#1 MS added spy "features" to Win7 & Win8
Posted: Tue Sep 01, 2015 6:54 pm
The issue isn't necessarily that Microsoft and other companies are binding their products more closely with the Internet, as a way of making truly dynamic applications with truly current data. The issue I have is the utter lack of transparency with which Microsoft in particular is doing this.arstechnica.com wrote:Windows' network activity continues to be scrutinized amid privacy concerns. Windows 10 was first put under the microscope with both new and old features causing concern. With its Cortana digital personal assistant, Windows 10 represents a new breed of operating system that incorporates extensive online services as an integral part of the platform. But its older predecessors haven't escaped attention, and questions are now being asked of Windows 7 and 8's online connectivity.
Windows 8 included many of the same online features as are now raising hackles around the Internet. While it had no Cortana, it nonetheless integrated Web and local search, supported logging in and syncing settings with Microsoft Account, included online storage of encryption keys, and so on and so forth. While a few privacy advocates expressed concern at these features when the operating system was first released, the response was far more muted than the one we see today about Windows 10. But a new addition has led to accusations that Windows 8 now mimics one of Windows 10's more problematic features: it reports information to Microsoft even when told not to.
Back in April, Microsoft released a non-security update for both Windows 7 and 8. This update, 3022345, created a new Windows service called the Diagnostics Tracking service. Microsoft describes this service as doing two things. First, it increases the amount of diagnostic data that the Customer Experience Improvement Program (CEIP) can collect in order to better diagnose problems. Second, it collects data for third-party applications that use the Application Insights service. Application Insights is a preview that allows app developers to track performance issues, crashes, and other problems of their applications. The Diagnostics Tracking service collects this data and sends it to Microsoft.
The update that added this service has itself been superseded at least twice with updates 3068708 and, most recently, 3080149. While this latter update was pushed out as an optional update—and hence only installs if chosen from the list of available updates—the earlier 3067808 update was deployed as a recommended update, installing automatically with the normal Windows Update settings.
Separate from this, another update, 3075249, enhanced the User Account Control (UAC) feature to enable it to collect more information from the elevation prompts.
The concern with the new Diagnostic Tracking service is much the same as with Windows 10's tracking: it's not clear what's being sent, and there are concerns that it can't be readily controlled. The traffic to Microsoft's servers is encrypted, sent over HTTPS, so it can't be easily examined. While the knowledge based articles describing the new service list the DNS names of the servers that the service connects to, there are reports that the service ignores the system HOSTS file. As such, a traditional and simple method for redirecting the traffic doesn't work.
However, we're not sure just how big an impediment this is in practice; in our testing of Windows 8, the builtin Windows Firewall, for example, is more than capable of blocking the traffic, and this appears to be working entirely as it should. Disabling the service is also effective for those who don't trust its behavior.
Additionally, most or all of the traffic appears to be contingent on participating in the CEIP in the first place. If the CEIP is disabled, it appears that little or no traffic gets sent. This may not always have been the case, however; the notes that accompany the 3080149 update say that the amount of network activity when not part of CEIP has been reduced. It's possible that with older versions of the service that data is sent even for opted out users.
As with the other privacy concerns around Windows, our feeling is that the major issue at stake here is not that Windows is collecting data, but that it put the user in control. Collecting information about application errors and the way the operating system is used is reasonable. Having an accurate picture of how people use the operating system is likely to produce a better platform in the future; knowing which applications crash, and why, is obviously invaluable if those apps are to be fixed.
But we continue to believe that people who do not wish to be a part of such data collection should have a clear and unambiguous way of opting out, and these opt-outs should be rigorous. Disabling CEIP, for example, should not only prevent systems from sending CEIP data, but it should also prevent systems from retrieving even configuration data from Microsoft's own systems. We would also argue that these settings should be made simpler; at the moment there are many individual controls each governing a particular behavior. Some kind of global control to supplement these fine-tuning switches would be an improvement. We like cloud connectivity and online features, but these should be paired with clear user control.
Things like Cortana would require that your computer have a proper pipe to Microsoft's servers, to ensure that your data stays the same and updated across multiple devices. This makes sense. Where it falls apart for me is Microsoft not being at all up-front about this - in fact, the way in which all of this is done is to treat it innocently as simply a new thing they're doing, and remarking upon it as if it's just a thing like Paint, when it's a different entity entirely.
Microsoft quietly adding the same kind of usage reporting through obscured means in Win7 and Win8 (not to mention not being able to turn it off once installed) is irksome to me.