Microsoft new Windows 10 privacy policy

[Thanas]

aka Fuck you, more data for us

Microsoft’s new small print – how your personal data is (ab)used
By Heini Järvinen

Microsoft has renewed its Privacy Policy and Service Agreement. The new services agreement goes into effect on 1 August 2015, only a couple of days after the launch of the Windows 10 operating system on 29 July.

The new “privacy dashboard” is presented to give the users a possibility to control their data related to various products in a centralised manner. Microsoft’s deputy general counsel, Horacio Gutierrez, wrote in a blog post that Microsoft believes “that real transparency starts with straightforward terms and policies that people can clearly understand”. We copied and pasted the Microsoft Privacy Statement and the Services Agreement into a document editor and found that these “straightforward” terms are 22 and 23 pages long respectively. Summing up these 45 pages, one can say that Microsoft basically grants itself very broad rights to collect everything you do, say and write with and on your devices in order to sell more targeted advertising or to sell your data to third parties. The company appears to be granting itself the right to share your data either with your consent “or as necessary”.

A French tech news website Numerama analysed the new privacy policy and found a number of conditions users should be aware of:

By default, when signing into Windows with a Microsoft account, Windows syncs some of your settings and data with Microsoft servers, for example “web browser history, favorites, and websites you have open” as well as “saved app, website, mobile hotspot, and Wi-Fi network names and passwords”. Users can however deactivate this transfer to the Microsoft servers by changing their settings.

More problematic from a data protection perspective is however the fact that Windows generates a unique advertising ID for each user on a device. This advertising ID can be used by third parties, such as app developers and advertising networks for profiling purposes.

Also, when device encryption is on, Windows automatically encrypts the drive Windows is installed on and generates a recovery key. The BitLocker recovery key for the user’s device is automatically backed up online in the Microsoft OneDrive account.

Microsoft’s updated terms also state that they collect basic information “from you and your devices, including for example “app use data for apps that run on Windows” and “data about the networks you connect to.”

Users who chose to enable Microsoft’s personal assistant software “Cortana” have to live with the following invasion to their privacy: “To enable Cortana to provide personalized experiences and relevant suggestions, Microsoft collects and uses various types of data, such as your device location, data from your calendar, the apps you use, data from your emails and text messages, who you call, your contacts and how often you interact with them on your device. Cortana also learns about you by collecting data about how you use your device and other Microsoft services, such as your music, alarm settings, whether the lock screen is on, what you view and purchase, your browse and Bing search history, and more.” But this is not all, as this piece of software also analyses undefined “speech data”: “we collect your voice input, as well your name and nickname, your recent calendar events and the names of the people in your appointments, and information about your contacts including names and nicknames.”

But Microsoft’s updated privacy policy is not only bad news for privacy. Your free speech rights can also be violated on an ad hoc basis as the company warns:

“We will access, disclose and preserve personal data, including your content (such as the content of your emails, other private communications or files in private folders), when we have a good faith belief that doing so is necessary to”, for example, “protect their customers” or “enforce the terms governing the use of the services”.

So much for clearly understandable and straightforward terms of service.

Geez.

[Ace Pace]

The Cortana piece is understandable. It's precisely what Google Now and Siri require to be the personal assistant they're selling.

[Elheru Aran]

The Cortana piece is understandable. It's precisely what Google Now and Siri require to be the personal assistant they're selling.

I can take giving a 'personal assistant' the ability to collect data as it goes, but is it really necessary for an OS to be doing so in order to target advertisements and potentially misuse the information it gathers? That's the problem here. Microshit did just fine for a couple decades without needing to do this.

[Purple]

This is so fucked up on so many levels. The worst part is that realistically there is no substitute for Windows on the market. Linux sucks unless you are happy not playing video games and stuff and anything coming from apple is equally incompatible with everything.

[salm]

Does anybody know what would happen if I run a Linux Virtual Box within Windows 10?
I´d use Windows for work (because the software isn´t available for Linux) and use Linux in the Virtual Box for web browsing and all the stuff that runs on Linux.
Would Windows be able to track what happens in the Virtual Box?

[bilateralrope]

Microsoft really likes sharing your Wi-fi password

It wouldn’t be a new version of Windows without at least a few entirely bewildering decisions on Microsoft’s part, but this one’s a high speed collision of face and palm even by the standards of the company behind Windows 8. In a nutshell, there’s this feature in Windows 10 which will automatically share your wifi passwords with any and all Outlook, Skype and Facebook contacts who also use Win 10. Or, were they to manually enter your password into their Win 10 device, it would by default be treated as ‘their’ network and shared with their contacts. In other words, be vigilant – otherwise you’ll end up with Kevin Bacon using your internet connection whenever he wardrives past your house.

