21 ms·

German federal office publishes Windows 10 telemetry analysis

323 points by jakobdabo 8y ago

minxomat 8y ago
For Windows. That should be part of the title.
- craftyguy 8y ago
  > Windows 10 telemetry ...
  - smolder 8y ago
    Perhaps someone changed the title...
    - graeme 8y ago
      They did, it was something else before
  - TheSpiceIsLife 8y ago
    Windows Tenlemetry
Zarath 8y ago
Does anyone know if there is a tool to safely remove telemetry executables from Win10? Is it possible to remove these?
- ssvss 8y ago
  I saw this tool being recommended in r/windows10. I have tried it, no issues so far, though haven't tested to see if it does disable telemetry. https://www.oo-software.com/en/shutup10 https://www.oo-software.com/en/shutup10
  - eastendguy 8y ago
    The point of the report above is that you can NOT disable all telemetry, not even in the Enterprise version of Windows.
    - tjoff 8y ago
      ...through official means. I don't for a second doubt you can turn it off completely. But unofficial solutions come with tons of potential issues.
      - metildaa 8y ago
        Could just block all communication with Microsoft by the OS. Or, move to non-Windows OSes like the retail giants already have. Kroger and Walmart run Suse Enterprise Linux (relevant Uptime Funk reference) https://www.youtube.com/watch?v=SYRlTISvjww https://www.youtube.com/watch?v=SYRlTISvjww
        Spooky23 8y ago
        Not in a government or business environment using Office 365. 365 requires all sorts of open connectivity to function.
        metildaa 8y ago
        If your using Office 365, telemetry in Windows is the least of your concern.
        Dylan16807 8y ago
        > Could just block all communication with Microsoft by the OS. Easier said than done when there's a minefield of firewall-bypasses for it.
        rasz 8y ago
        Care to elaborate? Afaik and tested w10 does NOT bypass its own firewall when set to 'drop all' traffic.
- jcoffland 8y ago
  There is a tool to safely remove all Windows 10 telemetry. It's called Linux.
  - wolfgke 8y ago
    > It's called Linux. It's called GNU/Linux. :-)
    - judge2020 8y ago
      https://www.lurkmore.com/view/GNU/Linux_interjection https://www.lurkmore.com/view/GNU/Linux_interjection
    - deleted 8y ago
      [deleted]
    - robdachshund 8y ago
      Nah it's just Linux.
  - Delmania 8y ago
    Great let me know when Linux can run the apps I need for work and I can reliably install it on any hardware and expect it to work without issue. I like Linux as anyone else around here, but to claim it can replace Win10 for the average user is a stretch.
    - Sir_Cmpwn 8y ago
      >let me know when [...] I can reliably install it on any hardware and expect it to work without issue. Consider yourself told, then. Linux works OOTB on pretty much all hardware, often better than Windows since it ships with all of the necessary drivers. >to claim it can replace Win10 for the average user is a stretch The average user can handle KDE Plasma just fine.
      - RaleyField 8y ago
        > Consider yourself told, then. Nowadays I run mostly Ubuntu but before this attitude used to be a big turn off for me. When things manifestly don't work but the partisan chorus is acting like Linux is the most perfect thing ever then it is really easy to walk back out of spite. I run Linux because it's the least bad OS _for me_, it's still pretty bad in so many ways. > often better than Windows And often not. My experience with Linux drivers has always been only "tolerable". > KDE Plasma It's functional. But its design language (if it has any) is by far my least favorite one. I'd rather use Windows than use KDE.
- snaky 8y ago
  You could set up the proxy for (not Microsoft) web browser on your router and disallow all the traffic forwarding other than going via that proxy.
  - wolfgke 8y ago
    See chapter 3 of the linked German paper > https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Cyber-Sicherheit/SiSyPHus/Analyse_Telemetriekomponente.pdf?__blob=publicationFile&v=4 https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Cyber-Si... for other suggestions. The variant with an HTTP proxy is described in section 3.2.1.
    - snaky 8y ago
      As far as I can tell, what they do with proxy is 'allow all, disallow telemetry' policy. That's not what seem to work reliably, because Microsoft is free to change everything at any second, and the 'telemetry' list is moving target. What I'm talking about is 'disallow all, allow the traffic from Firefox only' basically.
      - wolfgke 8y ago
        > That's not what seem to work reliably, because Microsoft is free to change everything at any second, and the 'telemetry' list is moving target. Principally, you are right. But keep in mind that the paper refers to Windows 10 LTSB 1607. It would surprise me a lot if Microsoft changed the telemetry servers for a Long Term Servicing Branch release.
        snaky 8y ago
        A couple of years ago, I would agree with you, considering the fact that enterprise customers with volume licenses and huge investments in Microsoft infrastructure are bread and butter for Microsoft, and the foundation of that is trust between those enterprise customers with platinum support contracts and Microsoft. But nowadays I don't know. Microsoft is moving to Azure and 'freemium' data-collecting based business so fast, and breaking so many things. Anyway, the 'disallow all, allow only Firefox' have additional benefits in that it's prevents any 3rd party software from phoning home or something worse. The obvious downside might be the inability of those 3rd party software to auto-update itself.
