That's not the web you're browsing, Microsoft. That's our data
- Reference: 1707125411
- News link: https://www.theregister.co.uk/2024/02/05/opinion_column/
- Source link:
With regard to the Edge browser's potential kleptomania, if true, it would reveal a lot more than spoon-lifting, it would betray a hierarchy of horror that goes well beyond browser burglary to asking fundamental questions of Windows as a trustworthy operating system.
The basic story is bad enough. If users on [1]multiple support threads are correct, every time Microsoft's flagship Edge browser starts up, it helps itself to open Chrome tab data and more besides. This goes well beyond the normal "Do you want to import bookmarks, history, etc?" that all browsers like to ask when you first install them on a system where another already lives. It also reportedly doesn't care what you answered to that question: this is a Microsoft package on a Microsoft operating system, and it's gonna Microsoft like it's [2]1999 .
[3]
The data in your browser is very sensitive, be it personal, work or both, you need the freedom to move it to a competing browser, or into some useful analytic package or whatever you deem fit. You also need the freedom to keep that data safe just where it is. Without both freedoms, you are open to exploitation through lock-in or data abuse. Heck, it is data abuse, even if it never leaves the computer on which the heist is happening.
[4]
[5]
Take a step back and ask what such an action – whether deliberate or inadvertent – would tell you about Microsoft's attitude to your data on Windows. We already know that Redmond sees Windows at least in part as a vehicle to insert [6]advertising into daily tasks and push behavioral patterns to its own [7]advantage . Now it would appear that personal data in non-MS products might also be open to exploitation, and there's no reason to think that Edge is going to be the only time this happens. Will any Microsoft code exercise its right to exfiltrate whatever data lives from any non-MS software that's running under Windows?
[8]That runaway datacenter power grab is the best news for net zero this century
[9]The Post Office systems scandal demands a critical response
[10]The New ROM Antics – building the ZX Spectrum 128
[11]CLIs are simply wizard at character building. Let's not keep them to ourselves
There's no reason to think that a kleptomaniac caught pillaging the dining room – if that's indeed what's happening – wouldn't also take advantage of other opportunities. What makes this even worse in this instance is that the light-fingered house guest is also the person who built the house, including all the furniture, cupboards and doors, and has the keys to everything.
One of the fundamental principles of baseline security on modern systems is that processes do not have default access to the workspace of others: it's a principle that has been a long time in the making, with advances in OS design, processor architecture and application engineering all working towards the ideal. If these reports are true, Microsoft would be throwing that away for commercial advantage.
What reaction is appropriate? Do application and system designers now assume Windows is a hostile environment, like the open internet, where data security has to be the responsibility of each product and service? There are limits to how much you can do on a per-app basis; data encryption at rest and in flight makes sense, but where do you draw the line if you have to use the OS to move data between CPU and local peripherals like screen and keyboard? That may seem extreme – it is extreme – but if the OS maker appears prepared to continuously abstract information from the user, there's not much to be done.
[12]
There are enough worries and hard risk calculations to make daily data security decisions without having to assume this extra piece of coprolitic corporate behavior is taking place.
It's not as if Microsoft is engineering Windows as a window into all our data; it's that the internal structure of the company is such that it can behave this badly and seemingly not notice. At the very least, such behavior could indicate a lack of governance and focus on core principles.
In the end, it's a very poor show if a key piece of software with a major role in maintaining online security starts behaving like the malware it's supposed to guard against. Sure, don't use Edge, but what does that actually guarantee? If you want your spoons to be safe, it's not enough to buy a new kitchen cabinet. ®
Get our [13]Tech Resources
[1] https://www.theregister.com/2024/01/30/microsoft_edge_tabs/
[2] https://www.theregister.com/1998/10/20/microsoft_on_trial/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZcC-2RFYancHB1hCMqr@ygAAAIM&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZcC-2RFYancHB1hCMqr@ygAAAIM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZcC-2RFYancHB1hCMqr@ygAAAIM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2023/04/17/microsoft_windows_start_ads/
[7] https://www.theregister.com/2023/06/02/microsoft_cortana_ads/
[8] https://www.theregister.com/2024/01/29/the_datacenter_runaway_power_grab/
[9] https://www.theregister.com/2024/01/22/opinion_column/
[10] https://www.theregister.com/2024/01/15/opinion_column_zxspectrum_128/
[11] https://www.theregister.com/2023/12/18/opinion_column_clis/
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZcC-2RFYancHB1hCMqr@ygAAAIM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[13] https://whitepapers.theregister.com/
Who wins?
