8 ms·

Microsoft adopts first international cloud privacy standard

114 points by varunagrawal 12y ago

yummybear 12y ago
Microsoft a forerunner on global privacy. .NET open sourced and (soon) running on Linux and Mac. Things certainly do change.
- itsbits 12y ago
  how are privacy and opensource related??
  - jameshart 12y ago
    Neither is a word which you would have associated with Microsoft ten years ago. An example for you: Microsoft used to have an identity service called 'Passport'. They wanted to make it into a universal login, along the lines of Google ID or Facebook logins today. They created a whole suite of related services, codenamed 'Hailstorm', which they tried to bring to market under the terrible name of ".NET MyServices". And they failed because the universal reaction of the world was that they were not prepared to trust Microsoft with their privacy. (see, e.g. http://www.theregister.co.uk/2002/12/17/net_my_services_gone_but/ http://www.theregister.co.uk/2002/12/17/net_my_services_gone...)
  - fysac 12y ago
    You can't have a reasonable assurance of privacy unless your software is open source.
    - gizmogwai 12y ago
      Going that direction, one could argue that what you open source might not be what you are running in production.
      - fysac 12y ago
        Right, you can never be 100% certain it's the same code. But it's a valuable "good faith" step that sets a level of trust between the users and developers.
    - Spivak 12y ago
      And that software is running on a machine that you own and control with verified open firmware running on open hardware with no known security vulnerabilities, with strong encryption on the drive and a locked bios, and not connected to any network (including the internet) where all the devices on that network satisfy the previous conditions. If any of these are not met then you are trusting someone else with your privacy.
- okasaki 12y ago
  Oh they're a forerunner that's for sure. https://upload.wikimedia.org/wikipedia/commons/c/c7/Prism_slide_5.jpg https://upload.wikimedia.org/wikipedia/commons/c/c7/Prism_sl...
  - junto 12y ago
    To be fair to Microsoft, they are fighting these requests, especially when it comes to requests outside US jurisdiction: https://www.eff.org/press/releases/eff-court-us-warrants-dont-apply-overseas-emails https://www.eff.org/press/releases/eff-court-us-warrants-don...
    - okasaki 12y ago
      On the contrary, they're the most enthusiastic and willing participant http://www.nytimes.com/2013/07/12/us/report-indicates-more-extensive-cooperation-by-microsoft-on-surveillance.html?_r=0 http://www.nytimes.com/2013/07/12/us/report-indicates-more-e...
- cm2187 12y ago
  And quickly. This was not that long ago: http://recode.net/2014/03/20/microsoft-says-will-tighten-its-policies-for-searching-hotmail-outlook-com/ http://recode.net/2014/03/20/microsoft-says-will-tighten-its... (I particularly liked their reference to their customer's emails as Microsoft's "own emails and customer services" and that searching their customer's data is "searching ourselves").
- asuffield 12y ago
  Forerunner? It's a cut down version of https://cloud.google.com/terms/data-processing-terms https://cloud.google.com/terms/data-processing-terms which has been in place for quite some time. (Tedious disclaimer: my opinion, not my employers. Not representing anybody other than myself. I work at Google, not on cloud, although I routinely fire my nerf gun at people who do)
  - yummybear 12y ago
    It wasn't a jab at competitors, neither an attempt to make MS seem like /the/ forerunner. Just to say that it's definately a different MS we're seeing.
DonHopkins 12y ago
I am so glad I installed the chrome extension "Butt To Butt Plus 1.2". I will never go back. https://chrome.google.com/webstore/detail/butt-to-butt-plus/apmlngnhgbnjpajelfkmabhkfapgnoai?hl=en https://chrome.google.com/webstore/detail/butt-to-butt-plus/... http://gizmodo.com/a-chrome-extension-that-replaces-cloud-with-butts-w-1615813889 http://gizmodo.com/a-chrome-extension-that-replaces-cloud-wi...
acqq 12y ago
Still, note what they don't say that the user data will be encrypted before transferred to the cloud, or even more important for Europeans, that the European data would be managed strictly in Europe. Interestingly, the money received in Europe is without problem for all these big companies so managed to not end in the US (avoiding the taxes), the data, it seems still not important?
ewzimm 12y ago
