Did you know that some Windows 10 installs inject Keeper, a password manager? I just checked my super-clean 1709 machine and didn’t see it. But appare
[See the full post at: Watch out for the Win10 apps: Ormandy finds a 16-month-old vulnerability in bundled Keeper]
![]() |
There are isolated problems with current patches, but they are well-known and documented on this site. |
SIGN IN | Not a member? | REGISTER | PLUS MEMBERSHIP |
-
Watch out for the Win10 apps: Ormandy finds a 16-month-old vulnerability in bundled Keeper
Home » Forums » Newsletter and Homepage topics » Watch out for the Win10 apps: Ormandy finds a 16-month-old vulnerability in bundled Keeper
- This topic has 21 replies, 10 voices, and was last updated 7 years, 4 months ago.
Tags: Keeper
AuthorTopicwoody
ManagerDecember 15, 2017 at 2:23 pm #152305Viewing 12 reply threadsAuthorReplies-
_Reassigned Account
AskWoody LoungerDecember 15, 2017 at 3:40 pm #152333Keeper one of the apps I uninstall first thing along with many of the other apps Microsoft seems intent on providing me no matter if I want them or not. Funny how Microsoft used to tell all users to keep stuff off your PC that you don’t use. Now they simply install this stuff without even offering a opt out. I think pretty much all users can figure out how to install any of these apps if they really want them.
3 users thanked author for this post.
-
zero2dash
AskWoody Lounger -
Cybertooth
AskWoody PlusDecember 15, 2017 at 7:55 pm #152424When I first read that script, I thought it was to remove anything from Microsoft that I didn’t like (“notlike microsoft”, get it?). <grin>
Coulda had loads of fun applying such a script…
-
anonymous
GuestDecember 15, 2017 at 9:41 pm #152439I know that devs pay money to MS to promote their apps on W10 as ‘suggestions’ and that’s OK, but to install them without user permission is bad form. Unfortunately, OEMs and at times MS, do not agree. When this transaction takes place it may only apply to a specific build and not carry over with a refresh. One user confirmed it was pre-installed on their W10 Signature edition – the so called no-bloat version!
I have read several comments online regarding this ‘problem’ and it has been confirmed by users that Keeper is included in the latest W10 ISO they downloaded from the MS Site. I guess it all depends on the tools you use to do a clean install whether it is there or not.
1 user thanked author for this post.
anonymous
GuestDecember 16, 2017 at 4:15 am #152509The few times I’ve found myself doing a clean install of windows 10 (rather than just removing it and installing any other OS) I’ve gotten a lot of pre-installed “down arrow tiles” that say some app is coming, but they never turned into anything (even after I eventually connect to the internet for the first time) and I eventually unpinned them, which left no trace.
Is this normal and/or what everyone else is seeing?
-
anonymous
Guest
Rock
AskWoody Loungeranonymous
GuestDecember 20, 2017 at 5:38 pm #153465The First Amendment protects citizens from punishment by the government for espousing views against the government, in speech, written, or published. There are other protections, but I think this is the relevant portion. It offers no protection from accusations of slander or libel by another citizen or private entity under US law. These charges must be adjudicated on their merit. It is generally held that a true statement cannot be a libelous statement, no matter how much harm results.
A reverse condition arises if the initial charge is proven false, then the accused can file as plaintiff as a damaged party for having their reputation sullied.
Cybertooth
AskWoody PlusDecember 20, 2017 at 7:49 pm #153477As I read Woody’s post, I was wondering if Tavis Ormandy could be related to Eugene Ormandy, the longtime conductor of the Philadelphia Orchestra.
And then when I navigated to this thread, Amazon’s “Shop Related Products” ad to the right is offering me four collections of music performed by… Eugene Ormandy and the Philadelphia Orchestra. <grin>
WildBill
AskWoody PlusDecember 20, 2017 at 8:31 pm #153482It offers no protection from accusations of slander or libel by another citizen or private entity under US law. These charges must be adjudicated on their merit. It is generally held that a true statement cannot be a libelous statement, no matter how much harm results. A reverse condition arises if the initial charge is proven false, then the accused can file as plaintiff as a damaged party for having their reputation sullied.
