Comment by kstrauser | Hacker News Reader

Comment by kstrauser | Hacker News Reader

I submitted a story to Boing Boing (at http://boingboing.net/2015/08/10/windows-10.html) about the weird experience I had after upgrading my son's laptop from Windows 8.1 to 10. We did this on a Saturday, and Monday morning I had a "family safety report" email from Microsoft detailing which websites he'd visited, which apps he'd used (and for how long), etc. since the upgrade.

According to Microsoft's Family Safety FAQ (https://account.microsoft.com/family/faq/):

> On Windows 10, you’ll need a Microsoft account in order to use Microsoft family whether you’re a part of a family as an adult or a child. When kids are added to a Microsoft family with a Microsoft account, any time they sign in to a Windows 10 device, their settings will be applied and their activity will be reported to the adults in their family. Adults can always turn off activity reporting or remove kids from the Microsoft family at account.microsoft.com/family.

By default, unless you log in and explicitly disable it, Windows 10 collects kids' usage activity and uploads it to Microsoft's servers. Presumably the same mechanism is disabled for adults. Presumably.

I definitely didn't enable it, and I'm sure my son didn't check any "narc me out to my parents" checkbox.

Edit: we already had a family account set up for our Xbox. I suspect that's how Microsoft determined that the emails should go to me.

Abusive parents are going to love this.

(And that's terrifying.)

I know, right? A kid thinks they're safely researching things that are important to them, but that's not at all true.

Statistically, it's almost certain that a kid somewhere has been beaten because of what their parents read in that report. When we're developing new features, we have to take into account ways they'll be twisted and abused. If anyone evaluated this before its development, and they were intellectually honest with themselves, these consequences had to have been dismissed as collateral damage. That makes me sad.

And beaten isn't even the worst of it. Kids are sometimes made homeless, or in some (rarer, more often non-Western) cases, murdered.

Better hope the kid isn't GLBT in a right winger christian family.

That would not go over well.

"Microsoft outed me, and now I'm homeless", says 17 year old.

Also parents who's kids accidentally stumble upon a site for predators. It's a tool that can be used for good or bad, but will depend on the parents.

That's true, but I can't justify this being enabled by default. As something parents can turn on if they feel they need to, sure, but not like this.

Heck, mistype a website name and accidentally get a porn site (ala the old whitehouse.com) and get in trouble.

> accidentally stumble upon a site for predators.

So public Minecraft servers, public minecraft forums, and /r/minecraft?

Surely you don't think that kids and pedophiles are meeting on forums specifically designed for it, right? I imagine that kids are preyed on by pedophiles who join spaces that are interesting for kids. How do you prevent that, or even know when it's going on?

The tools they're giving to parents are no more powerful than a browser history.

> It's a tool that can be used for good or bad, but will depend on the parents.

The potential for bad outcomes has been highlighted by other readers. What good can this feasibly do? And is that good worth the potential for abuse and the obvious security concerns that it places in Windows for users who aren't kids? I think not.

Also think what impact it's gonna have on organization. Would they have access to everything an employee types? Any website they visit?

In reality, if you're using a machine that's owned by your employer, you should always assume that everything you do is being monitored at all times, regardless of what operating system said machine is running, because chances are in favor of that being the case. Expect at the absolute least some sort of web traffic monitoring (probably via a corporate proxy); in some cases, I've seen companies install keyloggers (and, in fact, this is the "legitimate" use case for keyloggers, remote administration tools, etc.).

You should also expect that any mobile device accessing company resources (including - and especially - email) is effectively giving your employer root access. This is almost certainly the case if you use a mobile device with Microsoft Exchange.

In other words, in the context of employee workstations, Microsoft's spying is effectively a non-factor for employee privacy.

Now of course, this is all describing intra-organizational surveillance. Microsoft's data collection is inter-organizational, which has rather significant implications for healthcare organizations (since now Microsoft is the single-point-of-failure for a HIPAA breach), financial institutions, law firms, the works. That's all a bit of a digression from the point of children being automatically spied on, however.