This is a great move. Of course, there's the massive loophole on the last point that they really can't do anything about: >The standard requires that law enforcement requests for disclosure of personally identifiable data must be disclosed to you as an enterprise customer, unless this disclosure is prohibited by law. Since the policy of several governments seems to be "collect everyone's data and don't inform anyone about it under penalty of law," it's a pretty weak protection. Seems like the only way around it is removing centralized keys. Even if you trust your own government with the data, there are probably other ones you don't trust and you have no control over that will collect your data if they have any opportunity to do it.
- lmkg 12y ago
  Yeah, it's not like Microsoft could write a privacy policy that lets them not follow the law, and expect that to matter to law enforcement. Until the law changes, there's not much that individual companies can choose to do about that. At least they're at least saying that they will be transparent whenever they are legally allowed to do so, which is something.
  - acqq 12y ago
    Oh yes, they can do something, for example store the user data in the cloud only encrypted. It seems they don't want to do that, however.
    - NeutronBoy 12y ago
      And then what? They either keep the keys themselves, or the customer has to ensure that the key exists on every device they want to access the data from. If you're a one-man shop that doesn't matter, but if you're a multi-national trying to rollout Office 365, it makes it prohibitive.
      - acqq 12y ago
        "if you're a multi-national trying to rollout Office 365" ...if you're competent, you already issue your own certificates for other purposes and install them on the computers you own. Therefore maintaining additional keys would not even cause adding more manpower than what you already have. If you are multi-national and not having your own certificates, I'd be happy to do some consulting for you.
higherpurpose 12y ago
How "real" is this standard? I mean it seems to be set by the GCHQ motherland.
- wongarsu 12y ago
  The standard was created by the ISO JTC1/SC 27 Working Group 5 (Privacy and Identity Management). It seems like mostly an European effort, which certainly isn't limited to Great Britain. Europeans usually take privacy very seriously.
  - peawee 12y ago
    Except the European data privacy regulations don't seem to be too restrictive of law enforcement.
- Create 12y ago
  In an interview Richard Stallman, head of the Free Software Foundation, said: Microsoft corrupted many members of ISO in order to win approval for its phony 'open' document format, OOXML. This was so governments that keep their documents in a Microsoft-only format can pretend that they are using 'open standards.' The government of South Africa has filed an appeal against the decision, citing the irregularities in the process. http://en.wikipedia.org/wiki/Standardization_of_Office_Open_XML#Complaints_about_the_national_bodies_process http://en.wikipedia.org/wiki/Standardization_of_Office_Open_...
__Joker 12y ago
Can anybody clarify what privacy I as a Bing, outlook, windows mobiles user get from this ? It mentions enterprise customer, does this means, these standards doesn't apply to users of above mentioned services ?
- morganvachon 12y ago
  I'm pretty sure it's a different set of rules for regular consumers vs enterprise. It's always been that way in the past. That said, can you really trust any "cloud storage" provider these days? I'd say the most trustworthy would be someone like SpiderOak, as they don't have access to your private key and therefore have had minimal requests from law enforcement which yielded no info[1]. And I say that as someone who has settled on OneDrive for my casual cloud storage, with more important or private files (taxes, finances) stored on a personal server running OwnCloud from my home office. I have all of my files, important and casual, backed up to an external drive that lives in a fire safe. Not as secure as, say, a bank deposit box, but better than nothing. [1]https://blog.spideroak.com/20150212080057-increasing-transparency-and-privacy-2014-report https://blog.spideroak.com/20150212080057-increasing-transpa...
  - LLWM 12y ago
    Such "transparency reports" are only a lower bound. If the government requires you to keep the request a secret, you must keep it secret.
  - LeoPanthera 12y ago
    SpiderOak's client is closed-source though, so you only have their word that they don't have your private key.
zanny 12y ago
