14 ms·
Every 30 minutes Windows 10 sends all typed text to Microsoft
- CmonDev 11y agoNot to defend them, but in modern world my assumption is that everything I do on the machine is recorded by someone. As long as my bank account is not affected, not sure I care.
- irishcoffee 11y agoHope you don't do online banking.
- JustSomeNobody 11y agoIt's very sad when people just give up like this.
- deleted 11y ago[deleted]
- miguelrochefort 11y agoCan someone explain this?
- fixermark 11y agoIt's not giving up; it's embracing a set of risks for a reward. The question is whether one feels the set of risks and the reward are too ill-defined to make the trade worth it. Microsoft appears to be in the business of trying to build a fully-functioning virtual assistant. If they're solving that problem with big data, they need a full stream of the user's behavior to operate on. But the tradeoff---an actual, working virtual assistant---could very well be worth it to people for whom that personal information is not worth hiding from a corporation with no vested interest in undermining their customer base by irresponsibly divulging that data. If anything's sad, it's that we live in a world where some people do not have the freedom to treat their private info so loosely. That's a true tragedy, because there will increasingly be technologies they can't take advantage of.
- RankingMember 11y agoI think they should definitely have the freedom to treat their private info loosely, but I think that the decision itself should be an Opt-in rather than an Opt-out affair. We shouldn't have to build our own tools to turn this off.
- mike-cardwell 11y agoWhy not run an operating system which doesn't do this instead? I.e, any major non-Ubuntu Linux distro. Debian's pretty good.
- sokoloff 11y agoI'd like to ask a short diversion question: why specifically not Ubuntu?
- mike-cardwell 11y agohttps://www.eff.org/deeplinks/2012/10/privacy-ubuntu-1210-amazon-ads-and-data-leaks https://www.eff.org/deeplinks/2012/10/privacy-ubuntu-1210-am... I assume the same sort of stuff is happening on Ubuntu today, but I stopped using Ubuntu on the desktop/laptop when this came out and started using Debian instead.
- em3rgent0rdr 11y agofact checking: in 2014 Ubuntu make the amazon unity thing opt in: http://www.omgubuntu.co.uk/2014/03/ubuntu-make-amazon-product-results-opt-unity http://www.omgubuntu.co.uk/2014/03/ubuntu-make-amazon-produc... but regardless, they've lost too much respect/credibility for including it in the first place, so I wouldn't trust them in general.
- seyfulislam 11y agoWhy would you not recommend Ubuntu? It's been several years since last time I use desktop version but it was pretty good then.
- codingvelocity 11y agoUbuntu implemented the Amazon lens by default a few years ago. People got cranky about it.
- mike-cardwell 11y ago
- Lawtonfogle 11y agoAs long as your aren't the current group it is popular to pick on and you don't anger (or make fall in love) anyone with significant power, you'll probably be fine. I'm sure there were plenty who didn't care about slavery as long as they weren't the slaves.
- wtbob 11y agoI wonder if Microsoft also send typed-in passwords to themselves.
- blackbeard 11y agoThey do by default: http://i.imgur.com/NSQs5Ux.png http://i.imgur.com/NSQs5Ux.png
- Oletros 11y agoThis setting has nothing to do with the question the OP did
- mryan 11y agoIf passwords are synced between devices, they are presumably being stored on MS servers.
- Someone1234 11y agoThat's not what they were asking. They were asking about if TYPED passwords are sent (meaning keylogger style). You're talking about password manager syncing. To just give one example, if typed passwords are sent them passwords typed into Chrome are sent, if only the password manager is synced then that only impacts IE or Edge users.
- antsar 11y agoWe collect passwords, password hints, and similar security information used for authentication and account access. Source: https://www.microsoft.com/en-us/privacystatement/default.aspx https://www.microsoft.com/en-us/privacystatement/default.asp... (Click "Learn More" under "Personal Data We Collect")
- yk 11y agoThis sounds like the reasonable interpretation is, they are reading the passwords for MS accounts like hotmail. But IANAL, perhaps one should use the most hostile interpretation possible.
