Hotmail's social networking busts your privacy

[Woody]

Greg -

In fact, the "What's New with Your Network" screenshot is from my wife's Hotmail logon. As you say, it's also on her Windows Live login page.

> These are folks who've been actively invited into or asked to join your WL network.

See, that's my problem. They're not folks who have been invited to join her WL network. She doesn't have a WL network - never used Windows Live, doesn't have a Windows Live Spaces account. These people are selected from Windows Messenger buddies. At no point did my wife or her buddies say "Dear Microsoft, you may collect information about me and display it on my buddy's Hotmail login page."

>Inviting someone to chat via Messenger does not necessarily add them to your WL network either, unless you click the wrong option when accepting the chat request

Not true. If you have a copy of my Windows 7 All-In-One For Dummies book handy, there are screen shots of exactly what you agree to when you ask someone to become your Messenger buddy, and what your buddy agrees to, should they accept. (See Figure 7-8 on page 577.) Although both screens say, "Messenger contacts are part of your network on Windows Live," there's absolutely no indication of what that entails. Certainly, neither of the screens say anything like, "Dear Microsoft, you may collect information about me and display it on my buddy's Hotmail login page."

>this is a public comment left on a (presumably) public SkyDrive file, much like a comment on someone's blog

Once again, not true. I don't doubt that I left that comment somewhere - but I can't find it, using any search engine, so I don't know where it came from. I've never accessed a SkyDrive file. Never posted anything on anyone's personal blog (although I have posted on Microsoft blogs, even as an MVP). I don't know who Kim is, and I only have a guess as to what PDF file is being referred to. In short, Microsoft mined this information from somewhere, mashed it so it isn't factually correct, and then dished it up on my wife's Hotmail login page.

>Well, I'm pretty sure I received several e-mail notices from Microsoft about the changes, and the first time I logged into WL, I received several pop-up notifications.

I don't doubt that for a second, but my wife has never logged on to Windows Live. She's used Windows Messenger briefly. She logs into Hotmail. And that's it.

I've corresponded with Microsoft's reps, and they inform me that the Hotmail login screen was changed in February 2009, after which time the login sequence shows the What's New with Your Network pane. That may well be true, although PBear (see earlier post in this thread) says he still doesn't see the WNWYN pane. I never noticed it - I log in to Hotmail infrequently, and changes to the screen don't register. The only way this came to my attention was when my wife came into my office and said, "Who's Kim?"

What Microsoft's doing is unconscionable. Facebook is drawing fire today from several Senators. Google got hit hard with its changes to Buzz. Microsoft, in my opinion, is doing something equally objectionable - although admittedly different.

There's nothing inherently wrong with social networking, as long as everybody understands the ground rules. Signing up to be a Windows Messenger Buddy means that you know the other person's id, and you can see their picture and whatever else they may willingly broadcast. Fine. That's part and parcel of messaging. But becoming a Buddy doesn't mean that Microsoft should be able to mash up inaccurate information about you and serve it to your Buddy six months later, as part of their Hotmail login.

[gregsedwards]

They're not folks who have been invited to join her WL network. She doesn't have a WL network - never used Windows Live, doesn't have a Windows Live Spaces account. These people are selected from Windows Messenger buddies. At no point did my wife or her buddies say "Dear Microsoft, you may collect information about me and display it on my buddy's Hotmail login page."

To be fair, everyone who has a Live ID has a WL network. Your Messenger "buddies" (kind of a dated term, but alright), WL network, and Hotmail contacts are collectively part of your WL People service. There's a nice post on LiveSide that summarizes how it all works in Wave 3. Granted, it's convoluted, but don't get too comfortable with that layout. Scuttlebutt is that is expected to be simplified in Wave 4.

