15 ms·

Microsoft’s new small print – how your personal data is abused

348 points by rvern 11y ago

AdieuToLogic 11y ago
> Summing up these 45 pages, one can say that Microsoft basically grants itself very broad rights to collect everything you do, say and write with and on your devices in order to sell more targeted advertising or to sell your data to third parties. The company appears to be granting itself the right to share your data either with your consent “or as necessary”. And this differs from Google's and Facebook's usage policies how? Throwing out a red flag at this point for a corporation stating that people^H^H^H^H^H^H^H users are their product is the quintessential example of "closing the barn door after the horse is out."
- mholt 11y ago
  > And this differs from Google's and Facebook's usage policies how? This article has nothing to do with Google and Facebook. It doesn't even mention them. I think the article's purpose is to dispute the claim that the terms aren't as "straightforward" as Microsoft would have us think, as evidenced by the sarcastic closing line, "So much for clearly understandable and straightforward terms of service." In part, it is quite convincing. Phrases like "or as necessary" and "we collect voice input, as well as your name and nickname" is a little unsettling to me.
  - AdieuToLogic 11y ago
    > This article has nothing to do with Google and Facebook. It doesn't even mention them. Agreed. My point was not that the article critiques either of those organizations, simply that this move by Microsoft is quite comparable. To the point of being indistinguishable, IMHO. > I think the article's purpose is to dispute the claim that the terms aren't as "straightforward" as Microsoft would have us think, as evidenced by the sarcastic closing line, "So much for clearly understandable and straightforward terms of service." I recommend detailed reading of the ToC's the various Google and/or Facebook offerings which you are interested in as well then. Perhaps they are less shrouded in "legalese", but I submit their implications are no less disturbing.
- m_mueller 11y ago
  The difference is that this has been Google's and Facebook's business model ever since they became profitable, while MS was in the business of selling software products to users. The fact that they include this now combined with windows (the previously second largest cash cow) now being effectively free, indicates that MS sees user data as the future of their business too. Given MS makes their money mostly with enterprise/businesses I doubt that this will succeed.
  - zobzu 11y ago
    you mean, like android?
    - WorldWideWayne 11y ago
      Exactly. The whole argument is moot. People buy phones with Android/iOS just like they buy PCs with Windows. The problem is not Microsoft. They're actually only doing it now because smartphones gave them permission.
  - AdieuToLogic 11y ago
    > The difference is that this has been Google's and Facebook's business model ever since they became profitable, while MS was in the business of selling software products to users. I respect the point you are making, yet must point out that all it does is establish a timeline. There is no significant difference between the three companies' treatment of their customer base in this regard. And don't forget, including Google _also_ includes Andriod. > Given MS makes their money mostly with enterprise/businesses I doubt that this will succeed. I believe it would not be a surprise to find that the enterprise/ultimate/wtf-ever-they-call-it are excluded from this. Of course, I'm sure a user could receive the same exemption should they choose to pay the fee...
    - m_mueller 11y ago
      > here is no significant difference between the three companies' treatment of their customer base in this regard. Correct. What's different is the customer's expectation (so far) about this treatment. IMO this is significant. > I believe it would not be a surprise to find that the enterprise/ultimate/wtf-ever-they-call-it are excluded from this. Of course, I'm sure a user could receive the same exemption should they choose to pay the fee... I would certainly hope this to be the case, but so far this is AFAIK just speculation. Did MS think as far as building in these use cases? After what they did to the desktop UI (even on Windows Server) on Windows 8 I have stopped to just assume Microsoft knows what they're doing.
- kbenson 11y ago
  Agreed. While it is useful to know the privacy policies of a company, it's also very important to know how it relates to the market in general.
- em3rgent0rdr 11y ago
  >> And this differs from Google's and Facebook's usage policies how? Let's remember that you aren't running your desktop on facebook, you can use custom android rom or self-built chromium that doesn't interface with google.
- johnchristopher 11y ago
  We (edit: used to[0]) paid for windows, we shouldn't be the product. I believe the problem (and I am outraged about that) comes from the fact people are paying for Windows and practices such as the collecting of e-mail and contact shouldn't be necessary for 1. the OS to run smoothly and 2. for MS to cover for a low selling price. The OS and its default bundled application's set price should be enough to guarantee MS doesn't need a user's private data and metadata to provide the product (aka: we gave MS some money, they shouldn't need our private data to make money in order to keep the price `low'). There are many things like "data about network you connect to" that need to be collected and stored on the device unless the user wants to introduce the same password over and over again. This has to be stated somehow and phrased. Now if MS stores it on-line through the windows account for convenience it's almost the same thing if it's encrypted and hashed so MS just stores something that can't be exploited if leaked. I have been looking at Surface recently and now I wonder if I can run Debian on it. [0] but considering the upgrade path implies a paid product (win 7/8) it's a huge change for the user and my point still stand.
  - bitJericho 11y ago
    You know you don't have to login with a MS account right? that renders almost all of the privacy issues moot.
    - eps 11y ago
      What makes you so sure?
      - cwyers 11y ago
        https://www.thurrott.com/windows/windows-10/4260/windows-10-drops-reliance-on-microsoft-account https://www.thurrott.com/windows/windows-10/4260/windows-10-...
  - AdieuToLogic 11y ago
    You make a cogent argument, which I almost completely agree (excluding an OS vendor storing account info on their own servers). The consideration I hope to make evident now is: how do your points differ when applied to an Andriod device for which Google has been paid their licensing fees by the device manufacturer? Facebook's offerings are different, true, yet their Machiavellain use of whatever is presented to them warrants inclusion in this type of discussion IMHO.
- Sir_Substance 11y ago
  >And this differs from Google's and Facebook's usage policies how? By very little. Why are you still using google and facebook?
- justwannasing 11y ago
  > And this differs from Google's and Facebook's usage policies how? Was waiting for someone to bring that up. Microsoft has never done anything different than Google does yet, until now, no one bothered to check up on Microsoft. However, Microsoft has its tentacles more tightly wound around Windows users.
  - deleted 11y ago
    [deleted]
  - dhimes 11y ago
    What I find most disappointing is that Microsoft could have stopped all of this in the beginning if they had simply put adblockers on IE way back when they were giving the finger to all of the anti-trust legislation anyway. Google would have had to have a different model, and the currency of the Internet would be money. If you charge me $25/year to use facebook, I know what that means. If you charge me $25/year to use google, I know what that means. Now, however, the currency of the Internet is privacy, and not very many of us know what that means. It's still too abstract- and abstract thinking is hard for many of us.
    - bitmapbrother 11y ago
      What a silly short sighted argument. Web sites would have responded by blocking everything Microsoft created had they even attempted to do so.
      - dhimes 11y ago
        Please, your first sentence adds nothing, and it angers me. In that day, targeted ads weren't a major source of revenue (revenue models were still being worked out). Many web sites built primarily for Microsoft then-that is, taking advantage of their standards-breaking browser. The public didn't really cared about any other browser (by that I mean the same "public" that doesn't really care about privacy now). Microsoft did many bad things in that day. But if you wanted people to be able to use your site it had to work in IE (version 5 or 6 or so-I don't really remember). If it didn't work in Netscape it was no big deal. The web page would say "best viewed in IE5.5 or later" (or whatever version). So, no, websites couldn't afford to block Microsoft. They would lose their customers.
- bitmapbrother 11y ago
  >And this differs from Google's and Facebook's usage policies how? Unlike Microsoft, Google didn't criticize their competitors for their privacy polices. They really are hypocrites.
- marssaxman 11y ago
  You don't see a significant difference between terms of service governing the use of data you entrust to computers owned by some web service, and terms of service governing the use of data you store yourself on your own computer?
Animats 11y ago
Does this apply to users of Windows 10 in general? If so, it's going to be totally unacceptable to law firms, DoD customers, and anyone who competes with Microsoft or their advertisers.
- bitJericho 11y ago
  Most of the privacy invasion comes with logging in with a MS account. You can login with a standard windows or domain account and then all this integrated cloud stuff doesn't really apply.
  - labras 11y ago
    Not completely true. Don't forget you need an account, for instance, to buy, install and use MS Office 360. I bet if it wasn't for the Office, many people would move away from Windows easily. And don't forget windows comes with Defender installed, which collects user metrics out-of-the-box. IE/Sparta also collects your usage data. Even windows "search" does.
