I am trying to understand how to block communication from the client to the Microsoft DRM server which from which I understand automatically happens.  The registry key change is only to stop the auto-updating from my understaning *not* the DRM communication. I do not like the idea of any uncontrolled information being sent out beyond our firewall. From the Silverlight 2.0 privacy statement it makes it seem that there is no way to stop Silverlight from trying to talk to the mothership...is this true?

 In another message on this forum posted some time back, it was mentioned that the modification to the registry (via gui or manual) that is supposed to stop the transmission to Microsoft to auto-update "might not" work.  I assume this statement was due to the fact that this is a beta version?  Has anyone tested to make sure that this behaviour will actually stop whether with gui/manual registry change/GPO?

 Has anyone done a sniff of the wire themselves and if so, what was found?  What port, protocol, encrypted?

 Just trying to make the environment safer one packet at a time

 cheers!

I don't think there's any DRM in the current bits, but you can download WireShark and check it out the traffic yourself.

Without DRM support, are you just going to skip watching things like the Olympics or other sites which may use DRM to protect their content?

Privacy is probably a legit concern (everyone's definition is different), but I don't think you're making anything "safer" by trying to block DRM :)

Pete

If your question was answered, please mark the response as the answer.

Silverlight.net Moderator
MVP: Visual Developer - Client Application Development
POKE 53280,0 - My Blog

BTW, do you have a reference for the DRM "phone home" information you posted here? If so, I'd like to read it.

Thanks

Pete

If your question was answered, please mark the response as the answer.

Silverlight.net Moderator
MVP: Visual Developer - Client Application Development
POKE 53280,0 - My Blog

Please note that Silverlight 1.x vs 2.0 beta have different privacy notices. Sorry this is so long.  I am looking at this as a devil's advocate.  This is a lot more work for me if this is an issue so I hope I am wrong.

==================
http://www.microsoft.com/silverlight/resources/license.aspx?v=2.0
==================
[Opt out for registry may be done via reg key or slup.exe it seems.  This should not be an issue as long as it may be turned off which is what we did for v1.x]

7. AUTOMATIC UPDATES. This software contains an Automatic Update feature that is on by default. Microsoft may change or cancel it at any time. You may turn off this feature while the software is running ("opt-out"). Unless you expressly opt out of this feature, this feature will (a) connect to Microsoft or service provider computer systems over the Internet, (b) use Internet protocols to send to the appropriate systems standard computer information, such as your Internet protocol address, the type of operating system, browser and name and version of the software you are using, and the language code of the device where you installed the software, and (c) automatically download and install, or prompt you to download and/or install, current Updates to a previous version of the software. In some cases, you will not receive a separate notice before this feature takes effect. By installing the software and not opting out of this feature, you consent to the transmission of your computer information and the automatic downloading and installation of Updates.

8.  Microsoft Digital Rights Management
[This is where I'm a bit nervous.  I understand there will be some lack of functionality if this is turned off but how can you turn off the communication to Microsoft?]

DRM usage requests. If you use this software to access content that has been protected with Microsoft Digital Rights Management (DRM), the software will automatically request media usage rights from a rights server on the Internet, to enable you to play the protected content. When requesting media usage rights, the software will (a) connect over the Internet to a rights server operated by Microsoft or a third party, and (b) use Internet protocols to send to the rights server standard computer information, an ID for the DRM protected content (music or video) file, a request for permission to play the content, a unique identifier for your computer and information about the DRM components on your computer. You will not receive a separate notice before this feature takes effect. By installing the software, you consent to the transmission of this information. For more information about this feature, see http://go.microsoft.com/fwlink/?Linkid=110406.

