| Wednesday,
April 23, 2003 The
following on Windows Media Player privacy is long. To skip it, click
here.
I don't know how much to be concerned about:
To: BugTraq
Subject: Why is Microsoft watching us watch DVD movies?
Date: Feb 20 2002 4:46PM
Author: Richard M. Smith <rms@computerbytesman.com>
Serious privacy problems in Windows Media Player for
Windows XP
by Richard M. Smith http://www.ComputerBytesMan.com
February 20, 2002
Introduction ============
I found a number of serious privacy problems with
Microsoft's Windows Media Player (WMP) for Windows XP. A number of design
choices were made in WMP which allow Microsoft to individually track what
DVD movies consumers are watching on their Windows PC. These problems
which introduced in version 8 of WMP which ships preinstalled on all
Windows XP systems. In particular, the privacy problems with WMP version 8
are:
- Each time a new DVD movie is played on a computer,
the WMP software contacts a Microsoft Web server to get title and chapter
information for the DVD. When this contact is made, the Microsoft Web
server is giving an electronic fingerprint which identifies the DVD movie
being watched and a cookie which uniquely identifies a particular WMP
player. With this two pieces of information Microsoft can track what DVD
movies are being watched on a particular computer.
- The WMP software also builds a small database on
the computer hard drive of all DVD movies that have been watched on the
computer.
- As of Feb. 14, 2002, the Microsoft privacy policy
for WMP version 8 does not disclose that the fact that WMP "phones
home" to get DVD title information, what kind of tracking Microsoft
does of which movies consumers are watching, and how cookies are used by
the WMP software and the Microsoft servers.
- There does not appear to be any option in WMP to
stop it from phoning home when a DVD movie is viewed. In addition, there
does not appear any easy method of clearing out the DVD movie database on
the local hard drive.
Technical Details =================
When a DVD movie is played by the WMP, one of the
first thing that WMP does is to query via the Internet a Microsoft server
for information about the DVD. The query is made using the standard HTTP
protocol that is also used by Web browsers like Internet Explorer or
Netscape Navigator.
Using a packet sniffer I was able to observe WMP
making these queries to a Microsoft server each time a new DVD movie was
played. The packet sniffer also showed the movie information which was
returned to WMP by the Microsoft servers. The first HTTP GET request sent
by WMP identified the movie being played. For example, an HTTP GET request
is made for this URL for the "Dr. Strangelove" DVD:
http://windowsmedia.com/redir/QueryTOC.asp?WMP
Friendly=true&locale=409&version=8.0.0.4477&cd=
1E+96+1B1E+30D9+42D8+5D61+783E+9083+C49C
+F0C8+1151E+13CF9+15812+16C5D+1A04F+1BF2D
+1ECB7+212E1+22E48+25724+27E9D+2A91A+2D0E6
+2F451+38367+3CF64+4A4D6+4C001+4D517+4E51B
+4FDBC+51F74
The hex numbers at the end of the URL are an
electronic fingerprint for the DVD table of contents which uniquely
identify the "Dr. Strangelove" DVD.
This URL is sent to WindowsMedia.com, Microsoft's
Web site dedicated to the WMP software.
The HTTP GET request also included a ID number in
cookie which uniquely identifies my WMP player. Here's what this cookie
looks like:
MC1=V=2&GUID=CA695830BB504D399B9958473C0FF086
By default, this cookie is anonymous. That is, no
personal information is associated with the cookie value. However, if a
person signs up for the Windows Media newsletter, their email address will
be associated with their WindowsMedia.com cookie. For example, when I
signed for the Windows Media newsletter, the following URL was sent to
Microsoft servers:
http://windowsmedia.com/mg/Newsletter.asp?
eNws=rms@computerbytesman.com&format=HTM
The same windowsmedia.com cookie value will be sent
back to Microsoft servers when signing up for the newsletter and when a
DVD moive is played. In addition, using various well-known "cookie
synch" tricks, an email address can be associated with a cookie value
at any time.
Also when subscribing to the Windows Media
newsletter, I was encouraged by an email message from the Microsoft
newsletter department to create a Passport account based on my email
address. In theory, yet more personal information from Passport could be
matched with what DVD movies I have watched. There is no evidence however
that Microsoft is making this connection.
The WindowsMedia.com cookie was assigned to my
computer the first time I ran WMP. The lifetime of the cookie was set to
about 18 months. This cookie gives Microsoft the ability to track the DVD
movies that I watch on my computer.
