Microsoft new Windows 10 privacy policy

[Zaune]

I´m not really worried all that much about the rendering machine. Well, actually now I am a bit because I´m handling sensitive data but since Windows 10 is going to be a standard OS in this industry there will be some sort of standard way how this is handled. The clients will have to figure out how to handle this.
I´m more worried about Microsoft collecting data about my internet seach habbits and connecting this data with all my other personal data they might get from spying on files on my hdd and apps installed on my computer for marketing and whatever purposes.
Everybody on the internet and their dog knowing what I want to buy is annoying enough the way it is. Marketers getteing even more access to personal data by spying on the OS, the hdd and apps themselves doesn´t sound very desirable. That´s one of the reasons I never bothered to get a smart phone. The privacy invasion is not acceptable and to me looks a bit like Windows 10 is going in this very direction.
Maybe you´re right and simply getting a second computer and running Ubuntu or something on it is the best solution to this problem.

For storing really sensitive data, the standard practice for keeping it secure is exactly what I suggested; physically isolating, or "air-gapping", the hardware from the Internet and transferring data to and from it by thumb drive. This is generally considered overkill unless criminal evidence or trade secrets worth six figures are involved, but these days it's frankly the principle of the thing.

[Elheru Aran]

So... how exactly does one opt out of the update, or turn it off if it's already scheduled? Because I'm happy with Windows 7 as is, and they probably won't stop updating it for a little while, so I'm pretty good with keeping it right now... my past experience with new Microsoft OSes has been uniformly awful.

[salm]

For storing really sensitive data, the standard practice for keeping it secure is exactly what I suggested; physically isolating, or "air-gapping", the hardware from the Internet and transferring data to and from it by thumb drive. This is generally considered overkill unless criminal evidence or trade secrets worth six figures are involved, but these days it's frankly the principle of the thing.

Yeah, they do this thumb stick thing (my clients get files from their clients on thumb sticks sometimes) but for data that requires this I have to go to the clients office anyway and work from there, so this doesn´t apply for my home office machine.

For regular stuff it´s just use VPN and don´t use third party apps such as drop box to move files around.

[Zaune]

Sounds about right; I find Dropbox to be a good version-control solution, but I'd never store anything you could defraud or blackmail me with on it unless it'd gone through some very good encryption.

[Executor32]

Relevant:

How to disable Telemetry and Data Collection in Windows 10

Windows 10 now comes with the telemetry feature enabled by default which collects all sorts of user activity and sends it to Microsoft. Unfortunately, Microsoft has provided no way to disable it completely using the Settings app for Home and Pro editions of Windows 10. Only Enterprise users can turn it off. Here is a solution for editions other than Enterprise to disable Telemetry and Data Collection in Windows 10.

As you use Windows 10, Microsoft will collect usage information. All its options are available in Settings -> Privacy - Feedback and Diagnostics.

<snip image>

There you can set the options "Diagnostic and usage data" to one of the following options, as described by Microsoft:

Basic
Basic information is data that is vital to the operation of Windows. This data helps keep Windows and apps running properly by letting Microsoft know the capabilities of your device, what is installed, and whether Windows is operating correctly. This option also turns on basic error reporting back to Microsoft. If you select this option, we'll be able to provide updates to Windows (through Windows Update, including malicious software protection by the Malicious Software Removal Tool), but some apps and features may not work correctly or at all.

Enhanced
Enhanced data includes all Basic data plus data about how you use Windows, such as how frequently or how long you use certain features or apps and which apps you use most often. This option also lets us collect enhanced diagnostic information, such as the memory state of your device when a system or app crash occurs, as well as measure reliability of devices, the operating system, and apps. If you select this option, we’ll be able to provide you with an enhanced and personalized Windows experience.

Full
Full data includes all Basic and Enhanced data, and also turns on advanced diagnostic features that collect additional data from your device, such as system files or memory snapshots, which may unintentionally include parts of a document you were working on when a problem occurred. This information helps us further troubleshoot and fix problems. If an error report contains personal data, we won't use that information to identify, contact, or target advertising to you. This is the recommended option for the best Windows experience and the most effective troubleshooting.