> The British Standards Institute (BSI) has now independently verified Yeah great, show your proprietary code to a third party company and everyone is just going to immediately trust you. Plenty of other cloud storage services offer real reasons to trust the backing store, called the code is open. I can audit it, my neighbor could audit it, and every corporate user is liable to audit it. I have no reason to ever trust an arbitrary third party I have never had reason to trust in the past who is now trying to guarantee your cloud is secure, when competitive options are letting me do my own auditing, if I wish. Is there anything else this is comparable too - where a company has the gall to say "another company looked at our black box and said it was good, so trust us alright guys?". When cars or houses or roads or food get certified for something you always have the capacity to reproduce the certification process yourself as a verification measure. You cannot do that to proprietary software, especially when its on some foreign server somewhere running who knows what version of it.
- balls187 12y ago
  > Is there anything else this is comparable too - where a company has the gall to say "another company looked at our black box and said it was good, so trust us alright guys? Uh, isn't that how third party trust works? Like how SSL cert verification goes to a trusted root CA for validation.
  - mherkender 12y ago
    Not really, the only secret the trusted root has is their private key, not an entire stack of software/hardware/etc.
    - count 12y ago
      Your CA shows you everything they run?
  - merrua 12y ago
    To be honest people have pointed out problems with that as well.
- 12y ago
daliwali 12y ago
Should there ever be any reason to trust your privacy to proprietary software running on a third party's server? Or is this "privacy standard" they are conforming to just another form of security theatre?
- AaronIG 12y ago
  Replace "proprietary" with "open source" and the argument is virtually the same. You still need to trust the third party running the software.
Create 12y ago
The IT industry clearly needs systems so that companies can work well together, and these systems need to work well in all countries. The ISO process for IT standards was designed to promote interoperability, portability, and cultural and linguistic adaptability, using a consensus process. We believe strongly in these goals, but the current process is not designed to achieve them. The OOXML proposal has exposed serious flaws in ISO process–especially in the fast-track process–and we believe these flaws need to be fixed. The credibility of ISO is at stake. http://magazine.redhat.com/2008/03/24/iso-approval-a-good-process-gone-bad/ http://magazine.redhat.com/2008/03/24/iso-approval-a-good-pr... Either way, the ISO's current state is likely to be seen as a quagmire when viewed through history's lens. Microsoft did not respond to several calls requesting comment. http://archive.wired.com/software/coolapps/news/2007/08/ooxml_vote http://archive.wired.com/software/coolapps/news/2007/08/ooxm... We begin therefore where they are determined not to end, with the question whether any form of democratic self-government, anywhere, is consistent with the kind of massive, pervasive, surveillance into which the Unites States government has led not only us but the world. This should not actually be a complicated inquiry.
- gtirloni 12y ago
  Has the ISO 27018 process suffered from the same issues seen in the OOXML discussion?
  - Create 12y ago
    Ex-Microsoft privacy adviser: I don't trust company Microsoft's former chief privacy adviser said he did not have faith in the security of the software company's technology http://www.theguardian.com/world/2013/sep/30/microsoft-privacy-chief-nsa http://www.theguardian.com/world/2013/sep/30/microsoft-priva...
    - gtirloni 12y ago
      Has the ISO 27018 process suffered from the same issues seen in the OOXML discussion? Additionally, is the ISO 27018 not worth implementing because Microsoft seems to have implemented it (allegedly)?
deleted 12y ago
[deleted]
eyeareque 12y ago
This might actually mean something had it been a company from a country where there wasn't secret courts that can create secret subpoenas.
kelv 12y ago
Is there any way I can legally read the standards document without paying the prohibitive fee?
holri 12y ago
"There is no cloud, just other people's computers." FSFE Sticker: https://blogs.fsfe.org/mk/files/2014/11/there-is-no-cloud-pack.jpg https://blogs.fsfe.org/mk/files/2014/11/there-is-no-cloud-pa...
Aoyagi 12y ago
A company that slurps all contacts and calendar entries from customers' smartphones without their explicit consent and without a way to opt out from it is talking about privacy.

