I Was Carded by Windows Vista
|
Is anyone else confused by how Microsoft checks whether Vista copies are genuine? |
The process seemed pretty clear to me, until yesterday; I got an unexpected validation prompt when attempting to download Windows Mobile Device Center Driver for Windows Vista. According to the Windows Vista Welcome Center my operating system had been validated. A "genuine" badge indicated so.
I figured that if the additional validation confused me, other people might wonder, too. So, this evening I spoke with David Lazar, director of Microsoft's Genuine Windows initiative, who tried to make sense of the tiered-validation approach.
Some background: With Windows Vista, Microsoft introduced new anti-piracy mechanism SPP (Software Protection Platform), which basically bakes into the operating system "genuine" checks that had previously been done separately for Windows XP. Initially, for XP, some Microsoft downloads required a validation check to ensure the operating system hadn't been pirated. Later, Microsoft issued a WGA (Windows Genuine Advantage) notification tool through Windows Update to XP PCs.
With Windows Vista, the validation process is built in as part of SPP. For consumer PCs, Windows Vista activates and validates after installation. Later, Microsoft can trigger a revalidation through Windows Update, as it did to stop the so-called Frankenbuilds.
Lazar said that Vista also does a "silent" validation check when Windows Vista Ultimate users download Ultimate Extras. If Windows Vista fails either of these validation checks, the software essentially becomes unusable after 30 days, unless reactivated with a valid key code.
For businesses, the SPP mechanism requires Vista to essentially phone home--either to a Microsoft or corporate server--within every 180 days. Any copy of Vista that validates could invalidate later should its product activation key be flagged by Microsoft as being pirated.
Because Microsoft has baked the anti-piracy check into Windows Vista, I was taken aback when prompted to validate for a Web download. While Lazar tried to explain the rationale for yet another validation check, I had trouble accepting the logic. I suggested that it was like getting carded and then again and again.
"That's a very good analogy," Lazar said. "You go to a club and you get checked at the front door--and at the bar, because not everyone comes in through the front door."
If the download validation is the check at the bar, fine. But I suggested that people using Vista would have come in through the front door because of the validations done by the operating system. Maybe, but Microsoft has no set schedule for doing Windows Vista revalidations, Lazar explained. A piracy outbreak or event, like the Frankenbuilds, would trigger a revalidation.
Microsoft chose the approach for transparency, so that there would be no ongoing phoning home to check the software's legitimacy. Hence, the additional check for software downloads from the Web.
"By doing this online, we're being upfront with users," Lazar explained.
The process also accomplishes two important processes, from Microsoft's perspective: curbing piracy and "letting customers know they're getting something special" for using "genuine software," Lazar said.
I suggested that some people might balk at the extra checks, that something more invisible would be better. Apple takes this approach with music purchases from iTunes. The rights management is fairly invisible, unless there is attempt to violate usage rights.
While chatting with Lazar, I asked about Ultimate Extras downloads. I download the "Hold Em Poker Game" while we continued to talk. There was UAC (User Account Control) prompt but no visible validation check. I expressed concern that some users might be confused by the behavior--a prompt for software from Microsoft's Download Center but none for Ultimate Extras through the operating system.
Lazar said the Ultimate Extras download process "makes a call to [product] activation" for validation. That kind of process is exactly what would make sense to me for all downloads, because the user had already been validated through Windows Vista.
From an anti-piracy perspective, there is sense to Microsoft's approach, particularly in doing much software legitimacy checking without offending users. The company already took heat during the summer for WGA notifications phoning home. So, I can see why revalidation is trigged for businesses by a set time period (180 days) or piracy problem, like Frankenbuilds, for consumers and businesses. Downloads act as another regular validation trigger.
As for "genuine" benefits, people getting Ultimate Extras know they're getting something special. Validation at the Download Center could communicate similar sentiments to users, although some people are sure to balk.
By the way, invalidation during the Web check acts the same as one done by the operating system. Once invalidated, Windows Vista will countdown 30 days to essential uselessness, unless reactivated with a valid key.
WGA and SPP have been hot topics among Microsoft Watch commenters. I encourage further, candid discussion. Someone at Microsoft will read the comments. Microsoft Watch readers please express your views, which could impact how the anti-piracy mechanisms change over time.
Related Posts:
- Another Vista Activation Crack Appears, Dec. 27, 2006
- Mom's Genuine Holiday Surprise, Dec. 21, 2006
- Vista Anti-piracy Effort Will Drive People to Linux?, Dec. 14, 2006
- Who's Afraid of a Monster?, Dec. 14, 2006
- Vista Crack Means Big Trouble, Dec. 8, 2006
- WGA: Friendly Face, or Saving Face?, Nov. 29, 2006
- My Mother is a Software Pirate, Nov. 14, 2006

Comments (19)
This phoning home is one reason why I can't upgrade to Vista. Literally, I can't. I use Pro-Tools, a digital audio program which is on a separate computer which is not connected to the internet (it would just be a distraction). So if Vista wants to phone home, it's gonna have trouble.
