Catch up on stories from the past week (and beyond) at the Slashdot story archive


Forgot your password?
Microsoft Your Rights Online

Microsoft WGA Phones Home Even When Told No 403

Aviran writes "When you start WGA setup and get to the license agreement page but decided NOT to install the highly controversial WGA component and cancel the installation, the setup program will send information stored in your registry and the fact that you choose not to install WGA back to Microsoft's servers."
This discussion has been archived. No new comments can be posted.

Microsoft WGA Phones Home Even When Told No

Comments Filter:
  • Gibberish (Score:2, Insightful)

    Anyone have any insight what exactly they're sending back?
    • Re: (Score:3, Insightful)

      by NinjaTariq ( 1034260 )
      I would have thought this kind of thing would be annonymous usage or configuration, simply so that they know how people use it... Though i don't know.
      • Re: (Score:2, Funny)

        by Anonymous Coward
        Your comment is not anti-microsoft enough, so it has been bitchslapped.
    • Re:Gibberish (Score:5, Insightful)

      by Rogerborg ( 306625 ) on Wednesday March 07, 2007 @01:29PM (#18263916) Homepage

      We're not sending anything. Trust us.

      Oh, you checked, did you?

      Then what we meant to say was... it's nothing to worry about.

      Trust us.

    • Re:Gibberish (Score:5, Informative)

      by gigne ( 990887 ) on Wednesday March 07, 2007 @01:31PM (#18263946) Homepage Journal
      I have no idea, but it looks like some sort of unique id.

      an image from the now slashdotted page is here, it shows what gets sent to MS g []
    • Re: (Score:3, Informative)

      by TubeSteak ( 669689 ) []

      There's an english language article about the same packet dump
      Some of the data is encrypted, some of it are just acronyms you don't know
    • by WindBourne ( 631190 ) on Wednesday March 07, 2007 @04:44PM (#18266930) Journal
      MS owns the software, you do not. It is what you agreed to. MS has always done this and will continue to do more. If they stop in one place it will pop up again. The simple fact is, there is truth in saying that you are owned. Whether it is is by MS or by a cracker (from any number of avenues on the windows platform), you are till owned.
  • by swschrad ( 312009 ) on Wednesday March 07, 2007 @12:57PM (#18263422) Homepage Journal
    probably all the apps information. naysayer, meet the Business Software Association, also known down around the docks as "the muscle."

    can't RTFA because they're slashdotted already.
    • by DarthChris ( 960471 ) on Wednesday March 07, 2007 @01:11PM (#18263646)
      Interesting you say it's slashdotted because I can read it fine.

      It's very light on details, however. There is a screenshot from wordpad of the data sent; it's an XML-type document which appears to have pulled a couple of id/hash numbers out of the system registry, e.g. OS version, but no personal info. They can't really get any personal info anyway, since data protection laws here in the UK and other countries would land them in shite, and also I suspect that they have more important things to do than snoop random people's names.

      Personally, I think that they're just trying to get an idea of the number of people who won't install it. These people either have pirate copies and know they'll fail validation, or simply are opposed to the idea of their OS phoning home. From a cynical viewpoint, it's important for MS to gauge the reaction to this early so they know how far they can push these sorts of thing without there being a massive backlash.
      • by lazlo ( 15906 ) on Wednesday March 07, 2007 @01:25PM (#18263862) Homepage
        So, how hard might it be to generate random but valid data to fill out this XML? And then have a little daemon that does nothing but post it over and over 24/7? "Wow. Looks like a NAT/proxy server with millions of users behind it who really don't like WGA."

        Petty, I know, but fun.

      • by rben ( 542324 ) on Wednesday March 07, 2007 @02:22PM (#18264834) Homepage
        I refused to install WGA for a long time for several reasons, not the least was the fact that it was marked in the EULA as BETA software. Why should I be forced to install software that MS admits hasn't been fully tested yet? I have enough problems with MS bugs. Also, I resent the implication that I have to constantly prove that my software was purchased legally. I've always paid for the software I use, even when I was a poor college student.

