A report in Sunday's New York Times caused a bit of a weekend to-do, with news that the Registration Wizard in Windows 98 may be easily compromised. While setting up Windows 98, the user is prompted to register the product over the Internet, so that the unique registration code in Windows 98 can be tied to a particular user in Microsoft's databases. The process is optional, but the Times says that court orders could open the database to federal officials, giving them access to information that otherwise would be unavailable.
Perhaps more problematic: If the user setting up Windows 98 has a working Internet connection, the information is sent to Microsoft even if they ask for it not to be sent.
Microsoft's registration process was first found to be a security risk when a programmer from Phar Lap Software discovered that Microsoft Office programs embed unique identifiers in each document, so that the originator of any document can be identified. And the Office registration information is also sent to Microsoft even when the user asks that it not be sent.
Microsoft's group product manager for Windows Robert Bennett says that the registration code will be changed in the upcoming Windows 98 OEM Service Release (OSR), an update to Windows 98 that will be shipped to PC makers later this year. Bennett notes that the information is collected only to aid service calls, not as a marketing too. The existing database of Windows 98 users will be cleaned of any improper information
