10 ms·

The actual list of what it gathers: https://technet.microsoft.com/itpro/windows/configure/configure-windows-telemetry-in-your-organization#telemetry-levels http

The actual list of what it gathers: https://technet.microsoft.com/itpro/windows/configure/configure-windows-telemetry-in-your-organization#telemetry-levels https://technet.microsoft.com/itpro/windows/configure/config... Included: "Storage attributes, such as number of drives, type, and size" -- So ID numbers of all USB storage drives you've connected? Better not put sensitive data on a USB and send it to a journalist... "the number of crashes or hangs, and application state change details, such as how much processor time and memory were used, and the total uptime for an app." -- To e.g. determine when you used the TOR browser, since the difference in uptime between two time points is how much it was up during that interval. "App usage data. Includes how an app is used, including how long an app is used, when the app has focus, and when the app is started" -- Oh, never mind, they also explicitly state they gather which apps you have installed and how much and when you use them in the next section. "Accessory device data. Includes a list of accessory devices, such as printers or external storage devices, that are connected to Windows PCs and whether these devices will function after upgrading to a new version of the operating system." -- Print poster and glue it to a wall -> Printer gets identified via tracking dots ( https://www.eff.org/pages/list-printers-which-do-or-do-not-display-tracking-dots https://www.eff.org/pages/list-printers-which-do-or-do-not-d... ) -> Printer is linked back to you, even if you bought it with cash. I hope you didn't print anything your local sheriff would dislike! Edit: This is all in the 'basic' level, which you can't disable.