I can entirely understand why someone thought this feature, known as WiFI Sense, was a good idea. How many times you done that awkward dance where you go to a friend’s house and want to use their wifi, so he’s upstairs with the router, trying to bend the cable further than it will go so he can see the sticker on the back, and shouting “X94 no sorry X49″ down to you, then it takes twelve goes and you still don’t get anywhere?

WiFI Sense is intended to take the pain out of this: you go to your mate’s house and your Windows 10 laptop/tablet immediately hops online because the password’s been shared via MS’ servers. Your password won’t be shown to anyone – visitors’ PCs are invisibly sent it automatically, wreathed in encryption. Also, the only thing they get automatically is internet access: you’ll have to consciously intervene if you want them to have access to other devices and folders on the network too. In theory.

In theory, lovely. In practice – Microsoft have, somewhere, an enormous database full of people’s passwords. Sure it’s encrypted, but recent history shows that this isn’t the impediment to hackers that one would hope. Possibly even more worrying is that, in its current form, WiFI Sense offers no fine control over who passwords are shared with. So if you click the Facebook share option, it goes to everyone you have on Facebook. So that annoying guy you accepted the invite from because you didn’t want to upset him might in turn, unknowingly or otherwise, wind up sharing your password with his contacts from /r/makingpeoplesliveshellisfunnylol.

WiFi Sense doesn’t share your password with friends of friends, so it’s not going to be passed infinitely around the globe. However, if a visitor manually enters your password into their Windows 10 PC – maybe because you told them, maybe because they secretly wrote it down while you were having a wee – that will then be shared with their Facebook, Outlook and Sype contacts unless they’ve expressly said otherwise. This means that, abstractly, perfect strangers will have access to your network. Manually entering WiFi password is and will likely remain the default means of sharing networks for the forseeable, so this is hardly an unlikely scenario. Granted, said strangers finding your address – or even knowing to – is less plausible, but it does mean your password might end up out there on any number of unknown computers, which is an uncomfortable thought given the relative regularity with which big firms get hacked these days.

There’s also some handwringing about this system giving Microsoft some degree of access to your Facebook contacts, which isn’t info everyone wants other large corporations to have.

Insult to theoretical injury, Microsoft don’t exactly go out of their way to tell you that they’re doing this, so if you agree to Express Settings when installing or updating to Windows 10, WiFI sense is silently turned on for you. Realistically, the risks are small and yet to be proven, but this shouldn’t be something we all unknowingly agree to, or something that only tech-savvy PC users are aware of or understand.



How To Turn Wifi Sense Off
Basically, you should probably turn WiFI Sense off until you’re sure you’re 100% comfortable with it, or an update with more granular settings is released. To do that, go to Settings – Network & Internet – Manage WiFi Settings and turn off as much as concerns you. You can either wholesale block WiFi Sense, which means you won’t automatically connect to chums’ networks yourself, or just prevent Windows 10 from sharing your own networks with others. There’s also an option to automatically connect to suggested open networks, while also strikes me as something which could be abused were anyone to work out how to hack Microsoft.

What that won’t stop is friends who do have WiFi Sense turned on from sharing your password with the various thieves and murderers in their own Facebook contacts in the event they manually entered it into their PC. There is a convoluted means of preventing this, but it’s ridiculous that Microsoft don’t offer an option within Windows 10’s own WiFI Sense settings, to be honest. Let’s hope there’ll be an update to tighten up controls.

Here’s what you need to do for now, anyway: add ‘_optout’ to the end of your wifi network’s SSID/name. You’ll need to fiddle with your router settings for that, so refer to its manual if you don’t know how. Once that’s done, your friends’ Windows 10 devices won’t then share your network on with anyone else, regardless of WiFI Sense settings. You can also request that they uncheck the ‘Share network with my contacts’ box when they’re entering your password, but that requires both memory and trust.

Conversely, this official FAQ will tell you how to use WiFi Sense if all this sounds jolly hockeysticks to you.

Of course, Windows 10 isn’t actually released until tomorrow, so all is subject to change. However, the build available to anyone via Windows Insider is the one released to manufacturers, so WiFi Sense in its current form is a finished feature rather than a buggy one. We’ll just have to see if Microsoft update it as a result of the current web-wide palaver.

[Jub]

This is shitty news because feature wise windows 10 looks to be everything 8 should have been.

[Purple]

Does anybody know what would happen if I run a Linux Virtual Box within Windows 10?
I´d use Windows for work (because the software isn´t available for Linux) and use Linux in the Virtual Box for web browsing and all the stuff that runs on Linux.
Would Windows be able to track what happens in the Virtual Box?