a) you just slap Microsoft with multiple Billions of £$€ fines for a deliberate global mass breach of data protection
b) a fat brown envelope for regulator
Re: you just slap Microsoft with multiple Billions of £$€ fines
It looks like you're writing a lawsuit. Would you like help? I have all the information that is required...
If
> If users on multiple support threads are correct ...
A good question. But one the article fails to answer. And until someone who knows, does so this is just a long piece of suppository supposition
The great thing about FOSS is that it is at least possible for independent operators to answer such questions.
Keeps one on Edge.
:"...every time Microsoft's flagship Edge browser starts up, it helps itself to open Chrome tab data..."
I knew there was a reason I only opened Edge in the Sandbox (There are some sites that don't like Brave).
Big Problems?
Given that you've got a OS full of Apps that can do all sorts of queries of the data stored/used by the user, (see the MS 365 portal!) would think that a bit of tab sharing is the least of the problems - if you want properly isolation use a sandbox, separate machine etc.
does this only occur within the same account?
Within the same account/directory this probably OK. If this is global/multiple accounts then it is wrong.
I prefere firefox.
At what point does the license agreement for the suspected update (perpetrator of this behaviour) state that this is a valid thing to do - not only where in the agreement but at what point in time is it presented to the user? Would that be a "fair" or legitimate clause in law? After all, if I wrote a clause for a package that, half way through the "essential security update" said in paragraph 7.6 of a linked license agreement "I will take any data I want from any apps on your machine and save it to my remote server" I believe (and hope) it would be thrown out of court as "unfair terms and conditions" at the very least, a potential violation of the Computer Misuse Act, or GDPR at worst (as I wasn't clearly consenting to that behaviour).
Be an interesting one ... do I feel a visit to an Irish Court coming on?
Remind me again
why any OS anywhere needs access to user data, be it browser history or documents or anything?
Re: Remind me again
Well, the OS is responsible for managing that data. It opens and closes file handles if nothing else.
Now, if what you mean is "Why is it parsing that data?" there might be legit reasons for that. Search indexes for one. The problem here is that we just don't trust Microsoft to take proper care of the data that it has visibility of. The OS is a bit like a sysadmin. You would not believe the power a sysadmin has in most places if you've never been one. Your OS can go poking through your data, it can arbitrarily move things. It can erase the logs that it ever did anything wrong.
It's a huge amount of power and requires a great deal of trust. Once that trust is broken, you have to fire your sysadmin.
...or get a new OS.
"Hostile Environment"
Do application and system designers now assume Windows is a hostile environment, like the open internet, where data security has to be the responsibility of each product and service?
Yes. Yes they do. And they have for a while.
Not just a Microsoft problem
If the industry is going to address this issue then (we) need to go beyond just yelling about Microsoft and actually call it out wherever it occurs.
For example: Edge on Android attempts to contact over 15 different websites and IP addresses upon activation and each use. Yet Brave, a browser that claims "privacy!", contacts Wikimedia, Yahoo, Amazon AND Facebook's Instagram on EVERY restart, leaking at *minimum* your IP address and therefore your rough geolocation to these people without your consent.
So stop yelling "wolf!" just at MS and really target the topic industry-wide as it should be.
You don't have to do anything to Windows or Microsoft Apps, you just slap Microsoft with multiple Billions of £$€ fines for a deliberate global mass breach of data protection, decimate their profits and share value for a year for the shareholders and you can guarantee they will be coding their little backsides off to remove offending code across all their apps, even if some of the apps have yet to show dodgy doings and the upside is also the other Mega Corps start panicking and start cleaning up their houses ! Time to stop treading softly for these serial offenders, as they don't learn, it's just business to them !!!