This would be too big an oversight for a company trying to get more business adoption. According to Microsoft, the data is anonymized and run through a virtual shredder before being sent. Here's their statement on it:

“Some of this data is stored on your device and some is sent to Microsoft to help improve these services. Data sent to Microsoft for product improvement is put through rigorous, multi-pass scrubs to remove sensitive or identifiable fields (such as email addresses, passwords and alphanumeric data) and strings are chopped into very small bits and stripped of sequence data to prevent the information from being identified or put back together.”

http://blog.laptopmag.com/windows-10-privacy-issues-exaggera...

It amazes me that this information isn't easier to find and I end up being the one defending Microsoft. I definitely recommend using Free Software only if you want to be absolutely sure of confidentiality.

Do I understand this correctly that they are sending back everything you type, but they try to scan the data for things like e-mail addresses or passwords and remove those bits first, and then send the data back in pieces so it can't be reassembled?

If so, that sounds unbelievably error prone. What if your password is of the "correct horse battery staple" form, rather than the standard unreadable scramble? It seems impossible to reliably distinguish that from other text. Does that mean that Microsoft then has your password? Even anonymized, that's a massive problem.

It's not everything you type, just bits and pieces stripped of sequence, and most of what's saved is on your device only. They specify that what they send is only "some," and logically, everything typed into the billion devices they're shooting for would be too much data for even Microsoft to handle.

Passwords and the like are probably identified by the type of field they're entered into, as Windows forms and websites have explicit identifiers for passwords, and it would be easy not to record this. I think this analysis is more for things like analyzing the frequency of terms and which characters tend to follow other characters, but I don't have much more information, and I agree that there needs to be more shared about how this works.

That's what it may be sending today. What about next month after one of the forced automatic updates? If you authorize someone to take your data, that doesn't mean they have to do it right away.

> only "some"

99% is still "some". Regardless, since when is "some" keyloging acceptable?

> too much data

That depends on a lot of factors. Text is small and trivial compared to most stuff on the internet these days. How many kilobytes per day of text does the median windows user even type?

It would be even easier for MS to filter out stuff like video games (DirectInput?) to reduce the size.

> I think

Guessing is useless. What matters is the data going over the wire and what authorized MS to do in the future.

> there needs to be more shared about how this works

No, there needs to be explicit informed consent form the user.

I'm just trying to objectively interpret a really small amount of data here, not make a justification for or against any particular policy. You're right that it's important to have informed consent about this kind of thing. That applies to Google, Facebook, or Amazon too. It does seem like it's pretty obvious here when there are so many statements about how Cortana gets to know you, your speech, your schedules, your flights, your interests, etc., and there's a delete button for everything too.

Most people probably like all that, but I would like to see more robust privacy settings to easily disable tracking whenever it's desired.

> That's what it may be sending today. What about next month after one of the forced automatic updates?

You mean, like this?

# apt-get update && apt-get upgrade

Granted, running that isn't 'forced', but given that OSS users don't _actually_ analyze the code in their software, it's basically the same thing.

There's always a chance of something being slipped in later, no matter what OS you're on. Rampant paranoia and conspiracy theorizing does no one any good.

The "forced" you so easily dismiss is entirely the point. In case you haven't noticed, people choose when (and if) they upgrade, for a variety of complex reasons. One of those reasons is to wait and see if the early adopters complain of any issues.

The problem of inspecting the code itself is a separate issue entirely, though at least in the area of Free Software that inspection is possiblea, and reproducible (deterministic) will simply the problem. Good luck doing the same with Windows (or any other closed software).

> Rampant paranoia and conspiracy theorizing

Now you're simply resorting to either insults (and/or wilful ignorance).

> The "forced" you so easily dismiss is entirely the point.

I think it's you that missed my point.

> people choose when (and if) they upgrade, for a variety of complex reasons

If they're running Gentoo, or maybe a small group of other distros, sure. Otherwise, people (on all operating systems) don't really do a lot of choosing at all. If updates are available, they generally run them. The only picking and choosing I've ever seen from the vast majority of people (including technical folks) is if they don't have the bandwidth/time to update a particularly large piece of software at the moment. Of course, they'll update it later when they are able.