Probably. But why not just dual boot if you are going that way?

[Zaune]

This is so fucked up on so many levels. The worst part is that realistically there is no substitute for Windows on the market. Linux sucks unless you are happy not playing video games and stuff and anything coming from apple is equally incompatible with everything.

Wanna bet? There's an awful lot of game engines that have been ported to Linux; Unity, Source, Unreal and the new version of CryEngine are the most prominent 3D ones I can think of. Valve are testing a custom OS for their branded "Steam Box" PCs that's based on Linux. The indie gaming market is full of geeky bedroom coders, it's not hard to find plenty of Linux evangelists there.

It's not going to take many more bad business decisions, or just wildly unpopular ones like this one, before Microsoft start experiencing a sharp pain in the market-share.

[Broomstick]

This is so fucked up on so many levels. The worst part is that realistically there is no substitute for Windows on the market. Linux sucks unless you are happy not playing video games and stuff and anything coming from apple is equally incompatible with everything.

I have lived without an internet, I can do so again.

The stuff mentioned in the OP is why this household is opting out of Windows 10.

Access to my personal folders? I make part of my living as a writer. My spouse makes what living he does as an engineer and his entire software for running his CAD/CAM machines is on his computer. Microsoft sure as fuck wouldn't give that kind of access to THEIR data/files/internal software to some other company, why the fuck should we?

"Cryptolocking" one of my drives? Who the fuck do they think they are? The only one who should be encrypting MY computer is ME.

Fuck 'em.

[Purple]

If anything I predict a lot of people will not be updating from windows 7 until forced.

[Darth Yoshi]

Anybody know if Microsoft will have access to all this data for local accounts too? Because if I did switch over I wouldn't use a Microsoft login anyway.

[Broomstick]

If anything I predict a lot of people will not be updating from windows 7 until forced.

Oh, the downloaded the "wizard" without asking, loaded a bunch of shit on everyone's computer, and then one day you boot up to a splash screen announcing how wonderful it is that they're upgrading you for free... we killed that dead. Forced? If you aren't careful they'll simply upgrade you without permission.

[Ace Pace]

The Cortana piece is understandable. It's precisely what Google Now and Siri require to be the personal assistant they're selling.

I can take giving a 'personal assistant' the ability to collect data as it goes, but is it really necessary for an OS to be doing so in order to target advertisements and potentially misuse the information it gathers? That's the problem here. Microshit did just fine for a couple decades without needing to do this.

Cortana is part of the OS. If you disable it, it also stops collecting the data.

Microsoft really likes sharing your Wi-fi password

See this pretty accurate article from Ars Technica on why these chicken little articles are silly.

[Xisiqomelir]

The worst part is that realistically there is no substitute for Windows on the market. Linux sucks unless you are happy not playing video games and stuff and anything coming from apple is equally incompatible with everything.

No substitutes except for those you cite yourself and invalidate? We are talking about tens of millions of users.

[salm]

Does anybody know what would happen if I run a Linux Virtual Box within Windows 10?
I´d use Windows for work (because the software isn´t available for Linux) and use Linux in the Virtual Box for web browsing and all the stuff that runs on Linux.
Would Windows be able to track what happens in the Virtual Box?

Probably. But why not just dual boot if you are going that way?

I do my main work in a program that is not available for Linux, so I have to use Windows for this. But I need to be able to browse the internet for work related research and non work related cat videos and shit at the same time.
If I understand correctly with dual boot I can not have Windows and Linux running at the same time which I would like to have in case Windows privacy options really turn out to be as bad as they appear now.

[salm]

How is this automatic WiFi password sharing stuff even legal? I live in a country where I can be held accountable for if some asshole downloads illegal crap via my internet connection.

[Thanas]

Well, you're shit out of luck, especially if they combine it with mandatory monitoring for your files. No more swapping MP3s with friends, comrade.

[salm]

I read somewhere that a lot of these privacy issues are fixed in the enterprise version.

[Zaune]

I do my main work in a program that is not available for Linux, so I have to use Windows for this. But I need to be able to browse the internet for work related research and non work related cat videos and shit at the same time.
If I understand correctly with dual boot I can not have Windows and Linux running at the same time which I would like to have in case Windows privacy options really turn out to be as bad as they appear now.

There's always Wine. There's not many Windows programs it can't be persuaded to run given enough fiddling with the settings.

[salm]

I don´t know, it´s one of the 3D software suits. They are unstable and fickely enough on their native OS I doubt that Wine would be a good solution. Also, Internet searches tell me that Wine is doesn´t work well with this program.