- uto 8y ago
  Pi-hole seems to block windows telemetry domains by default. I don't know how complete the blocking is but there are a lot of domains like the ones listed in this thread on my top blocked domains list.
- kakarot 8y ago
  Not sure, I tried doing it myself once and it was a rabbit hole of scripts and changing obscure settings in the command line. After somewhere between 12-18 hours of solid work there was still so much left open, and I came to realize it's simply impossible to have a copy of Windows 10 that doesn't spy on you in some way. For example, hardware profiling. Attach a printer to Windows 10, Microsoft will receive the hardware ID. Sell the printer on craigslist. A political party uses it to print propaganda that is considered illegal. Don't be surprised when the police are at your door in two weeks. With support for Windows 7 Professional ending in 2020, I'm not sure where to go from here. I can just hope that VR and similar recent tech is fully realized on Linux or Linux+Wine in that time.
  - einr 8y ago
    With support for Windows 7 Professional ending in 2020, I'm not sure where to go from here. Maybe you'll be able to do what some folks did with Windows XP and use a registry hack to trick Windows into receiving security patches for Windows Embedded POSready 7, which is the embedded Point-Of-Sale version of Win7. This is going to be supported until 10/12/2021. Of course, this is a very fragile and hacky solution that I would be unwilling to use on boxes running important stuff. I'm in the same quandary and I think I'm going to just disconnect all my Windows 7 boxes from the Internet on the end date. Although a bit of a bother I will still be able to do my music production, games and graphics stuff without Internet access, and all the day-to-day Internet stuff I can migrate to Linux. Maybe use disposable Windows 7 VM's for random lightweight Windows-only stuff.
    - kakarot 8y ago
      As it is, I run Windows in a VM with IOMMU, firewalled incoming connections, host-level VPN, etc., passing through a Geforce 1080 for direct access, and I only use it for specific purposes. Everything else is done in other VMs that run Linux. It's a similar setup to Qubes. I also do music production and graphics and game programming in Windows, so I'm totally with you on how fucked this is going to be in a year. One of my biggest issues is that I know for a fact my fb2k visualizer doesn't work under Wine. One possible solution I've thought about for using a non-networked W7: * Set up a separate VM with allocated storage that gets broadcast as a set of read-only local network drives * Add both W7 and this VM to a private network without net access * Access the netdrive on W7 and copy any files with which you need write access to a W7-only storage partition. Seeing as how we seem to have similar use cases, I'm happy to give you some pointers on setting up something similar to what I have.
- tgsovlerkhgsel 8y ago
  No. Even if you succeed, the next update will likely bring back some of the stuff you removed, two additional independent monitoring tools using separate C2 domains/IPs hidden somewhere in your system (not necessarily the Windows folder either), plus three "repair" tools that try to find modifications to Windows files like the ones you made and revert them.
- njharman 8y ago
  Yeah, it’s called “installer for another OS”
- glenneroo 8y ago
  My experience testing multiple tools on VMs (mostly recommendations from reddit), eventually deciding on one that seemed to work as advertised and installing it on my primary PC, says definitely not. Initially I saw a drastic reduction in outgoing traffic to MS/akadns, but after a couple months it ramped back up again... as someone else mentioned above, a lot of telemetry tools are reactivated/reinstalled via Windows Updates. I seemed to have completely nuked SMB in the process as well. I never saw any outbound traffic to microsft.com, I wonder if it's because they are using the German version?
detaro 8y ago
German press release: https://www.bsi.bund.de/DE/Presse/Pressemitteilungen/Presse2018/Studie_Win_10_20112018.html https://www.bsi.bund.de/DE/Presse/Pressemitteilungen/Presse2... Fitting name for the project: SiSyPHuS Win10
jammygit 8y ago
I wish all governments did audits like this. Either the software would get less invasive, or we'd see Linux everywhere, wins all around. How bad is it that not even governments can use windows without the data vacuum being turned on? And they need to commission these investigations to even figure out what that means?
- iwiririwo 8y ago
  Well there's other issues with Linux on the desktop that doesn't let anybody except developers use it productively. You always have to weight your priorities, and getting stuff done is often number one priority.
  - Sylos 8y ago
    The use in government would mean running it in centrally administered form. The end user would just as well just click on the icon on their desktop and the application opens where they do their work. There may obviously be other problems, like the application not being available on Linux, or needing administrators with Linux knowledge, but that's nothing the end user has to deal with.
  - emayljames 8y ago
    LTS (Long Term Service) versions of Linux OS' are now breaking even, or even sometimes ahead, of Windows. Office is easily on par (actually better IMO). You can have the UI exactly as you want it to be. You have GIMP. The home of Apache/PHP, and many other improvements!.