> The problem of inspecting the code itself is a separate issue entirely, though at least in the area of Free Software that inspection is possible

Yes, it's possible, but it isn't done in practice, which is why I said it. That's the reason I said it's 'basically the same thing'. Whether you receive updates automatically or choose when to download them, you are still accepting what the distribution method gives you. There are FAR too many software packages out there for the average person to work out the logistics of reading accounts from early adopters of every single point release.

> Now you're simply resorting to either insults (and/or wilful ignorance).

It's not an insult. It's a factual statement. You claimed in your comment that a multi-billion dollar corporation who has a vested interest in keeping the good will of their customers (some of whom are corporate, some government, but the vast majority are consumers who look to them for help) would willfully send compromised software through forced updates in the future. If that isn't a conspiracy theory, I'd love to know what is.

> The only picking and choosing I've ever seen

Apparently you need to get out more, because you seem to have missed that "not upgrading" is so incredibly common that some major software packages (web browsers) and at least one operating systems have decided to force upgrades.

Also, do you really believe that all the IT departments in the world are running current versions of anything? There are entire industries that run "last year's" versions, who only upgrade after extensive testing.

> I'd love to know what is

Did you even read the thread you're replying to? You're knee-jerk application of the paranoid-style[1] ignores the fact that "It's in the privacy policy." There is not secret. MS is telling everyone they will send forced updates (which have already cause stability issues for some people). As for MS keeping "the good will of their customers", again, did your read this thread? Windows 10 has already forced various professionals to drop windows.

Also, "compromised" is your term, not mine. I'm sure any future update they push out will be buzzword compliant. The point is we don't know what future updates will bring, but you agree to run those future versions anyway.

--

Meh. I have better things to do than waste any more time on your distractions. If you want to be the apparatchik that refuses to believe MS would do anything malicious, that's your business.

[1] http://harpers.org/archive/1964/11/the-paranoid-style-in-ame...

> "not upgrading" is so incredibly common

Honestly it does not look like you wasted much time at all, you seem to have missed his point again.

So, here's a question then, assuming that's true, why send it? If its been so thoroughly anonymized that nothing useful can be gleaned from it, why bother sending it in the first place? If it is possible to derive useful info from it, that seems to directly contradict the idea that no sensitive information is going to be exposed (there being no realistic way to programmatically identity only sensitive information without some very specific domain knowledge). You can't have it both ways, either the info isn't useful in which case they have reason to transmit it, or else it's exposing potentially sensitive information and they shouldn't be transmitting it.

I can only speculate, but I would guess it goes something like this:

You type "the quick brown fox jumps over the lazy dog." You continue typing other stuff. 30 minutes later, there's a queue of random slices like: { "lazy dog", "chocolate donut", "brown fox" }. That gets encrypted and sent into a big pile of other data for a machine learning algorithm to develop better typing prediction.

I would like to know if that's the gist of it or if there are other things happening. Hopefully there will at least be a developer blog or something like that to better explain it.

The trouble is that not every place you type a password will necessarily have something identifying it to the OS as a password field. For example, what if you're entering a sudo password into an ssh client, or saving a password into a text file (saved on an encrypted drive, surely) using a text editor?

I'd like to know too. Maybe they compare typed data to a dictionary and throw away everything that doesn't match so that every slice contains only dictionary words that couldn't be identified as passwords. That's just speculation of course.

It's hard to see the utility in a bunch of individual unassociated dictionary words being sent back. Maybe there is some that I just don't know about. However, my money is on them being more confident in their scrubbing than is warranted. There have been so many cases in the past where companies have scrubbed and anonymized data, only to find that they missed something critical.

Even the frequency of words used might be valuable for typing predicion, but I would guess they would probably group a few words together. I really would love to know how it works.

Same here. If it has holes, it's important to know about them. If it doesn't, then it would be fascinating to understand how it works.

They made a statement to a magazine. Where is that statement on their website, and where is the information that discloses what they are sending?

I'd like to see precisely how they anonymize the data, and I'd also like to know what data it is.

Because companies haven't failed to anonymize data before with the general public being left to pick up the tab.

If Microsoft was a known moral bastion who had perfect security might not be a problem. But it isn't and it doesn't, so there is only one response: NO!

(OK, there are more responses, but I'm not sure if they are allowed with HN's code of conduct.)