[RogueIce]

How is this automatic WiFi password sharing stuff even legal? I live in a country where I can be held accountable for if some asshole downloads illegal crap via my internet connection.

From the article Ace Pace posted:

You can always just not enable it when installing Win10 (assuming you don't just pick Express Settings). You can also turn it off if you just clicked Express Settings anyway:

If you want to disable Wi-Fi Sense, hit the Start button and type "Wi-Fi," and then click "Change Wi-Fi settings." In the settings applet that pops up, click "Manage Wi-Fi settings." From there, you can tweak a variety of settings: you can turn Wi-Fi Sense off; you can disable password sharing with Facebook, Outlook, or Skype; and at the bottom there is a list of your known Wi-Fi networks, where you can opt in and out of password sharing.

And even if it is enabled, you'd have to opt-in when connecting to your WiFi network anyway:

However, it doesn't actually do anything until two things occur:
•First, you need to sign in with a Microsoft account. Wi-Fi Sense won't work with a local account.
•Whenever you connect to a new W-Fi network, it asks if you want to share it with other people.

So assuming you don't ever bother with a MS account at all, it'll never come up. And you'd need to actively decide to share it in any case.

Now granted, if somebody else has Win10 and this enabled, and you let them log on to your WiFi by giving them the passkey, it'll probably be potentially shared by them. But they could do that anyway by opening up the Properties menu and clicking "Show characters" in Win7 (and probably plenty of other OSes and smartphones) so that's on you for sharing your passkey in the first place.

[Zaune]

I don´t know, it´s one of the 3D software suits. They are unstable and fickely enough on their native OS I doubt that Wine would be a good solution. Also, Internet searches tell me that Wine is doesn´t work well with this program.

Are you self-employed or is this software mandated by your company? Because there's no shortage of open-source 3D graphics software out there, including Blender.

And if you're doing serious 3D rendering on this PC then I really don't think a virtual machine is going to be the answer. Even if Windows 10's authentication stuff plays nice with whatever VM software you use, and it may well not if MS really are going to abolish authentication keys and tie the license to the hardware (which is only a rumour I heard on Reddit, mind you), that's going to take up a non-negligible chunk of extra system resource overhead that I doubt you can afford to waste.

If you're really worried then you might be better off disconnecting your rendering machine from the Internet entirely after installing Windows and the software you need it for, and getting a second PC for doing everything else.

[salm]

Ah, that sounds a bit better.

[salm]

Are you self-employed or is this software mandated by your company? Because there's no shortage of open-source 3D graphics software out there, including Blender.

I am self employed but a lot of my customers want files in a certain format which I unfortunately can not provide them with from a Linux system. They need it in the native format because they continue to work with these files. If this was possible somehow I´d have migrated to Linux a long time ago.

And if you're doing serious 3D rendering on this PC then I really don't think a virtual machine is going to be the answer. Even if Windows 10's authentication stuff plays nice with whatever VM software you use, and it may well not if MS really are going to abolish authentication keys and tie the license to the hardware (which is only a rumour I heard on Reddit, mind you), that's going to take up a non-negligible chunk of extra system resource overhead that I doubt you can afford to waste.

I don´t know, my current machine is a 4 year old i7 with only 16 gigs of RAM and I´ve sometimes got a Virtual Box running Ubuntu for rendering Blender files in the Amazon Cloud. I can run my 3D software fine right next to it. I´ll have to get a new workstation in the comming year anyway with some more up-to-date specs, so perhaps I actually can afford to waste some resources. Times have changed a lot in the 3D business. You still need a decent rig but nothing like 10 or so years ago when you needed new cutting edge technology every two years.

If you're really worried then you might be better off disconnecting your rendering machine from the Internet entirely after installing Windows and the software you need it for, and getting a second PC for doing everything else.

I´m not really worried all that much about the rendering machine. Well, actually now I am a bit because I´m handling sensitive data but since Windows 10 is going to be a standard OS in this industry there will be some sort of standard way how this is handled. The clients will have to figure out how to handle this.
I´m more worried about Microsoft collecting data about my internet seach habbits and connecting this data with all my other personal data they might get from spying on files on my hdd and apps installed on my computer for marketing and whatever purposes.
Everybody on the internet and their dog knowing what I want to buy is annoying enough the way it is. Marketers getteing even more access to personal data by spying on the OS, the hdd and apps themselves doesn´t sound very desirable. That´s one of the reasons I never bothered to get a smart phone. The privacy invasion is not acceptable and to me looks a bit like Windows 10 is going in this very direction.
Maybe you´re right and simply getting a second computer and running Ubuntu or something on it is the best solution to this problem.