kbenson 11y ago
How do we not yet have a metric for noting specific security policies, so we can create a matrix of how different companies handle this information? I'm appreciative of information on what personal data policies Microsoft uses, but I'm more interested in how it compares to other companies. How is it the same or different than Google and Apple? This is extremely important. Right now we have an extremely inefficient market with respect to privacy. Users don't know what policies companies have, and even if they know where to find that information, it's extremely inaccessible. Making it easy to compare services would allow users to actually distinguish based on this metric, which is the first step towards pressuring companies to actually compete on this metric. Simplistically, this could be achieved with a set of data policy components (account information, login information, purchase information, location information, various activity information items, etc) and their policy on them in well defined terms, such as Not Applicable, Does not collect, Collects but does not share, Collects and may share, Collects and known to share. That would be the start of something beautiful.
- blackethylene 11y ago
  Terms of Service; Didn't Read (https://tosdr.org https://tosdr.org) is a project aiming to achieve what you describe, but it's mainly for websites and web applications. They need much more contributors though.
  - kbenson 11y ago
    With a much more clearly defined set of items they measure this is fairly close to an initial version of what I was describing. With that and a standardized legend for the rating for each item (save the specifics for a mouse-over) it would be fairly easy to create a service matrix of selected services.
    - scrollaway 11y ago
      TOSDR isn't just a good service, it has some momentum and an excellent dataset already. If the right people were to start contributing it could gather quite a lot of steam.
Oletros 11y ago
If the setting are synced between computers and Cortana is a personal assistant, how they can work without backing up the data and collecting the behavior?
- drdaeman 11y ago
  There are two approaches. First is technical. Encrypt everything on originating devices and store the encrypted copy to which Microsoft would have no key (not even escrowed one). Not like this works for all cases, but a lot of data - like browsing history or WiFi AP passwords - does not require server-side processing. Another is legal approach. Have sane privacy policies - not "we'll use your data as necessary" - and make sure users opt-in. Not like this also works - certainly not against all adversaries, but at least you can sue.
rvern 11y ago
See also: http://www.techworm.net/2014/10/microsofts-windows-10-permission-watch-every-move.html http://www.techworm.net/2014/10/microsofts-windows-10-permis... That article points out some things that are even worse in the privacy policy, for the technical preview however: “Microsoft collects information about you, your devices, applications and networks, and your use of those devices, applications and networks. Examples of data we collect include your name, email address, preferences and interests; browsing, search and file history; phone call and SMS data; device configuration and sensor data; and application usage.” “We may collect information about your device and applications and use it for purposes such as determining or improving compatibility” and “use voice input features like speech-to-text, we may collect voice information and use it for purposes such as improving speech processing.” “If you open a file, we may collect information about the file, the application used to open the file, and how long it takes any use [of]it for purposes such as improving performance, or [if you]enter text, we may collect typed characters, we may collect typed characters and use them for purposes such as improving autocomplete and spell check features.” Here is the policy itself: http://windows.microsoft.com/en-gb/windows/preview-privacy-statement http://windows.microsoft.com/en-gb/windows/preview-privacy-s...
Zekio 11y ago
The unique advertising ID is possible to opt out of and if you opt in again it generates a new one so you won't get associated with the old one. Anyway is it not as if apps aren't collection information on people without asking already.
- whoopdedo 11y ago
  Anyone up for making a Windows version of XPrivacy that generates a fake advertising ID, randomized so there's no way to associate any two sessions with each other.
  - Maarten88 11y ago
    Why do that when you can just turn it off?
kijin 11y ago
I'm going to hold off on the "free upgrade" to Windows 10 until I can find a trustworthy and comprehensive blog post on how I can disable all of the privacy-invading "features". Not linking a Microsoft account with the local account seems to be a good starting point. I also plan to do my best to get rid of OneDrive and Cortana, neither of which I have any use for. But I have no idea how to go about discovering and tackling all the other possible channels for data leakage, which we're bound to hear about in the days and weeks to come. Free upgrade means you're no longer a customer. It's a cliche, but it fits perfectly this time. Some of the things I'd like to disable will probably require upgrading to the Pro edition, which of course is only available to paying customers.
- kardos 11y ago
  It's a valiant effort, but you're navigating a privacy minefield. Even if you find/disable all the known things, a single windows update can introduce a new opt-out "feature" that undoes it all. Your effort might be better spent migrating to a less invasive system. "Today we were unlucky, but remember we only have to be lucky once – you will have to be lucky always."
  - kijin 11y ago
    Well, I guess it's inevitable as long as I'm using a proprietary operating system. I don't expect Apple to be any better. Heck, even Ubuntu nowadays comes with ads that you need to opt out of. At least if I get Windows 10 Pro, I'll be able to turn off non-security-related updates.
    - kardos 11y ago
      > Heck, even Ubuntu nowadays comes with ads that you need to opt out of. No longer true. Canonical took a lot of (deserved) flak for making that feature opt-out, and last year they finally fixed it [1]. http://www.omgubuntu.co.uk/2014/03/ubuntu-make-amazon-product-results-opt-unity http://www.omgubuntu.co.uk/2014/03/ubuntu-make-amazon-produc...
      - 11y ago
kardos 11y ago
TL;DR: "By using Windows 10, you relinquish any expectation of privacy". Stallman is an optimist! This "privacy policy" is much worse than what we expect from malware [1]. Cryptolocker might hold my files hostage for some bitcoins, but they're not going to sell me out to aggressive lawyers or overzealous law enforcement. [1] http://www.networkworld.com/article/2926215/microsoft-subnet/richard-stallman-windows-os-is-malware.html http://www.networkworld.com/article/2926215/microsoft-subnet...
jensen123 11y ago
I wonder if what we're seeing here is basically the beginning of a new era of some sort of feudalism, and the end of "the age of equality". The French revolution, US revolution etc. talked about and put equality into their constitutions, and that has kinda been the prevailing world view ever since. Although, I guess the real cause for this were technologies like the printing press, gun powder and the assembly line - technologies that made people more equal. But now, even if most people hear about this, I'm guessing that most will continue using Windows. For the last 200 years or so, we've had various leaders standing up for the little guy, but I wonder if anybody will bother in the future, when they see that most "little guys" will not even bother to switch operating systems or use a different search engine in order to preserve their freedoms and rights.
- touristtam 11y ago
  We have been in an economic feudalism for the last century. The fact that companies have all the right and none of the duty of a normal person in front of the law with the all power money can buy means there is a strong disparity between normal citizens and them. Corporation have effectively replaced the Lords of the previous despotic regimes in the Western World. Only when we cease to consider Corporations more important than the rest of the economic actors can we move the balance of powers back where the it has been intended by the previous revolutionary movement. But this is kind of off-topic with this news. I hope MSFT get a bash for this kind of niceties and implement an opt-out solution for all their in-built spyware.
  - IanDrake 11y ago
    >The fact that companies have all the right and none of the duty of a normal person in front of the law with the all power money can buy Can you unpack that for me? I own a corporation and enjoy nothing of what you mention. I fear I'm missing out on something.
    - dikaiosune 11y ago
      See [1] for an overview of corporate personhood. They don't get all of the protections and rights of a human being, but they do get a surprising number of them (like free speech) even though they never die, have children, or serve in the military. They also can't be jailed, and not all laws that apply to a natural person apply to a corporation. I'm sure that GP has some other examples of "none of the duty of a normal person" in mind, but that's what I know of off the top of my head. Regarding their power, I think that corresponds to corporations' ability to amass wealth and influence (often) faster than an individual. Of course there is a spectrum -- national defense contractors with billions of dollars in the bank can have a surprising amount of say in the way things are run, but an incorporated small business might have a hard time getting a local zoning issue addressed. [1] https://en.wikipedia.org/wiki/Corporate_personhood https://en.wikipedia.org/wiki/Corporate_personhood
systemz 11y ago
Default syncing with MS services is really bad for privacy. Unfortunately we are living in opt-out world now.
- kardos 11y ago