    - winrid 8y ago
      Word is light-years ahead of any open source alternative. Gimp is not a photoshop replacement. These guys don't care about Apache on their desktops. :)
      - SmellyGeekBoy 8y ago
        Lucky you can use Word in a browser these days, then. I'm not sure which government departments are using Photoshop but the few that do could just as easily use Macs.
AtomicOrbital 8y ago
to be fair every OS can and does do telemetry, say nothing about each software application calling back home in a similar way - such feedback helps speed up improvements however linux OS makes explicit notice of this and its simple to disable
- salawat 8y ago
  Which is why of all of those the only one that does it remotely right is Linux. Developers and businesses in particular have grown complacent with flagrant and repeated usurpation of their user's expectations of privacy. It needs to stop.
- msla 8y ago
  Saying "Linux does telemetry" is wrong. I'm not usually one of those "Linux is just a kernel!" types, but, in this case, it's very important to distinguish between the kernel, which does no telemetry, and the whole enchilada, which might. In short: If you can find me any on-by-default telemetry in Slackware, I'd be very interested.
- justinclift 8y ago
  > such feedback helps speed up improvements Recent MS "improvements" indicate things should not have been sped up.
- TangoTrotFox 8y ago
  There is 0 opt-out telemetry in most (all?) major flavors of Linux. But there's an even more important issue here. Even if there were some form of telemetry in Linux you'd be able to see exactly what it's collecting and where it's sending it since the OS itself is open source. I do not think many people are mostly okayish with purely diagnostic telemetry, but it's not clear exactly what Microsoft is collecting and their transition to a sort of 'free to play' style of OS does not lead one to the most optimistic views for either the type data they're harvesting, or their intended use for such data.
  - mschuster91 8y ago
    > Even if there were some form of telemetry in Linux At least for Debian, at install time it does ask you if you want to participate in the "popularity contest" apt telemetry. But, on the other hand, it's opt-in with the "no" option preselected.
pingec 8y ago
Has anything similar been done for Android phones with google services installed and Chrome browser?
- paride5745 8y ago
  I guess the document about Google is so big they have issues uploading it to the web server!
- wagutina 8y ago
  Install NetGuard and see by yourself, it's terrifying. For eg the stock camera of my essential phone is sending data to Facebook without my consent
- tgsovlerkhgsel 8y ago
  For Chrome, there's the official whitepaper: https://www.google.com/chrome/privacy/whitepaper.html https://www.google.com/chrome/privacy/whitepaper.html I'd love to see independent verification that it is complete and truthful, of course.
maxxxxx 8y ago
I am surprised that they using server names like "alpha.telemetry.microsft.com". when I see something like "microsft" in an E-mail or link I immediately suspect that somebody is trying to fake being from Microsoft. Or are these spelling errors in the article? Edit: these domain names are in the report too. Very strange. I would get very nervous if I saw "microsft" in a firewall log.
- pdkl95 8y ago
  > microsft.com https://en.wikipedia.org/wiki/8.3_filename https://en.wikipedia.org/wiki/8.3_filename
  - maxxxxx 8y ago
    Why would they use the short names in URLs? I thought they make sense only for file names.
    - pdkl95 8y ago
      I'm mostly joking. However, I've been observing Microsoft since the Windows 2.0 era, and I can't completely discard the possibility that Microsoft actually would use 8.3 domain names. Using 8.3 names "for legacy compatibility" in unusual places is something they've done before.
      - maxxxxx 8y ago
        It could be that at some point they mapped domain names to folder names or something like that. Still looks pretty hacky (or malicious) nowadays.
      - yesenadam 8y ago
        That does sound like some kind of rational explanation. p.s. Further proof that history's written by the victors, from that 8.3 wiki page: "An 8.3 filename...is a filename convention used by old versions of DOS and versions of Microsoft Windows...Similar 8.3 file naming schemes have also existed on earlier CP/M, TRS-80, Atari, and some Data General and [DEC] minicomputer operating systems." "Similar naming schemes also existed"! A strange way of saying "DOS copied CP/M's drive letter + colon + 8.3 filename exactly". ..and everything else. (Disclosure: I grew up on CP/M)
MikusR 8y ago
Did they find something that contradicts stuff listed at https://docs.microsoft.com/en-us/windows/privacy/ https://docs.microsoft.com/en-us/windows/privacy/ ?
- bhengaij 8y ago
  Are you really expecting anybody to waste time reading either of the reports when that time can be utilized spreading FUD against Microsoft? EDIT: On second thoughts, given that the M$ Windoze avoiders haven't shot this post up to 800 points, its probably nothing scandalous.
  - RaleyField 8y ago
    Nobody would need to read any reports if Microsoft respected customers by making telemetry opt-in.
  - dang 8y ago
    We've banned this account for posting unsubstantive and flamey comments. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
gmueckl 8y ago
