Chapter 6: Privacy Control
In This Chapter
Finding out why privacy is important
Discovering the complicated web of shared data
Blocking location tracking
Lessening the intrusion on your privacy
“The best minds of my generation are thinking about how to make people click ads. That sucks.”
— Jeff Hammerbacher, early Facebook employee
When you work with “free” services — search engines like Google and Bing; social networks like Facebook, Pinterest, and LinkedIn; online storage services like SkyDrive and Google Drive; free e-mail services like Gmail and Hotmail/Outlook.com or Yahoo! Mail; and on and on — these services may not charge you anything, but they’re hardly free. You pay with your identity. Every time you go to one of those sites, or use one of those products, you leave a trail that companies are eager to exploit, primarily for advertising.
There’s a reason why you buy something on, say, Alibaba, and then find ads for Alibaba appearing on all sorts of websites. One of the big advertising conglomerates has your number. Maybe just your IP address. Maybe a planted cookie. But they’ve connected enough dots to know that, whatever site you happen to be on at the moment, you once bought something on Alibaba.
Now, even when you log on to Windows 8.1, if you opt to use a Microsoft account, you leave another footprint in the sand. (I talk about Microsoft accounts in Book II, Chapter 5.)
This isn’t horrible. Necessarily. It isn’t illegal. In most cases, anyway. The advertisers view it as a chance to direct advertising at you that’s likely to generate a response. In some respects, it’s like a billboard for a cold Pepsi on a hot freeway, or an ad for beer on Super Bowl Sunday.
In other respects, though, logging your activity online is something quite different.
I talk about privacy in general in Book IX, Chapter 1, and the browser Do Not Track flag (which may or may not do what you think it should do) in Book VI, Chapter 6. In this chapter, I want to give you an overview of privacy settings — and some privacy shenanigans — specifically inside Windows.
Why You Should Be Concerned
As time goes by, people are becoming more and more aware of how their privacy is being eroded by using the Internet. Some people aren’t particularly concerned. Others get paranoid to the point of chopping off their clicking fingers. Chances are pretty good you’re somewhere between the two poles.
Windows 8.1 users need to understand that this version of Windows, much more than any version of Windows before, pulls in data from all over the web. Every time you elect to connect to a service — Facebook, Flickr, whatever — you’re connecting the dots for Microsoft’s data-collection routines. And if you use a Microsoft account, Microsoft’s dot connector gets to run into overtime.
I’m not implying that Microsoft is trying to steal your data or somehow use your identity for illegal purposes. It isn’t. At this point, Microsoft mostly wants to identify your buying patterns and your interests, so it can serve you ads that you will click, for products that you will buy. That’s where the money is.
Although Google freely admits that it scans your inbound and outbound Gmail e-mail, all the better to generate ads that you will click, Microsoft (as of mid-2013, anyway) insists that it doesn’t — ergo, the infamous Scroogled ads, where in the pot and kettle somehow tie it on. Don’t be fooled. Microsoft does scan Hotmail/Outlook.com mail and tiled Mail app messages that you receive with Windows 8.1 — for spam detection, if nothing else. Whether MS will start keeping track of detailed information about your messages in the future is very hard to say.
Here’s how the services stack up, when it comes to privacy (or the lack thereof):
Google: Without a doubt, Google has the largest collection of data. You leave tracks on the Google databases every time you use Google to search for a website. That's true of every search engine (except www.DuckDuckGo.com), not just Google, but Google has 70 percent or more of the search engine market. You also hand Google web-surfing information if you sign in to your Chrome browser (so it can keep track of your bookmarks for you) or if you sign in to Google itself (for example, to use Google Apps or Google Drive). The native Android browser ties into Google, too.
Google also owns Doubleclick, the best-known, third-party cookie generator on the web. Any time you go to a site with a Doubleclick ad — most popular sites have them — a little log about your visit finds its way into Google’s database.
Facebook: Although Facebook may not have the largest collection of data, it’s the most detailed. People who sign up for Facebook tend to give away a lot of information. When you connect your Microsoft account in Windows 8.1 to Facebook — for example, add your Facebook Friends to your Metro People list — some data that you allow to be shared on Facebook is accessible to Microsoft. That’s why it’s important to lock down your Facebook account (see Book V, Chapter 3).
Every time you go to a website with a Facebook Like icon, that fact is tucked away in Facebook’s databases. If you’re logged on to Facebook at the time you hit a site with a Like icon, your Facebook ID is transmitted, along with an indication of which site you’re looking at, to the Facebook databases. As of this writing, Microsoft can’t get into the Facebook database — which is truly one of the crown jewels of the Facebook empire — although it can pull a list of your Friends, if you allow it.
