Source: http://log.nadim.cc/?p=78
QuoteI?ve recently been using the final, Released to Manufacturing version of Windows 8 on one of my computers, to much delight. I?ve been very impressed by how fast, well-designed, functional and capable this latest iteration of Windows is. However, my tinkering around from a security/privacy perspective has left me concerned.
Windows 8 has a new featured called Windows SmartScreen, which is turned on by default. Windows SmartScreen?s purpose is to ?screen? every single application you try to install from the Internet in order to inform you whether it?s safe to proceed with installing it or not. Here?s how SmartScreen works:
- You download any application from the Internet. Say, the Tor Browser Bundle.
- You open the installer. Windows SmartScreen gathers some identifying information about your application, and sends the data to Microsoft.
- If Microsoft replies saying that the application is not signed with a proper certificate, the user gets an error that looks something like this.
There are a few serious problems here. The big problem is that Windows 8 is configured to immediately tell Microsoft about every app you download and install. This is a very serious privacy problem, specifically because Microsoft is the central point of authority and data collection/retention here and therefore becomes vulnerable to being served judicial subpoenas or National Security Letters intended to monitor targeted users. This situation is exacerbated when Windows 8 is deployed in countries experiencing political turmoil or repressive political situations.
I can see why they wanted this feature in there, to protect the uninformed or computer newbs from malicious or damaging software, or incompatible software. But as this article points out, it is also a very heavy data mining too.
I will be turning this off on my Windows 8 installations.
Quote from: Melbosa on August 24, 2012, 11:02:25 AM
Source: http://log.nadim.cc/?p=78
QuoteI?ve recently been using the final, Released to Manufacturing version of Windows 8 on one of my computers, to much delight. I?ve been very impressed by how fast, well-designed, functional and capable this latest iteration of Windows is. However, my tinkering around from a security/privacy perspective has left me concerned.
Windows 8 has a new featured called Windows SmartScreen, which is turned on by default. Windows SmartScreen?s purpose is to ?screen? every single application you try to install from the Internet in order to inform you whether it?s safe to proceed with installing it or not. Here?s how SmartScreen works:
- You download any application from the Internet. Say, the Tor Browser Bundle.
- You open the installer. Windows SmartScreen gathers some identifying information about your application, and sends the data to Microsoft.
- If Microsoft replies saying that the application is not signed with a proper certificate, the user gets an error that looks something like this.
There are a few serious problems here. The big problem is that Windows 8 is configured to immediately tell Microsoft about every app you download and install. This is a very serious privacy problem, specifically because Microsoft is the central point of authority and data collection/retention here and therefore becomes vulnerable to being served judicial subpoenas or National Security Letters intended to monitor targeted users. This situation is exacerbated when Windows 8 is deployed in countries experiencing political turmoil or repressive political situations.
I can see why they wanted this feature in there, to protect the uninformed or computer newbs from malicious or damaging software, or incompatible software. But as this article points out, it is also a very heavy data mining too.
I will be turning this off on my Windows 8 installations.
Have fun with that
QuoteSmartScreen is not easy to disable, and Windows will periodically warn users to re-enable it should they attempt to disable it.
Meh, I saw everyone wigging out about it on /. this morning, it can be disabled so no big whoop.
I'm no fan of Windows 8 but the "h8" machine is in full swing with a lot of these articles.
It is very easy to disable and tell window to ignore messages. Just did it on my test machine at work :D.
Yeah I've noticed the "h8" movement is very large. Must be the media... always blame the media :P
Quote from: Melbosa on August 24, 2012, 11:22:19 AM
It is very easy to disable and tell window to ignore messages. Just did it on my test machine at work :D.
Yeah I've noticed the "h8" movement is very large. Must be the media... always blame the media :P
You know something is large when it has its own abbreviation... h8 works nicely for both SMS and twitter...
Quote from: Lazybones on August 24, 2012, 12:19:01 PM
Quote from: Melbosa on August 24, 2012, 11:22:19 AM
It is very easy to disable and tell window to ignore messages. Just did it on my test machine at work :D.
Yeah I've noticed the "h8" movement is very large. Must be the media... always blame the media :P
You know something is large when it has its own abbreviation... h8 works nicely for both SMS and twitter...
Especially when its a short 4 letter word to begin with.
Quote from: Mr. Analog on August 24, 2012, 11:20:22 AM
Meh, I saw everyone wigging out about it on /. this morning, it can be disabled so no big whoop.
I'm sure it'll be easy for Jane Housewife and Joe the Plumber to turn it off... and be aware it even exists in the first place. Microsoft is known for its transparency and open-ness and flexibility of choice for its user base.
Quote from: Melbosa on August 24, 2012, 11:22:19 AM
Must be the media... always blame the media :P
Will McAvoy would agree with you.
http://jasonkobely.com/2012/07/newsroom-103-transcript-will-apology-112th-congress/
This isn't exactly limited to Microsoft, if you use a virus scanner you are sending stats on every app you install or remove.
But people are painting this as "h8" driven FUD.
I can see the feel-good reasoning "we can save our users". I guess the other way they could go is open an app store and only allow you to install apps from that app store (a la Apple and it's iPhone / iPod / iPad systems). Or, I dunno, continue to be the OS listed as the easiest to infest?
Quote from: Thorin on August 25, 2012, 08:15:46 PM
I can see the feel-good reasoning "we can save our users". I guess the other way they could go is open an app store and only allow you to install apps from that app store (a la Apple and it's iPhone / iPod / iPad systems). Or, I dunno, continue to be the OS listed as the easiest to infest?
Apple is also moving the App store model to OSX. And for apps that aren't signed you get a big scarry warning and an option to install anyway hidden behind a ? button.
MS is also likely to head in this direction, first they are moving to sell consumer copies of windows via the internet, and then once the Windows/Microsoft (or whatever they'll call it) store fully opens up, they will prioritize apps from there.
MS is certainly heading in this direction, whether or not the bulk of consumers enjoy the taste is another thing.
Quote from: Mr. Analog on August 25, 2012, 09:09:28 PM
MS is certainly heading in this direction, whether or not the bulk of consumers enjoy the taste is another thing.
Consumers will love it, IT Departments will have mixed feelings and techies will hate it.
Sorry but my dad, cousins etc don't give a $@CK about the portability or control of apps.. They want their internet to work, and to open that attachment that there friend sent them.. When they get a new computer they want everything already pre-loaded and if it is not they want it to be crazy simple to add.
Teens growing up now will be used to App stores on their phones and not having to go to stores to purchase apps, games, music, movies, they will just EXPECT an app store in the computer not caring how it works.
It really depends on how locked up everything is and how well Azure handles downtime/failure.