There is an API monitor included in the appendix of the report. From the looks of it, it seems to be designed to hook into the API for the ETW sources and log the data that they record. But I can't tell what script language it is written in, so I cannot be entirely sure. Can someone have a closer look and tell me what this does exactly and how to run it? Seems interesting for those who want to get the complete picture of what Windows is recording.
- voltagex_ 8y ago
  WinDBG possibly https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/-----------------------a---run-script-file- https://docs.microsoft.com/en-us/windows-hardware/drivers/de...
bhengaij 8y ago
Note to power users who don't subscribe to hacker news FUD against Microsoft (while using Gmail) remember how disappointed most of us were when start menu jumplists disappeared. This is how it wont happen again. Please don't turn it off- I don't want Microsoft removing power features
heybrendan 8y ago
(More) direct link to the publication: https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Cyber-Sicherheit/SiSyPHus/Workpackage4_Telemetry.pdf https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Cyber-Si... Page 31 of the report was of primary interest--hosts hard-coded in diagtrack.dll: geo.settings-win.data.microsoft.com.akadns.net db5-eap.settings-win.data.microsoft.com.akadns.net settings-win.data.microsoft.com db5.settings-win.data.microsoft.com.akadns.net asimov-win.settings.data.microsoft.com.akadns.net db5.vortex.data.microsoft.com.akadns.net v10-win.vortex.data.microsft.com.akadns.net geo.vortex.data.microsoft.com.akadns.net v10.vortex-win.data.microsft.com us.vortex-win.data.microsft.com eu.vortex-win.data.microsft.com vortex-win-sandbox.data.microsoft.com alpha.telemetry.microsft.com oca.telemetry.microsft.com At this point, I would recommend choosing to treat the {akadns.net, microsoft.com, microsft.com} TLDs with general distrust. Also in the report: 40.77.226.249 40.77.226.250 13.92.194.212 52.178.38.151 52.229.39.152 52.183.114.173 13.78.232.226 For convenience, I've enumerated the corresponding CIDRs: 13.104.0.0/14 13.64.0.0/11 13.96.0.0/13 40.112.0.0/13 40.120.0.0/14 40.124.0.0/16 40.125.0.0/17 40.74.0.0/15 40.76.0.0/14 40.80.0.0/12 40.96.0.0/12 52.145.0.0/16 52.146.0.0/15 52.148.0.0/14 52.152.0.0/13 52.160.0.0/11 52.224.0.0/11 I'm not sure how to react to the observation of the usage of "microsft.com". I'll admit my instinct is to perceive this as, at worst, a rather clandestine attempt at circumventing basic DNS black-holing techniques--in which case, well played MSFT. Now if you'll excuse me, I have some firewall policies to update.
- jlgaddis 8y ago
  If you put in a block for *.akadns.net you will very likely experience quite a bit of collateral damage. A lot of large, popular companies use Akamai. Likewise, Ii you drop all traffic from and to those CIDR ranges, well, I hope you don't use any services or sites that are hosted on Azure.
  - heybrendan 8y ago
    Excellent point, and I'm well aware. Vigilance (and a proactive security posture) are the price of privacy--and I suspect nothing of actual value will be lost. It's preferable (to me) to blacklist /everything/ and deal with any future connectivity issues on a case-by-case basis.
MikusR 8y ago
Note that they analyzed only version 1607. Before Microsoft started publishing Telemetry documentation and before GDPR. Also akadns.net or microsft.com does not appear in a current (1809) diagtrack.dll.
- BurnGpuBurn 8y ago
  I noted that yeah. It's a shame that it takes so much time and effort to get to the information that Microsoft should just be open about. I think, with the current short release cycle, audits on Windows will always lag behind the real world a year or two. So at best you know how Microsoft was spying on you two years ago.
msla 8y ago
How sure are we they found everything? Did they have official source code to work from, or documentation only, or did they disassemble binaries?
- msla 8y ago
  I've never seen downvotes used as a tacit admission before.
a_imho 8y ago
Will MSFT act surprised when the inevitable GDPR fine comes?
ttty 8y ago
Is there any way for getting an alert every time any program wants to access any IP/domain and let me decide if I let it pass or block it.
- TheRealDunkirk 8y ago
  You made me look. Apparently, there is a tool on Windows called NetLimiter (https://www.netlimiter.com https://www.netlimiter.com) that can do this. Discussion: https://superuser.com/questions/261440/whats-the-closest-equivalent-of-little-snitch-mac-program-on-windows https://superuser.com/questions/261440/whats-the-closest-equ...
anime_forever 8y ago
Holy shit, there's not a single useful comment in this entire thread
dvfjsdhgfv 8y ago
Slightly off-topic, from one of the comments to the original article: > as a foreigner living in Germany you definitely see a big difference when it comes to web privacy. One thing I found surprising is that many German people will use nicknames on social sites like Facebook as to not reveal their identity online. It has more to do with common sense, doesn't it? Unless you want to promote yourself, you will probably want to use a nickname, and change these nicknames from site to site so that an individual or organization targeting you for whatever reason can't reveal your identity and do any real harm. A reasonable person doesn't shout it on the rooftops where they live, how wealthy they are, what they kids look like and so on. And yet, this is what people do when posting things online while using real names (as required by Facebook and a couple of other companies).
jeisc 8y ago
I am going to wait for Windows 11 before giving up Windows 8.1