After a series of redirects from the
WindowsMedia.Com server, information about the "Dr. Strangelove"
movie was returned in this XML file:
http://services.windowsmedia.com/amgvideo_a/template/
QueryDVDTOC_v3.xml?TOC=90a1b0d1571524ea
WMP extracted movie information from this file and
then added this information to a database file, named
wmplibrary_v_0_12.db, which is located on my hard disk in the directory
" C:\Documents and Settings\All Users\Application
Data\Microsoft\Media Index". I didn't see any method of removing
movie information from this file, so it appears to me that the file keeps
a complete record of all movies watched that have ever been watched on my
computer.
Because as of Feb. 14, 2002 the Windows Media
privacy policy is silent about what is done with DVD information sent to
Microsoft servers by the WMP software, we can only speculate what
Microsoft is doing with the information. Here are some possibilities:
- Microsoft can be used DVD title information for
direct marketing purposes. For example, the WMP start-up screen or email
offers can be customized to offer new movies to a WMP user based on
previous movies they have watched.
- Microsoft can be keeping aggregrate statistics
about what DVD movies are the most popular. This information can be
published as weekly or monthly "top ten" lists.
- Microsoft might be doing nothing with the DVD
information. (In my discussions with Microsoft, I was told this option is
their current practice.)
Note: The Video Privacy Protection Act of the United
States prevents video rental stores from using movie titles for direct
marketing purposes. The letter of this law does not a pply to Microsoft
because they are not a video rental store. However, clearly the spirit of
the law is that companies should not be using movie title information for
marketing purposes.
Recommendations ===============
I believe that the Microsoft should remove the DVD
movie information feature from WMP version 8 altogether. The value of
feature seems very small given that almost all DVD movies include a
built-in chapter guide. In addition, the Microsoft movie information
feature is not available when DVD movies are shown in full-screen which is
how DVD are typically watched.
If Microsoft feels that this feature is important to
leave in WMP, then I think it should be turned off by default. The feature
can be made privacy-friendly very easily, by having WMP never send in
cookie information with movie title requests. This change will prevent
Microsoft from tracking individual movie viewing choices.
Vendor Response ===============
Response from the Windows Digital Media Division of
Microsoft Corporation is available here:
http://www.computerbytesman.com/privacy/wmp8response.htm
Acknowledgements ================
Thanks to Ian Hopper of the Associated Press for
bringing this issue to the attention of the author.
Links =====
Digital Media in Windows XP http://www.microsoft.com/windows/windowsmedia/windowsxp.asp
Media Player for Windows XP Privacy Statement http://www.microsoft.com/windows/windowsmedia/software/v8/privacy.asp
The RealJukeBox monitoring system http://www.computerbytesman.com/privacy/realjb.htm
TiVo's Data Collection and Privacy Practices http://www.privacyfoundation.org/privacywatch/report.asp?id=62&action=0
Internet Explorer SuperCookies bypass P3P and cookie
controls http://www.computerbytesman.com/privacy/supercookie.htm
Video Privacy Protection Act http://www.accessreports.com/statutes/VIDEO1.htm
Bill Gate's memo on Trustworthy computing memo http://www.computerbytesman.com/security/billsmemo.htm
And I don't intend to panic. Actually, I use
PowerDVD to watch DVD movies on my computer, and I do not believe there is
such a thing as an undeletable data base. I am sure many readers know far
more than I do about these things.
====
On another subject
entirely:
This came into my mail a little bit ago:
I find this quote from John Adams absolutely
remarkable. He wrote it to a friend when he was only 19 years old.
"All that part of Creation that lies within our
observation is liable to change," Adams began.
Even mighty states and kingdoms are not exempted. If
we look into history, we shall find some nations rising from contemptible
beginnings and spreading their influence, until the whole globe is
subjected to their ways. When they have reached the summit of grandeur,
some minute and unsuspected cause commonly affects their ruin, and the
empire of the world is transferred to some other place. Immortal Rome was
at first but an insignificant village, inhabited only by a few abandoned
ruffians, but by degrees it rose to a stupendous height, and excelled in
arts and arms all the nations that preceded it. But the demolition of
Carthage (what one should think should have established it in supreme
dominion) by removing all danger, suffered it to sink into debauchery, and
made it at length an easy prey to Barbarians.
England immediately upon this began to increase (the
particular and minute cause of which I am not historian enough to trace)
in power and magnificence, and is now the greatest nation upon the globe.