Notice that Keeper is not suing Ormandy; they’re suing Ars Technica, Conde Nast & Godkin. Assuming they have deeper pockets than Ormandy in case of a win… However, if Ormandy can prove his assertion that the bug has been there for 16 months, he should join the others as defendants if possible.
Bought a refurbished Windows 10 64-bit, currently updated to 22H2. Have broke the AC adapter cord going to the 8.1 machine, but before that, coaxed it into charging. Need to buy new adapter if wish to continue using it.
Wild Bill Rides Again...1 user thanked author for this post.
-
Ascaris
AskWoody MVPDecember 20, 2017 at 11:02 pm #153491The burden of proof is on the plaintiff in a civil case. It’s up to Keeper to prove that the defendants published wrongful and damaging statements, not for Ormandy or anyone else to prove that the statements they made are right.
It’s interesting that Keeper has not named Google in the suit. Ormandy was acting on behalf of Google’s Project Zero when he wrote the blog post in question, and if you want some deep pockets, Google’s got them.
Instead, Keeper is going after Ars for reporting what Ormandy wrote. They’re trying to kill the messenger rather than the author of the message the messenger carried.
Something is fishy about this.
This is a big warning flag to stay well clear of anything Keeper is involved in. Any company that tosses around the sue-hammer that easily is not someone I want to have anything to do with. When I read about this issue initially, I interpreted it as Microsoft screwing up by pushing an older version of the program with a discovered vulnerability from over a year ago, but now I’m thinking that “[Keeper] dost protest too much.”
Interesting bedfellow you got there, Microsoft… you teamed up with a real winner. Birds of a feather, I suppose.
Not a lawyer, IMHO, etc., where applicable.
Dell XPS 13/9310, i5-1135G7/16GB, KDE Neon 6.2
XPG Xenia 15, i7-9750H/32GB & GTX1660ti, Kubuntu 24.04
Acer Swift Go 14, i5-1335U/16GB, Kubuntu 24.04 (and Win 11) -
MrJimPhelps
AskWoody MVPDecember 21, 2017 at 7:25 am #153581My guess as to why they are suing ARS and no one else: Because ARS is the least capable of defending themselves. As you say, Google has deep pockets. They probably have an entire legal dept. with the very best lawyers. Ditto Microsoft. But ARS is just an online publication, likely without the money for a full-time legal staff.
Group "L" (Linux Mint)
with Windows 10 running in a remote session on my file server -
WildBill
AskWoody PlusDecember 21, 2017 at 8:10 am #153592As Woody said in the update to the original blog post, Keeper is suing Dan Goodin (Not Godkin, as I said in another reply; my bad), Ars Technica, & Conde Nast. Conde Nast is a major publisher with magazines & websites, including ARS, Bon Appetit, BRIDES, Glamour, Golf Digest, GQ, The New Yorker, Vanity Fair, Vogue, Wired & others. There are the deep pockets…
Bought a refurbished Windows 10 64-bit, currently updated to 22H2. Have broke the AC adapter cord going to the 8.1 machine, but before that, coaxed it into charging. Need to buy new adapter if wish to continue using it.
Wild Bill Rides Again...1 user thanked author for this post.
-
-
MrJimPhelps
AskWoody MVPDecember 21, 2017 at 7:20 am #153577On December 15, 2017, the ARS Technica website made false and misleading statements about the Keeper software application suggesting that it had a 16-month old bug that allowed sites to steal user passwords. The article contained numerous false and misleading statements. Ars Technica has revised the article twice, but to date has failed to remove the false statements.
Keeper now asserts claims for defamation, violation of the Illinois Uniform Deceptive Trade Practices Act, 815 ILCS 510/2, and commercial disparagement under Illinois law.
I hope ARS has kept good notes as they’ve discovered (and reported) these things.
Group "L" (Linux Mint)
with Windows 10 running in a remote session on my file serverrc primak
AskWoody_MVPDecember 21, 2017 at 9:17 am #153605Suing Ars Technica or any of its staff over their reporting is the very definition of a frivolous lawsuit. Every other tech outlet which has repeated Ormandy’s claim would be open to the same suit, including this site.
