Feeds

MS ID number system could track all Windows users

Redmond knows all about you - but it's not going to abuse the data, honest...

  • alert
  • submit to reddit

High performance access to file storage

Earlier this year the built-in serial numbers in Intel's Pentium III caused a privacy storm. But now a software company has revealed that Microsoft has been running a rather more effective identification system since the launch of Windows 98. So Redmond knows a lot more about you than you might have thought. The point about the Intel system is that it could be used to track personal data relating to PC users, but the Microsoft system is apparently doing so already, and has the potential to operate as a digital fingerprint that tracks where you go, and the documents you produce, anywhere on the Internet. Robert Smith, president of development tools company Phar Lap, last week pointed out that the Windows 98 registration wizard, which is used to register for support and updates, does cute things in addition to just sending Microsoft the Windows 98 registration number. This number, known as a Globally Unique Identifier, is sent to Microsoft along with name, address, phone number, plus demographic details and information on the hardware and software being used. Note that with the progressive tightening-up of Microsoft's registration procedures it is becoming more and more difficult to get support from the company, or to get software updates, without registering, so Microsoft is going to acquire more and more of this data. In the Windows 98 install procedure, users are not told that all this data is being sent, but Smith says that the data Microsoft is gathering is being used to build a database of Windows users globally. From what Smith says, it would also seem that Microsoft has been doing a pretty through job of 'integrating' the number into a user's entire installation. Aside from being linked to the user's name, it also appears in files the user has created, so Microsoft's database could be used to track both users and the documents they produce across the Internet. Microsoft denies that it ever intended to use the data it's gathered for marketing, but as the Windows 98 registration wizard clearly says that the data will be used by Microsoft and its affiliated companies, and the usual check box asking if you mind being sent information is there, this is obvious nonsense. Users do have the ability to decline to send inventory information during registration, but they clearly can't do much about identification numbers embedded in the data files they produce. Microsoft may change the registration wizard in the next Windows 98 service pack (which may be a while yet), but may also (probably depending on the level of the privacy firestorm) produce a utility that will delete the information from the local machine's registry. The company also apparently intends to delete information already collected from its database, but it's not clear what this information consists of. Probably it will be data on users and their machine configurations which have been acquired as part of the online support and update processes. Microsoft's own privacy policy provides some information on what this data consists of: "When you buy and install a new product, we ask you to register your purchase," it says. "We then merge your registration information with any information you've already left with us (we call that information your personal profile). If you haven't previously registered with us, we create a personal profile for you from your registration information." This information is available at the Personal Information Center" on the Microsoft site. But here's the bit that makes you wonder why everybody got worried about Intel without noticing Microsoft: "In creating a new profile or updating an existing one, we obtain your hardware identification number from the registry on your computer's hard drive. If you have already registered, we also obtain the personal identification number you were assigned … We then send a small bit of code back to your hard drive. This code is uniquely yours and only includes your registration information. It is your passport to seamless travel across microsoft.com, allowing you to download free software, order free newsletters and visit premium sites without having to fill out another registration form. Even if you switch computers, you won't have to re-register." There - so it's all supposed to make it easy for you, right? Microsoft may however find itself having to clean up its act sooner rather than later. The US and the EU remain locked in negotiation over how to tackle EU privacy regulations which restrict the export of personal data. If a solution is arrived at, US companies holding data on EU citizens will have to adhere to some sort of mutually agreed code of conduct. One might observe that a company that gives the impression of neither knowing what data it has nor why it acquired it will have a bit of difficulty passing the tests. ®

High performance access to file storage

More from The Register

next story
Sorry London, Europe's top tech city is Munich
New 'Atlas of ICT Activity' finds innovation isn't happening at Silicon Roundabout
MtGox chief Karpelès refuses to come to US for g-men's grilling
Bitcoin baron says he needs another lawyer for FinCEN chat
Dropbox defends fantastically badly timed Condoleezza Rice appointment
'Nothing is going to change with Dr. Rice's appointment,' file sharer promises
Audio fans, prepare yourself for the Second Coming ... of Blu-ray
High Fidelity Pure Audio – is this what your ears have been waiting for?
Did a date calculation bug just cost hard-up Co-op Bank £110m?
And just when Brit banking org needs £400m to stay afloat
Zucker punched: Google gobbles Facebook-wooed Titan Aerospace
Up, up and away in my beautiful balloon flying broadband-bot
Apple DOMINATES the Valley, rakes in more profit than Google, HP, Intel, Cisco COMBINED
Cook & Co. also pay more taxes than those four worthies PLUS eBay and Oracle
It may be ILLEGAL to run Heartbleed health checks – IT lawyer
Do the right thing, earn up to 10 years in clink
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
HP ArcSight ESM solution helps Finansbank
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.