Software
Windows 7's New Geolocation Service Introduces Privacy Problems
Posted by Jesus Diaz at 3:58 AM on November 11, 2008
Cnet's Ina Fried is covering WinHEC, Microsoft's Hardware Engineering Conference, and has discovered that Windows 7 has a new system-wide service that will offer very easily accessible geographical location services for all devices and programs. Unfortunately, their implementation seems half-baked in the security front, opening the door to privacy problems that even Microsoft program manager Alec Berntson didn't have a convincing answer for. What is worse: They don't plan to fix them for the final release.
In previous versions of Windows, users didn't have a way to turn geolocation services on or off, since the hardware was accessed on an application by application basis. However, the user was able to launch the application--which usually came with his GPS device--knowing that it was a "good" program. Having no easy-to-use API also made it more difficult for programmers (good ones and evil ones) to create software for GPS hardware and grab the geolocation data.
In Windows 7, the new system-wide GPS service can be turned on and off by the user, who has the option to make it available only to applications as opposed to background processes. However, once you turn the service on, there's no way to limit access to specific programs: Anything that you launch will be able to access the GPS information without even warning you. Berntson admitted that this is problematic, because it opens the door for spoofing programs that could use this information mischievously.
We only promise the control that we can realistically give to them, rather than trying to promise more than we can deliver, Application-based control would be great to have and it is certainly on our Christmas list for future stuff.
On top of that, following a question by an attendee, Berntson pointed out that there will be no way to give a warning to the user when an application tries to access the GPS. He said that, even while this is technically possible, it's not in their roadmap for Windows 7.
As a close comparison, when an application requests access to geographic information in the iPhone 3G, the operating system asks you for permission first. This happens on an application by application basis, every time it runs. Hopefully, someone at Microsoft will realise how absolutely stupid this is and, at least, implement the warning service before the updated OS reaches the market. [Cnet via Lifehacker]

Comments (AU Comments · US Comments)
luke
Posted November 11, 2008 11:00 AM
Does this mean those
"find girls in your area"
advertisements are going to be more accurate?
lilaliendog
Posted 6:07 AM 11/11/08
come on microsoft if you are gonna half ass something don't bother.
lilaliendog
redspectre
Posted 6:05 AM 11/11/08
"Christmas list for future stuff"??? i would expect one better for Windows 7
redspectre
natenovs
Posted 6:33 AM 11/11/08
so let me get this straight - when Firefox has it, it's cool, but if MS adds it in (and it's disabled by default!) it is a problem?
natenovs
chefgon
Posted 6:28 AM 11/11/08
Maybe I'm just not using my imagination, but why is it a massive security risk for a program on your computer to know where your computer is?
And even if that is a massive security risk somehow, then why is the system-wide service opening up a hole that wasn't already present by having a GPS device installed with regular drivers? Couldn't your malware just access that hardware without telling you anyway?
chefgon
Ibelieveinsandwitches
Posted 6:28 AM 11/11/08
I wonder how big of a problem this will actually become if there isn't some kind of fix for it.
Ibelieveinsandwitches
sarwatmj
Posted 6:26 AM 11/11/08
@lilaliendog: exactly, i don't understand why would they implement this feature if its not fully complete.. don't they ever learn!
sarwatmj
tobz1000
Posted 7:00 AM 11/11/08
Shouldn't ALL information be controlled on program-by-program basis by now?
tobz1000
Red_Flag
Posted 6:58 AM 11/11/08
@natenovs: Microsoft is offering no controls to the user beyond fully on or fully off. Irresponsible.
Red_Flag
hagrun
Posted 6:57 AM 11/11/08
I guess people should start paying attention to what programs they keep on their computers. Can we not take any ownership of security on our own systems?
hagrun
WB
Posted 6:53 AM 11/11/08
@natenovs: At [mozillalinks.org] it looks like Firefox will ask you permission to send coordinates each time a website requests it, plus it has the option to dilute the coordinates to 1 mile. Do you see the difference or are you blindly defending Microsoft?
WB
PotentChr0nic
Posted 6:47 AM 11/11/08
@natenovs: In firefox's case, it asks you every time a website tries to access your geolocation.