  > Unfortunately we are living in opt-out world now. This is a hyperbolic statement. Here's a fixed version: "Microsoft has created an opt-out privacy-hostile software ecosystem" The world is not Microsoft. You're free to use alternatives.
  - amirmc 11y ago
    Network effects mean that there are few pragmatic options left. The GP may well be free to use alternatives but at what cost? Should they be selecting future employers based on the employer's choice of software? I may well be free to go live in a (digital) cave but presenting it as a viable choice merely exacerbates the existing problem.
    - icebraining 11y ago
      If you're on your employer's computer, you already didn't have privacy, so nothing's changed in that regard.
      - amirmc 11y ago
        True, but there's a difference between 1. your employer having a bunch of information about you and 2. your employer signing up to a ToS with third parties that effectively hands over all your info to them. Point 2 is probably not unusual but were starting to see (imho) more pernicious attitudes. Examples include the current Windows discussion, where your employer may be perfectly happy to sign (on the employees behalf) that your data be sent off to Microsoft (and used for whatever Microsoft deems 'necessary'). There was also the announcement of Facebook at Work, which I'm sure would be more than happy to cross-correlate the 'work' you with the 'personal' you, in order to 'provide a better service'. In both these scenarios, I'm sure the company will act to protect itself from exposure, but it's unclear what choices the employees really have.
urwth6u 11y ago
So let's drop all pretense here. As a citizen of an European country, using Microsoft Account™, NSA can look at anything I do?
- jmnicolas 11y ago
  It certainly already does and your local spy agency too.
  - urwth6u 11y ago
    That is demonstrably not true. But that is not even what I was asking about. What I was talking about is an online feature, called Windows Account, which works online by default(!). Therefore we must ask ourselves what is Microsoft doing with that information.
    - abstractbeliefs 11y ago
      >That is demonstrably not true. Please do demonstrate/prove that then.
      - hkmix 11y ago
        I don't disagree, but burden of proof.
- higherpurpose 11y ago
  Despite all the "new security features" in Windows 10, or perhaps in spite of them as a work-around, Windows 10 seems to be the most "law enforcement friendly" OS yet (not just out of Windows all versions, but out of all operating systems).
rasz_pl 11y ago
Anecdote: Created new and unique Microsoft account 3 weeks ago with the sole purpose of testing w10, used it only ONCE to log into w10 vm. Started this VM today, logged into outlook and what do I see? 2 spam messages and one google news bounce. How do you trust a company like that with any data?
- kiiski 11y ago
  I suppose you're implying that Microsoft sold your new account name to spammers? It could also be that you used a name that you, or someone else, have used at a different place and the spammers simply try sending mail to all the big email providers with that name in the hope of reaching someone. That would seem like a more probable explanation to me.
  - mikegioia 11y ago
    Created new and unique Microsoft account I figure it was something he hadn't used before.
- cm2187 11y ago
  You are luckier than me. My windows 10 VM have usually crashed after a week.
  - rasz_pl 11y ago
    now that you mention, it pops memory read error every time I shut it down.
- com2kid 11y ago
  Spammers send out to machine generated lists of potential email addresses. If you create "james053164@hotmail.com" it will get spam eventually. (Well a bit faster now that it is indexed)
batou 11y ago
Not happening. Sorry this has gone on long enough. Closed both Microsoft accounts and cancelled my MSDN and AP subscription renewals. I do a big chunk of my work on a CentOS desktop machine already. There's not much of a push to chuck everything in an 8.1 VM and start moving it all over. The MSDN licenses I need persist past the sub so that's enough for me. I've been on the verge of doing this for a couple of months already anyway for ref. Edit: Also, I'm really not happy about the pro-Microsoft spin all over the media recently. It appears to be covering up a number of nasty changes behind the scenes and lacking in critical analysis. Edit 2: Proof: http://imgur.com/a/ZYWZM http://imgur.com/a/ZYWZM Edit 3: does anyone know of a decent 4G modem for a laptop, preferably one that works in Linux. I can then skip my phone as a tether and use a dumbphone.
- donkeyd 11y ago
  You could use a Mifi device to setup a wireless network. Will be platform independent.
  - batou 11y ago
    Thanks - much appreciated. That's a good solution I hadn't thought of. Annoyingly my ThinkPad has a Gobi 3G card in it but I've got used to 4G speeds now.
- sillygeese 11y ago
  The thing is, "our" data is abused by all big companies at the very least, regardless of what they publicly tell us they're doing. I appreciate the sentiment there, but you'll have to close pretty much everything if you really want to protest the abuse. Don't use any stock/operator/manufacturer version of Android either, by the way. They're full of spyware.
  - batou 11y ago
    Yes I agree entirely; you're 100% right. The only 3rd party service I now rely on personally is my domain registrar and an IMAP box which is unavoidable to participate in the world now. I've closed most of my online accounts with services over the last year already. I moved my code from github to local fossil instances about 3 months ago as well. Everything I use is hosted by reputable companies in the EU. I'm not touching Android. Too many bad experiences there about a year ago for me.
martijn_himself 11y ago
Honest question: is one better off using Apple's hardware and OS or is Linux the only alternative?
- fit2rule 11y ago
  Apple are just as bad as Microsoft. And some Linux distro's are headed in this direction too (Ubuntu).
  - labras 11y ago
    Agree! Ubuntu and similar, along with zeitgeist pre-installed, do exactly the same.
    - icebraining 11y ago
      As far as I know, Zeitgeist doesn't send that information to anywhere (it's kept in the computer), so I don't see how it's even nearly the same. I don't like the bloat, but I don't see it as more privacy invading than any other system logs.
      - labras 11y ago
        Zeitgeist stores your information on it's datahub, where 3rd party applications can retrieve it from. Nothing prevents such applications from sending this information elsewhere, once accessed. As this comes out-of-the-box by default, and is in fact a pain to switch off, I compare it to this new windows behavior.
        icebraining 11y ago
        All your criticisms apply to syslogd as well: it stores your information in a central location (/var/log), which 3rd party applications can read and upload to somewhere else, and lots of software expects it to be there, so it can be a pain to switch off too. Should we compare syslogd to the new Windows behaviour?
kungfufrog 11y ago
The real reason I'll never use Microsoft products again: I'm sick of legally purchasing software and being treated like a potential charlatan every time I change a component of my computer or upgrade. I have lost countless hours to Microsoft Tech Support for licensing issues (which, to be honest, are reasonably efficient these days). However, the older I get, the more I just plain resent having to deal with this intrusion into what should be an experience I control. Microsoft licensing is hellish, I've worked with it for years and I still don't entirely understand it.
- amelius 11y ago
  Well, at least you paid for those product which should give you better consumer protection than when you didn't (for Google/Facebook products for instance). But IANAL.
- batou 11y ago
  Indeed. Wait until you have to deal with an audit. Apparently, even on microsoft's advice on licensing, we still owed them about £50,000 of missing licenses after an audit... Most of this was down to a SQL Server upgrade where core and CPU terminology was changed.
  - redcalx 11y ago
    I'm currently arguing for serious considerations of SQL Server alternatives for selected new development work (and where reasonably achievable), in order to mitigate spiralling license fees. The main issue is that mostly those fees are paid by our customers, but ultimately our customer's cost is our cost. Collectively it's becoming a stupid amount of money.
    - batou 11y ago
      We're only keeping it around due to a pile of stored procedures and coupling (see an earlier thread on this I was whinging about). PostgreSQL is the next step. We'll pay for support via EnterpriseDB still. Our main SQL cluster is two 48 core HP machines with 512Gb of RAM each and a big EMC SAN. We want this as lots of much smaller machines but you can't really scale down SQL Server once everything is coupled into it.
sudioStudio64 11y ago
I was expecting this kind of thing today. I'm surprised that there is only one "oh noes muh freedums!" post on the front page.
cm2187 11y ago
Does any of this apply when we use a local account with Windows?
bronlund 11y ago
Finally! Microsoft going all in :D This is going to be fun.
userbinator 11y ago
It makes a lot of sense now why Windows 10 is being given away, even for those running pirated Windows versions: https://news.ycombinator.com/item?id=9224880 https://news.ycombinator.com/item?id=9224880 I had a feeling about this ever since the first announcements that Win10 would be (monetarily) free. That old saying is still relevant as ever: "If you're not paying for it, you're the product being sold."
__Joker 11y ago
And we thought Microsoft was a paragon when it comes to privacy[1]. Albeit, [1] was about cloud services. [1]. https://news.ycombinator.com/item?id=9058283 https://news.ycombinator.com/item?id=9058283
- yellowapple 11y ago
  It's worth noting that Microsoft is heavily afflicted with the "left hand doesn't know what the right hand's doing" syndrome. Most of its product departments have antagonistic relationships with one another at best. The cloud services department(s) could have entirely different policies and philosophies from the one that makes Windows, which further has different policies and philosophies from the team that makes Office, which further has different policies and philosophies from the team that makes Surface tablets, etc.