The usage data monitoring setting can be set to Full out of the box, which is not acceptable for many users. Those users might want to turn off the data collection in Windows 10. This can be done with a Registry tweak. To disable Telemetry and Data Collection in Windows 10 Home and Windows 10 Pro, you need to do the following:

1. Open Registry Editor.
2. Go to the following Registry key:

Code: Select all

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection

Tip: You can access any desired Registry key with one click.
If you do not have such a Registry key, then just create it.

3. There you need to create a new a 32-bit DWORD value named AllowTelemetry and set it to 0.

<snip image>

Now, you need to disable a couple of Windows services. Right click the File Explorer item in Windows 10 Start menu and pick Manage from its context menu:

<snip image>

Go to Services and Applications -> Services in the left pane. In the services list, disable the following services:

Diagnostics Tracking Service
dmwappushsvc

Double click the mentioned services and pick "Disabled" for the startup type:

<snip image>

You need to restart Windows 10 for changes to take effect.

Tip: it is a good idea to check out rest of the options in the Settings app - >Privacy.

This should prevent Windows 10 from spying on you. If you have a more elegant solution for this or any questions, feel free to write a comment.

[Dominus Atheos]

So... how exactly does one opt out of the update, or turn it off if it's already scheduled? Because I'm happy with Windows 7 as is, and they probably won't stop updating it for a little while, so I'm pretty good with keeping it right now... my past experience with new Microsoft OSes has been uniformly awful.

You had to have opted-in in the first place, and can opt out by clicking on the white-swedish-flag icon in your notification area, going to it's menu, view confirmation, cancel reservation.

Microsoft really likes sharing your Wi-fi password

See this pretty accurate article from Ars Technica on why these chicken little articles are silly.

More debunking with added ridicule:

If you know you're in my Skype contacts list feel free to park in front of my house with your Windows 10 PC. But you'll have to bring your own Wi-Fi, because Wi-Fi Sense won't let you connect to my network. That option is off by default for every network, as you can see by the Not Shared status message under each one.

And you have to very consciously enable sharing for a network. It's not something you'll do by accident.

...

I've been using Windows 10 since last October. And yet none of my networks are available for my friends and contacts to share over Wi-Fi Sense. Why? Because I never enabled sharing for any of those networks.

I could imagine doing so if I was having a party or expecting houseguests and I knew that some of them would be using Windows 10 on a tablet or a phone. It's much more convenient (and secure) for all concerned if I don't have to give them my password and they can just connect automatically.

I could also imagine disabling this feature after the party's over.

If you upgrade to Windows 10, you have the same options. Despite what you read yesterday, Wi-Fi Sense is not a security hole, and no one is going to connect to your network without your permission.

Spread the word. Don't spread FUD.

http://www.zdnet.com/article/no-windows ... RSSbaffb68

Hey Ace Pace, remember when Vista's support for HDCP encryption was going to ruin computers forever:

Windows Vista includes an extensive reworking of core OS elements in order to provide content protection for so-called “premium content”, typically HD data from Blu-Ray and HD-DVD sources. Providing this protection incurs considerable costs in terms of system performance, system stability, technical support overhead, and hardware and software cost. These issues affect not only users of Vista but the entire PC industry, since the effects of the protection measures extend to cover all hardware and software that will ever come into contact with Vista, even if it's not used directly with Vista (for example hardware in a Macintosh computer or on a Linux server). This document analyses the cost involved in Vista's content protection, and the collateral damage that this incurs throughout the computer industry.

Fun times.

[Ace Pace]

I'm not upgrading to Windows 10 for the next two months because I want driver support to settle down and some rather fun late-game bugs to be fixed (high DPI mode). Other than that, I see no reason not to move from 8.1 to 10.

[Anacronian]

So Microsoft is gonna have a run-in with the EU courts again i guess.

