5 ms·

Yet by default Windows 10 opts you into a system-wide advertising ID, a ‘smartscreen filter’ that sends the urls of websites you visit to Microsoft (to check ag

by stfwn 9y ago

Yet by default Windows 10 opts you into a system-wide advertising ID, a ‘smartscreen filter’ that sends the urls of websites you visit to Microsoft (to check against a database of ‘malicious websites’), sending whatever you type to Microsoft (to improve autocompletion), inserts a cloud-based Cortana into many things you do etc., etc. I agree that their main business model is probably ‘just’ software licenses, which is good I'd say, but they don't clearly align their incentives with their users. They dabble in other markets to see what they can get, and for me that muddies the waters a bit.

FireBeyond 9y ago
> a ‘smartscreen filter’ that sends the urls of websites you visit to Microsoft (to check against a database of ‘malicious websites’) You can't really compare at least this to Apple, as Safari does exactly the same thing. > cloud-based Cortana As opposed to cloud-based Siri?
- valleyer 9y ago
  > as Safari does exactly the same thing Source? I thought Safari downloaded the Google Safe Browsing database (using the "Update API" described at https://developers.google.com/safe-browsing/v4/#update-api-v4 https://developers.google.com/safe-browsing/v4/#update-api-v...) to do client-side checks.
  - FireBeyond 9y ago
    I believe it does, though I have not been able to find a definitive source as to whether it is used in online or offline modes.
  - TheCoreh 9y ago
    Safari does the same for an unrelated feature: iCloud tabs
    - LeoPanthera 9y ago
      iCloud data is e2e encrypted. Apple can't tell what tabs you have open.
      - gurkendoktor 9y ago
        Not all iCloud Data is E2E encrypted, most iCloud services actually work on the web if you go to icloud.com. In fact E2E encrypted services are still the exception, not the rule: https://support.apple.com/de-de/HT202303 https://support.apple.com/de-de/HT202303 It's frustrating that Apple does not let users disable iCloud tabs without also disabling bookmarks and the reading list (which I am fine with being synced on US servers). Workaround: Toggle mobile Safari into private browsing mode and use apps for everything that needs a login, use private browsing mode most of the time on macOS :/
        LeoPanthera 9y ago
        > most iCloud services actually work on the web if you go to icloud.com This is not evidence of a lack of E2E. Your browser can be an "end", with a key derived from your login. Much of the details of iCloud's security is not a secret, and can be found in the iOS Security PDF: https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf
        gurkendoktor 9y ago
        Point taken, it could be E2E on the web. It seem it's just a "classic" web app though. From both the PDF and the KB article, I don't see any indication that iCloud tabs are E2E encrypted? I'd love to be wrong :)
        gurkendoktor 9y ago
        (Oops, I've linked to the German version; English overview here: https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303)
- nerdponx 9y ago
  Last I checked, Siri's privacy policy was very clear about the fact that Siri data is used only to improve Siri. I was pretty surprised to find that; maybe I read it wrong.
freeone3000 9y ago
(giving insight, not speaking for Microsoft here) Internally we take privacy policy seriously. If you agreed to the policy, we're only using the data the way the policy says. (GDPR "keeps us honest", but there's actually internal drive for this. Microsoft Runs On Trust.) So autocomplete? seriously only used for autocomplete. same with inking and typing, it is only used for improvements to the inking and typing systems. smartscreen does exactly what it says on the tin. That data's not used for anything but malicious website detection. It's first line of defense against phishing in a lot of orgs. (systemwide Ad ID mirrors the feature on Apple and Android products. check the windows API for exactly what you get out of this. It's probably less than you think) cortana is... a bit of a misbranding, to be honest. It's MS's answer to IBM's "watson", in that pretty much every consumer-facing AI product gets Cortana branding whether it makes sense or not. Note the privacy policy here, we can use the Cortana data more freely. Don't agree unless you agree. Cloud-based is getting inserted into everything because users don't upgrade. We had to push an Office 2007 patch recently. 2007. It'd have its first crush by now. Disregarding the ability for the above to be stolen (and that'd be impressive, MSIT is top-tier), your personal data is being used for exactly the purpose we say it's being used for. While your personal incentives may not align, our business incentives are "get you on the cloud, get your software working well, get easy data transfer between MS products, make sure you're patched and updated, take your money for this". It's not a secret. It's not a conspiracy. It's time-limited software licensing and cloud services.
- millstone 9y ago
  I believe what you wrote, and that you wrote it in good faith, but it's still not enough to make me feel confident about using Windows. I'm a longtime Mac user but I recently bought a Windows machine, and the ads and telemetry make my skin crawl. There's a huge chasm between "we don't collect your data, period" and "we collect your data but have internal controls in place to prevent using it in certain ways for now." Apple's Spotlight Suggestions and Ad ID are real things, and IMO are mistakes. (Ad ID is not yet not yet on the Mac, thank goodness!)