bargl 11y ago
I'd be interested to see an independent audit on how much of this data they (and google/facebook/apple/etc) are collecting is being used to help improve training of Cortana as an assitant (or other tools that directly assist the user like Google Maps) , and how much of this data is really just for selling to advertising companies, and how much is mandated by governements. I know this isn't binary some data may be dual purposed (training and ads for example) but I'd like to see an audit of what it's used for. I'll never get that, but it would be interesting.
arafalov 11y ago
They say they can read my browsing history. I wonder if that's IE only or will they reach out into the Firefox and Chrome, etc.
arien 11y ago
It is a little unsettling when you read these policies. This is probably for Cortana. She has to understand and process your voice commands, learn your nickname and preferences to be effective. She already works in Windows Phone (very nicely), and I don't think a little phone processor would be enough to power her up. In fact, she doesn't work without an internet connection, at least in WP. What happens is that she takes the information you input to the cloud, processes it there with more than enough horsepower to do her stuff and brings it back to you. I suppose this is how it'll work as well on PCs. So for all this to work, yes they need to collect our data. Face it, with any smart assistant that we want it's going to be the same, they're all cloud powered. Doesn't Siri also require a internet connection? Probably Alexa too, and any others work exactly the same. It is a necessary evil to have a useful virtual assistant. Although if we don't want her we can opt out of the MSA account, as someone posted in the comments. Unsure if that removes all the privacy concerns, that would be useful to know. On Windows Phone it did (you can opt out of sending data to MS and Cortana is disabled).
- arihant 11y ago
  On Windows 10 you can opt-out as well. In fact, using Microsoft account is an opt-in while installing. You can just make a local account and certain features would be off by default. If you try to access them it will remind you that you need an MS account to access them. The fundamental problem with this privacy policy is the scary wording. When Gmail first came out, Google was (probably) the first company to read emails to figure out ads. But they enforced the not-touched-by-human-handsiness claim hard throughout. MS, on the other hand, not only says it will collect data but again and again mentions "disclose when necessary." There are too many uses of "disclose." It almost sounds like they will just hand over data without much conviction.
  - arien 11y ago
    I went to the Privacy statement [0], to the "Reasons we share your data" (click on Learn More) and it does not sound scary at all (it' pretty much the same as any internet company that holds customer data). It's very clearly worded and I know exactly how/why my data will be used, so I can decide if I want to go ahead or if I don't. [0] https://www.microsoft.com/en-us/privacystatement/default.aspx https://www.microsoft.com/en-us/privacystatement/default.asp... There's also a Data Retention section further down that specifies how long your data is in their servers. edit: In the top section (Personal Data we collect) it also says: "You have choices about the data we collect. When you are asked to provide personal data, you may decline. But if you choose not to provide data that is necessary to provide a service, you may not be able to use some features or services."
sandycheeks 11y ago
As a small business owner, my main concern is that there are no assurances that my competitors large and small will not be able to see my contracts/suppliers/budgets/sales/processes at some point due to this ambiguous 'disclosure' mentioned or perhaps through some flaw that allows access to the data collected from the computers used in my small business. I must be missing something here since I know Microsoft wants Windows to be used for businesses and the privacy of this information is vital to that.
- fluidcruft 11y ago
  I'll get the popcorn ready while waiting to see what hospital IT have to say about this. They have already banned use of Microsoft's new mobile Outlook apps (iOS,Android,Win Phone) when they found out that these are actually thin clients to a cloud service that performs MITM on the hospital Outlook server to download, store and processes all email (the cloud servers aren't even fully Microsoft--they became Microsoft's via acquisition). And of course it stores usernames and passwords in order to accomplish this (confirmed by common sense, obtuse fine print and deceptive non-denials by Microsoft support). The penalties in HIPAA and HITECH aren't jokes (and now include jail time).
brudgers 11y ago
I dislike the Microsoft privacy policy. I don't see a better way for it to navigate the legal minefield. If they promise any meaningful kind of protection, it is inevitable that it cannot be delivered. The wired world leaks data. Much of it by design, e.g. to a first approximation all browsers work with cookies, store history, cache content, use some sort of thumbprint for SSL, etc. No browser vendor promises operational privacy because implementing it would make the browser unusable. Just using NoScript (as I do) is a bit of a pain in the ass. Microsoft has a browser plus a whole lot more stuff including third party vendors, and big stacks of cash to make itself a lawsuit magnet...some lawyer somewhere will allege transmitting an IP address is breech under a strong privacy policy. The reality is that nothing you do on a computer connected to the internet should be considered private. The Microsoft privacy policy reflects this reality even if it upsets the world some of us wish existed [so long as we don't have to give up our mobile GPS, Uber, and iTunes]. But it hasn't existed since the days of credit card processing over copper. I admire Stallman, information wants to be free. Alas "An atom blaster point is a good weapon, but it can point both ways."
- ams6110 11y ago
  nothing you do on a computer connected to the internet should be considered private Amen. This is what I have been telling people for the past few years. If you put something online, consider it public and irrevocable.
- bad_user 11y ago
  > nothing you do on a computer connected to the internet should be considered private That doesn't excuse Microsoft and others for becoming more and more invasive. And voting with your wallet works.
  - brudgers 11y ago
    I think Windows 10 is pretty much free as in beer for most ordinary users so the wallet threat is pretty flat. I read Microsoft's policy as more legal cover for the reality that data gets stored all over the place. The internet is full of caches and nobody can guarantee that they can identify all of them, much less control them. The nature of people's complaints show how vulnerable Microsoft is to some jury believing "they should have known." If you want privacy, don't turn on your internet connected devices. TANSTAAFL.
cornstalks 11y ago
For a company that ran a heavy Scroogled campaign, the irony is amusing.
- bitmapbrother 11y ago
  So true. But, it's good to see these hypocrites finally expose themselves.
cm2187 11y ago
For those using a local account and having no use for these gadgets, would firewall rules be enough to prevent Windows from leaking data to Microsoft?
sandworm101 11y ago
Anyone else use Noscript? I just forwarded some comments re MS's privacy statement to a law-related listserv. But everyone responded they couldn't see the text I cited from MS. It turns out that the document looks very different with noscript than it does without. With all script allowed (ie for those using IE/edge) all the scary stuff hides behind "learn more" buttons. Check it out for yourself: https://www.microsoft.com/en-us/privacystatement/default.aspx https://www.microsoft.com/en-us/privacystatement/default.asp... I'll be adding this underhanded approach to my loooong list of reasons to love linux.
VOYD 11y ago
um yeah, this is how the entire internet works. You can't possibly think that Google Chrome doesn't do the same thing.
JimmaDaRustla 11y ago
Not sure what the fuss is about, the same old rule applies: if you want your data to be private, don't use any form of cloud services - server based voice/video chat, cloud storage services (google drive, skydrive, icloud), digital assistants (siri, cortana, google now), any contextual based delivered services which "learns" anything about you to provide you with any form of automated and/or dynamic experience. If you want to be treated like you live in a box, then you're going to have to live by it. Everyone complaining and "fed up", closing their MSDN accounts, boycotting MSFT products - you're in an echo chamber which won't be felt as our devices become more service oriented rather than boxed solutions. MSFT is trying to stay relevant, not undermine their massive user base. Whether it is right or wrong, I don't have an opinion on, but if you think MSFT is a pioneer in this space, you're being unjustly biased.
- p4bl0_666 11y ago
  finally someone who gets it! you want a service that requires your data? you have to give your data. you don't want to? don't complain for the missing service!
  - JimmaDaRustla 11y ago
    I guess the only thing we can complain about is that we aren't given a "closed/boxed" solution and able to accept the TOS to services we want on an adhoc basis - we have to go and disable services and hope that the TOS we agreed to needn't apply. Perhaps these are growing pains for the direction services are heading, or we'll just learn to accept invasion of privacy as a default.
shift32 11y ago
People need to take into consideration the fact that that is how you build an assistant or an AI. You need collective data gathered from a vast majority of interactions with a user. Besides, I am pretty sure this is how Google, Apple do it. All big corporations use your data in a form or another.