        Most copies of Windows in the U.S. are paid for, because Windows comes installed, by default, on almost every retail machine sold. That alone makes piracy a non-issue in the U.S. However, WGA does give Microsoft a way to shut down every Windows computer connected to the Internet. What a scam. Once they've got everyone using WGA, they can start dictating terms to governments instead of dealing with irritating lawsuits.

        Lets say that the kind souls at MS never even think of using WGA as leverage on say, Europe. I still think it's possible for a clever hacker to use WGA to do some real damage. The hacker would have to do some DNS spoofing and probably crack some encryption, but then, that's what these guys do. Whose to say someone might not use WGA to pull off the biggest Denial of Service extortion in history? Perhaps I'm a bit paranoid, but my caution has kept me from ever having one of my computers compromised.

        Piracy is a problem, but not nearly as big a problem as MS would have us believe. If people are stealing you blind, you don't make billions of dollars in profits, you lose money. If MS is feeling a pinch lately, it's due to their own foolish policies and assumptions that they would be able to dictate terms to the world forever. Google Apps and Open Source software will, hopefully, eliminate the need to put our computers at risk simply because a company is greedy.

        Microsoft seems to believe that if there were no piracy, everyone in the third world who is now stealing their software would pay for it instead. Yeah right. One of the reasons they steal it is because there is no way they could possibly pay for it. If MS ever finds a way to shut down piracy, it will merely hasten the move to Linux in 3rd world countries. Ironically, that will speed the demise of Windows.
        • by HermMunster ( 972336 ) on Wednesday March 07, 2007 @05:29PM (#18267466)
          Foolish is what Ballmer is made of. He claimed to financial analysts that the caution on Vista sales is for at least 2 reasons: 1) corporate pricing was too low, and 2) piracy.

          This was stated by him in the past couple days, if not today.

          Both are flawed. on item 1. Windows Vista is very expensive. Giving forecasts on certain pricing to corporate is what companies do. They forecast on those prices so that is really a moot point unless corporate just isn't purchasing. Then the low cost would make a difference, as they feel they should have made it higher so that the lack of corporate sales didn't affect the bottom line so much.

          On item 2. According to Microsoft pirating is impossible under Vista. Well, even if that is about 3 months outdated it still is an issue that needs to be addressed. What is the average number of pirated installs vs. legit installs of Vista. Are people choosing to pirate instead of purchasing? Is it easy for the average person to pirate Vista and is the future potential of loosing activation worth it to the average user?

          The answer to those is unknown so Microsoft can't be using that as a legitimate reason why their forecasts are so far off. Even if it was EASY to pirate Vista (which Microsoft said 3 months ago was impossible) it would have to be much easier than to pirate XP, which although is semi-easy to pirate if you can get the corporate product key or you can snatch a key from some unsuspecting person it is possible to get locked out by virtue of the WGA/WGN spyware programs.

          So, essentially it isn't possible to claim that corporate pricing and pirating is the cause of Ballmer's and Microsoft's woes. It has to be something else. That something else, at least to me, is pretty obvious. It is the restrictions on use, the violation of privacy (constantly claiming you are a thief -- incessant checking of your workstation using spyware programs (WGA/WGN)), the high cost to the consumer (parts as well as purchase price of Vista).

          When I talk to people, and I do so every day as I own a computer repair shop, I hear that they want nothing to do with Vista. I even have people that bring in the computers they bought with Vista on them to have them wiped and to have XP installed instead. The reasons they give are the same I read about day in and day out on the web. Microsoft accuses them of being a thief, Microsoft is spying on them, the technology in it will interfere, the costs to upgrade are too high, the cost of the OS is excessive, there's no compelling reason to upgrade. Vista is just a pretty interface on top of a massive spyware program.

