Home page logo
/

bugtraq logo Bugtraq mailing list archives

Re: Why is Microsoft watching us watch DVD movies?
From: "Patrick M. Hausen" <hausen () punkt de>
Date: Thu, 21 Feb 2002 11:42:13 +0100 (CET)

Hi all!

Richard Smith wrote:

Serious privacy problems in Windows Media Player for Windows XP
[...]

In particular, the privacy problems with WMP version 8 are: 

- Each time a new DVD movie is played on a computer, the WMP software
contacts a Microsoft Web server to get title and chapter information for
the DVD. When this contact is made, the Microsoft Web server is giving
an electronic fingerprint which identifies the DVD movie being watched

Microsoft might argue, that this is a "service" for the user
similar to the one CDDB has been providing for audio CDs for
years.

and a cookie which uniquely identifies a particular WMP player. With
this two pieces of information Microsoft can track what DVD movies are
being watched on a particular computer. 

_This_ on the other hand is an unfriendly attack on anyones privacy.
Does someone know if CDDB does similar things?

- The WMP software also builds a small database on the computer hard
drive of all DVD movies that have been watched on the computer. 

Well, again, just like CDDB does - I'd consider this a feature
as long as I get to control the content of the DB and no one but
me can peek inside.

- As of Feb. 14, 2002, the Microsoft privacy policy for WMP version 8
does not disclose that the fact that WMP "phones home" to get DVD title
information, what kind of tracking Microsoft does of which movies
consumers are watching, and how cookies are used by the WMP software and
the Microsoft servers. 

Neither does the README file for any CD player application, I have
tried so far.

- There does not appear to be any option in WMP to stop it from phoning
home when a DVD movie is viewed. In addition, there does not appear any
easy method of clearing out the DVD movie database on the local hard
drive. 

This, again, is _very_ bad practice.


CDDB was just my first thought when I read your post and I haven't
seen anyone complaining about that service in the last couple
of years. The cookie issue needs to be addressed at the very least,
though.

Regards,

Patrick M. Hausen
Technical Director
-- 
punkt.de GmbH         Internet - Dienstleistungen - Beratung
Scheffelstr. 17 a     Tel. 0721 9109 -0 Fax: -100
76135 Karlsruhe       http://punkt.de


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault