Neowin.net

I totally agree with you Chris, unfortunately not everyone sees it that way. On top of that, if you have a legit copy of Windows, I don't see how this could really effect you? If it isn't sending personal information and you have a legit copy of Windows, then what's wrong?

If you have a legit copy why does it need to phone home everyday?

Does no one know anything about the reason? It phones home to check whether or not it should turn itself off. If MS releases an update that conflicts with WGA, they can use thisphone home to disable WGA, thus allowing legit users to continue to use their system without issue.

BangBang boy here just hinted at why the lawsuit is viable, but perhaps missed it.

Microsoft doesn't have the right to come into your PC and turn anything on or off without your explicit permision.
They didn't ask you if you wanted WGA or not, they forced it on you and now they want to use it to change some bits on your machine without anyone asking you if you want that or not. That's grounds for a lawsuit.

It transmits your CD Key and IP address to Microsoft, effectively telling them who you are. It deletes all System Restore points prior to its install so that the system cannot be rolled back in the event the system doesn't pass validation.

Some seem to want to sit here and clap like a trained seal for this thing, and they can go ahead, since they don't see to understand fully what it does. But don't knock others for being wary over something like this considering the track record Microsoft has for screwing things up.

It does not trasmit your CD key during the daily phone homes that people are complaining about. As for the IP address, of course. Your IP is sent to any server you ever connect to on the internet. This would be no different.

Trained seals? More like someone with common sense who tends to be a little less paranoid.

Last edited by bangbang023 on 30 Jun 2006 - 02:07

That can be argued but is besides the point. This update was applied after you explicitally allowed it to do so. It's not a mandatory update, it's a optional one. They also changed it from daily checks of a config file to every X days. Also, it doesn't disable Windows.. it disables the WGA software incase there is a conflict or it acts up.

There's a key in the registry that contains a hash of your cd key. That hash IS sent and checked against a database. That little item IS your cd key. Saying that your key is not sent is not valid. If it weren't then Microsoft wouldn't know if any particular copy of XP was genuine or not.

So, with the cd key hash and an IP being sent to the servers, personal identifiable information is sent. There are no two ways around it.

Jesus Christ people don't listen or comprehend. The key is NOT SENT during the daily phone home process. Of course it's sent when you validate your install before updating your system, but the phone home process does not include the sending of any information.

Yes, however the extent of what the tool did was not told to people before they installed it. Therefore, there is little difference between it and any other piece of spyware. The basis of the lawsuit is that Microsoft did not fully disclose before hand what the tool did, or was capable of doing.

Except they are suing over the phone home feature which neither validated your install nor sent any information.

I had no idea that useing windows was a basic human right.
Who do you thing put them in their monopoly position? We did. Everyone who bought or pirated windows helped MS become what it is today.

I don't see how this would be any abuse of any monopoly..

Thats because it isnt. This has absolutly NOTHING to do with a 10 year old monopoly ruling. WGA doesnt give MS an unfair advantage and it doesnt have a single effect on their opposition or their market position. Infact any anti piracy measures are more likely to cost them market share if they were actually attempting to block pirates out, of which they havent.

And even if they are a so called monopoly, that doesnt mean you have to use it. Theres apple and linux too, both are extremly viable options. The whole monopoly thing is old, the options now are alot better and it was a decision made by another human like a decade ago which is a long time in the computer world. The computer scene has changed immensley in the years since that decision.

Uh, no. Spyware, like I said, requires some kind of information other than the obvious IP address to be sent.

from j.cxp.net

And that has nothing to do with the former daily phone homes which is what people are complaining about.

Maybe a kilobyte a computer for a split second.. Not that big of a deal.

I doubt it would make a difference at all even with 1000+ machines unless they all decide to shoot of the data at once and your using dial up. I mean, the machines probably wont all do it at once and like the guy previous saiid its maybe like a kb or something stupidly small. If theres network issues I seriously doubt WGA's goint to play any part and checking your email or viewing a website would do alot more to your network i reckon.

Exactly.

That has to be the most idiotic statement I've ever heard. So, in your mind, if someone does not want to install this piece of software, they then lose the right to any further updates for their system?

man, bill gates could give everyone a hundred bucks and still be the richest man.
on this subject, i dont know what to think. while its not doing any harm, it is sort of like spareware. yes you agreed to it by accepting the update it came in. but if you didnt know it was in the update, it would then be just like how most spywares get onto a system, by coming with something else.