If you have a copy of my Windows 7 All-In-One For Dummies book handy, there are screen shots of exactly what you agree to when you ask someone to become your Messenger buddy, and what your buddy agrees to, should they accept. (See Figure 7-8 on page 577.) Although both screens say, "Messenger contacts are part of your network on Windows Live," there's absolutely no indication of what that entails. Certainly, neither of the screens say anything like, "Dear Microsoft, you may collect information about me and display it on my buddy's Hotmail login page."

I don't actually have a copy, and the Messenger client is not available to me at work. Might you be gracious enough to send me a freebie? I'll take an e-book, I'm not picky. Either way, I'll check this out in WL Messenger when I get home this evening. Standby for additional opinionated response...

I don't doubt that I left that comment somewhere - but I can't find it, using any search engine, so I don't know where it came from. I've never accessed a SkyDrive file. Never posted anything on anyone's personal blog (although I have posted on Microsoft blogs, even as an MVP). I don't know who Kim is, and I only have a guess as to what PDF file is being referred to. In short, Microsoft mined this information from somewhere, mashed it so it isn't factually correct, and then dished it up on my wife's Hotmail login page.

Gotta call bull on that one, Woody. Not to drag "Kim" into this, but she's Kim Spilker, the marketing manager for Microsoft Press. You commented on a PDF draft of the First Look Microsoft Office 2010 eBook she had shared on her public SkyDrive. I can say that because it's still up there. In fairness, it appears she actually deleted the document dated 12/11 on which you commented and shared another copy of it on 12/15. Though the document has the same filename, the SkyDrive URL is different. The newer version of the document is still out there and has pages of comments. Your comment was likely deleted along with the original document. The funny thing about WL updates is that they occasionally hang around in your "What's New" feed, even if the underlying comment has been deleted (that's occasionally gotten me in trouble during "spirited disagreements" with my network mates that I've later tried to retract). Still, the fact remains that you made the comment on a public SkyDrive file on 12/11, WL pulled the update into your public feed, and your wife's What's New with My Network feed consumed it from there.

Your article implies that WL goes around willy-nilly fabricating updates on comments that never existed, but this is hardly an inaccurate mashup of information. Perhaps it would be more accurate to say that it's information you didn't intend for others in your network to see, which puts the onus on you to configure your permissions properly so that kind of information isn't shared.

I've corresponded with Microsoft's reps, and they inform me that the Hotmail login screen was changed in February 2009, after which time the login sequence shows the What's New with Your Network pane. That may well be true, although PBear (see earlier post in this thread) says he still doesn't see the WNWYN pane. I never noticed it - I log in to Hotmail infrequently, and changes to the screen don't register. The only way this came to my attention was when my wife came into my office and said, "Who's Kim?"

LOL, I've had similar conversations with my wife. She was curious about Windows Live for like a nano-second, after which she found Facebook and was lost to the dark side forever. Her Space has (had?) a whopping 1 blog post before she abandoned it. She now calls my obsession with WL "my little geek network." Still she occasionally inquires about exactly who are these people she's never heard of. It's true that WL hasn't (yet) matured into the kind of grass-roots social network that Facebook has. Most of my network mates on WL are other MVPs and WL enthusiasts. Very few of my meatbag (Jeffrey's term) friends and family actually use WL.

To answer PBear's question, Hotmail's Today page can be disabled by clicking Options > More Options > Today Page Settings, and clicking Skip the Today page and take me straight to my inbox. I don't typically show the Today page, because I use the WL Home page as my entry point for all things Live, and as you noted, it has it's own version of the What's New with Your Network feed.

I think if there's a pearl of agreement in this discussion, it's that Microsoft needs to be more transparent about the connections between their services, and they need to simplify their permissions customization UI.

[Woody]

Greg -

Opinionated responses most welcome.

I've attached a copy of Figure 7-8 from page 577 of Windows 7 All-In-One For Dummies. As you can see, all it says is "Messenger contacts are part of your network on Windows Live." It doesn't say anything about having your information broadcast on your buddy's Hotmail login page.

