A recent scare piece by Cryptocat developer Nadim Kobeissi over on Gizmodo alleges that Windows 8 will tell Microsoft everything the user installs into the new OS. The reveal is based on the RTM version of Windows 8 which offers a new feature called Windows SmartScreen. This feature is turned on by default, and is the culprit behind what Microsoft reportedly knows about the installed programs. According to the report, Windows SmartScreen is merely supposed to "screen" every application the user installs from the Internet, and inform the user if it's safe to proceed, or too evil to install. But there's more to it than that. Kobeissi provides an example of installing the Tor Browser Bundle. Once the installer is opened, Windows SmartScreen gathers information about the application and sends it to Microsoft. If the company responds saying that it doesn't have the proper certificate, then the user gets an error like the one seen here.

SmartScreen appeared to connect over HTTPS to a server in Redmond (apprep.smartscreen.microsoft.com, 65.55.184.60, run by Microsoft) in order to communicate information about the application I was trying to install.

After running some tests on this Microsoft server, I discovered that it ran Microsoft IIS 7.5 to handle its HTTPS connections. The Microsoft server is configured to support SSLv2 which is known to be insecure and susceptible to interception. The SSL Certificate Authority chain goes down from "GTE CyberTrust Global Root" to "Microsoft Secure Server Authority." The Certificate Authority model is itself susceptible to some serious problems.

I haven't checked whether Windows SmartScreen does in fact use SSLv2, but the fact that the Microsoft servers support it is concerning. Furthermore, SmartScreen is not easy to disable, and Windows will periodically warn users to re-enable it should they attempt to disable it.