          I'd have to say that Ballmer is very foolish and to try to pawn off on the financial community two very flawed reasons for Vistas lack of success is just pathetic. Microsoft is on a downhill slide. The fact that Linux and OSX just might be made valid viable attractive has to be affecting every thing they do. On top of that they have known for a couple years that Microsoft would not see growth anywhere near what it has seen in the past. I think one could forecast some very serious financial problems with Microsoft in the next couple years and that they need to get people switched over to Vista so they can better control your computer and purchases so that the major stock holders have time to divest themselves and reinvest in other arenas.

          Bill Gates and Steve Ballmer are killing Microsoft. Every DRM/CRM implementation makes Windows a lot less attractive to everyone. Every attempt to monitor our use is looked upon as a violation of our privacy (which it is) and is an accusation that we are a thief or will be a thief sometime down the road. When they don't care that they are invading our homes we realize they are too far gone to even consider giving a second chance. When they can use their monopoly power to extort business, other countries, and private citizens then that's the time everyone must look up and say "no". They know they have you by the short ones because they know that i
  • by GuyverDH ( 232921 ) on Wednesday March 07, 2007 @12:59PM (#18263460)
    notepad %windir%\system32\drivers\etc\hosts
    • by $RANDOMLUSER ( 804576 ) on Wednesday March 07, 2007 @01:04PM (#18263532)
      Or use a firewall that checks egress, too. I use one, and find that RealPlayer and Adobe Reader also phone home even when you tell them not to.
      • by rainman_bc ( 735332 ) on Wednesday March 07, 2007 @01:15PM (#18263712)
        and find that RealPlayer and Adobe Reader also phone home

        All the old Macromedia studio products also phone home too...

        That means Adobe Dreamweaver etc...
      • Or use a firewall that checks egress, too.

        How does a firewall check female herons []?

        That is what an egress [] is, right?
      • Re: (Score:3, Insightful)

        Does anybody use Adobe Reader anymore? That thing's become so insane I don't even waste time -- I just open things in

        Is anybody actually surprised that Microsoft is spying on them in ways that they're not disclosing?
      • Is there a WRT54G firmware that can do that? I wouldn't trust anything like that running on a Windows host...

      • Re: (Score:3, Informative)

        by Technician ( 215283 )
        Anybody do installs without a network connected? I wouldn't install any MS OS with a broadband connection live. Is the program silent then? Does it complain that it can't find your connection? MS assumes everyone is online.

        Back when Optical Mice first hit the scene, I picked up a MS optical mouse for a machine I was building on my coffee table. I loaded the driver and the install stalled and nagged me because it could not find my network connection. Please configure up your networking or start your dia
    • by AmiMoJo ( 196126 )
      This probably won`t work. You can`t, for example, redirect Windows Update. The IP address of the server is hard coded into the Update service, and bypasses hosts etc.

      If you did it at the router level it would work, but I cant find any info on this. I am betting that the IP info is sent to is not the same one used for the web host.
    • Doesn't work (Score:5, Informative)

      by alexhs ( 877055 ) on Wednesday March 07, 2007 @01:08PM (#18263604) Homepage Journal
      Seems you haven't read the past story about MS bypassing HOSTS file [] for microsoft sites.
      • Re:Doesn't work (Score:5, Insightful)

        by peragrin ( 659227 ) on Wednesday March 07, 2007 @01:16PM (#18263738)
        In MSFT's defense it is a smart move. That way a virus can't modify .

        The last time i had to set apt-get's update I used the IP address as well.
        • Re: (Score:2, Informative)

          by billcopc ( 196330 )
          I have to agree with you, the first thing most decently smart people do when their computer acts wonky is update their malware scanner(s) and OS. It is trivial for any malware to finagle with the HOSTS file on a Windows system, which is hidden in such a dumb obscure place (C:\winnt\system32\drivers\etc), a far cry from the self-explanatory /etc/hosts of every other goddamned OS on the planet.