Soon after the Reformation a few people came over
into the new world for conscience sake. Perhaps this (apparently) trivial
incident may transfer the great seat of empire into America. It looks
likely to me. For if we can remove the turbulent Gallics, our people
according to exactest computations, will in another century, become more
numerous than England itself. Should this be the case, since we have (I
may say) all the naval stores of the nation in our hands, it will be easy
to obtain the mastery of the seas, and then the united force of all
Europe, will not be able to subdue us. The only way to keep us from
setting up for ourselves is to disunite us. Divide et impera. Keep us in
distinct colonies, and then, some great men in each colony, desiring the
monarchy of the whole, they will destroy each others' influence and keep
the country in equilibrio. “
Tracy Walters
Adams has always been my favorite intellectual
among the Framers. He should have been the first Attorney General rather
than VP.
Cochran on Race and
Culture
I'm busy making up notes for a talk
on this topic, to be given to a conference on genetics and
anthropology this Friday. So I'm busy thinking about it. One of the
interesting implications is that we might be able to test for certain
genes that have strong effect on behavior and sort; even if a random draft
of Sicilians tends to produce an unmilitary army, a suitably sorted subset
might do fine.
In the same vein, even though a free society might
be unsustainable if everyone voted in country X, it might work if we let
the proper, genetically screened 60% vote. Strikes me that there in
something in this idea to offend just about everyone.
On an entirely different note, it appears there are fundamentally
different patterns of adaptation to high altitude in Andean Indians and in
Tibetans. The Tibetan strategy works better, produces fatter and healthier
babies - probably because the Tibetans have been there a lot longer.
Thinking about this, I realized that there is a way to make life better in
Bolivia over the long haul.
Tibetan studs.
Gregory Cochran
We do know of genetic adaptation, some fairly
complex, among species of animals. Siberian Huskies are not like Freedom
Poodles or Springer Spaniels in temperament or adaptability to living with
people, although all those can interbreed.
We don't think in such terms about the breeds of
mankind. As you say, there may be something in there to offend everyone.
Wasn't polyandry common in Tibet before the
Chinese Han invasion?
Joanne Dow on Fred and
Education
One might argue that British schools produce a worse
product than do the American schools. Or it may be a tossup. I do note
that the British and indeed European schools are more along the lines of
what I understood of Fred's comments. "Teach them what they will use
in their lives."
The tough questions are, "How do we know if a
young kid is going to go on to advanced education or turn into a
waitress?" and "How do we know this kid is going to go on for
advanced studies in physics rather than the arts?" The European
approach is "test 'em early and often" then tailor their
education to what might be the results of a bad day or of cheating. For
most this might be a good thing. For some I am reminded of one test I
foolishly tried to take in college when I had a 103 degree fever. I was
close to delirious during the exam and did remarkably and predictably
badly on it. I was fortunate in that the professor agreed to ignore that
test if the rest of the tests during the course showed significantly
better performance, which they did. Such a day might weld a brilliant kid
into a low level vocational course sequence, so he'd spend his time
learning to balance a checkbook when he should be studying algebra and
geometry.
Another thing to the point of Fred's comments is
that there is a tacit presumption that those who are poor and in the slums
belong there and should never expect to rise above their station. I note
that the teacher he quotes who makes this suggestion is one who did raise
above his station, slum-dweller, though education that somehow sunk in.
He'd have never become a teacher had this policy been followed.
I'm pretty sure that what Fred seems to be proposing
is not a good solution. Alas, I don't have any good ideas myself given the
numbers of pathetic teachers that pollute the profession detracting from
what might be far better performance on the part of most teachers if freed
from the rules needed to make the poor performing teachers "barely
adequate."
{^_^}
The obvious "solution" that no one
seems to propose is to abolish the entire national education system and
establishment, and return control of education to local school boards and
local government. Return financing of schools to local school boards and
local government. Districts will then get the schools they can afford, and
will tailor them to provide the kind of education that the parents and
taxpayers think they need.
Now true enough: under this "scheme"
(which is the way things were for nearly 200 years in this country) inner
city schools are unlikely to have as much money as rich suburban schools.
That doesn't mean they won't have decent schools. New York City produced a
number of schools that encouraged excellence before "open
enrollment" destroyed CCNY and the other excellent colleges and high
schools.
When Federal Aid To Education was debated in the
50's the prediction of those who opposed it was that it would lead to
Federalization, Unionization, Universal school systems that would be at
best mediocre. I think no one predicted just how horrible the result would
be.
I don't think that all the kids in the inner city
should be mechanics and plumbers and blue collar workers: but if we
weren't exporting those jobs as fast as we can, most of them would be.
Those with enough ambition and smarts could get out; many did in the past.
George Pepperdine founded Pepperdine College in the Inner City in a
location that he thought would provide maximum opportunity for students to
work their way through college. That worked for a long time, too, before
Pepperdine College became Pepperdine U and moved to Malibu.