It installed on to people's machines who had Automatic Updates enabled (the MS recommended setting, mind you). That is supposed to be for critical security updates, leaving the optional components for manual Windows/Microsoft Updates.

So, yes, this installed on a lot of people's machines without their consent, with no value to them whatsoever, was only for the benefit of the software company at the other end, had nothing to do with the system or OS security at all, wasn't able to be uninstalled, and phones home regularly.

That sounds a HELL of a lot like a form of spyware to me.

Um, I don't need this or want this on MY machine. It isn't there for MY convenience at all. I get NOTHING out of this.

And I shouldn't HAVE to worry about how to turn it off on MY machine. Period.

I have a legit version of XP.. but I personally hate the entire notion of Windows Genuine Advantage - not just the fact that it calls home.

Medion, you're wrong. Here's why.

You've installed WGA, you are a legitimate user, you are playing by the rules.

In the Fall, Microsoft releases the "kill switch" version that shuts down your Operating System if WGA fails - which includes calling Microsoft to verify key, etc.

You feel you are okay. You are a legitimate user, you are playing by the rules.

But as soon as Microsoft implements this, what do you think ten thousand hackers worldwide are going to IMMEDIATELY start doing? (My guess is they've already started)

Cracking WGA.

To break it? No. That's child's play. Only takes them hours to do that now.

No, they're going to drink coffee and red bull until one of them is the first to crack the "kill switch" mechanism. Because once they do that, they can shut down ALL Microsoft machines all over the world...at will. Why? Because they think it will be fun and make them cool in the eyes of ten thousand "lesser" losers.

And guess what? Everyone who DIDN'T install WGA (you know, those pirates, privacy advocates, and the paranoid mentioned above) will still be using their computers. While everyone who owns legitimate copies and played by the rules will be screaming bloody murder because they trusted Microsoft (of all companies) to do no evil.

A single point of failure across 90% of a target population is a dream come true for a virus as well as a hacker.

I love, own, and use Microsoft products 20 hours a day. But I don't trust Microsoft not to be human. They make mistakes and/or there is always someone smarter than themselves out there.

"A single point of failure across 90% of a target population is a dream come true for a virus as well as a hacker."

lol which vx'r told you *that*!!!!!!!!!!!!!!!!!!!!!!

The concept of cracking it to control the kill switch is interesting, but the motivation to use it just isn't there.

"The concept of cracking it to control the kill switch is interesting, but the motivation to use it just isn't there."

Ummm, it that denial, or delusion?

How can they shut down every MS PC by cracking WGA? They will need to hack their servers too since thats the point where the clients make a connection to verify it. Its the computers that contact microsoft, not MS contacting computers so the hackers would need to intercept those communications. And if that was so easy then they could have simply done the same sort of thing all along by feeding malicious files onto MS servers for years or bjorked windows update or whatever.

And if they can make an execuable or something to do it locally instead of on a server then really it may as well just be putting a typical pc killong virus on the pc for all the end result matters. Besides the kill switch wont just kill the PC and prevent it being used, they will have some form of "reattempt" for the case that something in the communications did go wrong so if the PC was "killed" youd still be able to just reauthenticate it.

how about these (hypothetical) scenarios...

Unforseen major power outtage in the area where the authentication servers are. (hmmm, the whole northeast went dark once, didnt it?)

Major ISP pulls an Enron.
(Think WorldCom, Enron, etc.)

Moron at major ISP/DOD/company X cuts a major fiber optic feeder.
(has happened MANY times now, even the undersea line to Australia...wanna see an entire continent go Internet dark?)

MS (or a third party) releases a patch to something/anything that kills network connectivity for some users, thus making it impossible for WGA to phone home once failed.
(MS just pulled and then had to fix and reissue a patch that did just just that for dial-up users with the latest patch Tuesday)
(similarly, my DRM'd music files purchased from MusicMatch can't be played anymore because MS released a patch that killed the old MM DRM, and it seems MM is dead because they haven't updated their program in years, so...I have useless DRM'd data that I PAID FOR)

CISCO router firmware compromise due to source code theft, Denial of Service of key DNS name server or support structure, etc.
(all of these events have already happened, but the difference is, your computer still worked even though the Internet was down/slow/broken for a while)

Terrorist attack on said data center. A few tons of fertilizer driven by one nutter and they can take out 90% of the world's computers (business, government, personal) worldwide indefinitely.
(boy, they'd NEVER think of this one, ahem)

Any of these (unlikely?) scenarios would cause a single point of failure for a "kill switch".