> I definitely recommend using Free Software only if you want to be absolutely sure of confidentiality.

So, has anybody ever audited build farms for Debian, Ubuntu, etc? Have we ever seen a breakdown of their income sources? How do you know that the binaries you install are built from the sources you can browse or download from the net?

Do you compile everything yourself?

Debian and others realize that this is a problem, and you absolutely shouldn't trust anyone at their word. There's an ongoing effort at Debian to make all builds reproducible so that you can verify that they were built from the sources they provide for inspection. This should be completed soon.

For the situation I'm talking about where absolute confidentiality is required, the right way to do it would absolutely be auditing all code and compiling from source, assuming you're working in an organization that has that kind of capacity.

But for most cases, just dealing with an organization you trust is enough, whether they provide source or not.

> "There's an ongoing effort at Debian to make all builds reproducible so that you can verify that they were built from the sources they provide for inspection. This should be completed soon."

Ah, good to know. Do you have any links to articles or discussions about this? Would like to learn more.

While it is true that most end users of Free software do not audit or compile their own binaries, the situations aren't even remotely comparable.

You can trust Microsoft. Don't worry about it. They'd never do anything to compromise your privacy. Just ask them.

/LOL.

FWIW, I believe they try to do these things however, I'm not sure how its technically possible.

Various security measures rename sensitive fields into things that are basically random strings that are stored in a session. [e.g. Fields to change your password? They are set to something like 2ajefklaj23324rk]

There is also the issue of people who write erotica for fun. Or doctors writing down notes for patients.

Here are some references to explain how data is anonymized:

http://www.caida.org/data/anonymization/index.xml

How do you think Apple gets their spell-check data, or improves Siri's voice recognition?

In any event, during the installation process, you do see a screen where you can turn all this off. It's not off by default, but viewing these settings was part of my Windows 10 installation experience.

I thought the options to turn off defaults were pretty clear during the installation process. Requests to make options more explicit and visual are reasonable, but it bothers me that Mozilla and others are acting like "choose my default programs" or "custom settings" are too obscure for anyone to understand. You also have the option to delete your history.

> In any event, during the installation process, you do see a screen where you can turn all this off. It's not off by default, but viewing these settings was part of my Windows 10 installation experience.

The problem is that Windows 10 does not respect you having this turned off. It will send away your data, even if you turned off all the switches.

Don't you see this as a huge problem?

I don't know, how about using a dictionary and doing research?

Otherwise wouldn't every commonly misspelled word show up incorrectly in spellcheck?

There is quite a bit of work in the field of speech recognition, too, and it's entirely possible to create a functional model without recording every user's voice and storing that information on a server. Even if they require speech samples, or samples from different languages, they should at least pay someone for that information.

I was disappointed when I learned that the voice recognition feature in Siri wasn't local to the phone.

Turning those things off still doesn't prevent Windows 10 from sending tracking and usage data to Microsoft though, even when you're only using a Local Account instead of a Microsoft Account.

I can confirm: I bought a Surface Pro 3 the other day, and when I first booted it up, the setup screens explicitly asked me which privacy settings I'd like to enable.

Do you know if there is any information sent to Microsoft by default for which they did not offer you a screen widget to click that says "off"?

Do you know what actual data is, and is not, sent to Microsoft as you use your device?

Even if you do, will you still know once Microsoft pushes a mandatory update and/or changes its 12,000 word terms of service?

I'm not sure this is what Beltiras is referring to, but in the privacy FAQ for Windows speech, inking, and typing [1], it says this:

"When you interact with your Windows device by speaking, writing (handwriting), or typing, Microsoft collects speech, inking, and typing information—including information about your Calendar and People (also known as contacts)—that helps personalize your experience. This information improves your device’s ability to correctly recognize your input, such as your pronunciation and handwriting. You can turn the Speech, inking, and typing setting (which is called Getting to know you) on or off in Settings.

Note: If you want to use Cortana, you must have Getting to know you turned on.

We also collect your typed and handwritten words to improve character recognition and provide you with a personalized user dictionary and text completion suggestions. Some of this data is stored on your device and some is sent to Microsoft to help improve these services. You can turn the Send Microsoft info about how I write setting on or off in Settings."

1. http://windows.microsoft.com/en-us/windows-10/speech-inking-...