I have absolutely no intention of hooking up my computer to the internet every 30, 60 or 90 days, just so I can reassure Microsoft that I'm not a criminal.
I realise they have to have a crack at piracy, but this is just punishing honest users like myself.
The next PC I buy will be a Mac. Pro-tools works great on that, and Apple hasn't made me once validate the fact that my iPod was bought legitimately. With the advent of things like Parallel's, I'm sure I'm not the only one.
I'm not an MS-basher, I'm a fan of competition, and Microsoft would not be competitive right now if they didn't hold something of a monopoly.
Posted by Ben Gray | February 1, 2007 10:32 PM
The webs we weave!
It would be nice if we could get a version of Vista that validated against a USB dongle.
Posted by Ed Goward | February 2, 2007 4:21 AM
Doesnt this seem a little overengineered ? What will happen to the poor lone corporate SMB user who has his PC disabled and cant get back into it ?
(How many users actually act on prompts these days?)
Given the low quality coming out of Redmond these days, how long till the system breaks ?
I can predict howls of protest in the coming years.
---* Bill
Posted by Wild Bill | February 2, 2007 4:29 AM
Joe
Nice mountain you have made here out of the "perverbial" mole hill !
Keep trying if you throw enough mud at microsoft I am sure some of it will stick "eventually" !
How about some "NEWS" rather than all this "OPINION" !
Lately a lot of your articles have ONLY been commentaries.
You keep on posing "QUESTONS" ! No hard solid facts mate !
News stories should not be asking questions of your commenters, they should be stating some facts !
Like several people have said to you in the so distant past "Slow news day Joe"?
There are there is a question for you !
Posted by Neil | February 2, 2007 6:50 AM
Fact: Microsoft Vista calls home every 180 days.
Fact: Microsoft can cause validation when an outbreak/hack occurs.
Fact: If not validated, the operating system becomes "useless".
Fact: Useless used with detail is useless ;-) (what functions become disabled...would have been nice to see that list).
Fact: Microsoft is a US company...
Which leads into my question. Why aren't governments, businesses, etc. raising a stink about an operating system that can be disabled at will?
Theory 1: US/UN needs to levy sancations or provide a police force for a spcefic country....US orders Microsoft to disable the operating system.
Theory 2: Hackers develop a method to redirect validation and render the operating system 'useless'...for everyone on the planet.
Theory 3: Wide spread ban on Vista's use in the government sectors (due to theory 1). Wide spread ban on Vista's use in school systems (computer lab's strict no-internet policies.). Wide spread ban on Vista's use in businesses (realtime businesses cannot risk their operating systems....not operating).
Theory 4: Consumers don't understand the hidden dangers and Vista will be a huge success.
Theory 5: Consumer rights based class action suite. I am now required to use the operting with an internet connection whereas before, I was not required.
Let me put these fears in context....I'm an MCSE(Microsoft Certificated Systems Engineer). I've also been an MSDN subscriber for almost 10 years. I support Microsoft products;however, these are now very real situations that no one seems to be addressing.
My English teacher from long ago will commend me....read George Orwell's '1984'. Do your own comparisons.
Posted by Daniel | February 2, 2007 10:20 AM
So what happens if you have bought a valid key and some joker happens to stumble across it as valid and posts it to the 'net as a cracked copy? Is microsoft saying they will nuke your legitimate copy? Are they going to give such a person a new license key/sticker? And how long will it take them to compensate such a person? Are they going to pay the legitimate consumer for the time they are denying them access to the computer?
Posted by Methuss | February 2, 2007 11:48 AM
So how does the Microsoft validation work with the versions sold in China for 7 Yuan? News article yesterday indicated the vendors were selling copies of Vista with a money back guarantee. Most of the buyers were foreigners. Apparently they are not affected by the validation process.
Posted by Steve | February 2, 2007 12:43 PM
Daniel, actually the threat of #2 is more like:
Spyware kicks actual users key to a server. Then it starts generating Vista keys, using MS's own servers to validate that they are indeed good. Send those on to the server.
Server takes the keys and posts them on various sites, specifically to make sure that they get MS's attention (or hell, have the damn spyware post the keys).
MS then proceeds to find out they're revoking keys faster than they are actually selling them.
That's the problem with the approach that MS is using, it can, and I'm very much afraid that it will be used against them.
