David Methvin: Win 98 Privacy Issue: Worse Than You Thought

[James Love <love@cptech.org>]

http://www.techweb.com/wire/story/TWB19990312S0008

Win 98 Privacy Issue: Worse Than You Thought
(03/12/99, 12:20 p.m. ET)
By David Methvin, Windows

A Windows Magazine investigation has shown the
recently reported privacy concern with Microsoft's
Windows 98 Registration Wizard goes much deeper than
previously reported.

It's not only possible for any website to read information
that uniquely identifies you and your PC, but that
information can be modified and/or sent to Microsoft
without your consent.Last week, Richard Smith of Phar
Lap Software first identified a risk with the Registration
Wizard, or RegWiz. (The Phar Lap discussion of this
problem is at
http://security.pharlap.com/regwiz/index.htm).

Win 98 uses RegWiz to process your product registration
form and submit it to a Microsoft server over the Internet.
Two identification numbers are generated based on your
PC configuration and the data you enter during registration.
The first number, called the hardware identification
number (HWID), can, in most cases, uniquely identify the
computer. A second number, called the Microsoft ID
(MSID), uniquely identifies a user and is placed in a
browser cookie for access to services on Microsoft's
website.


  [snip]

-- 
James Love, Director, Consumer Project on Technology
I can be reached at love@cptech.org, by telephone 202.387.8030,
by fax at 202.234.5176. CPT web page is http://www.cptech.org