The PDF file in question was apparently originally posted to http://cid-d7229b252a0ad6f2.skydrive.live.com (as you note, the file isn't there any more). It appears from the URL that's a personal SkyDrive folder.

So we can agree on a few things. But our one big point of disagreement is embodied in this statement:

> [It] puts the onus on you to configure your permissions properly so that kind of information isn't shared

I disagree with that statement. For obvious reasons, I think, the onus is on Microsoft to clearly identify what information will be shared, and to give us the tools - actually, the defaults - to make sure that potentially embarrassing information isn't shared.

[gregsedwards]

Interesting news on this front this morning, courtesy of LiveSide.net: Windows Live Profile Wave 4 to come with enhanced privacy controls

[Woody]

Greg -

It's a welcome improvement, but it doesn't address the primary issue: Microsoft should not automatically convert Messenger Buddies into Live Contacts. MS can prompt, can beg, can cajole, can bribe me into turning Buddies into Live contacts - just as they now try to get me to convert my Hotmail contacts into Live contacts - but subverting the Buddies list wholesale, without my permission and without my Buddies' permission, ain't kosher.

(Pardon for using the archaic term "Buddies" but it's the only one I can think of that fits. MS has used the term "Contacts" in a zillion different ways. What I'm referring to are the people - actually the id's - that have communicated with me via one of the myriad MS Messenger products, which is to say, the id's in my Messenger Buddies list.)

[tayloga]

Re "Centronics parallel interfaces in a USB world" in recent Win Secrets letter:

My solution is to network my (old) machine running XP Pro to my new one running Win 7 Ultimate. You don't need a monitor on the old machine but need XP pro on the old one and Win 7 Ultimate on the new. Type "run" mstsc and you can "see" the old computer on your new screen. With the old printer att'd to the old computer with centronics parallel port connexion I can print through the network on my old HP IIP Laserjet printer which is still in perfect working order (around 20 years old!!)

Have fun!

Allan Taylor (tayloga@sympatico,ca)

[Custom Computers]

Woody, There are times when quality national journalism such as yours overshadows all the blogging and feedback ever created and put into print!

Having read with interest and followed this thread from the start, please know I agree with you completely concerning the Windows Live Suite of services and the social networking aspect. The average consumer user would not be aware of the complexities. From beta days until today, over three years now it has been a test case. Adding, modifying, exposing various forms of data. It continues as we speak to a degree, however your publicity may have influenced some of the changes implemented recently.

Please be aware Microsoft has chosen to modify the settings factor for the sevices. The link I will provide you to a blog post by my friend,Technogran, explains well the function of the above mentioned settings that were just released. Link: http://windowslive.com/Connect/Post/...d-3cabcd6aa470 This information supplements all the guidance Greg has so patiently shared. Sorry to cut this short but must run and remove my home phone number from my profile page.

Read with interest and pat yourself and Brian on the back for your part in bringing about the changes.

Edited to add this from Network World:
Seethis!

[Mike Bourke]

It's my impression that the specific problem lies not in what the system shares with friends, but with how the system defines those "friends" in the first place. They may very well have improved security handling with referance to the former, leaving the real problem unresolved. And, in part, this problem would seem to be naturally inherant in the very purpose of "social networking", which is all about connecting one contact with another, until we are all six degrees of seperation (or whatever) from every other registered user - whether they are a friend, lover, relative, acquantance, axe-murderer, or martian.

There are two obvious solutions: fix the over-lax criteria that the system uses to determine whether or not a contact is a friend (from a universal 'yes' to something more restrictive) or change the name of 'friends' to something less directly threatening to privacy - the "knows somebody who knows" list, for example. The latter would be relatively quick and easy and would mean that the software would continue to grow the social network at breakneck speed - so that is what I forecast will be done, if anything.

[Tom-the1]

Can all this also be connected to the Tracking cookie.Atdmt which M$ seem to have inflicted us with?