Posted by Bryan Price | February 2, 2007 12:58 PM
I used Windows 2000 until a couple months ago, when I bought an XP Media Center PC. I'm looking forward to the Vista upgrade that HP is sending me.
I will however be hanging on to my Windows 2000 CD; the last OS that can't be remotely crippled or inflicted with annoying pop-ups at the whim of others.
Posted by Roger Strong | February 2, 2007 1:12 PM
The Redmond folks appear to have reached a level of "inbredness" that has them spouting nonsense and believing that they are saying something meaningful. As a career software developer I despise pirate s/w, but don't punish me, the honest buyer, to get to the few pirates. For Lazar to say we are "getting something special" for using genuine software" is ludicrous. It's like making a purchase at a store and as you walk out the security alarm rings. Lazar wants shoppers to hurry back to the register, but I refuse and keep walking. I've paid for my items, I'll not assist the store with managing security. Neither will I assist MS fight piracy. It does NOT serve me, only MS.
Lastly, I don't buy a computer with the anticipation of joy over the operating system. The OS is supposed to sit quietly in the background and allow me to use the PC for my needs. Microsoft seems to be turning that idea on it's head.
I have to thank Mr. Gates and Mr. Lazar. I've wanted to try Linux or an Apple for years. Now, my next PC will be one of those.
Posted by Richard | February 2, 2007 7:18 PM
I gave up on Microsoft long ago, and with Vista I just shake my head in wonder.
Methuss asked, "So what happens if you have bought a valid key and some joker happens to stumble across it as valid and posts it to the 'net as a cracked copy?" The answer with my daughter's copy of XP (for which we paid 3 figures) was "invalidation". Microsoft was judge, jury and executioner. Her XP works exactly like a copy I could have downloaded from the Internet for free, if it weren't for my pesky morals.
Fool me once, shame on you, Microsoft. You'll not get the chance to fool me twice.
Posted by George | February 2, 2007 11:26 PM
This tight activation and WGA integration into vista is a real deal breaker for me. I'll stick with XP and maybe switch over to mac in the future, using bootcamp to have both xp and mac on the same unit to ensure compatability with my old windows apps.
Posted by Fritz | February 3, 2007 4:14 PM
Thats fine i'll love this new system.
All we have to do is visit our friends family goverment departments etc write down their key codes off their puter boxes put them in our own and then microsoft can essentially lock itself out of the world!
If we all did it Microsoft would get the message we simply had enough of its bullying tactics and i can tell you idiots at microsoft the franken builds outclass your encrypted drm hql genuine advantage communist crap.
Like I say to everyone: locks are to keep out the honest person as anyone else just laughs at it.
The talk about piracy the lock mechanisms etc are encouraging the new generations to take it up like underage drugs.
Watch vista die! and microsoft!!!
Posted by Joseph Francis | February 4, 2007 9:00 AM
There is always Linux. A well put together Linux distro is Ubuntu, which works with just about anything you can throw at it. The ports tree "free software" is awesome and installs with a simple couple of clicks.
Oh and did I mention it is free and there is no phoning home.
http://www.ubuntu.com/
Posted by Linux guy | February 4, 2007 3:52 PM
Let me comment on Vista Speed. We were running XP-64 on an Intel D945 Sys Board with a 3.0 Pentium D CPU with 1gb memory and raptor hard drive. We ran a series of network, hard drive, and CPU benchmark tests.
Then we installed a clean copy of Vista Business Edition.
In almost every speed comparison, Vista was almost 1/3 slower. We are going to do more tests this week to confirm, but if this is really the case, how much is Vista really worth?
Posted by Chuck | February 4, 2007 5:01 PM
I simply cannot believe the mentality of some of the posters here defending MS WGA SPP or whatever you wish to call it. It is simply a invasion of your privacy. And to further insult the intelligence of fellow computer users some of the posters throw mud at the authors and or others who dare question Microsoft’s anti piracy approach. MS truly loves folks that not only defends its anti piracy initiatives but champion it as innovation. I have asked myself over and over why anyone would defends MS actions and quite frankly short of being a MS employee or heavily invested in MS to the point where their income is based on a invest in MS I cannot see any reason to support this. These folks are going to buy the software no matter if MS has piracy checks or not and pirates are going to use and circumvent the checks as they see fit. This leaves John Q Consumer to just let MS pop into the family PC any old time MS wishes. So the logic of the folks is flawed from any angle you look at it. Of course I will be labeled a pirate because I choose to speak out rather than deal with the issue as it’s an easier path for them to take. But this would however explain why their logic is in line with MS. They look at it from the standpoint that you’re guilty until you check in ever so often to continue to prove you are innocent. I guess we are lucky our judicial system and governments do not work this way. My home and cars cost considerably more than any MS operating system. My home and car also contain intellectual property but they do not need to phone home to Acura to make sure my car is valid for the next 180 days or it will go into reduced functionality mode until I prove I am the owner. Not does my home phone back to local government to make sure I paid my taxes or my home will be placed in reduced functionality mode until I pay my property tax. If they sheep want to follow Bill’s flock then so be it. I for one have never been a Linux or Apple fanboy but thanks to MS they are pushing me that way. I just bought a new PowerMac that dual boots OSX and Windows XP. What I can say for absolute certainty is that the only operating system coming off that machine one day will be Windows XP and the one OS that will never see the light of day is Vista on my Mac. If anything Windows XP will be replaced with Linux. Does MS CARE? Certainly not but considering my household have five desktops and three laptops that will never see past XP. That’s a cool $3192.00 in Vista that I will not be spending ($399.00 VUEx8 license=$3192.00). Which can be used to replace other PC’s with Mac’s or desktops running Linux.
