5 ms·

Can anyone give a non-biased, fact based report on what Microsoft tracks and sends to their servers on Windows 10? I've seen a lot of stories claiming that Win

by ep103 11y ago

Can anyone give a non-biased, fact based report on what Microsoft tracks and sends to their servers on Windows 10? I've seen a lot of stories claiming that Windows 10 is free because it tracks just about everything, and sends it all to MS servers.

Asmod4n 11y ago
Windows Search is looking up everything you type on bing. The AV solution sends memory dumps to Microsoft.
- agentdrtran 11y ago
  Doesn't that kind of make sense though? I just turned off Bing integration and the AV sending memory dumps makes sense if they want to improve detection.
  - rbanffy 11y ago
    I imagine Microsoft will eventually amass a humongous porn stash from those memory dumps. You can hope it's anonymous, at least. ;-)
  - Asmod4n 11y ago
    In older versions of their AV solution you could choose what to send to Microsoft, down to even not sending where the File is located, just what it detected. There was not even a option to send Memory Dumps. Now its all or nothing.
  - marcosdumay 11y ago
    Except that "memory dump" means anything you have, and text typed at the browser includes most of your passwords.
  - ionised 11y ago
    Turn off Bing integration and SearchUI.exe still attempts to make connections to Microsoft servers even though it should be operating completely locally. I blocked it with my (third party) Firewall, which I shouldn't have to do.
- UnoriginalGuy 11y ago
  > The AV solution sends memory dumps to Microsoft. Both error reporting and Windows Defender asked you if you want to upload additional information (e.g. memory dumps).
pcunite 11y ago
"Trust" with any OS is questionable. If you need that level of trust, you need an edge device that deeply inspects each packet.
- bsilvereagle 11y ago
  > you need an edge device that deeply inspects each packet. As cert pinning becomes more common, we are rapidly losing the ability to do this. The only work around I know of for iOS/Android is to jailbreak/root your device and get a debugger attached to apps. I haven't seen a workaround for getting around cert pinned Metro apps.
- blisterpeanuts 11y ago
  But do Linux distributions like Debian and OpenSuse send feedback to some server? I doubt there's enough of an organization to even care, let alone engineer that kind of infrastructure. Well, Suse and Redhat, maybe. Ubuntu, almost definitely. But Linux seems safer from prying eyes than the commercial OS's.
  - Asmod4n 11y ago
    The Desktop search of Unity (Ubuntu) returned suggestions from Amazon.
    - Spivak 11y ago
      And they're still getting shit for it. The community tore them apart when it happened. The fact that they even considered such a thing means my distro recommendation is now permanently anything not Ubuntu/Ubuntu based. It's an inevitability that people are going to make user-hostile Linux distros that take advantage of users ignorance, some already exist, but that shouldn't be a black mark on those distros that do it right and respect their users.
- massysett 11y ago
  "I think that "trust" with any OS is now over." Not with many GNU/Linux distributions or the BSDs.
pjmlp 11y ago
The same stuff Apple and Google OSes do.
v4n4d1s 11y ago
I don't know what they track and send, but here's a list for suspected updates. https://gist.github.com/xvitaly/eafa75ed2cb79b3bd4e9 https://gist.github.com/xvitaly/eafa75ed2cb79b3bd4e9 Anyone knows if this is complete?
drdaeman 11y ago
The best engineering analysis I've seen: http://www.root.cz/clanky/windows-10-analyza-probihajici-komunikace/ http://www.root.cz/clanky/windows-10-analyza-probihajici-kom... It's in Czech, but packet dumps are language-agnostic and comments can be translated using, say, Google Translate, reasonably accurately.

by ep103 11y ago

Asmod4n 11y ago

Windows Search is looking up everything you type on bing. The AV solution sends memory dumps to Microsoft.

agentdrtran 11y ago
Doesn't that kind of make sense though? I just turned off Bing integration and the AV sending memory dumps makes sense if they want to improve detection.
- rbanffy 11y ago
  I imagine Microsoft will eventually amass a humongous porn stash from those memory dumps. You can hope it's anonymous, at least. ;-)
- Asmod4n 11y ago
  In older versions of their AV solution you could choose what to send to Microsoft, down to even not sending where the File is located, just what it detected. There was not even a option to send Memory Dumps. Now its all or nothing.
- marcosdumay 11y ago
  Except that "memory dump" means anything you have, and text typed at the browser includes most of your passwords.
- ionised 11y ago
  Turn off Bing integration and SearchUI.exe still attempts to make connections to Microsoft servers even though it should be operating completely locally. I blocked it with my (third party) Firewall, which I shouldn't have to do.
UnoriginalGuy 11y ago
> The AV solution sends memory dumps to Microsoft. Both error reporting and Windows Defender asked you if you want to upload additional information (e.g. memory dumps).

pcunite 11y ago

"Trust" with any OS is questionable. If you need that level of trust, you need an edge device that deeply inspects each packet.

bsilvereagle 11y ago
> you need an edge device that deeply inspects each packet. As cert pinning becomes more common, we are rapidly losing the ability to do this. The only work around I know of for iOS/Android is to jailbreak/root your device and get a debugger attached to apps. I haven't seen a workaround for getting around cert pinned Metro apps.
blisterpeanuts 11y ago
But do Linux distributions like Debian and OpenSuse send feedback to some server? I doubt there's enough of an organization to even care, let alone engineer that kind of infrastructure. Well, Suse and Redhat, maybe. Ubuntu, almost definitely. But Linux seems safer from prying eyes than the commercial OS's.
- Asmod4n 11y ago
  The Desktop search of Unity (Ubuntu) returned suggestions from Amazon.
  - Spivak 11y ago
    And they're still getting shit for it. The community tore them apart when it happened. The fact that they even considered such a thing means my distro recommendation is now permanently anything not Ubuntu/Ubuntu based. It's an inevitability that people are going to make user-hostile Linux distros that take advantage of users ignorance, some already exist, but that shouldn't be a black mark on those distros that do it right and respect their users.
massysett 11y ago
"I think that "trust" with any OS is now over." Not with many GNU/Linux distributions or the BSDs.

pjmlp 11y ago

The same stuff Apple and Google OSes do.

v4n4d1s 11y ago

I don't know what they track and send, but here's a list for suspected updates. https://gist.github.com/xvitaly/eafa75ed2cb79b3bd4e9 https://gist.github.com/xvitaly/eafa75ed2cb79b3bd4e9 Anyone knows if this is complete?

drdaeman 11y ago

The best engineering analysis I've seen: http://www.root.cz/clanky/windows-10-analyza-probihajici-komunikace/ http://www.root.cz/clanky/windows-10-analyza-probihajici-kom... It's in Czech, but packet dumps are language-agnostic and comments can be translated using, say, Google Translate, reasonably accurately.