114 points by varunagrawal 12y ago

Microsoft a forerunner on global privacy. .NET open sourced and (soon) running on Linux and Mac. Things certainly do change.

itsbits 12y ago
how are privacy and opensource related??
- jameshart 12y ago
  Neither is a word which you would have associated with Microsoft ten years ago. An example for you: Microsoft used to have an identity service called 'Passport'. They wanted to make it into a universal login, along the lines of Google ID or Facebook logins today. They created a whole suite of related services, codenamed 'Hailstorm', which they tried to bring to market under the terrible name of ".NET MyServices". And they failed because the universal reaction of the world was that they were not prepared to trust Microsoft with their privacy. (see, e.g. http://www.theregister.co.uk/2002/12/17/net_my_services_gone_but/ http://www.theregister.co.uk/2002/12/17/net_my_services_gone...)
- fysac 12y ago
  You can't have a reasonable assurance of privacy unless your software is open source.
  - gizmogwai 12y ago
    Going that direction, one could argue that what you open source might not be what you are running in production.
    - fysac 12y ago
      Right, you can never be 100% certain it's the same code. But it's a valuable "good faith" step that sets a level of trust between the users and developers.
  - Spivak 12y ago
    And that software is running on a machine that you own and control with verified open firmware running on open hardware with no known security vulnerabilities, with strong encryption on the drive and a locked bios, and not connected to any network (including the internet) where all the devices on that network satisfy the previous conditions. If any of these are not met then you are trusting someone else with your privacy.
okasaki 12y ago
Oh they're a forerunner that's for sure. https://upload.wikimedia.org/wikipedia/commons/c/c7/Prism_slide_5.jpg https://upload.wikimedia.org/wikipedia/commons/c/c7/Prism_sl...
- junto 12y ago
  To be fair to Microsoft, they are fighting these requests, especially when it comes to requests outside US jurisdiction: https://www.eff.org/press/releases/eff-court-us-warrants-dont-apply-overseas-emails https://www.eff.org/press/releases/eff-court-us-warrants-don...
  - okasaki 12y ago
    On the contrary, they're the most enthusiastic and willing participant http://www.nytimes.com/2013/07/12/us/report-indicates-more-extensive-cooperation-by-microsoft-on-surveillance.html?_r=0 http://www.nytimes.com/2013/07/12/us/report-indicates-more-e...
cm2187 12y ago
And quickly. This was not that long ago: http://recode.net/2014/03/20/microsoft-says-will-tighten-its-policies-for-searching-hotmail-outlook-com/ http://recode.net/2014/03/20/microsoft-says-will-tighten-its... (I particularly liked their reference to their customer's emails as Microsoft's "own emails and customer services" and that searching their customer's data is "searching ourselves").
asuffield 12y ago
Forerunner? It's a cut down version of https://cloud.google.com/terms/data-processing-terms https://cloud.google.com/terms/data-processing-terms which has been in place for quite some time. (Tedious disclaimer: my opinion, not my employers. Not representing anybody other than myself. I work at Google, not on cloud, although I routinely fire my nerf gun at people who do)
- yummybear 12y ago
  It wasn't a jab at competitors, neither an attempt to make MS seem like /the/ forerunner. Just to say that it's definately a different MS we're seeing.

DonHopkins 12y ago

I am so glad I installed the chrome extension "Butt To Butt Plus 1.2". I will never go back. https://chrome.google.com/webstore/detail/butt-to-butt-plus/apmlngnhgbnjpajelfkmabhkfapgnoai?hl=en https://chrome.google.com/webstore/detail/butt-to-butt-plus/... http://gizmodo.com/a-chrome-extension-that-replaces-cloud-with-butts-w-1615813889 http://gizmodo.com/a-chrome-extension-that-replaces-cloud-wi...