Yes, and during the install process, I was presented with a screen and the option to turn this off.

I think you mean, during the install process you selected the tiny "Customize settings" and manually disabled this option, after scrolling down on the page that (on my smaller screen) doesn't have a scrollbar enabled:

ref: https://jonathan.porta.codes/2015/07/30/windows-10-seems-to-...

Also, it seems that Win10 ignores some of these settings: https://www.reddit.com/r/Windows10/comments/3gm1e3/what_wind...

If this is true, then it really does flabber my gaster.

I've no problem with them doing this sort of thing, but it must be opt-in rather than opt-out. Like you say, this isn't just about individual privacy concerns, it's about important legal obligations that people may unwittingly be violating if they use Windows 10.

This is my point. I do not care one iota under what sort of black-box privacy scheme they maintain they employ. It's a black box and through it all generated information can be passed to Microsoft. "Trust us" is not a good reply by someone with their track record.

I'm curious: Are doctors, psychologists, and anyone under an NDA forbidden from using the Google search engine or Android voice recognition under a logged-in account?

I'd think that the security concerns would be functionally identical.

> I'm curious: Are doctors, psychologists, and anyone under an NDA forbidden from using the Google search engine or Android voice recognition under a logged-in account?

Android voice recognition might raise similar problems; the Google search engine less so. You can use Google Search without putting any protected information into it; OTOH, if an OS is capturing all of your typing and inking and sending it to another party, anything you do by typing or inking that involves protected information is being sent, so (in the HIPAA case) unless you have a BAA in place, and both parties have both the technical and administrative safeguards required under HIPAA, using it for PHI is going to involve regular illegal disclosures.

The major difference is if I'm looking up drug Apraximine to give to fixermark for his PTSD resulting from embarrassing secret, I would just google (or whatever professional service they use) Apraximine. Google only sees that and know knows I have some interest in this drug. It can't even attach your name to it. But if I write in an electronic file that fixermark is being given Apraximine for PTSD resulting from embarrassing secret, Microsoft know has all that information. More so, hackers have a much easier time getting such information.

They would be if they're entering actual patient data into Google, which would be silly (Android voice recognition would be less silly, since doctors do use voice recognition software for dictation, though in my experience this is usually something locally-installed on a PC, like DragonSpeak).

The problem is that, by way of Windows 10 effectively having a keylogger installed, pretty much any EMR accessed via a Windows 10 machine is automatically insecure, since the data entered into said EMR is being sniffed and sent to a third party. If Microsoft experiences any sort of data breach, hospitals throughout the U.S. will be having a HIPAA/HITECH hell-day.

They are forbidden from disclosing confidential data to those services, which is still somewhat under their control, as opposed to the OS deciding to disclose all the data for them.

So would a logged-in search for, say, "rheumatoid arthritis" or specific drug names be out of the question if it's in the context of finding treatments for a patient? And does HIPAA also block a family practitioner from using Drive to track patient histories?

Yes you can't store patient data on google drive.

There are plenty of practice management cloud solutions with cloud storage support which are hipaa compliant.

Thank you for the clarification!

Swinging back to topic: Microsoft has traditionally had a good rapport with the business / government space, so I'll be shocked if they don't already have a plan for addressing the need to protect private data. Maybe the enterprise solution version of Windows 10 will have this feature off by default?

There is a nod to Enterprise. The minimum value for HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\AllowTelemetry is 0 on win10 Enterprise, and 1 on consumer editions. (I believe the default value is 3. Lower is more private, but lowest is not offered to consumers)

Like people mentioned there are different settings for Enterprise SKU's including different settings for different verticals (e.g. education or health industry).

For example Office 365 for Healthcare which is HIPAA compliant has probably quite a different privacy policy and out of the box authentication, encryption and right management settings than what you would get as an individual or even by buying Office 365 for business editions.

http://www.microsoft.com/en-us/health/products/office365/def...

Not saying that's right, but most companies that provide free/subsidizes consumer services including companies like Google tend to have quite a different SLA and service terms for corporate customers.

They are probably not putting sensitive and confidential patient information into Google searches though.

Windows 10 is harvesting and relaying every-fucking-thing you type on your operating system.

According to an article that isn't even slightly credible. I love how people read something on the internet and instantly believe it as fact.