348 points by rvern 11y ago

> Summing up these 45 pages, one can say that Microsoft basically grants itself very broad rights to collect everything you do, say and write with and on your devices in order to sell more targeted advertising or to sell your data to third parties. The company appears to be granting itself the right to share your data either with your consent “or as necessary”. And this differs from Google's and Facebook's usage policies how? Throwing out a red flag at this point for a corporation stating that people^H^H^H^H^H^H^H users are their product is the quintessential example of "closing the barn door after the horse is out."

mholt 11y ago
> And this differs from Google's and Facebook's usage policies how? This article has nothing to do with Google and Facebook. It doesn't even mention them. I think the article's purpose is to dispute the claim that the terms aren't as "straightforward" as Microsoft would have us think, as evidenced by the sarcastic closing line, "So much for clearly understandable and straightforward terms of service." In part, it is quite convincing. Phrases like "or as necessary" and "we collect voice input, as well as your name and nickname" is a little unsettling to me.
- AdieuToLogic 11y ago
  > This article has nothing to do with Google and Facebook. It doesn't even mention them. Agreed. My point was not that the article critiques either of those organizations, simply that this move by Microsoft is quite comparable. To the point of being indistinguishable, IMHO. > I think the article's purpose is to dispute the claim that the terms aren't as "straightforward" as Microsoft would have us think, as evidenced by the sarcastic closing line, "So much for clearly understandable and straightforward terms of service." I recommend detailed reading of the ToC's the various Google and/or Facebook offerings which you are interested in as well then. Perhaps they are less shrouded in "legalese", but I submit their implications are no less disturbing.
m_mueller 11y ago
The difference is that this has been Google's and Facebook's business model ever since they became profitable, while MS was in the business of selling software products to users. The fact that they include this now combined with windows (the previously second largest cash cow) now being effectively free, indicates that MS sees user data as the future of their business too. Given MS makes their money mostly with enterprise/businesses I doubt that this will succeed.
- zobzu 11y ago
  you mean, like android?
  - WorldWideWayne 11y ago
    Exactly. The whole argument is moot. People buy phones with Android/iOS just like they buy PCs with Windows. The problem is not Microsoft. They're actually only doing it now because smartphones gave them permission.
- AdieuToLogic 11y ago
  > The difference is that this has been Google's and Facebook's business model ever since they became profitable, while MS was in the business of selling software products to users. I respect the point you are making, yet must point out that all it does is establish a timeline. There is no significant difference between the three companies' treatment of their customer base in this regard. And don't forget, including Google _also_ includes Andriod. > Given MS makes their money mostly with enterprise/businesses I doubt that this will succeed. I believe it would not be a surprise to find that the enterprise/ultimate/wtf-ever-they-call-it are excluded from this. Of course, I'm sure a user could receive the same exemption should they choose to pay the fee...
  - m_mueller 11y ago
    > here is no significant difference between the three companies' treatment of their customer base in this regard. Correct. What's different is the customer's expectation (so far) about this treatment. IMO this is significant. > I believe it would not be a surprise to find that the enterprise/ultimate/wtf-ever-they-call-it are excluded from this. Of course, I'm sure a user could receive the same exemption should they choose to pay the fee... I would certainly hope this to be the case, but so far this is AFAIK just speculation. Did MS think as far as building in these use cases? After what they did to the desktop UI (even on Windows Server) on Windows 8 I have stopped to just assume Microsoft knows what they're doing.
kbenson 11y ago
Agreed. While it is useful to know the privacy policies of a company, it's also very important to know how it relates to the market in general.
em3rgent0rdr 11y ago
>> And this differs from Google's and Facebook's usage policies how? Let's remember that you aren't running your desktop on facebook, you can use custom android rom or self-built chromium that doesn't interface with google.
johnchristopher 11y ago
We (edit: used to[0]) paid for windows, we shouldn't be the product. I believe the problem (and I am outraged about that) comes from the fact people are paying for Windows and practices such as the collecting of e-mail and contact shouldn't be necessary for 1. the OS to run smoothly and 2. for MS to cover for a low selling price. The OS and its default bundled application's set price should be enough to guarantee MS doesn't need a user's private data and metadata to provide the product (aka: we gave MS some money, they shouldn't need our private data to make money in order to keep the price `low'). There are many things like "data about network you connect to" that need to be collected and stored on the device unless the user wants to introduce the same password over and over again. This has to be stated somehow and phrased. Now if MS stores it on-line through the windows account for convenience it's almost the same thing if it's encrypted and hashed so MS just stores something that can't be exploited if leaked. I have been looking at Surface recently and now I wonder if I can run Debian on it. [0] but considering the upgrade path implies a paid product (win 7/8) it's a huge change for the user and my point still stand.
- bitJericho 11y ago
  You know you don't have to login with a MS account right? that renders almost all of the privacy issues moot.
  - eps 11y ago
    What makes you so sure?
    - cwyers 11y ago
      https://www.thurrott.com/windows/windows-10/4260/windows-10-drops-reliance-on-microsoft-account https://www.thurrott.com/windows/windows-10/4260/windows-10-...
- AdieuToLogic 11y ago
  You make a cogent argument, which I almost completely agree (excluding an OS vendor storing account info on their own servers). The consideration I hope to make evident now is: how do your points differ when applied to an Andriod device for which Google has been paid their licensing fees by the device manufacturer? Facebook's offerings are different, true, yet their Machiavellain use of whatever is presented to them warrants inclusion in this type of discussion IMHO.
Sir_Substance 11y ago
>And this differs from Google's and Facebook's usage policies how? By very little. Why are you still using google and facebook?
justwannasing 11y ago
> And this differs from Google's and Facebook's usage policies how? Was waiting for someone to bring that up. Microsoft has never done anything different than Google does yet, until now, no one bothered to check up on Microsoft. However, Microsoft has its tentacles more tightly wound around Windows users.
- deleted 11y ago
  [deleted]
- dhimes 11y ago
  What I find most disappointing is that Microsoft could have stopped all of this in the beginning if they had simply put adblockers on IE way back when they were giving the finger to all of the anti-trust legislation anyway. Google would have had to have a different model, and the currency of the Internet would be money. If you charge me $25/year to use facebook, I know what that means. If you charge me $25/year to use google, I know what that means. Now, however, the currency of the Internet is privacy, and not very many of us know what that means. It's still too abstract- and abstract thinking is hard for many of us.
  - bitmapbrother 11y ago
    What a silly short sighted argument. Web sites would have responded by blocking everything Microsoft created had they even attempted to do so.
    - dhimes 11y ago
      Please, your first sentence adds nothing, and it angers me. In that day, targeted ads weren't a major source of revenue (revenue models were still being worked out). Many web sites built primarily for Microsoft then-that is, taking advantage of their standards-breaking browser. The public didn't really cared about any other browser (by that I mean the same "public" that doesn't really care about privacy now). Microsoft did many bad things in that day. But if you wanted people to be able to use your site it had to work in IE (version 5 or 6 or so-I don't really remember). If it didn't work in Netscape it was no big deal. The web page would say "best viewed in IE5.5 or later" (or whatever version). So, no, websites couldn't afford to block Microsoft. They would lose their customers.
bitmapbrother 11y ago
>And this differs from Google's and Facebook's usage policies how? Unlike Microsoft, Google didn't criticize their competitors for their privacy polices. They really are hypocrites.
marssaxman 11y ago
You don't see a significant difference between terms of service governing the use of data you entrust to computers owned by some web service, and terms of service governing the use of data you store yourself on your own computer?