- knowaveragejoe 11y agoAnalysis here: http://localghost.org/posts/a-traffic-analysis-of-windows-10 http://localghost.org/posts/a-traffic-analysis-of-windows-10 Doesn't look like the original source of the info is very trustworthy, will need other people to verify this.
- 16bytes 11y agoAgree, this is large enough an issue to verify its validity. If true, however, it is very problematic and of questionable legality (e.g. unintended HIPAA data disclosures etc). Apparently people will have to start to invest in configuring outbound firewalls on their network to prevent various phone-home operations.
- knowaveragejoe 11y agoI have a feeling that there is a grain of truth in some of it, however the wholesale keylogging and what is basically searching for pirated content after keywords are typed is probably not real.
- blackbeard 11y agoI think that depends on what data people manage to sue out of them and then react upon...
- emodendroket 11y agoYeah... the backlash seems kind of predictable even for cartoonishly evil software companies.
- blackbeard 11y agoThe problem is that it's TLS encrypted traffic going from a black box component to a remote black box service so it's pretty hard to determine what is going over the channel. Without extensive and complex reverse engineering, you can only infer what is going over it and draw some hypotheses that need to be tested. I think that the article is spot on with respect to that. And of course there is no word from the horse's mouth (Microsoft) at all on ANYTHING related to this. Silence is always worrying.
- guardian5x 11y agoIs there any other reliable source for this? Extraordinary claims require extraordinary evidence. Having a keylogger in the system by default sounds like a move that would exclude MS from competing in any businesses in the future. A move that seems illogical. So it would be nice to back that story up with some more information.
- amelius 11y agoWhen using Google Docs, the same thing happens :) It is just part of the new trend, that everything runs in the cloud somehow.
- tomswartz07 11y agoYou're technically correct, but: Do you type passwords and other private information directly into GDocs? What about other things you type on your keyboard? There's a difference between knowingly entering information into a 'cloud' system, and having a core OS collecting all keystrokes.
- fixermark 11y ago> Do you type passwords and other private information directly into GDocs? Of course! Why on earth would I trust passwords in some random third-party password locker when I can instead store them in a heavily-secured Drive doc behind the one account I have with a regular password rotation schedule and two-factor authentication? It's where I keep my bank account numbers and last will and testament too. ;)
- czechdeveloper 11y agoAbout information source: Aeronet.cz is known Russian propaganda website in Czech. Nothing close to credible source. I don't judge content, but this should be noted. Just try https://translate.google.com/translate?sl=auto&tl=en&js=y&prev=_t&hl=en&ie=UTF-8&u=http%3A%2F%2Faeronet.cz%2Fnews%2F%3Fs%3DMH17&edit-text=&act=url https://translate.google.com/translate?sl=auto&tl=en&js=y&pr...
- JosephRedfern 11y agoSee also: http://imgur.com/Aq0vBpb http://imgur.com/Aq0vBpb
- blackbeard 11y agoTo be fair that's no worse than the celebrity trash splattered all over the MSN home page for example..
- czechdeveloper 11y agoPoint is: Russia, Russia, Russia is great on Czech website. I'm just saying, for us it's on par with your prisonplanet.com
- blackbeard 11y agoI'm in the UK so no prisonplanet.com. We do however get RT here :)
- tired_man 11y agodespite being a propaganda rag, they still have brought to light something that should not be happening, as others in this thread have noted. MS wants to collect massive amounts of information from Windows 10 installs.