323 points by jakobdabo 8y ago

minxomat 8y ago

For Windows. That should be part of the title.

craftyguy 8y ago
> Windows 10 telemetry ...
- smolder 8y ago
  Perhaps someone changed the title...
  - graeme 8y ago
    They did, it was something else before
- TheSpiceIsLife 8y ago
  Windows Tenlemetry

Zarath 8y ago

Does anyone know if there is a tool to safely remove telemetry executables from Win10? Is it possible to remove these?

ssvss 8y ago
I saw this tool being recommended in r/windows10. I have tried it, no issues so far, though haven't tested to see if it does disable telemetry. https://www.oo-software.com/en/shutup10 https://www.oo-software.com/en/shutup10
- eastendguy 8y ago
  The point of the report above is that you can NOT disable all telemetry, not even in the Enterprise version of Windows.
  - tjoff 8y ago
    ...through official means. I don't for a second doubt you can turn it off completely. But unofficial solutions come with tons of potential issues.
    - metildaa 8y ago
      Could just block all communication with Microsoft by the OS. Or, move to non-Windows OSes like the retail giants already have. Kroger and Walmart run Suse Enterprise Linux (relevant Uptime Funk reference) https://www.youtube.com/watch?v=SYRlTISvjww https://www.youtube.com/watch?v=SYRlTISvjww
      - Spooky23 8y ago
        Not in a government or business environment using Office 365. 365 requires all sorts of open connectivity to function.
        metildaa 8y ago
        If your using Office 365, telemetry in Windows is the least of your concern.
      - Dylan16807 8y ago
        > Could just block all communication with Microsoft by the OS. Easier said than done when there's a minefield of firewall-bypasses for it.
        rasz 8y ago
        Care to elaborate? Afaik and tested w10 does NOT bypass its own firewall when set to 'drop all' traffic.
jcoffland 8y ago
There is a tool to safely remove all Windows 10 telemetry. It's called Linux.
- wolfgke 8y ago
  > It's called Linux. It's called GNU/Linux. :-)
  - judge2020 8y ago
    https://www.lurkmore.com/view/GNU/Linux_interjection https://www.lurkmore.com/view/GNU/Linux_interjection
  - deleted 8y ago
    [deleted]
  - robdachshund 8y ago
    Nah it's just Linux.
- Delmania 8y ago
  Great let me know when Linux can run the apps I need for work and I can reliably install it on any hardware and expect it to work without issue. I like Linux as anyone else around here, but to claim it can replace Win10 for the average user is a stretch.
  - Sir_Cmpwn 8y ago
    >let me know when [...] I can reliably install it on any hardware and expect it to work without issue. Consider yourself told, then. Linux works OOTB on pretty much all hardware, often better than Windows since it ships with all of the necessary drivers. >to claim it can replace Win10 for the average user is a stretch The average user can handle KDE Plasma just fine.
    - RaleyField 8y ago
      > Consider yourself told, then. Nowadays I run mostly Ubuntu but before this attitude used to be a big turn off for me. When things manifestly don't work but the partisan chorus is acting like Linux is the most perfect thing ever then it is really easy to walk back out of spite. I run Linux because it's the least bad OS _for me_, it's still pretty bad in so many ways. > often better than Windows And often not. My experience with Linux drivers has always been only "tolerable". > KDE Plasma It's functional. But its design language (if it has any) is by far my least favorite one. I'd rather use Windows than use KDE.
snaky 8y ago
You could set up the proxy for (not Microsoft) web browser on your router and disallow all the traffic forwarding other than going via that proxy.
- wolfgke 8y ago
  See chapter 3 of the linked German paper > https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Cyber-Sicherheit/SiSyPHus/Analyse_Telemetriekomponente.pdf?__blob=publicationFile&v=4 https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Cyber-Si... for other suggestions. The variant with an HTTP proxy is described in section 3.2.1.
  - snaky 8y ago
    As far as I can tell, what they do with proxy is 'allow all, disallow telemetry' policy. That's not what seem to work reliably, because Microsoft is free to change everything at any second, and the 'telemetry' list is moving target. What I'm talking about is 'disallow all, allow the traffic from Firefox only' basically.
    - wolfgke 8y ago
      > That's not what seem to work reliably, because Microsoft is free to change everything at any second, and the 'telemetry' list is moving target. Principally, you are right. But keep in mind that the paper refers to Windows 10 LTSB 1607. It would surprise me a lot if Microsoft changed the telemetry servers for a Long Term Servicing Branch release.