Posted by Scott Freeman | February 6, 2007 8:07 AM
Its bad enough that in my current job I've seen this a few times already since Vista's release in January to John Q. Public. "Call Microsoft. It's a problem with Windows Genuine Advantage," is my answer to their concern.
Telling them something they don't want to hear is met with the expected anger at my company. I can't back down, since it's not our fault.
"Microsoft thinks you're a pirate. We have no control over this since we didn't create the operating system. Furthermore, calling the computer's manufacturer isn't going to do any good either. They'll tell you to call Microsoft. You _must_ go straight to the heart of the problem by calling Microsoft. If you don't want to go through the hassle with this kind of garbage, get a Mac or install Linux on this computer."
This usually diffuses the bomb. The customer understands they have to call Microsoft. But, in more than half the instances, I've been asked to explain the alternatives. I usually start with showing them the Macs we have available. I often end by demonstrating Ubuntu from a Live CD, handing it to them after the demo, and saying, "Here, I've got more copies where this came from. It's free as in beer and free as in speech. If you like it, copy it for your friends. No one will call you a pirate for it." The next time it happens, I'll be able to add, "Ubuntu is so well designed and supported that Dell is shipping it on some of their desktop and laptop systems."
I dread the next mainboard replacement I have to perform and having to tell the customer to purhcase a new license because of Microsoft's EULA.
My job is to provide solutions for my customers. While Microsoft and the rest of Windows-based software industry has solutions available for most needs, the bottom line is that Microsoft has to stop abusing it's customers. Piracy _is_ a problem, but abusing customers _is not_ a solution. This is not win-win for anyone. In the long run it's likely to cost Microsoft a lot more than just pirated software.
Posted by Chris | May 6, 2007 2:59 PM
My first Microsoft experience was DOS 4.2 ... then the very last DOS version (6.?). From there, I went to Win3.1, to Win95, to Win98SE, and then to XP. But starting with XP, I noticed the beginnings of an invasiveness I didn't like. And when Vista came out, the invasiveness implied seemed more like a dog collar than a security solution ... so much so that I refuse to upgrade to it.
Ubuntu (Linux) is beginning to look very good to me. And I predict that if Microsoft cuts off support for XP to "force" Vista upgrades, I won't be alone for very long.
Posted by J. Alec West | May 8, 2007 9:13 PM
The sinario where legitimate keys are distributed by pirates to be flagged by MicroSoft as comprimised is interesting. It appears unlikely that they'll cause a problem for major Corporate/Government networks though. A great many such networks still run Windows 2000 service pack 2 or even NT due to better stability and/or security than subsiquent MicroSoft OSs. The lack of updates isn't a problem becasue security is taken care of by perpose built software from non-MicroSoft sources.
It might also intrest some of you to know that the EU has recently slapped MicroSoft with the highest fine on record for continued non-complience with antitrust laws. MicroSoft is appealing the fine in the EU's supreme court.
What I think is happening here is a major shift in how we understand intellectual property. MP3s have now eclipsed all other audio media. Even while we make examples of individual music pirates, we continue to market MP3 players. Even MicroSoft is in with the Zune device. How, I wonder do they justify such vigorous anti-piracy protection of their own intellectual property, while marketing a device that so clearly promotes the theft of someone else's? Even so far as to build in a wireless device-to-device media sharing capability...
As for my own veiws, I support the freedome of information. Including intellectual property. I don't at all mind giving credit to the property's owners, and even finantial contribution. Provided the owner created the property, and that the finantial contribution be preportionate to my satisfaction with the intellectual property in question. Windows, any version, would thus not command a large contribution, and a song by Luis Armstrong would be public domain and require no contribution at all as Mr Armstrong (the creator of the intellectual property in question) has passed on (and therefore no-longer owns anything).
Posted by Red Threat | March 20, 2008 5:11 AM