And all of them would ONLY affect legitimate users...ahem.

It's effectively a backdoor scenario waiting to happen...and you all know it.

And, importantly, this increased risk is because of something that has NO VALUE to a single user of Windows XP (and Vista next) anywhere in the world. It only has a very minor value to Microsoft - who would see piracy dwindle substantially (and keep profits level with increased volume) if they just lowered their 1980's level monopoloy pricing (just like they did with the special $60 offers to Asian markets)...sigh.

So, I guess I will be removing/preventing WGA from my legitimately licensed Windows XP machines so they can have the same security (and I can have the same peace of mind) as all the people who stole the software, ahem.

And for those of you who mention the slippery slope, may I remind ALL of you that years ago, people said MS would go this way when WPA, etc. started being introduced. I was one of the people who thought MS would never go this far, that people were being paranoid. That is was (clearly) bad for business to inconvenience their own paying customers and put them at risk. Well, the earliest naysayers were right. I was wrong. MS is only going to keep taking us down the forced DRM path...for EVERYTHING, EVERYONE, EVERYWHERE.

I no longer trust that they won't misuse their monopoly, so...you win, Microsoft! It's time you should be granted Monopoly status by the government, then you can be regulated like the public utlity you have become. Congratulations.

Devils Own version of XP was leaked from within Microsoft. They let it go on for years and then start this. I do OWN a legal copy of XP. 4 of them in fact and I have a problem with this.

Apart from the (daily) increasing number of legit users who are being told that their copies aren't. A single false positive makes the tool useless. Any software that need to check whether it should be shut down by contacting a remote server simply because they couldn't code it right is software that has no place on my systems. And as excalpious said above, it becomes a new attack vector for hackers to screw your installation over.

speaking of retards

I understand...WGA checking once....but why the need to check every 14 days from the same computer.....does MS think..that once run..the user is gonna install a 'pirated' copy....and then again...you will either have to install the WGA over again..or avoid it...or maybe MS thinks the user is gonna 'change' keys on a daily bases...just to have something to do....get real retard.

Reading comprehension, where hast thou gone?

It doesn't verify your installation every 14 days. It connects to the MS servers every 14 days and checks to see whether it needs to turn itself off or not, in case of a update that conflicts with it in the future.

It doesn't verify your installation every 14 days. It connects to the MS servers every 14 days and checks to see whether it needs to turn itself off or not, in case of a update that conflicts with it in the future.

And you believe this...want to buy a bridge off the coast of Florida?...it should check once..and shut down and delete itself..if they wanted to turn it back on..they can offer it again on the WU...if your assumption is right..which I highly doubt, this WGA will be exploited by a hacker soon and this so-called 'check in with the MS server' every 14 days will be too late for many.

Lol, I'm not going to argue with your insane logic. I'm the one presenting facts and you're presenting your own conspiracy theories. I've long learned there's no use in fighting someone who doesn't rely on any logic.

Um, that rootkit was a huge EVIL. I totally support its banishment.

So, I'm 100% behind this lawyer. Bravo.

After all, these guys seem to be the only shepards willing to fight for the rights of you, their silent sheep.

I've mentioned this in the forums a few times already: At my office our VLK was flagged as pirated and now all our desktops are going to fail. I did mine just to see if it would and then promptly notified everyone to ignore the update.

this is what amazes me...if these VLK's are legit..and failing...then how stupid can MS be with this WGA...sure they have money to waste but some Corporation or Person with the funds and gets shutdown due to MS ****up will dig deeply into their pockets...really all MS has to do..is prove what information its seeking...not just lip service...but let some 'Watch Group' view the data...and even monitor it...MS won't because its just not the 'key' they seek..

'IF' that is true then the chances are your VLK key has been leaked, this has happened before with VLK keys and if you think about it you can't blame MS for this because this is another area MS are cracking down on, there were a number of news posts a couple of weeks ago about VLK changing with Vista because of companys taking the pee so to speak. Anyway, if a VLK key has leaked how is MS suppose to know who should and shouldn't be using it? Also i was under the impression that if you thought your key had been leaked you were suppose to contact MS about it and they would flag that key and issue you with another, theres something on the MS site about it.

Last edited by SIE on 30 Jun 2006 - 18:47