          Anyway as I was saying, once a virus takes over the HOSTS file, it could fool the common user into downloading malic
    • Microsoft bypasses the hosts file [] for their own hosts.
  • Interesting (Score:4, Insightful)

    by jesusphish ( 1072854 ) on Wednesday March 07, 2007 @01:03PM (#18263516)
    Yay, I believe RMS's essay on treacherous computing may apply here. Not to start an argument over RMS and his stance with open source and free software. But i believe we should all have the right if you use windows to know what they are sending. I use gnu/linux so i really don't affect me much.
    • Sometimes the only way to exercise your rights effectively is to just walk away (as you and I have). Ranting sure does not work. Enough people have yelled from the rooftops of Vista's crapness and MS's evil methods but that will not stop sales. DOJ does not work. MS just ignore them.

      The masses are not concerned with threachery, privacy, liberty and other high-browed virtues. Give them a full belly and a reality TV show and they are happy. Take away XP and substitute Vista and they will buy Vista.

    • Re: (Score:2, Insightful)

      by shoemael ( 625156 )
      I use Linux also so I'm not vulnerable to this particular issue, however there are some other "phone home" issues that are cross-platform and totally hidden from most people. Have you ever taken a look at how much information you send to You're probably thinking 'None' but you're wrong. I added a firewall rule to log all the connections to and there are hundreds of them established everyday for me alone (or there were until I decided to drop them all). The amou
  • Great... (Score:2, Funny)

    by pchoppin ( 864344 )
    ... Now you're going to tell me that all Microsoft is in business for is to make money. You're ruining a perfectly good fantasy. Thanks a lot!
    • Re:Great... (Score:5, Insightful)

      by Catbeller ( 118204 ) on Wednesday March 07, 2007 @01:15PM (#18263706) Homepage
      That Free Markets religion again. Businesses cannot do anything they like; they are corporations, fictional entities created by license of the people of the country through their government. They are granted super-powers as non-existent individuals, exempting real operators from liablity for their own actions. In return, they hew the line we set for them. They have more responsibilty to the nation that created them other than pleasing shareholders, no matter what propoganda they pump to the contrary. They are not gods. And Microsoft is a monopoly, ruled so by the courts, and is under even more stringent strictures, because they have constantly abused their power in the past to invade and hold new markets.

      So, no, making money is not all they have to worry about. Deceit and chicanery should have consequences other than making them more money. And if they need to cheat to win, it might be time to think about a new concept: revoking the corporate license, and reinstituting personal responsibility for their underhanded actions, with civil and criminal penalties.
  • Use Zone Alarm or other free firewall, problem solved.
  • by KC7GR ( 473279 ) on Wednesday March 07, 2007 @01:06PM (#18263568) Homepage Journal
    From the image in TFA, it looks like they're sending back the Windows version code, and the installation-unique CSID, along with some other stuff that I didn't recognize.

    There didn't appear to be any identification of the specific user in there.

    It seems to me that it would be easy enough to determine what port WGA is using to send this stuff, and lock down said port at one's firewall. That's the method I'd choose to deal with it (if I were even running anything with WGA installed -- which, thankfully, I'm not).

    • Your IP address doesn't identify you? Someone should tell the RIAA that.
    • by drinkypoo ( 153816 ) <> on Wednesday March 07, 2007 @01:25PM (#18263860) Homepage Journal

      From the image in TFA, it looks like they're sending back the Windows version code, and the installation-unique CSID, along with some other stuff that I didn't recognize. There didn't appear to be any identification of the specific user in there.

      so let me get this straight. the ID that identifies your installation is there, and you don't recognize all of the other information, so you concluded that there doesn't be any identification of the user?

      Truly, your intellect is astonishing.

    • Re: (Score:2, Insightful)

      by Slashcrap ( 869349 )
      It seems to me that it would be easy enough to determine what port WGA is using to send this stuff, and lock down said port at one's firewall.

      Great idea. Except that obviously you can't filter by the source port because that will be almost random. And then you find that they're using Port 80 as the destination port anyway because it's about the only port guaranteed to pass through most firewalls/proxies.