[Jub]

So Microsoft is gonna have a run-in with the EU courts again i guess.

First, I doubt they much care at this stage. Second, seeing as most of this handwaving has been hyperbolic to this point what would the courts go after them for?

[Broomstick]

So... how exactly does one opt out of the update, or turn it off if it's already scheduled? Because I'm happy with Windows 7 as is, and they probably won't stop updating it for a little while, so I'm pretty good with keeping it right now... my past experience with new Microsoft OSes has been uniformly awful.

My spouse took care of it - apparently you can find the required procedures on line if you look for them. You'll have to hunt through a bunch of stuff and delete things manually. It took him some time to research it and do it to our main computer and laptop.

THEN you have to keep an eye out - after we cleaned it off our laptop once it spontaneously download itself and tried to reschedule the update for us.

Bastards.

[Broomstick]

So... how exactly does one opt out of the update, or turn it off if it's already scheduled? Because I'm happy with Windows 7 as is, and they probably won't stop updating it for a little while, so I'm pretty good with keeping it right now... my past experience with new Microsoft OSes has been uniformly awful.

You had to have opted-in in the first place, and can opt out by clicking on the white-swedish-flag icon in your notification area, going to it's menu, view confirmation, cancel reservation.

Bullshit. There's no opt-in. Windows downloads that shit in the background when you aren't looking. They'll upgrade you unless you specifically tell them not to do so. You have to opt out, not in, and they don't give you an easy opt out. Which makes me even more suspicious about what the hell is going on here.

[Pinjar]

Given the exceedingly high valuation of companies such as Facebook that (at least used to) have as their only assets private information Microsoft would be remiss to the point of irresponsibility if they did not at least try to push in the direction of less user privacy.

It does strike me as creepy but it really shouldn't. Ultimately all they are trying to do is sell us things. With the correct equipment you can even read and manipulate unencrypted flash memory from a significant distance so your nation states security apparatus having easy access to your data and devices is something that they already have and there is no extra capacity being provided by Microsoft. The manipulation of the law is the problem, not Microsoft trying to make money on your data.

EDIT: "With the correct equipment you can even read and manipulate unencrypted flash memory from a significant distance" I was convinced I read this in a paper in the late '90s but when I went to link it I could not find it so withdraw the comment. I think the point still stands that it is the law that protects you not a lack of technical ability and that the focus should be on improving the law not expecting Microsoft to voluntarily cripple itself.

[Executor32]

Bullshit. There's no opt-in. Windows downloads that shit in the background when you aren't looking. They'll upgrade you unless you specifically tell them not to do so. You have to opt out, not in, and they don't give you an easy opt out. Which makes me even more suspicious about what the hell is going on here.

Er, no. The reservation app itself is an automatically installed, yes, but getting rid of it permanently is as simple as uninstalling the update that adds it (KB3035583) and then hiding the update in Windows Update. However, if it automatically downloaded Windows 10 and notified you that the upgrade was all ready to go, then you, your husband, or someone else using your computer opted into it from the reservation app, plain and simple. Even then, you would have to provide final confirmation and initiate the upgrade from the reservation app before the upgrade would proceed, it doesn't force it on you.

[Purple]

Can anyone link me to an article or something explaining how to get rid of it?

[Broomstick]

It does strike me as creepy but it really shouldn't. Ultimately all they are trying to do is sell us things. With the correct equipment you can even read and manipulate unencrypted flash memory from a significant distance so your nation states security apparatus having easy access to your data and devices is something that they already have and there is no extra capacity being provided by Microsoft. The manipulation of the law is the problem, not Microsoft trying to make money on your data.