Leave local problems to local institutions. If
the Feds want to be involved, let them found national universities along
the lines of the service Academies, with free education at the cost of
national service after graduation. They could do the same with boarding
high schools.
The truth is that 50% of all the kids are BELOW
AVERAGE. There is nothing we can do about that: but below average doesn't
mean worthless, or unable to manage their own lives, and be good and
useful citizens. Character counts. Contents of their character rather than
color of their skin -- or size of their IQ for that matter.
Once upon a time, schools were seen as a
"conserving influence", whose duty was to civilize the masses of
immigrants and inculcate them with American values and the necessary
information that all Americans should have as part of the process of
creating a shared culture that was "America". Public education
was seen as a patriotic duty, and those heathen statue-worshiping Papists
who sent their children to parochial schools were seen as vaguely
unpatriotic and perhaps even seditious.
Somewhere we gave up on that concept, I'm not sure
where. Now you have the Christian fundamentalists who home school or send
their kids to "Fundie Academies". You have folks like Fred who
say, why don't we just let people have the education they want, rather
than the education that someone else wants for them? And while I really
can't blame them for that (certainly many of the values they would be
exposed to in public schools are not values I would choose for my own
children, nor does the curriculum of today's public schools inspire
anything except disdain), it does bring to mind the question of, if we
cannot create a shared culture for America via the schools, how DO we do
it?
Perhaps Fred's modest proposal (perhaps charter
schools as the future) is the best we can do. It seems a shame, though.
Because that means that the American values of my youth -- values of
liberty, justice, freedom, truth, charity, civic duty, respect for others,
and a patriotism which was deep and to the core rather than shallow
flag-waving, the values that made this nation great -- are dead in
America, replaced by a shallow materialism and cynicism that are in no way
an adequate substitute. It means that there is no such thing as
"American culture" in our nation's future, just a bunch of odds
and ends with a nice slipcover of commercial gloss ("popular
culture") thrown over it.
And civil society is dead as a result too, for
without a shared education, how can citizens get together to engage in
rational discourse? The future of America looks a lot like Hate Radio on
the AM dial, where vile talk show hosts spend hours whipping their
millions of listeners into frenzies of hate against whatever group of
people they wish to intimidate today. It is a vision which, frankly,
scares the **** out of me, but now that we've given up on trying to create
a culture via our schools, I don't know any way to stop it. I'm not at the
point of applying for my immigration visa to Canada yet (Canada being
arguably the only civilized nation left in the Western Hemisphere). I'm an
American, I was born here, I still have that old notion of "civic
duty" in my bones where it is my duty as an American to try to tug on
the ropes of the American nation to try to steer it away from the iceberg
upon which it is close to foundering. But I am not optimistic.
BTW, these issues are not unknown to teachers, even
in inner city schools. I remember a faculty meeting when I was teaching at
an inner city school, must have been in 1992 or so. We brought in a
motivational speaker. She asked, "What does this school need
most?". The answer was almost unanimous: "God." These
teachers knew instinctively that there was something missing from their
school, something important, that no amount of teaching of reading and
writing and arithmetic could replace. That something was a shared set of
values, once provided by the Christian religion, but no longer provided by
anything in today's schools. Perhaps that was inevitable, given the lack
of consensus today as to what is America and what are American values. But
it's a shame.
-- Eric Lee Green mailto:eric@badtux.org Web:
http://www.badtux.org
And yet I think the consensus is here, among the
people. It is the intellectuals, the enlightened ones, who are certain
there is no longer a shared culture and we must use the legal system to
keep things that way.
Irving Kristol long ago said that he would not be
afraid to have the United States declared "a Christian Nation."
He did not fear persecution from acknowledgment of what nearly everyone
believed.
Aristotle was certain that civilizations went
through cycles.
On the previous topic:
If folks don't want anyone to know what DVD's
they're watching, basic DVD players are $60 or less at Wal-Mart.
They're stacked in the aisles like they used to
stack blank video tape.
For some folks, maybe the computer is the only thing
they've got to play 'em on, but I never thought I'd use the 2000 dollar
computer to do the job of a $200 dedicated bit of hardware that's out in
the living room ready to use at the push of a button.
Bill Newkirk wnewkirk@bellsouth.net
Amateur Radio Station WB9IVR Melbourne, FL - Birthplace of Jim Morrison
The web site says you like pizza.
Indeed. As it happens I tend to watch DVD's on a
computer, but then I have lots of computers.
TOP
CURRENT
VIEW
|
CLICK HERE for
a Special Request. 