acqq 12y ago

Still, note what they don't say that the user data will be encrypted before transferred to the cloud, or even more important for Europeans, that the European data would be managed strictly in Europe. Interestingly, the money received in Europe is without problem for all these big companies so managed to not end in the US (avoiding the taxes), the data, it seems still not important?

ewzimm 12y ago

This is a great move. Of course, there's the massive loophole on the last point that they really can't do anything about: >The standard requires that law enforcement requests for disclosure of personally identifiable data must be disclosed to you as an enterprise customer, unless this disclosure is prohibited by law. Since the policy of several governments seems to be "collect everyone's data and don't inform anyone about it under penalty of law," it's a pretty weak protection. Seems like the only way around it is removing centralized keys. Even if you trust your own government with the data, there are probably other ones you don't trust and you have no control over that will collect your data if they have any opportunity to do it.

lmkg 12y ago
Yeah, it's not like Microsoft could write a privacy policy that lets them not follow the law, and expect that to matter to law enforcement. Until the law changes, there's not much that individual companies can choose to do about that. At least they're at least saying that they will be transparent whenever they are legally allowed to do so, which is something.
- acqq 12y ago
  Oh yes, they can do something, for example store the user data in the cloud only encrypted. It seems they don't want to do that, however.
  - NeutronBoy 12y ago
    And then what? They either keep the keys themselves, or the customer has to ensure that the key exists on every device they want to access the data from. If you're a one-man shop that doesn't matter, but if you're a multi-national trying to rollout Office 365, it makes it prohibitive.
    - acqq 12y ago
      "if you're a multi-national trying to rollout Office 365" ...if you're competent, you already issue your own certificates for other purposes and install them on the computers you own. Therefore maintaining additional keys would not even cause adding more manpower than what you already have. If you are multi-national and not having your own certificates, I'd be happy to do some consulting for you.

higherpurpose 12y ago

How "real" is this standard? I mean it seems to be set by the GCHQ motherland.

wongarsu 12y ago
The standard was created by the ISO JTC1/SC 27 Working Group 5 (Privacy and Identity Management). It seems like mostly an European effort, which certainly isn't limited to Great Britain. Europeans usually take privacy very seriously.
- peawee 12y ago
  Except the European data privacy regulations don't seem to be too restrictive of law enforcement.
Create 12y ago
In an interview Richard Stallman, head of the Free Software Foundation, said: Microsoft corrupted many members of ISO in order to win approval for its phony 'open' document format, OOXML. This was so governments that keep their documents in a Microsoft-only format can pretend that they are using 'open standards.' The government of South Africa has filed an appeal against the decision, citing the irregularities in the process. http://en.wikipedia.org/wiki/Standardization_of_Office_Open_XML#Complaints_about_the_national_bodies_process http://en.wikipedia.org/wiki/Standardization_of_Office_Open_...

__Joker 12y ago

Can anybody clarify what privacy I as a Bing, outlook, windows mobiles user get from this ? It mentions enterprise customer, does this means, these standards doesn't apply to users of above mentioned services ?

morganvachon 12y ago
I'm pretty sure it's a different set of rules for regular consumers vs enterprise. It's always been that way in the past. That said, can you really trust any "cloud storage" provider these days? I'd say the most trustworthy would be someone like SpiderOak, as they don't have access to your private key and therefore have had minimal requests from law enforcement which yielded no info[1]. And I say that as someone who has settled on OneDrive for my casual cloud storage, with more important or private files (taxes, finances) stored on a personal server running OwnCloud from my home office. I have all of my files, important and casual, backed up to an external drive that lives in a fire safe. Not as secure as, say, a bank deposit box, but better than nothing. [1]https://blog.spideroak.com/20150212080057-increasing-transparency-and-privacy-2014-report https://blog.spideroak.com/20150212080057-increasing-transpa...
- LLWM 12y ago
  Such "transparency reports" are only a lower bound. If the government requires you to keep the request a secret, you must keep it secret.
- LeoPanthera 12y ago
  SpiderOak's client is closed-source though, so you only have their word that they don't have your private key.