- The government for the most part doesn't give a fuck what the average citizen is doing and isn't going to bother to read said citizen's data.
- On the other hand, various private companies ARE trying to do something with our data, and therefore DO have an interest in our data and WILL be looking at it.
- I think advertising is already intrusive enough, and do not want to be, say, working on one of my own projects and start having pop-up adds for no damn good reasons.
- Too many companies are not ethical operators, they try to get away with whatever they can, and the temptation to go beyond advertising will, I believe, be too great. Yeah, you're right, "manipulation of the law" indeed.
- So, you go to apply for a job, and either your prospective employer already has your private information, or can easily purchase it - you really think that won't be abused? Why make it easier for this to happen?

[Broomstick]

Bullshit. There's no opt-in. Windows downloads that shit in the background when you aren't looking. They'll upgrade you unless you specifically tell them not to do so. You have to opt out, not in, and they don't give you an easy opt out. Which makes me even more suspicious about what the hell is going on here.

Er, no. The reservation app itself is an automatically installed, yes, but getting rid of it permanently is as simple as uninstalling the update that adds it (KB3035583) and then hiding the update in Windows Update.

No, it's not. A bunch of other stuff is installed with it and takes up room on your computer.

However, if it automatically downloaded Windows 10 and notified you that the upgrade was all ready to go, then you, your husband, or someone else using your computer opted into it from the reservation app, plain and simple.

No, we did not. We most emphatically did not.

[Executor32]

Can anyone link me to an article or something explaining how to get rid of it?

The reservation app? Just open up Control Panel, open Programs & Features (or, if you're a Category-view-using pleb, click 'Uninstall a program' under Programs), and click 'View installed updates' in the sidebar on the left. Then, find 'Update for Microsoft Windows (KB3035583)' in the list of updates and uninstall it like you would any other program. You might have to reboot after that, but I'm not sure. Either way, once it's uninstalled, go to Windows Update and manually check for updates. The reservation app is considered an important update, so once the update check completes, click '## important updates are available' to view the list of important updates. Find 'Update for Microsoft Windows (KB3035583)' in the list, then right-click on it and click 'Hide update'. It'll get greyed out, and in future update checks (even automatic, background ones) it won't even show up at all, let alone be downloaded or installed.

No, it's not. A bunch of other stuff is installed with it and takes up room on your computer.

Yes, if you've reserved the upgrade at some point. If not, KB3035583 is literally only ten files totaling about 3.5 MB.

No, we did not. We most emphatically did not.

Sorry, Broomstick, but you're wrong. You have to reserve the upgrade through the reservation app in order for it to download, it does not just automatically happen to anyone and everyone regardless of reservation status. I haven't reserved it on my brother's computer, for instance, and it hasn't downloaded a damn thing. You or your husband might have done it and forgotten so, or someone else who you allowed to use your computer may have done it, but somebody did reserve it at some point or another.

[Broomstick]

We don't fucking allow anyone else to use our computers.

We didn't OK the update.

[Simon_Jester]

Could there perhaps have been some mistaken clicking? That's happened to me a few times.

If anything I predict a lot of people will not be updating from windows 7 until forced.

Oh, the downloaded the "wizard" without asking, loaded a bunch of shit on everyone's computer, and then one day you boot up to a splash screen announcing how wonderful it is that they're upgrading you for free... we killed that dead. Forced? If you aren't careful they'll simply upgrade you without permission.

The "Oh, the downloaded" part makes it unclear what you are saying.

Are you referring to an event in the past, or to a prediction in the future?

Microsoft really likes sharing your Wi-fi password

See this pretty accurate article from Ars Technica on why these chicken little articles are silly.

In fact, I'm not sure the Ars Technica article disagrees with the Rock Paper Shotgun article about the facts- just the tone. And the Ars Technica article sort of breezes over what I'd consider to be the biggest single concern- that this system requires Microsoft to keep a database of passwords for basically every lightly-protected wireless network on the planet.

We've had some really huge identity theft and so on issues in the past few years, like the OPM incident that basically revealed personal information on everyone who's ever worked for the government. While Microsoft no doubt has pretty good security, it can't be perfect, and there are endless possibilities of someone finding a previously unknown exploit and using it to sneak past their security somehow.