      - snaky 8y ago
        A couple of years ago, I would agree with you, considering the fact that enterprise customers with volume licenses and huge investments in Microsoft infrastructure are bread and butter for Microsoft, and the foundation of that is trust between those enterprise customers with platinum support contracts and Microsoft. But nowadays I don't know. Microsoft is moving to Azure and 'freemium' data-collecting based business so fast, and breaking so many things. Anyway, the 'disallow all, allow only Firefox' have additional benefits in that it's prevents any 3rd party software from phoning home or something worse. The obvious downside might be the inability of those 3rd party software to auto-update itself.
uto 8y ago
Pi-hole seems to block windows telemetry domains by default. I don't know how complete the blocking is but there are a lot of domains like the ones listed in this thread on my top blocked domains list.
kakarot 8y ago
Not sure, I tried doing it myself once and it was a rabbit hole of scripts and changing obscure settings in the command line. After somewhere between 12-18 hours of solid work there was still so much left open, and I came to realize it's simply impossible to have a copy of Windows 10 that doesn't spy on you in some way. For example, hardware profiling. Attach a printer to Windows 10, Microsoft will receive the hardware ID. Sell the printer on craigslist. A political party uses it to print propaganda that is considered illegal. Don't be surprised when the police are at your door in two weeks. With support for Windows 7 Professional ending in 2020, I'm not sure where to go from here. I can just hope that VR and similar recent tech is fully realized on Linux or Linux+Wine in that time.
- einr 8y ago
  With support for Windows 7 Professional ending in 2020, I'm not sure where to go from here. Maybe you'll be able to do what some folks did with Windows XP and use a registry hack to trick Windows into receiving security patches for Windows Embedded POSready 7, which is the embedded Point-Of-Sale version of Win7. This is going to be supported until 10/12/2021. Of course, this is a very fragile and hacky solution that I would be unwilling to use on boxes running important stuff. I'm in the same quandary and I think I'm going to just disconnect all my Windows 7 boxes from the Internet on the end date. Although a bit of a bother I will still be able to do my music production, games and graphics stuff without Internet access, and all the day-to-day Internet stuff I can migrate to Linux. Maybe use disposable Windows 7 VM's for random lightweight Windows-only stuff.
  - kakarot 8y ago
    As it is, I run Windows in a VM with IOMMU, firewalled incoming connections, host-level VPN, etc., passing through a Geforce 1080 for direct access, and I only use it for specific purposes. Everything else is done in other VMs that run Linux. It's a similar setup to Qubes. I also do music production and graphics and game programming in Windows, so I'm totally with you on how fucked this is going to be in a year. One of my biggest issues is that I know for a fact my fb2k visualizer doesn't work under Wine. One possible solution I've thought about for using a non-networked W7: * Set up a separate VM with allocated storage that gets broadcast as a set of read-only local network drives * Add both W7 and this VM to a private network without net access * Access the netdrive on W7 and copy any files with which you need write access to a W7-only storage partition. Seeing as how we seem to have similar use cases, I'm happy to give you some pointers on setting up something similar to what I have.
tgsovlerkhgsel 8y ago
No. Even if you succeed, the next update will likely bring back some of the stuff you removed, two additional independent monitoring tools using separate C2 domains/IPs hidden somewhere in your system (not necessarily the Windows folder either), plus three "repair" tools that try to find modifications to Windows files like the ones you made and revert them.
njharman 8y ago
Yeah, it’s called “installer for another OS”
glenneroo 8y ago
My experience testing multiple tools on VMs (mostly recommendations from reddit), eventually deciding on one that seemed to work as advertised and installing it on my primary PC, says definitely not. Initially I saw a drastic reduction in outgoing traffic to MS/akadns, but after a couple months it ramped back up again... as someone else mentioned above, a lot of telemetry tools are reactivated/reinstalled via Windows Updates. I seemed to have completely nuked SMB in the process as well. I never saw any outbound traffic to microsft.com, I wonder if it's because they are using the German version?