      So you filter it by IP address instead, but then find that they're using a huge range of probably Akamize
      • Or you could filter via a layer 7 rule ditching connections to port 80 asking for anything * there are better filters than early 90's ip proto and port based.
    • I have an older version of Kerio's firewall and most recent "phone home" applications do so on port 80. Older apps use custom ports. Kerio's product is very good in this way.

      I'm not sure why this is an issue _now_. It's been this way for years starting with Microsoft's MSI installers that phone home to certificate servers and certificate revocation list servers. I have screenshots to prove it should there be any doubt. It should be obvious by now they are slowly paving the way to a PC with their OS th
  • This is good (Score:5, Interesting)

    by Devir ( 671031 ) on Wednesday March 07, 2007 @01:09PM (#18263618) Homepage
    While many think this is bad and invasion of privacy, think of it as this:

    when we normally click "I DONT Agree" the software does nothing. But if it sends the message back home with statistics of how many dont agree, it tells the software company some people dont agree.

    We can argue EULA's till our fingers are raw and bloody, but it doesnt matter if the company in question doesnt read the conversations.

    In short, by clicking the Dont agree button and having it sent home to MS we're telling them we dont want that crap on our machines. Maybe (deity willing) MS will start to listen. More companies may adopt that approach and we'll get less and less one sided (retarded) EULA's.

    anyone Remember Borland's |"like a book" EULA? Great stuff.

    • by MaggieL ( 10193 )
      But if it sends the message back home with statistics of how many dont agree, it tells the software company some people dont agree.

      I guess "the software company" doesn't read Slashdot, or they'd already know.
    • Re:This is good (Score:5, Interesting)

      by Lumpy ( 12016 ) on Wednesday March 07, 2007 @02:04PM (#18264528) Homepage
      So let's have fun.

      anyone got a way to dissect it completely so we can write a little app to send maybe 20-30 fake entries a day? now spread that across 100-300 people and microsoft thinks that there is a mass rejection of WGA starting to brew.
  • on a related note (Score:5, Interesting)

    by jjeffries ( 17675 ) on Wednesday March 07, 2007 @01:12PM (#18263666)
    This is kinda old, but some years ago my neighbor got a new Win ME (!!!) machine, and I helped him put in a NIC and put it on our little neighborhood network. I was curious if it was going to phone home, so I had a sniffer running on my router...

    The damn thing picked/guessed a valid (NATted) IP address, netmask, and gateway without using DHCP (arp tricks?), and sent a load of mystery packets to an address in a Microsoft IP block. Only then did the computer do the "new device detected" routine, but could not find a driver for the NIC and I had to go fetch one on another machine.

    W T F ?

    Unfortunately I have since lost the pcap dump.

    Moderation: -1, no proof
    • by Slashcrap ( 869349 ) on Wednesday March 07, 2007 @01:40PM (#18264118)
      The damn thing picked/guessed a valid (NATted) IP address, netmask, and gateway without using DHCP (arp tricks?)

      Did that IP resemble 169.254.x.x by any chance?

      But really there's no point trying to find technical explanations when the obvious one is at hand - you can't read a sniffer trace for shit.

      Having the ability to install Ethereal does not magically confer on you the ability to interpret the results correctly.
      • Re: (Score:3, Informative)

        by jjeffries ( 17675 )
        Did that IP resemble 169.254.x.x by any chance?

        No, it was a valid, unused rfc1918 address in the correct subnet. MAC address was the one on the card in the computer in question.

        My home shorewall box correctly drops 169.254.x.x made-up addresses, and my ISP does not forward traffic from IPs not assigned to it. I know, I configure the routers.

        But really there's no point trying to find technical explanations when the obvious one is at hand - you can't read a sniffer trace for shit.