- amlgsmsn 11y agoI don't see how making up lies is a good thing, unless one is pushing an agenda. Reminds me of the DRM FUD against Windows 7[1] and the fake benchmarks claiming that Windows 7 was eating up memory and was slow[2]. And they end up getting a lot of attention and page hits from sites like this, so it's a vicious cycle, with people repeating this 'information' to others. [1] http://tech.slashdot.org/story/09/02/16/2259257/draconian-drm-revealed-in-windows-7?sbsrc=thisday http://tech.slashdot.org/story/09/02/16/2259257/draconian-dr... [2] http://www.zdnet.com/article/why-we-dont-trust-devil-mountain-software-and-neither-should-you/ http://www.zdnet.com/article/why-we-dont-trust-devil-mountai...
- Beltiras 11y agoIt's in the privacy policy. I didn't believe what I was reading. Windows 10 is unusable for anyone handling any sensitive data. Think doctors, psychologists, anyone under an NDA. https://www.microsoft.com/en-us/privacystatement/default.aspx https://www.microsoft.com/en-us/privacystatement/default.asp...
- dr_zoidberg 11y agoCould you point in what part they explicitly say so? I just skimmed through the text and couldn't find any reference to keylogging, in whatever "legal terms-friendly" way they could write it.
- robotkilla 11y agoUnder Windows click "learn more" and then read under "Input Personalization". I'm considering using a secondary computer (linux) for all of my personal internet activity and making my windows box purely game dev / gaming.
- dr_zoidberg 11y agoIt's right there, thank you. It says it can be turned off, and that Cortana will not work after you do that. Considering I live in a Cortana-less country, it shouldn't be a problem if I ever migrate to Win10. However it's be best to see how they handle this.
- maze-le 11y agoI am using the setup you describe since about two years now. I mean, my Arch-Linux machine is bugging me off sometimes, especially when a update cracked something, and I have to downgrade again. But everytime I read news like that, I am glad to have it as my primary machine (where I know exactly what goes on under the hood)...
- jeremiep 11y agoI've stopped gaming on PC about 5 years ago and couldn't be happier. Consoles don't have this constant hardware upgrade cycle and you're free of Windows. In the long run I think I've actually saved a bunch of money; I used to buy high-end graphics cards easily worth two consoles and now I spend that money on more games :) Took me a few weeks to completely replace my Windows workflow in OSX and Ubuntu but I'd say the broader perspective of knowing all three platforms when being a programmer is well worth the investment! I'd have to say, Uncharted played a small role in this transition; I've been blown away by this series and they're not available for PC, so there :)
- mahouse 11y agoOff-topic, and please believe me I'm not trying to start a flame war, but I'm really concerned about this and I think it could be time to switch -- is OS X any better in this regard? I had heard it has been phoning Apple since forever. (I'm not going to consider Linux for a desktop)
- l1n 11y ago>I'm not going to consider Linux for a desktop) Why not at least consider it? I run Arch + GNOME3 on my desktop and I haven't had any insurmountable problems, nor any that would be easier to solve in Windows.
- cJ0th 11y ago> Why not at least consider it? That is a fair question. However, it all depends on your personal use case and because of that Linux just isn't an option for most people. If you value gaming you can fine tune wine till the cow comes home ... it will never feel (always) right. If you're into music production Linux gives you another "screw you!" Then, there is this huge amount of software for which it seems as if Linux offers reasonable alternatives. But if you really consider what a user actually wants Linux doesn't cut it. For example, Word could be replaced with Libre Office or (my personal favorite) an intriguing combination of markdown and pandoc. If, however, Word is what you want to use (even though I do not understand that) then every click that is different poses as a minor frustration that together with all the other minor frustrations adds up to a huge disappointment.
- jdbernard 11y agoHave you looked at UbuntuStudio or other similar distributions? I'm not running a professional studio, but I do a fair amount of audio recording and production entirely in Linux for bands I plan in and personal projects.
- cJ0th 11y ago> Have you looked at UbuntuStudio or other similar distributions? I haven't but I worry that some VSTi plugins might not work. For example: https://www.winehq.org/pipermail/wine-bugs/2012-January/307297.html https://www.winehq.org/pipermail/wine-bugs/2012-January/3072...