In many US States, there is a definition of SLAPP, which is a frivolous lawsuit filed to silence public criticism. This lawsuit may fit the criteria, and opens Keeper to countersuits. In any event, the lack of a retraction from Ars Technica supports the idea that Keeper will not prevail, and Conde Nast has no fear of this suit. But Windows users should have great fear of installing any potentially buggy app when the vendor is so lawsuit-happy.
Meanwhile, I have found some nicely priced Intel based Chromebooks which should handle a Linux install with Crouton very nicely. Goodbye, Microsoft.
-- rc primak
-
anonymous
Guest -
rc primak
AskWoody_MVPDecember 24, 2017 at 10:17 pm #154315Nice try, but the linked discussion thread explicitly states that on ARM Ubuntu 16.04 does not work.
Mine is not such a situation. It’s a very simple option in Intel based (not ARM) Chromebooks to get Ubuntu or any other Linux distro within reason, installed alongside ChromeOS on Intel architecture and never revert into Emergency Mode.
You have to boot the modified Chromebook with a special keyboard combination, but that’s no worse than the multiple screens I have to go through in my Intel NUC desktop PC before actually getting Windows 10 or Ubuntu 16.04 to boot. And so far, no reports of hardware drivers not behaving properly in Chromebooks when the OS switch takes place. I’ll have to see if any hardware features become unavailable when switching into Linux. That depends on the exact model and production run of the Chromebook I may choose.
I already had the second article bookmarked. A Chromebook recovery USB drive is essential if making any system-level mods to a Chromebook. I would not proceed without that guide.
-- rc primak
-
Cascadian
AskWoody LoungerDecember 21, 2017 at 2:57 pm #153671On defamation, disparagement, deceptive business practices, and frivolous lawsuits, it may be interesting to note these will be discussed in terms of Illinois law as it reads in Chicago. Not New York. Historical views of Chicago’s approach to reading law may be interesting. Keeper is playing home court [sic] advantage here.
1 user thanked author for this post.
anonymous
GuestDecember 22, 2017 at 1:38 pm #153805I read this article and enjoyed it. If the Keeper program like Candy Crush is one of several SuggestedApps listed under the following current user registry key then Microsoft is lying when claiming no knowledge of how it gets installed on a computer. Some Microsoft employee had to perform an action to put that in the build.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\SuggestedApps
I deleted all of the values listed when setting up a system and that quelled any further attempted nearly silent installations. Don’t set up an internet connection until you have set new connections as metered connections and have taken a peek at that registry key for every user account!
1 user thanked author for this post.
rc primak
AskWoody_MVPDecember 24, 2017 at 10:23 pm #154317The Keeper App being out of date and insecure reminds me of the versions of Firefox, Flash Player Plugin and just about everything else which Ubuntu installs from their own Repositories. Maybe the change in Ubuntu 18.04 to a new repository will get these apps more up to date, but the mere fact that an app is an old version can happen in anyone’s app store. Users who can install apps from outside official Stores and Repositories have long been encouraged to do so, where possible from the original vendors’ web pages. This advice applies to all OSes which have Walled Gardens of their own versions of apps.
-- rc primak
1 user thanked author for this post.
-
Cascadian
AskWoody LoungerDecember 25, 2017 at 1:33 pm #154402I agree with the advice, and have great respect for a vendor that maintains their own download services. I still have misgivings on being sent to SourceForge or other third party clearinghouses to retrieve software. I am also more comfortable with recognized institutions like universities hosting mirrors.
But a small nagging voice wonders if I am being misled by illusion or poor critical thinking on this. I am curious where your comfort level is.
-
rc primak
AskWoody_MVPJanuary 10, 2018 at 8:28 am #158122I have little fear of installing something bad from Sourceforge, as I look over several tech reviews before trying any new software in Linux. If multiple authors think the Sourceforge version is safe, I give it a go. Otherwise, yes I am skeptical. I always keep a system and data backup on multiple external drives just in case I trust too much. This has happened a few times — more than I care to admit. But rolling back a week has few unwanted consequences, so I feel comfortable with the occasional crash risk or Beta bug.
I would not have up to date Ubuntu software without taking some risks. I feel the same way about Windows software. Just have recent system and data backups, and retain configuration file exports, and trying newer versions may become less scary.
-- rc primak
1 user thanked author for this post.