[Automatically download and install a DRM upgrade?  In our environment nothing is installed till tested in-house first]

DRM upgrades. Music or video owners who choose to protect their content with Microsoft DRM may require you to upgrade the DRM components on your computer before accessing their content. When you attempt to play content that requires a DRM upgrade, Silverlight will (a) connect to Microsoft or service provider computer systems over the Internet, (b) use Internet protocols to send to the appropriate systems standard computer information, troubleshooting data, a unique identifier for your computer and information about the DRM components on your computer, (c) and automatically download and install a DRM upgrade. By installing the software and attempting to play content that requires a DRM upgrade, you consent to the automatic downloading and installation of DRM upgrades. For more information about this feature, see http://go.microsoft.com/fwlink/?Linkid=110406.

==================
From http://www.microsoft.com/silverlight/resources/privacy.aspx?v=2.0
==================

["generally not personally identifiable"???..."such as" "typically" the language leaves it a bit open]

Internet enabled features in software will send information about your computer ("standard computer information") to the websites you visit and web services you use. This information is generally not personally identifiable. Standard computer information typically includes information such as your IP address, operating system version, browser version, your hardware ID which indicates the device manufacturer, device name, and version, application version and your regional and language settings. In this case, the application version would be the version of Microsoft Silverlight installed on your device. Microsoft Silverlight contains an update notification feature that sends standard computer information to Microsoft.

[Information is then given to 3rd parties as described below]

Information that is sent to Microsoft by this software will be used to provide you with Microsoft Silverlight features and services. This information may be used to improve Microsoft Silverlight and our other products and services, as well as for analysis purposes. Except as described in this statement, information you provide will not be transferred to third parties without your consent. We occasionally hire other companies to provide limited services on our behalf, such as packaging, sending, and delivering purchases and other mailings, answering customer questions about software or services, processing event registration, or performing statistical analysis of our services. We will only provide those companies the information they need to deliver the service, and they are prohibited from using that information for any other purpose.

[automatically request...standard computer information...]

Updating Media Usage Rights. If you access DRM protected content in a Silverlight application (typically on a website), Silverlight will automatically request media usage rights from a rights server on the Internet. You will not be prompted before Silverlight sends the request to the rights server. This helps to ensure that you have a seamless playback experience. When requesting media usage rights, Silverlight will provide the rights server with standard computer information, an ID for the DRM protected content (music or video) file, a request for permission to play the content, information about the DRM components on your computer such as their revision and security levels, and a unique identifier for your computer. The unique identifier is used only to generate rights for your computer and, because it is enclosed in an encrypted request, is not available to the rights server in a way that uniquely identifies you or your computer.

Thanks!

I didn't really explain completely why I threw all the info above.  I just wanted to show that the verbage may allow Microsoft to pull more information then is just listed.  Security is very important to me (its me job ) and I am required to restrict what goes in and out from our systems.  Tomorrow I will attempt to get a capture but assume it will be encrypted (hopefully).  I was hoping someone had done the legwork already or Microsoft had a whitepaper that I didn't know about.

Most Microsoft employees I've spoken with don't understand their own data collection policies or simply don't care / don't see any issue.  (or tell me it's good for us, and that we really want / need it?)  Most users don't seem to care (or probably don't know) that WGA was / is collecting this same type of information either.  My argument has been that if they (and third parties) can uniquely identify any PC in the world, then that is personally identifiable information.  Microsoft's argument is that they don't collect your name, address and phone number.  But with all of the information they collect, like unique hardware IDs, they are effectively taking the equivalent of a DNA profile on each unique personal PC (which could easily be linked to unique individuals).  No matter how, or where, you connect to the internet in the world, they will be able to uniquely identify your PC.  Obviously human DNA doesn't contain names, addresses and phone numbers, but how would most people feel if Microsoft, or any other corporation, collected samples of their DNA when they did business with them?  Make no mistake Microsoft and third parties will make use of every little bit of user tracking info they can get.

I posted a similar question (amongst others) in another post without a reply.

Anyone from Microsoft help address the concerns?  Not looking for a debate just some facts so I can complete my security assessment. 

 Thank you.