zanny 12y ago

> The British Standards Institute (BSI) has now independently verified Yeah great, show your proprietary code to a third party company and everyone is just going to immediately trust you. Plenty of other cloud storage services offer real reasons to trust the backing store, called the code is open. I can audit it, my neighbor could audit it, and every corporate user is liable to audit it. I have no reason to ever trust an arbitrary third party I have never had reason to trust in the past who is now trying to guarantee your cloud is secure, when competitive options are letting me do my own auditing, if I wish. Is there anything else this is comparable too - where a company has the gall to say "another company looked at our black box and said it was good, so trust us alright guys?". When cars or houses or roads or food get certified for something you always have the capacity to reproduce the certification process yourself as a verification measure. You cannot do that to proprietary software, especially when its on some foreign server somewhere running who knows what version of it.

balls187 12y ago
> Is there anything else this is comparable too - where a company has the gall to say "another company looked at our black box and said it was good, so trust us alright guys? Uh, isn't that how third party trust works? Like how SSL cert verification goes to a trusted root CA for validation.
- mherkender 12y ago
  Not really, the only secret the trusted root has is their private key, not an entire stack of software/hardware/etc.
  - count 12y ago
    Your CA shows you everything they run?
- merrua 12y ago
  To be honest people have pointed out problems with that as well.
12y ago

daliwali 12y ago

Should there ever be any reason to trust your privacy to proprietary software running on a third party's server? Or is this "privacy standard" they are conforming to just another form of security theatre?

AaronIG 12y ago
Replace "proprietary" with "open source" and the argument is virtually the same. You still need to trust the third party running the software.

Create 12y ago

The IT industry clearly needs systems so that companies can work well together, and these systems need to work well in all countries. The ISO process for IT standards was designed to promote interoperability, portability, and cultural and linguistic adaptability, using a consensus process. We believe strongly in these goals, but the current process is not designed to achieve them. The OOXML proposal has exposed serious flaws in ISO process–especially in the fast-track process–and we believe these flaws need to be fixed. The credibility of ISO is at stake. http://magazine.redhat.com/2008/03/24/iso-approval-a-good-process-gone-bad/ http://magazine.redhat.com/2008/03/24/iso-approval-a-good-pr... Either way, the ISO's current state is likely to be seen as a quagmire when viewed through history's lens. Microsoft did not respond to several calls requesting comment. http://archive.wired.com/software/coolapps/news/2007/08/ooxml_vote http://archive.wired.com/software/coolapps/news/2007/08/ooxm... We begin therefore where they are determined not to end, with the question whether any form of democratic self-government, anywhere, is consistent with the kind of massive, pervasive, surveillance into which the Unites States government has led not only us but the world. This should not actually be a complicated inquiry.

gtirloni 12y ago
Has the ISO 27018 process suffered from the same issues seen in the OOXML discussion?
- Create 12y ago
  Ex-Microsoft privacy adviser: I don't trust company Microsoft's former chief privacy adviser said he did not have faith in the security of the software company's technology http://www.theguardian.com/world/2013/sep/30/microsoft-privacy-chief-nsa http://www.theguardian.com/world/2013/sep/30/microsoft-priva...
  - gtirloni 12y ago
    Has the ISO 27018 process suffered from the same issues seen in the OOXML discussion? Additionally, is the ISO 27018 not worth implementing because Microsoft seems to have implemented it (allegedly)?

deleted 12y ago

[deleted]

eyeareque 12y ago

This might actually mean something had it been a company from a country where there wasn't secret courts that can create secret subpoenas.

kelv 12y ago

Is there any way I can legally read the standards document without paying the prohibitive fee?

holri 12y ago

"There is no cloud, just other people's computers." FSFE Sticker: https://blogs.fsfe.org/mk/files/2014/11/there-is-no-cloud-pack.jpg https://blogs.fsfe.org/mk/files/2014/11/there-is-no-cloud-pa...

Aoyagi 12y ago

A company that slurps all contacts and calendar entries from customers' smartphones without their explicit consent and without a way to opt out from it is talking about privacy.