Microsoft: Microsoft’s Internet access database may not be as big as Google’s, or as detailed as Facebook’s, but the ’Softies are trying to get there fast. One of the ways they’re catching up is by encouraging you to use a Microsoft account. The other is to create all these connections to other data-collecting agencies inside Windows 8.1, including Facebook and Yahoo! (through Flickr). Then there’s Bing, which logs what you’re looking at just like Google search.
Windows 8.1 is light-years ahead of earlier versions of Windows when it comes to harvesting your data. Or perhaps I should say it’s light-years behind earlier versions of Windows when it comes to protecting your privacy. Same, same.
The single biggest new surprise in Windows 8.1 is the “Smart Search” feature — which is certainly smart for Microsoft’s data collection efforts. If you enable Smart Search, Microsoft (through Bing) keeps a list of all of the terms you search for on your computer. Because Smart Search is enabled by default when you install Windows 8.1, chances are pretty good that Microsoft’s collecting information about every single search you make for your documents, pictures, e-mail, and so on. I talk about Smart Search — and, most importantly, show you how to turn it off — in Book II, Chapter 3.
For an ongoing, authoritative discussion of privacy issues, look at the Electronic Frontier Foundation's Defending Your Rights in the Digital World page at www.eff.org/issues/privacy.
Knowing What Connections Windows Prefers
If you use Windows, you’re not on a level playing field. Microsoft plays favorites with some online companies and shuns others as much as it possibly can.
Cases in point:
Microsoft owns part of Facebook. You see Facebook here and there in Windows. There’s a reason why: Microsoft owns a 1.6-percent share of Facebook (at the time of this writing, anyway).
If you link your Windows 8.1 system to Facebook, Windows pulls all your contact data from Facebook. If, in addition, you’re signed in with a Windows account, all that contact data from Facebook becomes available in the Microsoft cloud.
It isn’t clear whether Microsoft and Facebook share any other data about individual users. But that’s certainly a possibility, if not now, at some point in the undefined future.
Microsoft doesn’t play well with Google. Windows has some hooks into Google, but invariably they exist in order to pull your personal information out of Google (for example, Contacts) and put it in Microsoft’s databases. When you see a ready-made connector in Windows 8.1’s Mail app to add a Gmail account — so you can retrieve your Gmail messages in Microsoft’s tiled Mail app — there’s an ulterior motive.
Microsoft would love to import your data from LinkedIn or Twitter. If you connect to either from inside Windows, all your contacts come across.
Microsoft gives lip service to Apple. There’s no love lost between the companies. Microsoft still makes software for Mac and iPad platforms (for example, OneNote runs on the iPad, and Office has been on the Mac for longer than it’s been on Windows!). Apple still makes software for Windows (such as iTunes, Safari, and QuickTime). But they’re both fiercely guarding their own turf. Don’t expect to see any sharing of user information.
Microsoft once tried to buy Yahoo!, which owns Flickr. Although that possibility seems less likely now than it did in 2008 and again in 2011, it comes up from time to time. Microsoft has hired a boatload of talented people from Yahoo!. Microsoft also still has strong contractual ties to Yahoo!, particularly for running advertising on its search engine, although that could change. The net result is that Flickr is welcome in Windows 8.1.
And of course, you know that Microsoft also owns Skype, Hotmail/Outlook.com, and SkyDrive, right?
Your information — aggregated, personally identifiable, vaguely anonymous, or whatever — can be drawn from any of those sources and mashed up with the data that Microsoft has in its databases. No wonder data mining is a big topic on the Redmond campus.
Controlling Location Tracking
For the first time in any version of Windows, this version has location tracking. You have to tell Windows and specific applications that it’s okay to track your location, but if you do, those apps — and Windows itself — know where you are.
Location tracking isn’t a bad technology. Like any technology, it can be used for good or not-so-good purposes, and your opinion about what’s good may differ from others’. That’s what makes a horse race. And a lawsuit or two.
Location tracking isn’t just one technology. It’s several.
If your PC has a GPS chip (see Figure 6-1) — they’re common in tablets, but unusual in notebooks and rare in desktops — and the GPS is turned on, and you’ve authorized a Windows app to see your location, the app can identify your PC’s location within a few feet.
Source: Infineon
Figure 6-1: GPS chips are smaller than the head of a match.
GPS is a satellite-based method for pinpointing your location. Currently two different commercial satellite clusters are commonly used — GPS (United States, two dozen satellites) and GLONASS (Russia, three dozen satellites). They travel in very specific orbits around the earth (see Figure 6-2) — they aren’t geosynchronous orbits, but they’re good enough to cover every patch of land on earth. The GPS chip locates four or more satellites and calculates your location based on the distance to each.
If your Windows PC doesn’t have a GPS chip, or it isn’t turned on, but you do allow Windows apps to track your location, the best Windows can do is to approximate where your Internet connection is coming from, based on your IP address (a number that uniquely identifies your computer’s connection to the internet). And in many cases, that can be miles away from where you’re actually sitting.