detaro 8y ago

German press release: https://www.bsi.bund.de/DE/Presse/Pressemitteilungen/Presse2018/Studie_Win_10_20112018.html https://www.bsi.bund.de/DE/Presse/Pressemitteilungen/Presse2... Fitting name for the project: SiSyPHuS Win10

jammygit 8y ago

I wish all governments did audits like this. Either the software would get less invasive, or we'd see Linux everywhere, wins all around. How bad is it that not even governments can use windows without the data vacuum being turned on? And they need to commission these investigations to even figure out what that means?

iwiririwo 8y ago
Well there's other issues with Linux on the desktop that doesn't let anybody except developers use it productively. You always have to weight your priorities, and getting stuff done is often number one priority.
- Sylos 8y ago
  The use in government would mean running it in centrally administered form. The end user would just as well just click on the icon on their desktop and the application opens where they do their work. There may obviously be other problems, like the application not being available on Linux, or needing administrators with Linux knowledge, but that's nothing the end user has to deal with.
- emayljames 8y ago
  LTS (Long Term Service) versions of Linux OS' are now breaking even, or even sometimes ahead, of Windows. Office is easily on par (actually better IMO). You can have the UI exactly as you want it to be. You have GIMP. The home of Apache/PHP, and many other improvements!.
  - winrid 8y ago
    Word is light-years ahead of any open source alternative. Gimp is not a photoshop replacement. These guys don't care about Apache on their desktops. :)
    - SmellyGeekBoy 8y ago
      Lucky you can use Word in a browser these days, then. I'm not sure which government departments are using Photoshop but the few that do could just as easily use Macs.