Animats 11y ago

Does this apply to users of Windows 10 in general? If so, it's going to be totally unacceptable to law firms, DoD customers, and anyone who competes with Microsoft or their advertisers.

bitJericho 11y ago
Most of the privacy invasion comes with logging in with a MS account. You can login with a standard windows or domain account and then all this integrated cloud stuff doesn't really apply.
- labras 11y ago
  Not completely true. Don't forget you need an account, for instance, to buy, install and use MS Office 360. I bet if it wasn't for the Office, many people would move away from Windows easily. And don't forget windows comes with Defender installed, which collects user metrics out-of-the-box. IE/Sparta also collects your usage data. Even windows "search" does.

kbenson 11y ago

How do we not yet have a metric for noting specific security policies, so we can create a matrix of how different companies handle this information? I'm appreciative of information on what personal data policies Microsoft uses, but I'm more interested in how it compares to other companies. How is it the same or different than Google and Apple? This is extremely important. Right now we have an extremely inefficient market with respect to privacy. Users don't know what policies companies have, and even if they know where to find that information, it's extremely inaccessible. Making it easy to compare services would allow users to actually distinguish based on this metric, which is the first step towards pressuring companies to actually compete on this metric. Simplistically, this could be achieved with a set of data policy components (account information, login information, purchase information, location information, various activity information items, etc) and their policy on them in well defined terms, such as Not Applicable, Does not collect, Collects but does not share, Collects and may share, Collects and known to share. That would be the start of something beautiful.

blackethylene 11y ago
Terms of Service; Didn't Read (https://tosdr.org https://tosdr.org) is a project aiming to achieve what you describe, but it's mainly for websites and web applications. They need much more contributors though.
- kbenson 11y ago
  With a much more clearly defined set of items they measure this is fairly close to an initial version of what I was describing. With that and a standardized legend for the rating for each item (save the specifics for a mouse-over) it would be fairly easy to create a service matrix of selected services.
  - scrollaway 11y ago
    TOSDR isn't just a good service, it has some momentum and an excellent dataset already. If the right people were to start contributing it could gather quite a lot of steam.

Oletros 11y ago

If the setting are synced between computers and Cortana is a personal assistant, how they can work without backing up the data and collecting the behavior?

drdaeman 11y ago
There are two approaches. First is technical. Encrypt everything on originating devices and store the encrypted copy to which Microsoft would have no key (not even escrowed one). Not like this works for all cases, but a lot of data - like browsing history or WiFi AP passwords - does not require server-side processing. Another is legal approach. Have sane privacy policies - not "we'll use your data as necessary" - and make sure users opt-in. Not like this also works - certainly not against all adversaries, but at least you can sue.

rvern 11y ago

See also: http://www.techworm.net/2014/10/microsofts-windows-10-permission-watch-every-move.html http://www.techworm.net/2014/10/microsofts-windows-10-permis... That article points out some things that are even worse in the privacy policy, for the technical preview however: “Microsoft collects information about you, your devices, applications and networks, and your use of those devices, applications and networks. Examples of data we collect include your name, email address, preferences and interests; browsing, search and file history; phone call and SMS data; device configuration and sensor data; and application usage.” “We may collect information about your device and applications and use it for purposes such as determining or improving compatibility” and “use voice input features like speech-to-text, we may collect voice information and use it for purposes such as improving speech processing.” “If you open a file, we may collect information about the file, the application used to open the file, and how long it takes any use [of]it for purposes such as improving performance, or [if you]enter text, we may collect typed characters, we may collect typed characters and use them for purposes such as improving autocomplete and spell check features.” Here is the policy itself: http://windows.microsoft.com/en-gb/windows/preview-privacy-statement http://windows.microsoft.com/en-gb/windows/preview-privacy-s...

Zekio 11y ago

The unique advertising ID is possible to opt out of and if you opt in again it generates a new one so you won't get associated with the old one. Anyway is it not as if apps aren't collection information on people without asking already.

whoopdedo 11y ago
Anyone up for making a Windows version of XPrivacy that generates a fake advertising ID, randomized so there's no way to associate any two sessions with each other.
- Maarten88 11y ago
  Why do that when you can just turn it off?

kijin 11y ago

I'm going to hold off on the "free upgrade" to Windows 10 until I can find a trustworthy and comprehensive blog post on how I can disable all of the privacy-invading "features". Not linking a Microsoft account with the local account seems to be a good starting point. I also plan to do my best to get rid of OneDrive and Cortana, neither of which I have any use for. But I have no idea how to go about discovering and tackling all the other possible channels for data leakage, which we're bound to hear about in the days and weeks to come. Free upgrade means you're no longer a customer. It's a cliche, but it fits perfectly this time. Some of the things I'd like to disable will probably require upgrading to the Pro edition, which of course is only available to paying customers.

kardos 11y ago
It's a valiant effort, but you're navigating a privacy minefield. Even if you find/disable all the known things, a single windows update can introduce a new opt-out "feature" that undoes it all. Your effort might be better spent migrating to a less invasive system. "Today we were unlucky, but remember we only have to be lucky once – you will have to be lucky always."
- kijin 11y ago
  Well, I guess it's inevitable as long as I'm using a proprietary operating system. I don't expect Apple to be any better. Heck, even Ubuntu nowadays comes with ads that you need to opt out of. At least if I get Windows 10 Pro, I'll be able to turn off non-security-related updates.
  - kardos 11y ago
    > Heck, even Ubuntu nowadays comes with ads that you need to opt out of. No longer true. Canonical took a lot of (deserved) flak for making that feature opt-out, and last year they finally fixed it [1]. http://www.omgubuntu.co.uk/2014/03/ubuntu-make-amazon-product-results-opt-unity http://www.omgubuntu.co.uk/2014/03/ubuntu-make-amazon-produc...
    - 11y ago

kardos 11y ago

TL;DR: "By using Windows 10, you relinquish any expectation of privacy". Stallman is an optimist! This "privacy policy" is much worse than what we expect from malware [1]. Cryptolocker might hold my files hostage for some bitcoins, but they're not going to sell me out to aggressive lawyers or overzealous law enforcement. [1] http://www.networkworld.com/article/2926215/microsoft-subnet/richard-stallman-windows-os-is-malware.html http://www.networkworld.com/article/2926215/microsoft-subnet...

jensen123 11y ago

I wonder if what we're seeing here is basically the beginning of a new era of some sort of feudalism, and the end of "the age of equality". The French revolution, US revolution etc. talked about and put equality into their constitutions, and that has kinda been the prevailing world view ever since. Although, I guess the real cause for this were technologies like the printing press, gun powder and the assembly line - technologies that made people more equal. But now, even if most people hear about this, I'm guessing that most will continue using Windows. For the last 200 years or so, we've had various leaders standing up for the little guy, but I wonder if anybody will bother in the future, when they see that most "little guys" will not even bother to switch operating systems or use a different search engine in order to preserve their freedoms and rights.

touristtam 11y ago
We have been in an economic feudalism for the last century. The fact that companies have all the right and none of the duty of a normal person in front of the law with the all power money can buy means there is a strong disparity between normal citizens and them. Corporation have effectively replaced the Lords of the previous despotic regimes in the Western World. Only when we cease to consider Corporations more important than the rest of the economic actors can we move the balance of powers back where the it has been intended by the previous revolutionary movement. But this is kind of off-topic with this news. I hope MSFT get a bash for this kind of niceties and implement an opt-out solution for all their in-built spyware.
- IanDrake 11y ago
  >The fact that companies have all the right and none of the duty of a normal person in front of the law with the all power money can buy Can you unpack that for me? I own a corporation and enjoy nothing of what you mention. I fear I'm missing out on something.
  - dikaiosune 11y ago
    See [1] for an overview of corporate personhood. They don't get all of the protections and rights of a human being, but they do get a surprising number of them (like free speech) even though they never die, have children, or serve in the military. They also can't be jailed, and not all laws that apply to a natural person apply to a corporation. I'm sure that GP has some other examples of "none of the duty of a normal person" in mind, but that's what I know of off the top of my head. Regarding their power, I think that corresponds to corporations' ability to amass wealth and influence (often) faster than an individual. Of course there is a spectrum -- national defense contractors with billions of dollars in the bank can have a surprising amount of say in the way things are run, but an incorporated small business might have a hard time getting a local zoning issue addressed. [1] https://en.wikipedia.org/wiki/Corporate_personhood https://en.wikipedia.org/wiki/Corporate_personhood

systemz 11y ago

Default syncing with MS services is really bad for privacy. Unfortunately we are living in opt-out world now.