by stfwn 9y ago

FireBeyond 9y ago

> a ‘smartscreen filter’ that sends the urls of websites you visit to Microsoft (to check against a database of ‘malicious websites’) You can't really compare at least this to Apple, as Safari does exactly the same thing. > cloud-based Cortana As opposed to cloud-based Siri?

valleyer 9y ago
> as Safari does exactly the same thing Source? I thought Safari downloaded the Google Safe Browsing database (using the "Update API" described at https://developers.google.com/safe-browsing/v4/#update-api-v4 https://developers.google.com/safe-browsing/v4/#update-api-v...) to do client-side checks.
- FireBeyond 9y ago
  I believe it does, though I have not been able to find a definitive source as to whether it is used in online or offline modes.
- TheCoreh 9y ago
  Safari does the same for an unrelated feature: iCloud tabs
  - LeoPanthera 9y ago
    iCloud data is e2e encrypted. Apple can't tell what tabs you have open.
    - gurkendoktor 9y ago
      Not all iCloud Data is E2E encrypted, most iCloud services actually work on the web if you go to icloud.com. In fact E2E encrypted services are still the exception, not the rule: https://support.apple.com/de-de/HT202303 https://support.apple.com/de-de/HT202303 It's frustrating that Apple does not let users disable iCloud tabs without also disabling bookmarks and the reading list (which I am fine with being synced on US servers). Workaround: Toggle mobile Safari into private browsing mode and use apps for everything that needs a login, use private browsing mode most of the time on macOS :/
      - LeoPanthera 9y ago
        > most iCloud services actually work on the web if you go to icloud.com This is not evidence of a lack of E2E. Your browser can be an "end", with a key derived from your login. Much of the details of iCloud's security is not a secret, and can be found in the iOS Security PDF: https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf
        gurkendoktor 9y ago
        Point taken, it could be E2E on the web. It seem it's just a "classic" web app though. From both the PDF and the KB article, I don't see any indication that iCloud tabs are E2E encrypted? I'd love to be wrong :)
      - gurkendoktor 9y ago
        (Oops, I've linked to the German version; English overview here: https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303)
nerdponx 9y ago
Last I checked, Siri's privacy policy was very clear about the fact that Siri data is used only to improve Siri. I was pretty surprised to find that; maybe I read it wrong.

freeone3000 9y ago

(giving insight, not speaking for Microsoft here) Internally we take privacy policy seriously. If you agreed to the policy, we're only using the data the way the policy says. (GDPR "keeps us honest", but there's actually internal drive for this. Microsoft Runs On Trust.) So autocomplete? seriously only used for autocomplete. same with inking and typing, it is only used for improvements to the inking and typing systems. smartscreen does exactly what it says on the tin. That data's not used for anything but malicious website detection. It's first line of defense against phishing in a lot of orgs. (systemwide Ad ID mirrors the feature on Apple and Android products. check the windows API for exactly what you get out of this. It's probably less than you think) cortana is... a bit of a misbranding, to be honest. It's MS's answer to IBM's "watson", in that pretty much every consumer-facing AI product gets Cortana branding whether it makes sense or not. Note the privacy policy here, we can use the Cortana data more freely. Don't agree unless you agree. Cloud-based is getting inserted into everything because users don't upgrade. We had to push an Office 2007 patch recently. 2007. It'd have its first crush by now. Disregarding the ability for the above to be stolen (and that'd be impressive, MSIT is top-tier), your personal data is being used for exactly the purpose we say it's being used for. While your personal incentives may not align, our business incentives are "get you on the cloud, get your software working well, get easy data transfer between MS products, make sure you're patched and updated, take your money for this". It's not a secret. It's not a conspiracy. It's time-limited software licensing and cloud services.

millstone 9y ago
I believe what you wrote, and that you wrote it in good faith, but it's still not enough to make me feel confident about using Windows. I'm a longtime Mac user but I recently bought a Windows machine, and the ads and telemetry make my skin crawl. There's a huge chasm between "we don't collect your data, period" and "we collect your data but have internal controls in place to prevent using it in certain ways for now." Apple's Spotlight Suggestions and Ad ID are real things, and IMO are mistakes. (Ad ID is not yet not yet on the Mac, thank goodness!)