        Having the ability to install
  • .... is it as simple as going to add and remove programs to uninstall the two components for WGA or does it "break" something when you try to uninstall it? Or worse, does it leave anything behind?
    • by J0nne ( 924579 )
      You can't uninstall it. You need to find a third-party program to remove it (I don't remember the name of it, but the tool works).
  • by Joe Random ( 777564 ) on Wednesday March 07, 2007 @01:22PM (#18263814)
    Sounds like a perfect place to use MS speech recgonition:
    Computer: "Where do you want to go today?"
    You: "Nowhere."
    C: "I heard 'Microsoft Validation Site'. Is this correct?"
    Y: "No!"
    C: "I'm sorry. I heard 'Dear aunt, let's set so double the killer delete all'. Is this correct?"
    Y: "NO!!"
    C: "I understand. So 'Microsoft Validation Site' was correct. Redirecting now. Thank you for using My Microsoft Live Enterprise Genuine Advantage Ultimate. Have a nice day."
  • Are you getting the picture yet? Powerful organisations (and politicians) really CAN and DO get away with anything they want. Microsoft is a prime example. I'll be very surprised if they ever get in any serious trouble for this (and no, for MS, a multi-million-dollar fine is not "serious trouble", it's a slap on the wrist. A $10,000,000 fine wouldn't hurt them. A $10,000,000,000 fine... maybe, yes.
  • I detect hypocrisy (Score:5, Insightful)

    by suv4x4 ( 956391 ) on Wednesday March 07, 2007 @01:50PM (#18264300)
    I can understand people not wanting WGA on their PC-s as it can cause issues on legitimate installations as well, in certain situations.

    But sending back a little XML that you denied the EULA? Don't you detect hypocrisy here. You send your "identification" in the form of IP, browser user agent string and what not to virtually any site you visit, without "agreeing" to this every time. Why is nobody whining about this?

    Having privacy and right to deny something is cool. But I think some of the most vocal opposition is simply using pirated Windows and not being honest about it.

    I don't install WGA on existing (legit) computers as it doesn't help me with anything. I don't have any problem with Microsoft getting my "no" back though. In fact, I *want* them to hear my no.
    • by mwillems ( 266506 ) on Wednesday March 07, 2007 @02:30PM (#18265004) Homepage
      I disagree. When I send my IP to a web site, it is because I have chosen to browse there.

      In the WGA example, on the other hand, one chooses NOT to do something, and yet data is sent. That is very different to browsing voluntarily to a web site.

  • by Animats ( 122034 ) on Wednesday March 07, 2007 @01:58PM (#18264442) Homepage

    This should be reported to "".'s definition of badware [] requires prior consent to send personally identifiable information to a site. This should be enough to put WGA on the Badware list.

    Google is now flagging sites that have been identified by StopBadware.

    StopBadware is run by law professors from Harvard and Oxford, with assistance from Consumer Reports. StopBadware is effective. They complained about the Jessica Simpson screensaver, which installed spyware in May 2006. The makers of that didn't listen. In October of 2006, a US federal judge shut that outfit down.

  • by brunascle ( 994197 ) on Wednesday March 07, 2007 @02:57PM (#18265506)
    i've noticed that whenever i try to upgrade to SP2/etc on a new install of XP, it will fail if any other PC using the same CD key is online at that moment. but once i unplug the other PCs, the upgrade works fine.

    assuming this isnt a fluke, that really frightmens me, the fact that MS knows when any of my PCs are online.
  • Looks like (Score:3, Interesting)

    by TwistedSpring ( 594284 ) on Wednesday March 07, 2007 @05:20PM (#18267332) Homepage
    All this is conjecture, but this is what I'm guessing the elements in the ID block are.

    UGD: Not sure. Looks like a UUID.
    HDSLN: Hard disk serial
    USID: User security identifier (id of logged in user, Microsoft can tell if you're any of the default SIDs like Administrator)
    CSID: Computer security identifier

    So Microsoft can tell whether you're an admin or not, they know the unique ID of the computer (CSID), your account if you aren't "Administrator" and - perhaps - the hard disk. If UGD turns out to be something that is unique to each individual copy of Windows, then all the people who've ripped it off could find life inconvenient in the future. I'm not sure what the tracking implications are, it depends how many Microsoft products report the HD serial or USID to them.

"The pathology is to want control, not that you ever get it, because of course you never do." -- Gregory Bateson