kardos 11y ago
> Unfortunately we are living in opt-out world now. This is a hyperbolic statement. Here's a fixed version: "Microsoft has created an opt-out privacy-hostile software ecosystem" The world is not Microsoft. You're free to use alternatives.
- amirmc 11y ago
  Network effects mean that there are few pragmatic options left. The GP may well be free to use alternatives but at what cost? Should they be selecting future employers based on the employer's choice of software? I may well be free to go live in a (digital) cave but presenting it as a viable choice merely exacerbates the existing problem.
  - icebraining 11y ago
    If you're on your employer's computer, you already didn't have privacy, so nothing's changed in that regard.
    - amirmc 11y ago
      True, but there's a difference between 1. your employer having a bunch of information about you and 2. your employer signing up to a ToS with third parties that effectively hands over all your info to them. Point 2 is probably not unusual but were starting to see (imho) more pernicious attitudes. Examples include the current Windows discussion, where your employer may be perfectly happy to sign (on the employees behalf) that your data be sent off to Microsoft (and used for whatever Microsoft deems 'necessary'). There was also the announcement of Facebook at Work, which I'm sure would be more than happy to cross-correlate the 'work' you with the 'personal' you, in order to 'provide a better service'. In both these scenarios, I'm sure the company will act to protect itself from exposure, but it's unclear what choices the employees really have.

urwth6u 11y ago

So let's drop all pretense here. As a citizen of an European country, using Microsoft Account™, NSA can look at anything I do?

jmnicolas 11y ago
It certainly already does and your local spy agency too.
- urwth6u 11y ago
  That is demonstrably not true. But that is not even what I was asking about. What I was talking about is an online feature, called Windows Account, which works online by default(!). Therefore we must ask ourselves what is Microsoft doing with that information.
  - abstractbeliefs 11y ago
    >That is demonstrably not true. Please do demonstrate/prove that then.
    - hkmix 11y ago
      I don't disagree, but burden of proof.
higherpurpose 11y ago
Despite all the "new security features" in Windows 10, or perhaps in spite of them as a work-around, Windows 10 seems to be the most "law enforcement friendly" OS yet (not just out of Windows all versions, but out of all operating systems).

rasz_pl 11y ago

Anecdote: Created new and unique Microsoft account 3 weeks ago with the sole purpose of testing w10, used it only ONCE to log into w10 vm. Started this VM today, logged into outlook and what do I see? 2 spam messages and one google news bounce. How do you trust a company like that with any data?

kiiski 11y ago
I suppose you're implying that Microsoft sold your new account name to spammers? It could also be that you used a name that you, or someone else, have used at a different place and the spammers simply try sending mail to all the big email providers with that name in the hope of reaching someone. That would seem like a more probable explanation to me.
- mikegioia 11y ago
  Created new and unique Microsoft account I figure it was something he hadn't used before.
cm2187 11y ago
You are luckier than me. My windows 10 VM have usually crashed after a week.
- rasz_pl 11y ago
  now that you mention, it pops memory read error every time I shut it down.
com2kid 11y ago
Spammers send out to machine generated lists of potential email addresses. If you create "james053164@hotmail.com" it will get spam eventually. (Well a bit faster now that it is indexed)

batou 11y ago

Not happening. Sorry this has gone on long enough. Closed both Microsoft accounts and cancelled my MSDN and AP subscription renewals. I do a big chunk of my work on a CentOS desktop machine already. There's not much of a push to chuck everything in an 8.1 VM and start moving it all over. The MSDN licenses I need persist past the sub so that's enough for me. I've been on the verge of doing this for a couple of months already anyway for ref. Edit: Also, I'm really not happy about the pro-Microsoft spin all over the media recently. It appears to be covering up a number of nasty changes behind the scenes and lacking in critical analysis. Edit 2: Proof: http://imgur.com/a/ZYWZM http://imgur.com/a/ZYWZM Edit 3: does anyone know of a decent 4G modem for a laptop, preferably one that works in Linux. I can then skip my phone as a tether and use a dumbphone.

donkeyd 11y ago
You could use a Mifi device to setup a wireless network. Will be platform independent.
- batou 11y ago
  Thanks - much appreciated. That's a good solution I hadn't thought of. Annoyingly my ThinkPad has a Gobi 3G card in it but I've got used to 4G speeds now.
sillygeese 11y ago
The thing is, "our" data is abused by all big companies at the very least, regardless of what they publicly tell us they're doing. I appreciate the sentiment there, but you'll have to close pretty much everything if you really want to protest the abuse. Don't use any stock/operator/manufacturer version of Android either, by the way. They're full of spyware.
- batou 11y ago
  Yes I agree entirely; you're 100% right. The only 3rd party service I now rely on personally is my domain registrar and an IMAP box which is unavoidable to participate in the world now. I've closed most of my online accounts with services over the last year already. I moved my code from github to local fossil instances about 3 months ago as well. Everything I use is hosted by reputable companies in the EU. I'm not touching Android. Too many bad experiences there about a year ago for me.

martijn_himself 11y ago

Honest question: is one better off using Apple's hardware and OS or is Linux the only alternative?

fit2rule 11y ago
Apple are just as bad as Microsoft. And some Linux distro's are headed in this direction too (Ubuntu).
- labras 11y ago
  Agree! Ubuntu and similar, along with zeitgeist pre-installed, do exactly the same.
  - icebraining 11y ago
    As far as I know, Zeitgeist doesn't send that information to anywhere (it's kept in the computer), so I don't see how it's even nearly the same. I don't like the bloat, but I don't see it as more privacy invading than any other system logs.
    - labras 11y ago
      Zeitgeist stores your information on it's datahub, where 3rd party applications can retrieve it from. Nothing prevents such applications from sending this information elsewhere, once accessed. As this comes out-of-the-box by default, and is in fact a pain to switch off, I compare it to this new windows behavior.
      - icebraining 11y ago
        All your criticisms apply to syslogd as well: it stores your information in a central location (/var/log), which 3rd party applications can read and upload to somewhere else, and lots of software expects it to be there, so it can be a pain to switch off too. Should we compare syslogd to the new Windows behaviour?

kungfufrog 11y ago

The real reason I'll never use Microsoft products again: I'm sick of legally purchasing software and being treated like a potential charlatan every time I change a component of my computer or upgrade. I have lost countless hours to Microsoft Tech Support for licensing issues (which, to be honest, are reasonably efficient these days). However, the older I get, the more I just plain resent having to deal with this intrusion into what should be an experience I control. Microsoft licensing is hellish, I've worked with it for years and I still don't entirely understand it.

amelius 11y ago
Well, at least you paid for those product which should give you better consumer protection than when you didn't (for Google/Facebook products for instance). But IANAL.
batou 11y ago
Indeed. Wait until you have to deal with an audit. Apparently, even on microsoft's advice on licensing, we still owed them about £50,000 of missing licenses after an audit... Most of this was down to a SQL Server upgrade where core and CPU terminology was changed.
- redcalx 11y ago
  I'm currently arguing for serious considerations of SQL Server alternatives for selected new development work (and where reasonably achievable), in order to mitigate spiralling license fees. The main issue is that mostly those fees are paid by our customers, but ultimately our customer's cost is our cost. Collectively it's becoming a stupid amount of money.
  - batou 11y ago
    We're only keeping it around due to a pile of stored procedures and coupling (see an earlier thread on this I was whinging about). PostgreSQL is the next step. We'll pay for support via EnterpriseDB still. Our main SQL cluster is two 48 core HP machines with 512Gb of RAM each and a big EMC SAN. We want this as lots of much smaller machines but you can't really scale down SQL Server once everything is coupled into it.

sudioStudio64 11y ago

I was expecting this kind of thing today. I'm surprised that there is only one "oh noes muh freedums!" post on the front page.

cm2187 11y ago

Does any of this apply when we use a local account with Windows?

bronlund 11y ago

Finally! Microsoft going all in :D This is going to be fun.

userbinator 11y ago

It makes a lot of sense now why Windows 10 is being given away, even for those running pirated Windows versions: https://news.ycombinator.com/item?id=9224880 https://news.ycombinator.com/item?id=9224880 I had a feeling about this ever since the first announcements that Win10 would be (monetarily) free. That old saying is still relevant as ever: "If you're not paying for it, you're the product being sold."

