France orders Microsoft to stop tracking Windows 10 users
Ah, CNIL.<p>What counts as &quot;excessive&quot;? Apparently whatever someone at CNIL thinks is excessive. I can imagine that Microsoft learning what apps you download is inevitable given their reputation based malware detection scheme: no way for that to easily work except by IE checking in with Microsoft to find out if a program is known malicious or not. And figuring out if a program is actually interacted with or not seems like a pretty good signal to determine if a new, unknown program is a silent botnet or not.<p>&quot;4-PIN limit is insecure, because there&#x27;s no limit on the number of accesses&quot; is exactly the kind of bureaucratic central-planning nonsense that France has so many problems with. You do not need absolute counted limits on a password&#x2F;PIN system to make it secure. You just need to take other steps to make brute forcing infeasible, like throttling the rate of attempts. Why is CNIL attempting to micro-manage the code for the Windows authentication systems, something they are clearly not qualified to do? The details of Microsoft&#x27;s security system is their concern alone: if users dislike the way Microsoft do it, then they have other alternatives they can easily switch to.<p>I suspect Microsoft may do what other big companies do and simply ignore CNIL completely. They can only hand out relatively small fines and it&#x27;s easy for big companies to just pay them off to make them go away. Their rulings have a long history of being completely unreasonable so it&#x27;s usually the easiest path.