- jand 11y agoJust in case anybody wants to know: If you want a Windows 10 without Cortana, simply disable the sound card during installation (BIOS or physically). This is not a solution, but a workaround for those having no other choice. Tested with Windows 10 Pro N.
- signal11 11y agoI don't have a Windows 10 box near me but I remember an option to send typing data back to Microsoft, which I switched off. I see they have a short FAQ about it too: http://windows.microsoft.com/en-us/windows-10/speech-inking-typing-privacy-faq http://windows.microsoft.com/en-us/windows-10/speech-inking-... "Go to Start, then select Settings > Privacy > General, and then turn Send Microsoft info about how I write to help us improve typing and writing in the future on or off." Does anyone know if this stops Windows 10 from sending typing data across?
- splitbrain 11y agoHowever this will turn out (for now it looks like the source not very trustworthy) I wonder if there's a small little tool you can install on a fresh Windows 10 that will let you disable all the various privacy related setting in one screen. Just a list of checkboxes with short descriptions of the setting and what feature you will lose when disabling it.
- userbinator 11y agoTheoretically it should be possible to do this even if MS don't provide the configuration options by patching files, but there is a ton of signing and verification which gets in the way, not to mention things like Secure Boot. Hopefully the crackers are still interested in breaking through all this and giving the masses such a tool, like they did before with signed drivers.
- dothis 11y agoI don't want the OS to talk to anywhere except for a clearly defined, lean, verifiable process that fetches security updates. That's why I use Debian. And hope they do the right thing.
- systemz 11y agoI never liked Cortana in Halo, apparently she is a spy
- fixermark 11y agoOptimized for accessing secured systems with a military-grade suite of intrusion routines hand-crafted by her creator, yes. ;)
- steeples 11y agoWait...what? `oca.telemetry.microsoft.com.NSAtc.net`
- hias 11y agonsatc.net is registered by MarkMonitor Inc.
- arca_vorago 11y agoFirst of all, as others have said, this source may be slightly dubious, but I have seen a handful of similar sources saying similar things, but I have yet to see an extensive reverse engineering effort. For the time being though, because of the variety of similar reports and side effects, I am considering Windows 10 an surveillance state approved operating system. For example, in another HN submission where someone posted a tool to delete/disable tracking services and add ip lists to the hosts file, a user has reported startup errors. To me this indicates Windows 10 is trying to communicate even during boot without the users knowledge! That's a big deal in my book... I don't know about yall. The one reason I have suffered the slings and arrows of Windows so long is for gaming purposes, more recently because I wanted to release my hobby side-project, a game in Unreal Engine 4, on Windows and so I have kept one of my computers on Windows 8.1. Last night that machine was compromised, and despite my fairly extensive malware fighting abilities, I couldn't get rid of it. That means a complete wipe and only moving data over that I must have, and not trusting that data, not to mention never trusting the HDD again (going to have to throw it away). I also question my bios, so I'll need to flash bios too. I run three main computers, Windows on a Asus laptop, OSX on a Mac Air, and Linux/DragonFlyBSD dual boot on a Macbook Pro 2014. I think Windows 10 just might be the excuse I need to push myself completely away from the MS ecosystem. I've been talking about it for years, but the power of their tie-in is not to be trifled with. I also fear for the state of linux in the same way though. At >10 million lines of kernel code, I think the many eyes theory has a weakness, namely that complex and huge codebases are antithetical to the many eyes theory working. that's why I personally think the future of computing will be in code simplicity and pairing down existing codebases. A good example of a try at this is Minix 3. <10k loc. (of course lacks many features). That's also why, even thought I'm a huge GPL/GNU guy, I am increasingly leaning towards the top down ecosystem of the BSD's. I think there are a lot of fundamental issues in personal computing that many of us just ignore and don't want to discuss because the implications of the conclusions could be uncomfortable. I think it's time for those of us who are considered power users to start having this difficult discussions more often and in more public ways.
