(This usually evokes disbelief. If you think I'm wrong, please consider what you would do if it turned out I was right. Then, if you're on Windows 10, lookup your "speech, inking & typing" settings. This is where they ask permission to do this. It is turned on by default.)
"We also collect your typed and handwritten words to improve character recognition and provide you with a personalized user dictionary and text completion suggestions."
http://windows.microsoft.com/en-us/windows-10/speech-inking-...
It's a pity because the kernel and surrounding subsystems are getting better with each Windows release.
Maybe something like nLite can be used to create a Windows image that doesn't contain the nasty stuff, but then an update would reinstall them
The icing on the cake is that even when using Windows Enterprise edition in a Windows Domain, you cannot control what updates are installed as you could before. This is a huge problem because stuff you don't want will be slipped back in.
They just lost their mind.
Those 8 words change are what we're talking about. A keyboard app obviously needs to use your data to improve auto-correct.
When it starts sending that data off-device, however, that's a whole different ballgame.
No, that's not obvious, in fact that would be the opposite of what a keyboard's auto-correct should do. Because the whole point of having auto-correct is for the keyboard to correct my mistakes, not learn from them or from the mistakes of other people that also don't know how to spell.
For this reason for example Swype on iOS has been basically unusable for me, because it makes more mistakes than I do. And no matter the implementation, now every time I choose to override the auto-correct decision for a certain word, I always end up pausing because I fear that from then on, the word will be added so some personal dictionary that I don't want. Basically learning from what the individual types is a disservice to the individual.
Also, on iOS custom keywords need explicit permission for accessing the Internet. And on Android I found no mention anywhere that Google's Keyboard sends telemetry to its parent. People just assume that for some reason.
Or to make the general dictionary pick up on new terms automatically and give them to other windows users.
Edit: The full quote is actually:
> We also collect your typed and handwritten words to improve character recognition and provide you with a personalized user dictionary and text completion suggestions. Some of this data is stored on your device and some is sent to Microsoft to help improve these services. You can turn the Send Microsoft info about how I write setting on or off in Settings.
Which means they don't send EVERYTHING so it's not really a keylogger (unless you also count the keyboard-helping stuff keyloggers?).
Furthermore on that link, it seems to me that the data they would be sending to their servers is the ones about the other services like speech/handwriting to feed into their system to machine-learn recognition.
And it is all turn-off'able which is a plus.
It seems like most people will assume the worst, I am not saying you're wrong but it doesn't seem like some "malware" thing like other people are saying..
> Which means they don't send EVERYTHING
In any mathematical or logical context, "some" can be a proper subset of "all" or equal to "all". Any lawyer or judge thinking logically would agree. If the matter had to be confronted in court, Microsoft's legalese covers the case where they capture and store everything.
Another way they can hedge is by not capturing something innocuous and uninteresting, like words you type into Microsoft Help or Group Policy Editor. Now they can say that they don't capture and store every single thing.
(Also, my "malware" comment was about the forced upgrade to WinX, not about WinX itself, as I have even noted in the last sentence.)
It sure seems like they can have an easy access to the source code..
Unbelievable
I've yet to see any actual technical evidence of this. Quoting their very unspecific legal documents is hardly evidence of anything.
The traffic is encrypted, and no one has been able to MITM it yet, as far as I know. But Microsoft has confirmed in the press that yes, they do this.
And until someone bothers to do a MITM we really don't know what that means.
>The traffic is encrypted, and no one has been able to MITM it yet, as far as I know. But Microsoft has confirmed in the press that yes, they do this.
Are you sure? Unless they're specifically trying to prevent such you should be able to just drop in your own root certificate and MITM it with the tool of your choice.
In the end, it's customers who have bought their computers and should retain ultimate agency over their hardware and what Microsoft is doing isn't necessarily in their customers' best interest because it puts undue, poorly communicated risks on them. Most users aren't equipped with necessary background knowledge to evaluate these risks so aren't even capable of consciously accepting them.
edit: oh it's you ryan. I'm sure you already know all this. :)