What will they want to do next, memorize the passwords to access your bank accounts "to make it easier for you to get your money?"

[SpottedKitty]

Ultimately all they are trying to do is sell us things.

Isn't that the wrong way round? We're not the customers, we're the product. Look at what Yahoo! users (especially in Y! Groups, although other sections are badly affected) have been going through the last couple of years, since Y! introduced its hideously badly implemented and incredibly bug-ridden Neo "upgrade".

[Ace Pace]

I'm going to break these down into seperate problems.

In fact, I'm not sure the Ars Technica article disagrees with the Rock Paper Shotgun article about the facts- just the tone. And the Ars Technica article sort of breezes over what I'd consider to be the biggest single concern- that this system requires Microsoft to keep a database of passwords for basically every lightly-protected wireless network on the planet.

Not really, you can keep these passwords in a format such as you don't need to keep the plain text data. Similar in a way that no real OS or service keeps your password in plain text.

We've had some really huge identity theft and so on issues in the past few years, like the OPM incident that basically revealed personal information on everyone who's ever worked for the government. While Microsoft no doubt has pretty good security, it can't be perfect, and there are endless possibilities of someone finding a previously unknown exploit and using it to sneak past their security somehow.

Obviously. By that measure, your password managers are inherently unsafe, seeing as how they also have pretty good security. Infact, if we consider the big 4 (Google, Facebook, Microsoft, Amazon) it's pretty clear that the latter two are somewhat better at security. The OPM example is a red herring, considering their software security record is worse than you can imagine.

What will they want to do next, memorize the passwords to access your bank accounts "to make it easier for you to get your money?"

If it's opt-in (like Wifi-Sensing), what's the problem? Idiots worldwide keep them in crappy password managers that are less secure than my Gmail inbox. Using a Microsoft provided password vault is going to be far better.

tl;dr Microsoft is pretty much the world standard in modern software and a strong player in web security. I'd rather trust my data with them than pretty much any other vendor.

[Purple]

The difference is that before using password managers and the like was the behavior of idiots which anyone with a brain discouraged. Because we know how stupid it is to use such things and how easy your data can and will get stolen. Suddenly the people making our OS are encouraging it and building it in as a feature. So if we know it's stupid and unsafe and they know it's stupid an unsafe than what are we supposed to think?

[Beowulf]

Since essentially no one uses a 64 character hex string for their WiFi password, it's almost certain that Microsoft is just storing the derived key, instead of the password (takes slightly less room, and is fixed in size).

Microsoft would very much like to get everyone on Windows 10, because the faster it happens, the quicker everyone is on the same codebase, and they have to worry less about vulnerabilities in older versions of windows. That's the point of the free upgrade. All the fancy features that are new in the privacy policy can be turned off: Cortana and Bing integration with search, WiFi Sense, OneDrive (though that's actually from Windows , etc.

Also, Simon, you're about 3-4 versions of Windows behind that idea. Windows has a "Credential Manager", that stored account credentials. IE uses that for where it stores passwords. And you can backup and restore the credentials. The big part that's missing is to do cloud syncing of them.

[Batman]

If Win 10 is automatically forced on everybody using win 7...how come I'm still on Win 7? Sorry, Broomstick, I'm with Executor32...either somebody opted in somewhere up the line or you somehow caught some software forcing the update. From where I stand, it looks exactly the way he describes-you have the little swiss flagg icon 'allowing' you to opt in, if you decide not to, Win 10 doesn't happen.

[Grumman]

Microsoft would very much like to get everyone on Windows 10, because the faster it happens, the quicker everyone is on the same codebase, and they have to worry less about vulnerabilities in older versions of windows. That's the point of the free upgrade. All the fancy features that are new in the privacy policy can be turned off: Cortana and Bing integration with search, WiFi Sense, OneDrive (though that's actually from Windows , etc.

If all Microsoft wanted was the convenience of everyone being on one OS, they should have made a "strictly better" OS to attract us, instead of something bloated with borderline malware and sinister EULAs.