever there is a hit, so even the party at the other end (Google) can't tell what malware URL, if any, you actually hit. Google has added an additional, undocumented SafeBrowsing service to Chrome to check downloaded files, and that one does send the URL off to Google for scanning, but Mozilla has refused to implement this feature in Firefox until the privacy concerns can be addressed. Note that, aside from being much better for privacy, using a local database is obviously of much higher performance than contacting a remote server for every URL.
- Dylan16807 14y agoOverall I'm not impressed with chrome's download safety features. Last I checked it flagged any unknown exes on http://dl.dropbox.com http://dl.dropbox.com but trusted unknown exes on https://dl.dropbox.com https://dl.dropbox.com.
- brudgers 14y agoIf one loads an app on Apple's popular smartphone, Apple keeps a record of it. Along with one's credit card number and potentially a large amount of location and connectivity data. If one loads an app on Facebook or searches on Google or even visits a commercial website one's privacy is likely to be compromised. None of this makes Windows behavior entirely devoid of causing concern, but in my opinion, Microsoft is more trustworthy filling that role than the crapware antivirus providers who have been doing it for years.
- quattrofan 14y agoI've already decided to steer well clear of Win8, going to buy a new laptop before its forced upon me and wait for the next release. This just confirms my decision.
- TazeTSchnitzel 14y agoWhy? You can turn it off. And Windows already had the sending of error reports, did you avoid Windows XP too?