When you start a Windows 8.1 app that wants to use your location — the tiled Weather app being a good, innocuous example — you see a message like the one in Figure 6-3.
Source: Colorado Center for Astrodynamics Research
Figure 6-2: Carefully crafted orbits ensure that a GPS chip can almost always find four satellites.
Figure 6-3: Windows 8.1’s Weather app wants to know whether it can use your location.
If you’ve already turned on location services, each time you add another app that wants to use your location, you see a notification that says, “Can [Windows 8.1 app] use your location?” You can respond either Allow or Block. The following sections explain how you can control location tracking in Windows 8.1.
Blocking all location tracking
To keep Windows from using your location in any app — even if you’ve already turned on location use in some apps — follow these steps:
1. Swipe from the right or hover your mouse in the upper-right corner to bring up the Charms bar. At the bottom, choose the Settings charm.
2. At the bottom of the Start Settings pane, tap or click the Change PC Settings link and then select Privacy on the left. Choose Location.
The Location Privacy screen appears, as shown in Figure 6-4.
Figure 6-4: The location-tracking, master shut-off switch is at the top.
3. To turn off location tracking — even if you’ve already given your permission to various and sundry applications to track your location — set Let Apps Use My Location to Off.
That’s all it takes.
Blocking location tracking in an app
If you’ve given an app permission to use your location, but want to turn it off, without throwing the big Off switch described in the preceding steps, here’s how to do it:
1. Bring up the app you want to throttle.
In this example, I start the Windows 8.1 Weather app.
2. Swipe from the right or hover your mouse in the upper-right corner to bring up the Charms bar. At the bottom, choose the Settings charm.
3. Select Permissions.
Depending on the app, you see a screen like the one in Figure 6-5.
Figure 6-5: You can turn off location tracking for individual apps, as well.
4. Under Privacy/Allow this App to Access Your, slide the Location slider to Off.
The app loses its permission.
Some apps keep a history of your locations, or searches that may pertain to your location. If you want to verify that’s been deleted, too, bring up the Charms bar, choose the Settings charm, and select Settings. If the app saves history files, you see a choice to Clear History and/or a slider that allows you to turn off Search History.
Minimizing Privacy Intrusion
Although it’s true that using Windows 8.1 exposes you to many more privacy concerns than any previous version of Windows, you can reduce the amount of data kept about you by following a few simple rules:
If you want to log on to Windows using a Microsoft account — and there are many good reasons for doing so — consider setting up a Microsoft account that you use only for logging on to Windows (and possibly for SkyDrive, Xbox, and/or Skype). See Book II, Chapter 5 for details.
Don’t use the Windows 8.1 apps for Mail, People, Calendar, Skype, or SkyDrive. If you have a Hotmail/Outlook.com or Gmail account, don’t access them through Windows 8.1 Mail, go to your browser and log on to Hotmail/Outlook.com or Gmail. If you keep a separate Microsoft account for logging on to Windows only, use the web interface for SkyDrive — by going through SkyDrive. Run your Contacts, Calendar, and Messaging through Hotmail/Outlook.com or Gmail as well. It isn’t as snazzy as using the Windows 8.1 tiled apps, but it works almost as well. Even better, in many cases.
Also, as noted earlier in this chapter, be very aware of the fact that both Google (Gmail) and Microsoft (Hotmail/Outlook.com) scan every inbound message. Google has no qualms about saying it scans inbound and outbound messages for text that will improve its aim with advertising. Microsoft swears it doesn’t.
Personally, I use Gmail. If Google wants to bombard me with ads, so be it: I don’t buy anything from the ads anyway.
Always use “private” browsing. In Internet Explorer it’s called InPrivate; Firefox calls it Incognito; Chrome says Private Browsing. Turning on this mode keeps your browser from leaving cookies around, and it wipes out download lists, caches, browser history, forms, and passwords.
Realize, though, that your browser still leaves crumbs wherever it goes: If you use Google to look up something, for example, Google still has a record of your IP address and what you typed.
“Private” browsing isn’t the same thing as Do Not Track. In fact, as of this writing, Do Not Track is just a request that you make to the websites that you visit, asking them to refrain from keeping track of you and your information. For details, see Book VI, Chapter 6.
Don’t opt in for Microsoft’s Consumer Experience Improvement Program. CEIP is the method Microsoft uses to watch what you’re doing and send information back for its analysis about what you tried and how you tried it. Microsoft calls it “telemetry.” Yes, I know that Microsoft swears it doesn’t keep any personally identifiable information from the CEIP. But “personally identifiable” is a squishy topic, and it’s simpler to just not go there.
There really is a trade-off between privacy and ease of use: All the apps mentioned in this chapter require a piece of your privacy in order to function. Only you can make the decision about how much of your privacy you want to give up, in exchange for nifty new features. Just be aware of what you’re doing, before you do it.