PotentChr0nic
odnet
Posted 6:47 AM 11/11/08
@natenovs: adding it in, and appropriately developing a system level control center, to manage applications are 2 very different things.
odnet
odnet
Posted 6:46 AM 11/11/08
@lilaliendog: what about vista?
odnet
Red_Flag
Posted 7:20 AM 11/11/08
@natenovs: Microsoft is offering no controls to the user beyond fully on or fully off. Irresponsible.
Red_Flag
zimstyles
Posted 7:20 AM 11/11/08
@Fourthletter: What about WIFI? Geolocation uses wifi too you know.
zimstyles
Red_Flag
Posted 7:18 AM 11/11/08
@Red_Flag: Sorry, that got replied to the wrong post. My bad. >_<
Red_Flag
frigg
Posted 7:12 AM 11/11/08
This would never have happened if Lucius Fox still worked at Microsoft.
frigg
Fourthletter
Posted 7:07 AM 11/11/08
So which computers or laptops come with GPS preinstalled ?
Gps is added with a USB dongle or a bluetooth device.
So you just UNPLUG IT !
Fourthletter
natenovs
Posted 7:07 AM 11/11/08
@WB: um, the thing isnt even enabled? and the OS is in pre-beta form. maybe, when they add in permissions, they'll enable it! dont you see something wrong with blindly criticizing everything MS makes?
natenovs
aec007
Posted 7:34 AM 11/11/08
@Ibelieveinsandwitches:
For what I read in the note I don't see it as a problem at all!
You don't need to fix anything!.
You enable a system wide GPS API so any program can access the data.
ANY PROGRAM that YOU the user install. No some random spyware or malware.
To that effect, any spyware and malware that gets installed by itself (because you are an idiot for not installing anti-virus, malware, etc. protection) can certainly do more harm to your data, bank account, etc...that just learn your GPS coordinates.
Imagine if you would, allowing hard drive access to certain applications only, so a virus cannot access your data in drive X.
Well guess what?... it does not exist, ALL drives are always system-wide accessible in Windows, Macs and Linuxs.
What seems to be the problem then?
An API that allows GPS data in system wide use?
Seems people already start looking for problems in Windows 7 where they do not exist.
aec007
TBM-Fan
Posted 8:09 AM 11/11/08
@Fourthletter: Basically every wireless connection (HSPA, EDGE, GSM, WIFI, GPS and etc..) has the ability to pin-point you
so you just have to unplug everything that can trace you
TBM-Fan
natenovs
Posted 8:03 AM 11/11/08
@Red_Flag: they arent offering anything. they sent a pre-beta build to developers to test their apps. and this feature wasnt enabled.
natenovs
The_Gas_Man
Posted 9:15 AM 11/11/08
Odds that Giz & others are blowing this out of proportion by not having enough information? 10:1.
The_Gas_Man
radeon21
Posted 9:45 AM 11/11/08
@The_Gas_Man:
++
And if it did ask you every time a program wanted to access GPS information, then it would be annoying. Does no one remember the UAC fiasco? You can't have it both ways.
radeon21
Dyltone
Posted 9:41 AM 11/11/08
"As a close comparison, when an application requests access to geographic information in the iPhone 3G, the operating system asks you for permission first. This happens on an application by application basis, every time it runs."
FALSE!!! The application prompts the first 3 launches. No management console to revoke permissions by application after that point.
Dyltone
oranges
Posted 9:36 AM 11/11/08
@aec007: Gizmodo??... looking for problems in Windows??... where they do not exist?
...you've been here before, haven't you?
oranges
tandonmiir
Posted 10:05 AM 11/11/08
*hugs his Ubuntu installs a little closer*
I think I just realized how important free software is to me. I do not like the idea of these things being in my operating system AT ALL.
Great, it's turned off by default. Okay... Well, let's start a pool of bets on when the first Windows 7 virus turns this feature on and starts harvesting data and selling it to people.
That may seem paranoid, but I bet you money if this feature is implemented as it is described above, something along those lines COULD HAPPEN.
I don't want it turned off by default, I want the option to NOT HAVE IT AT ALL.
tandonmiir
centipedex
Posted 10:31 AM 11/11/08
They'll fix it. If anything Microsoft is more known for going overboard with security prompts.
centipedex
rudolphdude
Posted 1:06 PM 11/11/08
They guy just said the user level screening of aps using GPS is "not on the roadmap".