__Joker 11y ago

And we thought Microsoft was a paragon when it comes to privacy[1]. Albeit, [1] was about cloud services. [1]. https://news.ycombinator.com/item?id=9058283 https://news.ycombinator.com/item?id=9058283

yellowapple 11y ago
It's worth noting that Microsoft is heavily afflicted with the "left hand doesn't know what the right hand's doing" syndrome. Most of its product departments have antagonistic relationships with one another at best. The cloud services department(s) could have entirely different policies and philosophies from the one that makes Windows, which further has different policies and philosophies from the team that makes Office, which further has different policies and philosophies from the team that makes Surface tablets, etc.

bargl 11y ago

I'd be interested to see an independent audit on how much of this data they (and google/facebook/apple/etc) are collecting is being used to help improve training of Cortana as an assitant (or other tools that directly assist the user like Google Maps) , and how much of this data is really just for selling to advertising companies, and how much is mandated by governements. I know this isn't binary some data may be dual purposed (training and ads for example) but I'd like to see an audit of what it's used for. I'll never get that, but it would be interesting.

arafalov 11y ago

They say they can read my browsing history. I wonder if that's IE only or will they reach out into the Firefox and Chrome, etc.

arien 11y ago

It is a little unsettling when you read these policies. This is probably for Cortana. She has to understand and process your voice commands, learn your nickname and preferences to be effective. She already works in Windows Phone (very nicely), and I don't think a little phone processor would be enough to power her up. In fact, she doesn't work without an internet connection, at least in WP. What happens is that she takes the information you input to the cloud, processes it there with more than enough horsepower to do her stuff and brings it back to you. I suppose this is how it'll work as well on PCs. So for all this to work, yes they need to collect our data. Face it, with any smart assistant that we want it's going to be the same, they're all cloud powered. Doesn't Siri also require a internet connection? Probably Alexa too, and any others work exactly the same. It is a necessary evil to have a useful virtual assistant. Although if we don't want her we can opt out of the MSA account, as someone posted in the comments. Unsure if that removes all the privacy concerns, that would be useful to know. On Windows Phone it did (you can opt out of sending data to MS and Cortana is disabled).

arihant 11y ago
On Windows 10 you can opt-out as well. In fact, using Microsoft account is an opt-in while installing. You can just make a local account and certain features would be off by default. If you try to access them it will remind you that you need an MS account to access them. The fundamental problem with this privacy policy is the scary wording. When Gmail first came out, Google was (probably) the first company to read emails to figure out ads. But they enforced the not-touched-by-human-handsiness claim hard throughout. MS, on the other hand, not only says it will collect data but again and again mentions "disclose when necessary." There are too many uses of "disclose." It almost sounds like they will just hand over data without much conviction.
- arien 11y ago
  I went to the Privacy statement [0], to the "Reasons we share your data" (click on Learn More) and it does not sound scary at all (it' pretty much the same as any internet company that holds customer data). It's very clearly worded and I know exactly how/why my data will be used, so I can decide if I want to go ahead or if I don't. [0] https://www.microsoft.com/en-us/privacystatement/default.aspx https://www.microsoft.com/en-us/privacystatement/default.asp... There's also a Data Retention section further down that specifies how long your data is in their servers. edit: In the top section (Personal Data we collect) it also says: "You have choices about the data we collect. When you are asked to provide personal data, you may decline. But if you choose not to provide data that is necessary to provide a service, you may not be able to use some features or services."

sandycheeks 11y ago

As a small business owner, my main concern is that there are no assurances that my competitors large and small will not be able to see my contracts/suppliers/budgets/sales/processes at some point due to this ambiguous 'disclosure' mentioned or perhaps through some flaw that allows access to the data collected from the computers used in my small business. I must be missing something here since I know Microsoft wants Windows to be used for businesses and the privacy of this information is vital to that.

fluidcruft 11y ago
I'll get the popcorn ready while waiting to see what hospital IT have to say about this. They have already banned use of Microsoft's new mobile Outlook apps (iOS,Android,Win Phone) when they found out that these are actually thin clients to a cloud service that performs MITM on the hospital Outlook server to download, store and processes all email (the cloud servers aren't even fully Microsoft--they became Microsoft's via acquisition). And of course it stores usernames and passwords in order to accomplish this (confirmed by common sense, obtuse fine print and deceptive non-denials by Microsoft support). The penalties in HIPAA and HITECH aren't jokes (and now include jail time).

brudgers 11y ago

I dislike the Microsoft privacy policy. I don't see a better way for it to navigate the legal minefield. If they promise any meaningful kind of protection, it is inevitable that it cannot be delivered. The wired world leaks data. Much of it by design, e.g. to a first approximation all browsers work with cookies, store history, cache content, use some sort of thumbprint for SSL, etc. No browser vendor promises operational privacy because implementing it would make the browser unusable. Just using NoScript (as I do) is a bit of a pain in the ass. Microsoft has a browser plus a whole lot more stuff including third party vendors, and big stacks of cash to make itself a lawsuit magnet...some lawyer somewhere will allege transmitting an IP address is breech under a strong privacy policy. The reality is that nothing you do on a computer connected to the internet should be considered private. The Microsoft privacy policy reflects this reality even if it upsets the world some of us wish existed [so long as we don't have to give up our mobile GPS, Uber, and iTunes]. But it hasn't existed since the days of credit card processing over copper. I admire Stallman, information wants to be free. Alas "An atom blaster point is a good weapon, but it can point both ways."

ams6110 11y ago
nothing you do on a computer connected to the internet should be considered private Amen. This is what I have been telling people for the past few years. If you put something online, consider it public and irrevocable.
bad_user 11y ago
> nothing you do on a computer connected to the internet should be considered private That doesn't excuse Microsoft and others for becoming more and more invasive. And voting with your wallet works.
- brudgers 11y ago
  I think Windows 10 is pretty much free as in beer for most ordinary users so the wallet threat is pretty flat. I read Microsoft's policy as more legal cover for the reality that data gets stored all over the place. The internet is full of caches and nobody can guarantee that they can identify all of them, much less control them. The nature of people's complaints show how vulnerable Microsoft is to some jury believing "they should have known." If you want privacy, don't turn on your internet connected devices. TANSTAAFL.

cornstalks 11y ago

For a company that ran a heavy Scroogled campaign, the irony is amusing.

bitmapbrother 11y ago
So true. But, it's good to see these hypocrites finally expose themselves.

cm2187 11y ago

For those using a local account and having no use for these gadgets, would firewall rules be enough to prevent Windows from leaking data to Microsoft?

sandworm101 11y ago

Anyone else use Noscript? I just forwarded some comments re MS's privacy statement to a law-related listserv. But everyone responded they couldn't see the text I cited from MS. It turns out that the document looks very different with noscript than it does without. With all script allowed (ie for those using IE/edge) all the scary stuff hides behind "learn more" buttons. Check it out for yourself: https://www.microsoft.com/en-us/privacystatement/default.aspx https://www.microsoft.com/en-us/privacystatement/default.asp... I'll be adding this underhanded approach to my loooong list of reasons to love linux.

VOYD 11y ago

um yeah, this is how the entire internet works. You can't possibly think that Google Chrome doesn't do the same thing.

JimmaDaRustla 11y ago

Not sure what the fuss is about, the same old rule applies: if you want your data to be private, don't use any form of cloud services - server based voice/video chat, cloud storage services (google drive, skydrive, icloud), digital assistants (siri, cortana, google now), any contextual based delivered services which "learns" anything about you to provide you with any form of automated and/or dynamic experience. If you want to be treated like you live in a box, then you're going to have to live by it. Everyone complaining and "fed up", closing their MSDN accounts, boycotting MSFT products - you're in an echo chamber which won't be felt as our devices become more service oriented rather than boxed solutions. MSFT is trying to stay relevant, not undermine their massive user base. Whether it is right or wrong, I don't have an opinion on, but if you think MSFT is a pioneer in this space, you're being unjustly biased.

p4bl0_666 11y ago
finally someone who gets it! you want a service that requires your data? you have to give your data. you don't want to? don't complain for the missing service!
- JimmaDaRustla 11y ago
  I guess the only thing we can complain about is that we aren't given a "closed/boxed" solution and able to accept the TOS to services we want on an adhoc basis - we have to go and disable services and hope that the TOS we agreed to needn't apply. Perhaps these are growing pains for the direction services are heading, or we'll just learn to accept invasion of privacy as a default.

shift32 11y ago

People need to take into consideration the fact that that is how you build an assistant or an AI. You need collective data gathered from a vast majority of interactions with a user. Besides, I am pretty sure this is how Google, Apple do it. All big corporations use your data in a form or another.