1001101 10y ago
"Telemetry gives users a voice" Guess what mine is saying...
- ocdtrekkie 10y ago
  They mean this quite literally too, as Microsoft employees direct everyone to use the Windows Feedback app to submit feedback, and the Feedback app refuses to function without Enhanced or Full Telemetry. So, if you don't enable at least enhanced telemetry, Microsoft does not want to hear from you, does not care about your feedback, and no Microsoft employee will respond to your query on the matter. I've tried to engage the Windows Insider folks over a couple different mediums, as far as I can tell they're barred from talking to anyone who even mentions telemetry.
- DoofusOfDeath 10y ago
  > Guess what mine is saying... Hey, LANGUAGE!
shakna 10y ago
So enough software information to know everything you do, and enough hardware information to fingerprint you. How in the hell can this just be called analytics? This level of data isn't anonymous. It can't be. If another piece of software did this, Microsoft would label it spyware and Windows Defender would kill it. Yet, they feel fine doing this with an OS that they actually sell. It's not even crap freeware. You pay to have your every move watched.
- riffraff 10y ago
  > This level of data isn't anonymous. It can't be. is there some big list of the hardware I have bought? If not, sure, they can fingerprint me but I don't see how it de-anonymizes me.
  - simcop2387 10y ago
    I'm not sure that they do this, but all it would take is for it to be tied to the license key you bought from microsoft.
    - mmastrac 10y ago
      Which is conveniently taken care of when you sign in using your Microsoft account.
  - wernercd 10y ago
    If you get enough info... and compare it to someone else's set of info... there is going to be an intersecting set of information. Combine that with unique combinations... and you get an increasing confidence of who the end user is. It's why they suggest you don't "full screen" browsers when using tor... Stuff like browser sizes can identify you: https://security.stackexchange.com/questions/102133/how-can-you-be-tracked-using-screen-resolution-monitor-size-in-tor https://security.stackexchange.com/questions/102133/how-can-... It's easy to tell that if a custom screen size can identify you... what will other unique traits do?
  - nbadg 10y ago
microcolonel 10y ago
> If your organization relies on Windows Update for updates, you shouldn’t use the Security level. Because no Windows Update information is gathered at this level, important information about update failures is not sent. Microsoft uses this information to fix the causes of those failures and improve the quality of our updates. Note that they don't tell you which of the other levels enables Windows Update telemetry, which is apparently helpful.
- xorblurb 10y ago
  It's enabled with Basic.
- hendersoon 10y ago
  That's simply not true. Telemetry is not required to update Windows. I've had it disabled for nearly 2 years now with Shutup10 and my OS updates just fine. That's just a single datapoint, but Shutup10 and other similar programs are very popular. If it broke updates people would be making noise about it.
ASalazarMX 10y ago
This is awful, but if you use a smartphone, this is about the same telemetry that has been collected on you for years. Microsoft is just keeping up with the times.
- sqeaky 10y ago
  There was a class action lawsuit over the preinstalled carrier iq agent that did this: https://en.wikipedia.org/wiki/Carrier_IQ https://en.wikipedia.org/wiki/Carrier_IQ If you have a clean android phone I suspect there no monitoring going on. For example if you use a community built mod or build AOSP yourself.
- dingaling 10y ago
  One difference being that seriously privacy-sensitive or -critical smartphone users can avoid using Google's services on their phone and create a firewall whitelist, or a filtering loopback VPN, to avoid leakage.[0] Not that's ideal, but it seems a lot better than Windows 10 seemingly indefatigible ways and means of sneaking data out. Ignoring hosts file and DNS responses is just rude. [0] baseband attacks are still a problem, but at that level of threat then the BIOS or management subsystem on your PC isn't trustworthy either.
  - kcorbitt 10y ago
    "avoid using Google's services" implies using an Android build that doesn't include Google Play Services, which means you're probably going to have to download and flash it yourself. If you're willing and able to do that, you can probably handle using Linux on your desktop, which is the analogous alternative on the PC.
    - lucideer 10y ago
      ... or even something as simple as blocking MS IP ranges and domains, which should be far simpler than rooting an Android phone.
    - milcron 10y ago
      CopperheadOS sells preflashed phones.
xorblurb 10y ago
This isn't the detailed list, here it is: https://technet.microsoft.com/en-us/itpro/windows/configure/basic-level-windows-diagnostic-events-and-fields https://technet.microsoft.com/en-us/itpro/windows/configure/... I know Windows is a large piece of SW, but this seems "quite" big for the "Basic" level... :/
Flammy 10y ago
> > "the number of crashes or hangs, and application state change details, such as how much processor time and memory were used, and the total uptime for an app." > To e.g. determine when you used the TOR browser, since the difference in uptime between two time points is how much it was up during that interval. Having personally talked with Microsoft engineers who handle what this data is used for, I can tell you they take PII very seriously and per user details aren't being shared with 3rd parties (at present). Could they be misusing this? Or start selling it? Yes, but it would be an incredibly dumb idea from a brand value perspective, and I trust them to at least protect that. (I do honestly think that like most people, Microsoft employees are well-meaning individuals with good intentions) What is this data used for? The most common use is to tell a large software developer "you have a memory leak in version 3.1.x when running on 4th gen intel CPUs with driver version 11.3" or similar. So companies with wide install bases (Oracle, IBM, other Microsoft divisions, etc) can fix issues which impact literally millions of users. If anyone reading this has ever received this sort of Microsoft communication about your software, could you share your experiences?
- Veratyr 10y ago
  > Having personally talked with Microsoft engineers who handle what this data is used for, I can tell you they take PII very seriously and per user details aren't being shared with 3rd parties (at present). Could they be misusing this? Or start selling it? Yes, but it would be an incredibly dumb idea from a brand value perspective, and I trust them to at least protect that. (I do honestly think that like most people, Microsoft employees are well-meaning individuals with good intentions) Being an American company, you also have to worry about Microsoft being compelled to disclose per-user details with law enforcement or the intelligence community. They have no choice when it comes to this, so allowing them to have this data at all is dangerous.
  - dTal 10y ago
    >it would be an incredibly dumb idea from a brand value perspective Imagine how damaging it would be to their brand value if they put ads in the main OS interface.
- 10y ago
Veratyr 10y ago
> So ID numbers of all USB storage drives you've connected? Better not put sensitive data on a USB and send it to a journalist... This should definitely work for hard disks, which have a serial number in their SMART data but do standard USB flash drives have any kind of unique identifier? There's the vendor ID but that covers every single instance of that model of device. Or is there some kind of identifier at the filesystem level?
- pseudalopex 10y ago
  USB mass storage devices have serial numbers.
drzaiusapelord 10y ago
> So ID numbers of all USB storage Fairly certain USB drives don't have serial numbers, just vendor numbers that are far from unique.
- pseudalopex 10y ago
  They do. See section 4.1 of the USB mass storage spec.[1] [1] http://www.usb.org/developers/docs/devclass_docs/usbmassbulk_10.pdf http://www.usb.org/developers/docs/devclass_docs/usbmassbulk...
Stopmisinfo 10y ago
> This is all in the 'basic' level, which you can't disable. Incorrect. Please stop spreading this misinformation. http://winaero.com/blog/how-to-disable-telemetry-and-data-collection-in-windows-10/ http://winaero.com/blog/how-to-disable-telemetry-and-data-co...
- hendersoon 10y ago
  To be more precise, you can't disable telemetry entirely on Windows Home or Professional in a supported manner. You have root, so you can run third-party programs to do it. I myself use O&O's Shutup10. But this is unsupported and Microsoft overwrites those settings with every major updates such as the 1703 update coming this month. So you need to run it again.
  - Stopmisinfo 10y ago
    Using Regedit to change things in the registry is fully supported by Microsoft. They even tell you to do it in many, many support articles. Also, I have Admin rights on my computer because I own the computer. If somebody else owns the computer than they are welcome to set the settings however they like to. So I don't really see the problem.
self-diversity 10y ago
You have a point, but you oversell it with the hyperbolic commentary and it makes me want to disagree with you. I don't like agreeing with people who exhibit such sloppy thinking.
tokenizerrr 10y ago
It's "Tor", not "TOR". From https://www.torproject.org/docs/faq.html.en#WhyCalledTor https://www.torproject.org/docs/faq.html.en#WhyCalledTor > Note: even though it originally came from an acronym, Tor is not spelled "TOR". Only the first letter is capitalized. In fact, we can usually spot people who haven't read any of our website (and have instead learned everything they know about Tor from news articles) by the fact that they spell it wrong.
- ouid 10y ago
  so you use the spelling of tOr to collect information about anonymous people on the internet.
deleted 10y ago
[deleted]