You know, some of us observed the same behavior on our own machines. I love apologists who have no idea what they fight for.

Then it will be easy to provide proof of those claims, isn't?

For example: http://arstechnica.com/information-technology/2015/08/even-w...

Can you point where in that article is proved that microsoft send every typed thing to their servers?

Microsoft has no business to send out anything without consent.

I will not waste my time to MITM SSL traffic and break down binary blobs to find out, whether it contains something I just typed. It sends out unwanted traffic when I type into start menu --> onus is on Microsoft to be transparent, what it sends out. And to allow user to disable that behavior.

So, you just accept that your link has nothing to do with what the OP said and you just don't want to accept it. Got it.

> Cortana is your personal assistant. Cortana works best when it can learn about you and your activities by using data from your device, your Microsoft account, third-party services and other Microsoft services. You can choose whether to enable Cortana, and you can turn Cortana off at any time.

> Windows 10, rather than residing as a static software program on your device, key components of Windows are cloud-based, and both cloud and local elements of Windows are updated regularly, providing you with the latest improvements and features. In order to provide this computing experience, we collect data about you, your device, and the way you use Windows. And because Windows is personal to you, we give you choices about the personal data we collect and how we use it.

> And because Windows is personal to you, we give you choices about the personal data we collect and how we use it.

Apart from the data we don't give you a choice about. And the choices we opt to ignore anyway.

Could you point in what part they explicitly say so? I just skimmed through the text and couldn't find any reference to keylogging, in whatever "legal terms-friendly" way they could write it.

Under Windows click "learn more" and then read under "Input Personalization".

I'm considering using a secondary computer (linux) for all of my personal internet activity and making my windows box purely game dev / gaming.

It's right there, thank you. It says it can be turned off, and that Cortana will not work after you do that. Considering I live in a Cortana-less country, it shouldn't be a problem if I ever migrate to Win10. However it's be best to see how they handle this.

I've stopped gaming on PC about 5 years ago and couldn't be happier. Consoles don't have this constant hardware upgrade cycle and you're free of Windows. In the long run I think I've actually saved a bunch of money; I used to buy high-end graphics cards easily worth two consoles and now I spend that money on more games :)

Took me a few weeks to completely replace my Windows workflow in OSX and Ubuntu but I'd say the broader perspective of knowing all three platforms when being a programmer is well worth the investment!

I'd have to say, Uncharted played a small role in this transition; I've been blown away by this series and they're not available for PC, so there :)

I personally like to mod my games, though, which is borderline-impossible on modern consoles. There are also quite a few games - like Kerbal Space Program - that aren't available for consoles and that I enjoy playing.

I personally just game on a Linux box (running Slackware, specifically). I don't get the best selection in the world, but most of the indie games seem to be paying attention to Linux/SteamOS, and said games tend to be the better ones anyway.

> "Consoles don't have this constant hardware upgrade cycle and you're free of Windows."

Do you own an Xbone? I hope not for your sake as Windows 10 is coming to that too.

(If I'm being pedantic, other consoles have used Windows in some way. I'm not sure about the Xbox 360 but IIRC the OS for the original Xbox was based on Windows 2000. The Dreamcast also had limited support for Windows CE, I don't think the main OS was based on it, but a few games used it).

I am using the setup you describe since about two years now. I mean, my Arch-Linux machine is bugging me off sometimes, especially when a update cracked something, and I have to downgrade again. But everytime I read news like that, I am glad to have it as my primary machine (where I know exactly what goes on under the hood)...

Er... reading the "Learn More" option under the "Personal Data We Collect" heading sends up giant red flags... why would anyone agree to this, ever?

I don't care how good your data gets anonymized; time and again, it's been shown that anonymized data can be fingerprinted and de-anonymized over time.

Whether or not this is happening, this should raise legitimate concerns with people who are considering, or who have already upgraded to Windows 10.

Why is it unusable for those people? Will they be held legally liable if something were to leak? Seems like Windows 10 is one of many services collecting anonymous information, what makes it different?

You can opt-out of services, if you run Windows you can't opt-out of your operating system. That's basically the line I see.

I'm fairly certain things under NDA won't go near Windows 10, even if anonymous the data is still leaked. Just like these things currently stay far away from 3rd-party services.