Criticism of Microsoft Windows

Did You Know?

• A Google engineer criticized Microsoft for taking 7 months to patch a security vulnerability in the Windows virtual DOS machine.
• A security researcher criticized Microsoft for providing a patch for the Windows ASN.1 implementation only after 200 days.
• Google has criticized Windows for becoming slower and less reliable over long term use.

Data collection

Windows 10's default 'Express' settings configure the system to send various information to Microsoft and other parties, including user contacts, calendar data, and input data for personalization of speech, typing, and inking. Typing and inking data are collected to improve recognition, and apps may use a unique advertising ID for analytics and advertising personalization, a feature introduced in Windows 8.1. Apps can also request location data and send it to Microsoft and 'trusted partners' to improve location detection; Windows 8 had similar settings but did not include 'trusted partners'. Users can opt out of most data collection, but telemetry data for error reporting and usage cannot be disabled on non-Enterprise versions. Cortana requires data such as device location, calendar data, apps used, emails, text messages, call history, contacts, and interaction frequency. Critics argued that Microsoft's intent lacked transparency, with one writer noting that 45 pages of policy documents and opt-out settings spread across 13 settings screens and an external website did not constitute real transparency. Another outlet observed that Microsoft now collects data in ways that would make Google jealous, though the requirement for such data usage had become a norm due to cloud computing and similar services on mobile devices. In August 2015, a Russian politician called for Windows 10 to be banned from Russian government use because it sends user data to servers in the United States, ahead of a federal law requiring online services to store Russian user data on servers within the country.

Digital rights management

After the release of Windows Vista, computer scientist Peter Gutmann criticized the digital rights management (DRM) included in Windows, stating that it could inadvertently disable functionality, potentially shut out open-source hardware through a hardware functionality scan requirement, make unified drivers impossible, and include buggy drivers. He also claimed that if a driver was found to be leaking content, Microsoft could remotely shut it down for all computers using it, causing denial of service, and that the DRM decreased system reliability, increased hardware costs, forced software makers to license unnecessary third-party intellectual property, and consumed excessive CPU and device resources. Microsoft responded that these features would only activate when required by the content being played. Other responses came from ZDNet writers, one of whom published a three-part rebuttal detailing factual errors in Gutmann's analysis and criticizing his reliance on questionable sources. For Windows 7, allegations of 'draconian DRM' spurred debate on Slashdot, but independent tech writers dismissed the claims as faulty analysis; the actual problem was an unrelated issue where a user tried to circumvent Adobe Creative Suite copy protection by changing files.

Integration of Internet Explorer into Windows

From Windows 98 onward, Internet Explorer was integrated into the Windows shell, whereas previously it was shipped as a separate application. This integration made it difficult to replace Explorer with another vendor's product, raising concerns about consumer choice and monopolistic practices, which led to the United States v. Microsoft Corp. court case, settled out of court. Security vulnerabilities in Internet Explorer also created security vulnerabilities in Windows, potentially allowing remote code execution. In January 2009, the European Commission investigated Microsoft's bundling of Internet Explorer, stating it harmed competition, innovation, and consumer choice. Microsoft agreed to include a web browser choice screen for users in the European Economic Area via BrowserChoice.eu. Windows 10 includes Internet Explorer but defaults to Microsoft Edge; Windows 11 removes Internet Explorer except for Edge's Internet Explorer mode for legacy applications.

NSA backdoor allegations

In 1999, a chief scientist found a cryptographic public key stored in the variable _KEY and a second key labeled _NSAKEY in Windows, leading to speculation that the second key could belong to the National Security Agency and allow subversion of user security. Another researcher discovered these keys and a third key in the ADVAPI.DLL file in Windows 2000 before its release. Concerns were raised about CPUs with encrypted instruction sets that would have made key discovery impossible. Microsoft denied the allegations, attributing the key's name to a technical review by the NSA that pointed out a backup key was needed for regulatory compliance. No evidence beyond the key's name has been presented that it enabled a backdoor. A cryptographer argued that if the NSA wanted a back door with Microsoft's consent, they would not need their own cryptographic key. These keys have been included in all versions of Windows from Windows 95 OSR2 onward.