1001101 10y ago

"Telemetry gives users a voice" Guess what mine is saying...

ocdtrekkie 10y ago
They mean this quite literally too, as Microsoft employees direct everyone to use the Windows Feedback app to submit feedback, and the Feedback app refuses to function without Enhanced or Full Telemetry. So, if you don't enable at least enhanced telemetry, Microsoft does not want to hear from you, does not care about your feedback, and no Microsoft employee will respond to your query on the matter. I've tried to engage the Windows Insider folks over a couple different mediums, as far as I can tell they're barred from talking to anyone who even mentions telemetry.
DoofusOfDeath 10y ago
> Guess what mine is saying... Hey, LANGUAGE!

shakna 10y ago

So enough software information to know everything you do, and enough hardware information to fingerprint you. How in the hell can this just be called analytics? This level of data isn't anonymous. It can't be. If another piece of software did this, Microsoft would label it spyware and Windows Defender would kill it. Yet, they feel fine doing this with an OS that they actually sell. It's not even crap freeware. You pay to have your every move watched.

riffraff 10y ago
> This level of data isn't anonymous. It can't be. is there some big list of the hardware I have bought? If not, sure, they can fingerprint me but I don't see how it de-anonymizes me.
- simcop2387 10y ago
  I'm not sure that they do this, but all it would take is for it to be tied to the license key you bought from microsoft.
  - mmastrac 10y ago
    Which is conveniently taken care of when you sign in using your Microsoft account.
- wernercd 10y ago
  If you get enough info... and compare it to someone else's set of info... there is going to be an intersecting set of information. Combine that with unique combinations... and you get an increasing confidence of who the end user is. It's why they suggest you don't "full screen" browsers when using tor... Stuff like browser sizes can identify you: https://security.stackexchange.com/questions/102133/how-can-you-be-tracked-using-screen-resolution-monitor-size-in-tor https://security.stackexchange.com/questions/102133/how-can-... It's easy to tell that if a custom screen size can identify you... what will other unique traits do?
- nbadg 10y ago

microcolonel 10y ago

> If your organization relies on Windows Update for updates, you shouldn’t use the Security level. Because no Windows Update information is gathered at this level, important information about update failures is not sent. Microsoft uses this information to fix the causes of those failures and improve the quality of our updates. Note that they don't tell you which of the other levels enables Windows Update telemetry, which is apparently helpful.

xorblurb 10y ago
It's enabled with Basic.
hendersoon 10y ago
That's simply not true. Telemetry is not required to update Windows. I've had it disabled for nearly 2 years now with Shutup10 and my OS updates just fine. That's just a single datapoint, but Shutup10 and other similar programs are very popular. If it broke updates people would be making noise about it.

ASalazarMX 10y ago

This is awful, but if you use a smartphone, this is about the same telemetry that has been collected on you for years. Microsoft is just keeping up with the times.

sqeaky 10y ago
There was a class action lawsuit over the preinstalled carrier iq agent that did this: https://en.wikipedia.org/wiki/Carrier_IQ https://en.wikipedia.org/wiki/Carrier_IQ If you have a clean android phone I suspect there no monitoring going on. For example if you use a community built mod or build AOSP yourself.
dingaling 10y ago
One difference being that seriously privacy-sensitive or -critical smartphone users can avoid using Google's services on their phone and create a firewall whitelist, or a filtering loopback VPN, to avoid leakage.[0] Not that's ideal, but it seems a lot better than Windows 10 seemingly indefatigible ways and means of sneaking data out. Ignoring hosts file and DNS responses is just rude. [0] baseband attacks are still a problem, but at that level of threat then the BIOS or management subsystem on your PC isn't trustworthy either.
- kcorbitt 10y ago
  "avoid using Google's services" implies using an Android build that doesn't include Google Play Services, which means you're probably going to have to download and flash it yourself. If you're willing and able to do that, you can probably handle using Linux on your desktop, which is the analogous alternative on the PC.
  - lucideer 10y ago
    ... or even something as simple as blocking MS IP ranges and domains, which should be far simpler than rooting an Android phone.
  - milcron 10y ago
    CopperheadOS sells preflashed phones.