> In reality, if you're using a machine that's owned by your employer, you should always assume that everything you do is being monitored at all times, regardless of what operating system said machine is running, because chances are in favor of that being the case. Expect at the absolute least some sort of web traffic monitoring (probably via a corporate proxy); in some cases, I've seen companies install keyloggers (and, in fact, this is the "legitimate" use case for keyloggers, remote administration tools, etc.).

It is one thing for a company to do so. I really really doubt that companies are OK with microsoft having a copy of all activity from all their employee's workstations.

Right. But from the context of the employee, it's a distinction without a difference. By using a company computer, the chances of your activities being keylogged and tracked with absurd amounts of granularity go up significantly. If you're not the owner of the hardware (and, hell, sometimes even when you are), all bets are off.

Of course from a company's perspective will the distinction actually be meaningful, but that didn't seem to be what the parent comment was going for.

Installing keyloggers is not legal in all the countries. If you look at the advanced economies, I'd dare to say in very few of them.

Even where illegal, few employers realize this. "It's our hardware, we bought it, so we have the right to monitor it in infinitely-fine-grained detail" often kicks in well before any ethical or even legal implications do.

I wonder how long until Microsoft has that Target moment[1] and tells a father that his daughter is pregnant. I also wonder what happens if someones medical information leaks via this data gathering.

1) http://www.nytimes.com/2012/02/19/magazine/shopping-habits.h...

Thanks for sharing this, that was a great article. Once again, RMS is completely right on a topic: store rewards cards are invasive and allow for significant tracking and you should stop using them if that bothers you.

For parents of kids who are getting themselves into troubling things (physical, mental, social: thinspiration, suicidal temptation, and dangerous "religious" indoctrination, to pick one example from each of those categories) are going to like it too - so while I see your concern I can definitely see why this was considered a good enough idea to implement.

Of course we are still in a position where most kids know more about what goes on inside the computer than their parents[] so many will find ways around this if they need to...

[] though I feel this is changing, at least here, as the 90s (and to an extent 80s) generation have growing families: they grew up with tech around them so were far more attuned to it than their parents, and to many kids these days tech is just commodity items so they can use them well but don't bother to understand them.

Wow that's insane! And I'm glad you're an awesome parent. You should post a anonymised screenshot of that email sometime if you can, this is pretty ridiculous.

Ask and ye shall receive: http://imgur.com/eeBtcIw

Bear in mind that it's nearly empty because we'd only just recently upgraded to Windows 10, but note that it has an entry for "Latest searches". Wouldn't that be one hell of a way for a kid to come out of the closet to his parents, or for someone to find out their daughter's pregnant?

Consider that this data is linked to each kid's email address. When this database is hacked, won't that be an interesting week in all the local schools as everyone learns what their peers are really doing?

No.

The schools provide laptops to the kids. And then make them "kid accounts". Then the school process all of those reports and punishes based on them... or sells them to advertising firms.

You know, a couple of years ago I would have written that off as paranoid ranting.

No, I think it still is paranoid. It's just now provably true as well.

I'm not entirely sure how much I believe the "MS sniffs your keyboard every half hour". However, with that kid-sniffer (search this page for imgur); that's built in. That terrifies me.

And I'm thinking of LGBT, other religions, TOR, abortions and women's health, medical searches, domestic abuse searches, and more. And the allegations that the torrent sites are levying are also insane too.

I'm glad I've been working on Ubuntu and FreeBSD for the last 12 years. Unfortunately, I'm getting a nice writeup to the 2 directors I've passed an Intel Compute Stick to with Win10, alerting them of the situation.

What's really surprised me here is that I haven't seen Microsoft comment on any of the privacy concerns here at all.

They haven't even said they're going to fix the stuff you can't disable ( see http://arstechnica.com/information-technology/2015/08/even-w... ).

I'm worried that they're just going to ignore problems like this and in a few years, there will be no choice but to run this if you want to be able to run the latest versions of other software.

Only played New Vegas for 8 minutes? Please. This is obviously a fake.

:)

Well, that one night. He's logged another 19 hours so far today.

Ah. Well that's more like it, then :)

By default, unless you log in and explicitly disable it, Windows 10 collects kids' usage activity and uploads it to Microsoft's servers. Presumably the same mechanism is disabled for adults. Presumably.

And this is legal under COPPA? If so, the law needs to be fixed sooner rather than later.

Reply on news.ycombinator.com