Passport May Violate Euro Privacy

good-n-nappy writes: "More shocking news about Passport. The EU thinks Passport may violate privacy. Of course, Microsoft claims that all data is supplied voluntarily (for now... cue evil laugh). Too bad we in the U.S. will likely have to continue sacrificing privacy for national security." Part of a continuing series.

Excuse the ignorance...

[MImeKillEr]

...but it was explained to me by a friend who uses Passport that one of its main features was to sheild consumers from having to give their credit card information to every webfront said user purchases from. Instead, the webfront is given a confirmation number on the transaction. I ask you, how exactly does this make MS evil? Having never used Passport, I'm relying on his view for this (and seeing as how I've known him for 15 years, he's in the tech market, knows his stuff, etc...)

How about a little less (right!) biased comments for the stories from the staff?

Mod away. My karma's good.

Re:Excuse the ignorance...

[linuxbert]

Your right, the idea is a good one, infact, the CC companies have a Secure online trasaction standard (SET) that is used to authenticate cards, but not have individul mechants deal with the card information.

The problem with passport, is that some people dontlike all there shopping habits and personal information tied up in a big repository, that could be sold at the drop of a hat.

Microsoft also has a history of changing policies to benifit them, and take away rights from the user, and there is also the concern of your dataa being kept by microsoft as a result of thier track record on privacy and security of systems

if visa offered this thier intentions would be to lessn fraud and increase thier profits. id say visa is trust worthy, and has a vaild point, so sign up now, but what is MS's reasons for doing this?

Re:Excuse the ignorance...

[MImeKillEr]

Ahh, but it was also explained to me that MS doesn't actually gather such data, and that the information is actually obtained by a 3rd party.

To quote my buddy's email:

"But people were worried that MS would track peoples spending habits if they had your CC info. Well they contract it out to a 3rd party organization that provides absolutely no data to MS on spending habits, etc..

Just who exactly the 3rd party is, I don't know. Again, I'm ignorant when it comes to Passport, as I don't use it.

Re:Excuse the ignorance...

[good-n-nappy]

You're still dodging the obvious question - what does MS get out of the deal? I suppose they're doing this for philanthropic reasons, right?

The real reason this is a threat to privacy isn't as obvious in the short term. Its the same as the Oracle (tm) national ID card in the US. Only once it is an accepted standard will the true abuse begin.

Your buddy is correct about how the system is supposed to work, but wait till MS changes the EULA. [slashdot.org] Do you really trust MS not to do this? If you do, then you or your buddy works for them.

Re:Excuse the ignorance...

[dirk]

You're still dodging the obvious question - what does MS get out of the deal? I suppose they're doing this for philanthropic reasons, right?

I am assuming here, but what they would be gaining would be websites paying to use the Passport service. As Passport takes off, more and more websites sign up to use it, and (I'm assuming here, but it makes perfect sense) pay MS for the use of the Passport service. It works like a credit card service, where the consumer pays nothing for it, because the business pays the fees up front. So yes, they are doing it to make money, just like Visa would be.

Re:Excuse the ignorance...

[good-n-nappy]

Yeah, that's nice. When Passport becomes a monopoly, there'll be a new meaning to the "microsoft tax."

Of course, good luck taking business from the only monopoly bigger than Microsoft's.

Ignorance excused.

[Martin Spamer]

Ignorance excused.

The two most obvious problems with the Microsoft Passport is that 1) It shares your personal data with vendors in countries that do not protect that data. That is a breach of the Eight Data Protection Principal. 2) The Data must be secure, if not this is a violation of the Seventh Principal.

MS Privacy?!?

[ChiPHeaD23]

Even if MS had a great privacy policy (which it doesn't), how safe can you be trusting them with personal data? Their history of insecurity makes me think twice about telling them anything. Remember the Hotmail exploit a few years back? What happens when someone cracks Passport server?

As far as MS can tell I'm still an old lady from Qatar...

That's shocking

[anthony_dipierro]

I guess Jon Katz was right that "modern media is about making money, and that depends entirely on selecting stories that entertain, titillate, blow up or confront." Add bash Microsoft to that list.

UK Data Protection Act.

[Martin Spamer]

The UK Data Protection Act 1998 (http://www.hmso.gov.uk/acts/acts1998/19980029.htm ) governs how 'data-holders' make capture and process personal data.

This Act is an EU treaty obligation ( http://www.privacy.org/pi/intl_orgs/ec/final_EU_Da ta_Protection.html ) and replaces a similar act from 1984

The UK Government can be rightly criticised on many aspects of IT legislation, however the Data Protection is not one.

The Act codifies 'Eight Principals'.

1. fairly and lawfully processed;
2. processed for limited purposes;
3. adequate, relevant and not excessive;
4. accurate;
5. kept no longer than necessary;
6. processed in accordance with the data subject's rights;
7. secure;
8. not transferred to countries without adequate protection.

It seem likely to me that the MS-Passport violates several of these, though most notable numbers 7 and 8.

The Data Protection Registra/Commissioner.

http://www.dataprotection.gov.uk

Passport Insecurity?

[Coward Anonymous]

Aren't hotmail accounts now part of the passport world?
If so, has anyone noticed the little fact that passport passwords are case insensitive?
Great security...