xorblurb 10y ago

This isn't the detailed list, here it is: https://technet.microsoft.com/en-us/itpro/windows/configure/basic-level-windows-diagnostic-events-and-fields https://technet.microsoft.com/en-us/itpro/windows/configure/... I know Windows is a large piece of SW, but this seems "quite" big for the "Basic" level... :/

Flammy 10y ago

> > "the number of crashes or hangs, and application state change details, such as how much processor time and memory were used, and the total uptime for an app." > To e.g. determine when you used the TOR browser, since the difference in uptime between two time points is how much it was up during that interval. Having personally talked with Microsoft engineers who handle what this data is used for, I can tell you they take PII very seriously and per user details aren't being shared with 3rd parties (at present). Could they be misusing this? Or start selling it? Yes, but it would be an incredibly dumb idea from a brand value perspective, and I trust them to at least protect that. (I do honestly think that like most people, Microsoft employees are well-meaning individuals with good intentions) What is this data used for? The most common use is to tell a large software developer "you have a memory leak in version 3.1.x when running on 4th gen intel CPUs with driver version 11.3" or similar. So companies with wide install bases (Oracle, IBM, other Microsoft divisions, etc) can fix issues which impact literally millions of users. If anyone reading this has ever received this sort of Microsoft communication about your software, could you share your experiences?

Veratyr 10y ago
> Having personally talked with Microsoft engineers who handle what this data is used for, I can tell you they take PII very seriously and per user details aren't being shared with 3rd parties (at present). Could they be misusing this? Or start selling it? Yes, but it would be an incredibly dumb idea from a brand value perspective, and I trust them to at least protect that. (I do honestly think that like most people, Microsoft employees are well-meaning individuals with good intentions) Being an American company, you also have to worry about Microsoft being compelled to disclose per-user details with law enforcement or the intelligence community. They have no choice when it comes to this, so allowing them to have this data at all is dangerous.
- dTal 10y ago
  >it would be an incredibly dumb idea from a brand value perspective Imagine how damaging it would be to their brand value if they put ads in the main OS interface.
10y ago

Veratyr 10y ago

> So ID numbers of all USB storage drives you've connected? Better not put sensitive data on a USB and send it to a journalist... This should definitely work for hard disks, which have a serial number in their SMART data but do standard USB flash drives have any kind of unique identifier? There's the vendor ID but that covers every single instance of that model of device. Or is there some kind of identifier at the filesystem level?

pseudalopex 10y ago
USB mass storage devices have serial numbers.

drzaiusapelord 10y ago

> So ID numbers of all USB storage Fairly certain USB drives don't have serial numbers, just vendor numbers that are far from unique.

pseudalopex 10y ago
They do. See section 4.1 of the USB mass storage spec.[1] [1] http://www.usb.org/developers/docs/devclass_docs/usbmassbulk_10.pdf http://www.usb.org/developers/docs/devclass_docs/usbmassbulk...

Stopmisinfo 10y ago

> This is all in the 'basic' level, which you can't disable. Incorrect. Please stop spreading this misinformation. http://winaero.com/blog/how-to-disable-telemetry-and-data-collection-in-windows-10/ http://winaero.com/blog/how-to-disable-telemetry-and-data-co...

hendersoon 10y ago
To be more precise, you can't disable telemetry entirely on Windows Home or Professional in a supported manner. You have root, so you can run third-party programs to do it. I myself use O&O's Shutup10. But this is unsupported and Microsoft overwrites those settings with every major updates such as the 1703 update coming this month. So you need to run it again.
- Stopmisinfo 10y ago
  Using Regedit to change things in the registry is fully supported by Microsoft. They even tell you to do it in many, many support articles. Also, I have Admin rights on my computer because I own the computer. If somebody else owns the computer than they are welcome to set the settings however they like to. So I don't really see the problem.

self-diversity 10y ago

You have a point, but you oversell it with the hyperbolic commentary and it makes me want to disagree with you. I don't like agreeing with people who exhibit such sloppy thinking.

tokenizerrr 10y ago

It's "Tor", not "TOR". From https://www.torproject.org/docs/faq.html.en#WhyCalledTor https://www.torproject.org/docs/faq.html.en#WhyCalledTor > Note: even though it originally came from an acronym, Tor is not spelled "TOR". Only the first letter is capitalized. In fact, we can usually spot people who haven't read any of our website (and have instead learned everything they know about Tor from news articles) by the fact that they spell it wrong.

ouid 10y ago
so you use the spelling of tOr to collect information about anonymous people on the internet.

deleted 10y ago

[deleted]