So this isn't an issue of just a beta missing the final polish. It is a design level error.
Listen, I want MS to get it's shit together. This is not inspiring confidence. And honestly guys, you don't have to defend MS. Really, they don't care about you. They DON'T CARE ABOUT YOU!
rudolphdude
takemetoyourtoaster
Posted 1:43 PM 11/11/08
not in there f*ing roadmap! well add it in !! or make windows 7 late like two days, or something, don't just leave it and hope nobody touches it, and if you arent going to touch it don't make it worse by telling everyone!! seriuously microsoft wtf!!?
takemetoyourtoaster
CamilleStag
Posted 2:03 PM 11/11/08
Like someone above me said, if you don't have a GPS installed, why care? How many people have GPS's installed on their laptops/desktops? Probably less than 1% of the population. And when you're indoors, you can't get a GPS signal anyway. So when you're indoors, your GPS doesn't work.
CamilleStag
MadCow234
Posted 2:44 PM 11/11/08
@radeon21: I don't find it annoying that my iPhone asks me when an app wants to use my location, you just hit "ok". The UAC fiasco is not the same thing. UAC happens with the stupidest things. I'm the admin and only account on my computer, why should it ask me for my permission to, for instance, turn off file sharing on a network when I'm the admin. That doesn't make sense. Making a notification that a program or website wants to know where I am located...in real life...that's pretty damn important to me. In these days of massive hacks and identity theft, one more security threat is not needed, and not appreciated from such a huge company like Microsoft. Not to mention, if Apple can implement it on a cell phone, then why can't Microsoft just throw in a little notification, it can't be that difficult.
MadCow234
MadCow234
Posted 2:53 PM 11/11/08
@CamilleStag: It was said in a comment farther up, but everything from EDGE to wi-fi can pinpoint you. That's how location triangulation works on the 1st gen iPhone. It takes data from GSM towers you are close to, adds in the data from the nearest wi-fi hot-spots, and grabs your location. In other words, every time I'm on the wi-fi at school, which is everyday, someone somewhere could possibly know where I am without me having to give them permission. I don't like the idea of that. And people can say it's paranoia all they want. Like I said in a reply a little farther up...in today's world where hacking and identity theft are everyday occurrences, another security threat like this just isn't okay, IMHO.
MadCow234
Valicore
Posted 5:44 PM 11/11/08
@Fourthletter:
You can bet GPS will be a standard feature on laptops when Windows 7 is released.
Valicore
Valicore
Posted 5:42 PM 11/11/08
@natenovs:
What? Blindly criticizing everything MS makes? No, read the article dude. He said they didn't PLAN on fixing it at ANY point in Windows 7's release process, it wont be fixed in the final release! If for nothing else than their own reputation they should handle that better. Don't defend every mistake MS makes dude.
Valicore
im.thatoneguy
Posted 7:50 PM 11/11/08
@tandonmiir:
Ludite.
"OMG I'm so glad I don't have an internet connection otherwise people might know things about me."
Might as well stop using your credit card too. Because it might be tracked or stolen.
Face it. If there is hardware which is capable of tracking your location. A virus can very easily access that information. Regardless if you are 'prompted' or not.
What is it that we always say DRM is absurd because it'll just be cracked! Oh but MY data my precious precious data. That's uncrackable and wrong to take.
im.thatoneguy
lmjabreu
Posted 1:00 AM 12/11/08
So remember kids, thing twice before you buy your next W7 laptop next month.
lmjabreu
mdoublej
Posted 2:10 AM 12/11/08
It certainly would be much easier to scam someone that isn't very computer savvy, if you can tell them you know their address or current location.
mdoublej
Bluesk1d
Posted 9:59 AM 12/11/08
@oranges:
Seriously. They just cant resist. I like the last paragraph thrown in for good measure. I'm surprised it wasn't followed up by:
Proper ejaculation while fondling an iPhone [HOWTO]
Bluesk1d
LeanderJobnick
Posted 11:38 PM 11/11/08
finally, my adultfriendfinder adds can show me hot girls in my exact location.. that's cool
LeanderJobnick