- steeples 11y agoWindows 10 and previous versions are known to be SIGINT enabled either by design, or by accident. It would be very cloak and dagger to say by design, but certainly more plausible to say by accident. There are numerous ways to harden Windows however, and depending on how much time and money you're willing to invest; you can get a pretty robust setup. Personally I use Zemana Antilogger (try to get an older copy - the new one is possibly backdoored). Download this: http://hardenwindows8forsecurity.com/ http://hardenwindows8forsecurity.com/ (Some of the settings still apply on Win10 I think). And buy the new version of Glasswire: https://www.glasswire.com/ https://www.glasswire.com/ (Super handy utility that stops all the phone behavior of Win10 that can get quite intrusive/invasive). There are many other hacks to harden Windows but I won't go into them here. But you can have those ones for free... Here's Antilogger: https://www.zemana.com/AntiLoggerFree https://www.zemana.com/AntiLoggerFree Please avoid the new version, as it's probably weakened by ICs. I'm sure an older copy is lying around the net somewhere.
- emodendroket 11y agoWhy should I trust Zemana more than Microsoft? You're already suggesting at least the latest version is compromised. Then the other question becomes how I know the older copy I get is genuine and not also compromised.
- steeples 11y agoThe older version is blacklisted by the NSA. They don't like people using it. Leaked Snowden documents prove this.
- mosselman 11y agoOh now I can finally install the OS that will try everything to unearth what I do on my computer... Oh wait, of course I wont. This is such nonsense. It is like saying 'Hey, there is no problem with living in a glass house where everyone can see you go to the bathroom, you can just put up some curtains.'
- steeples 11y ago
- deleted 11y ago[deleted]
- llama052 11y agoWhat is it lately with Windows 10 privacy issues blowing up in Hacker-news since windows 10 came out? I know most of you guys are Apple/Linux guys (I myself love Linux like the rest of you) but come on, Apple does this, your smartphone does this, most services you use do this. Just getting tired of the big bad M$ hate bandwagon. This isn't even a credible article and people are already going off about it. This is no different than Yosemite which logs your location and searches that you make with Spotlight and Safari. Yet, I don't recall seeing articles constantly on the front page about that? Seems a little biased to me. NOTE: Not that I condone what Microsoft is doing, just a little hypocritical to think that big bad Microsoft is doing anything new in the industry, especially when the products you guys are talking about jumping ship to, have the same problems. This is nothing new
- fixermark 11y agoIt's new for Microsoft, which is what makes it news. MS seems to be finding its way into the consumer-level big-data world slower than its competitors, but now that they're going in that direction---yeah, people should care that their assumption that the OS they use at home (the OS itself, not the myriad applications they run atop it) isn't keyboard-logging them might very well be false.
- llama052 11y agoYet we are basing this hype around a non-credible article that doesn't really offer much in terms of proof? There have already been a few people including myself who have done HTTPS/HTTP sniffing who haven't found any "keylogging" like evidence other than for Cortana/search related tasks. At this point it's a witch hunt.
- vetinari 11y agohttp://arstechnica.com/information-technology/2015/08/even-when-told-not-to-windows-10-just-cant-stop-talking-to-microsoft/ http://arstechnica.com/information-technology/2015/08/even-w...
- 11y ago
- deleted 11y ago[deleted]
- chris_wot 11y agoWhat is with these privacy violations? Lenovo just got caught out installing a BIOS root kit on a wide range of laptops [0], now Microsoft is phoning home? 0. https://news.ycombinator.com/item?id=10053419 https://news.ycombinator.com/item?id=10053419
- adam12 11y agoI guess we won't be seeing any more of those Scroogled ads.
- beauzero 11y ago...and I just watched Kingsman the other day too. I don't need this crap.