-
Viewing 12 reply threads -

Plus Membership
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
Get Plus!
Welcome to our unique respite from the madness.
It's easy to post questions about Windows 11, Windows 10, Win8.1, Win7, Surface, Office, or browse through our Forums. Post anonymously or register for greater privileges. Keep it civil, please: Decorous Lounge rules strictly enforced. Questions? Contact Customer Support.
Search Newsletters
Search Forums
View the Forum
Search for Topics
Recent Topics
-
Worrying about how to Backup Yahoo Emails? Try the Yahoo Backup Tool! (Awaiting moderation)
by
jules28
1 minute ago -
Is Aegean Airlines Safe to Fly? A Complete Safety Guide (Awaiting moderation)
by
jacksmith243
1 hour, 48 minutes ago -
Microsoft-Backed Builder.ai Set for Bankruptcy After Cash Seized
by
Alex5723
3 hours, 42 minutes ago -
Location, location, location
by
Susan Bradley
4 hours, 11 minutes ago -
Cannot get a task to run a restore point
by
CWBillow
5 hours, 8 minutes ago -
What is wrong with simple approach? (Awaiting moderation)
by
WSSpoke36
9 hours, 19 minutes ago -
Frustrating search behavior with Outlook
by
MrJimPhelps
6 minutes ago -
June 2025 Office non-Security Updates
by
PKCano
15 hours, 53 minutes ago -
Secure Boot Update Fails after KB5058405 Installed
by
SteveIT
8 hours, 34 minutes ago -
Firefox Red Panda Fun Stuff
by
Lars220
15 hours, 50 minutes ago -
How start headers and page numbers on page 3?
by
Davidhs
1 day, 2 hours ago -
Attack on LexisNexis Risk Solutions exposes data on 300k +
by
Nibbled To Death By Ducks
4 hours, 56 minutes ago -
Windows 11 Insider Preview build 26200.5622 released to DEV
by
joep517
1 day, 10 hours ago -
Windows 11 Insider Preview build 26120.4230 (24H2) released to BETA
by
joep517
1 day, 10 hours ago -
MS Excel 2019 Now Prompts to Back Up With OneDrive
by
lmacri
1 day ago -
Firefox 139
by
Charlie
17 hours, 13 minutes ago -
Who knows what?
by
Will Fastie
7 hours, 34 minutes ago -
My top ten underappreciated features in Office
by
Peter Deegan
1 day, 11 hours ago -
WAU Manager — It’s your computer, you are in charge!
by
Deanna McElveen
1 day, 6 hours ago -
Misbehaving devices
by
Susan Bradley
7 hours, 22 minutes ago -
.NET 8.0 Desktop Runtime (v8.0.16) – Windows x86 Installer
by
WSmeyerbos
2 days, 17 hours ago -
Neowin poll : What do you plan to do on Windows 10 EOS
by
Alex5723
14 hours, 57 minutes ago -
May 31, 2025—KB5062170 (OS Builds 22621.5415 and 22631.5415 Out-of-band
by
Alex5723
2 days, 16 hours ago -
Discover the Best AI Tools for Everything
by
Alex5723
1 day, 15 hours ago -
Edge Seems To Be Gaining Weight
by
bbearren
2 days, 6 hours ago -
Rufus is available from the MSFT Store
by
PL1
2 days, 14 hours ago -
Microsoft : Ending USB-C® Port Confusion
by
Alex5723
3 days, 17 hours ago -
KB5061768 update for Intel vPro processor
by
drmark
1 day, 17 hours ago -
Outlook 365 classic has exhausted all shared resources
by
drmark
1 day, 15 hours ago -
My Simple Word 2010 Macro Is Not Working
by
mbennett555
3 days, 13 hours ago
Recent blog posts
Key Links
Want to Advertise in the free newsletter? How about a gift subscription in honor of a birthday? Send an email to sb@askwoody.com to ask how.
Mastodon profile for DefConPatch
Mastodon profile for AskWoody
Home • About • FAQ • Posts & Privacy • Forums • My Account
Register • Free Newsletter • Plus Membership • Gift Certificates • MS-DEFCON Alerts
Copyright ©2004-2025 by AskWoody Tech LLC. All Rights Reserved.