What does Microsoft do with my contacts list?

I have to be honest that right now after reading your post, druellan, I am not quite sure how to proceed.  Have you done anything special, other than posting here?  And opting out of their service?

And this business of sneaking a peek at our contacts list isn't so cool and might even fit in as a violation of some right.  But which one?  No Peeking At My List Of Friends Right?

To be clear, I was only trying to login to a Bitdefender service using my MS account. AFIAK the API is open, so, anyone can add Live Connect to their service, no need to be a partner or something like that.

The service must declare the information it needs to allow access (email, profile, etc). Seems that in this case Bitdefender needs at least an email, a first name and a last name:


The first and last name are part of the profile, but looks like MS is providing access to a lot more, just because the service needs a name.

The problem I have with that, is that even if Bitdefender is asking only for a name, if they later change their mind and start mining my contacts, I'm not going to receive any notification, because I already granted permission to access it all, and as I see it, my contacts are not part of MY information, so, even if I trust Bitdefender eyes-shut, this is something I don't feel comfortable sharing around.

In sum, no, I don't think Bitdefender is to blame here, and yes, I believe that the "contacts and friends" part is not implicit, and perhaps an attorney's idea, but anyway is not something I'm going to overlook.

The 'Edit' option for the apps on https://account.live.com/consent/Manage cannot edit individual permissions (yet?), it's all or nothing.

Yes, this is my concern, I have the feeling that even if an external service is requesting access to only my avatar, I'm forced to grant permission to ALL my profile, and trust them (and their partners) not peek other things. This is something I'm not going to do lightly. If we then add the "contacts and friends" thing, it is an instant red flag for me.

Hi druellan,

At least phone numbers and birthdays of contacts require separate permissions. - There is a sample at the bottom of page 2 in this thread, from a Nokia to Microsoft account transfer app that I used at the time.

What I mean by 'all or nothing' is that you cannot opt out of one app requirement without removing the app altogether.

Microsoft's business model changed during 2015, so the Privacy and Terms of Use are adjusted accordingly.

When something is free, you're not the customer, you're the product.

--

Hans

Microsoft's business model changed during 2015, so the Privacy and Terms of Use are adjusted accordingly.

When something is free, you're not the customer, you're the product.

While I agree with that, I don't believe it is applicable in this case. Remember, anyone can add this functionality to their page. MS has no gain on providing this information, in fact, I they are truly into the metadata business, they are giving the product for free.

I believe this is just a lazy segmentation of the permissions. Looking at the API, seems that you can indeed have access to contact's names using the basic authentication, but NOT the email, and birthday is going to trigger a new level of access.

https://msdn.microsoft.com/en-us/library/hh243648.aspx?f=255&MSPPError=-2147217396#contact