AtomicOrbital 8y ago

to be fair every OS can and does do telemetry, say nothing about each software application calling back home in a similar way - such feedback helps speed up improvements however linux OS makes explicit notice of this and its simple to disable

salawat 8y ago
Which is why of all of those the only one that does it remotely right is Linux. Developers and businesses in particular have grown complacent with flagrant and repeated usurpation of their user's expectations of privacy. It needs to stop.
msla 8y ago
Saying "Linux does telemetry" is wrong. I'm not usually one of those "Linux is just a kernel!" types, but, in this case, it's very important to distinguish between the kernel, which does no telemetry, and the whole enchilada, which might. In short: If you can find me any on-by-default telemetry in Slackware, I'd be very interested.
justinclift 8y ago
> such feedback helps speed up improvements Recent MS "improvements" indicate things should not have been sped up.
TangoTrotFox 8y ago
There is 0 opt-out telemetry in most (all?) major flavors of Linux. But there's an even more important issue here. Even if there were some form of telemetry in Linux you'd be able to see exactly what it's collecting and where it's sending it since the OS itself is open source. I do not think many people are mostly okayish with purely diagnostic telemetry, but it's not clear exactly what Microsoft is collecting and their transition to a sort of 'free to play' style of OS does not lead one to the most optimistic views for either the type data they're harvesting, or their intended use for such data.
- mschuster91 8y ago
  > Even if there were some form of telemetry in Linux At least for Debian, at install time it does ask you if you want to participate in the "popularity contest" apt telemetry. But, on the other hand, it's opt-in with the "no" option preselected.

pingec 8y ago

Has anything similar been done for Android phones with google services installed and Chrome browser?

paride5745 8y ago
I guess the document about Google is so big they have issues uploading it to the web server!
wagutina 8y ago
Install NetGuard and see by yourself, it's terrifying. For eg the stock camera of my essential phone is sending data to Facebook without my consent
tgsovlerkhgsel 8y ago
For Chrome, there's the official whitepaper: https://www.google.com/chrome/privacy/whitepaper.html https://www.google.com/chrome/privacy/whitepaper.html I'd love to see independent verification that it is complete and truthful, of course.

maxxxxx 8y ago

I am surprised that they using server names like "alpha.telemetry.microsft.com". when I see something like "microsft" in an E-mail or link I immediately suspect that somebody is trying to fake being from Microsoft. Or are these spelling errors in the article? Edit: these domain names are in the report too. Very strange. I would get very nervous if I saw "microsft" in a firewall log.

pdkl95 8y ago
> microsft.com https://en.wikipedia.org/wiki/8.3_filename https://en.wikipedia.org/wiki/8.3_filename
- maxxxxx 8y ago
  Why would they use the short names in URLs? I thought they make sense only for file names.
  - pdkl95 8y ago
    I'm mostly joking. However, I've been observing Microsoft since the Windows 2.0 era, and I can't completely discard the possibility that Microsoft actually would use 8.3 domain names. Using 8.3 names "for legacy compatibility" in unusual places is something they've done before.
    - maxxxxx 8y ago
      It could be that at some point they mapped domain names to folder names or something like that. Still looks pretty hacky (or malicious) nowadays.
    - yesenadam 8y ago
      That does sound like some kind of rational explanation. p.s. Further proof that history's written by the victors, from that 8.3 wiki page: "An 8.3 filename...is a filename convention used by old versions of DOS and versions of Microsoft Windows...Similar 8.3 file naming schemes have also existed on earlier CP/M, TRS-80, Atari, and some Data General and [DEC] minicomputer operating systems." "Similar naming schemes also existed"! A strange way of saying "DOS copied CP/M's drive letter + colon + 8.3 filename exactly". ..and everything else. (Disclosure: I grew up on CP/M)

MikusR 8y ago

Did they find something that contradicts stuff listed at https://docs.microsoft.com/en-us/windows/privacy/ https://docs.microsoft.com/en-us/windows/privacy/ ?

bhengaij 8y ago
Are you really expecting anybody to waste time reading either of the reports when that time can be utilized spreading FUD against Microsoft? EDIT: On second thoughts, given that the M$ Windoze avoiders haven't shot this post up to 800 points, its probably nothing scandalous.
- RaleyField 8y ago
  Nobody would need to read any reports if Microsoft respected customers by making telemetry opt-in.
- dang 8y ago
  We've banned this account for posting unsubstantive and flamey comments. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

gmueckl 8y ago

There is an API monitor included in the appendix of the report. From the looks of it, it seems to be designed to hook into the API for the ETW sources and log the data that they record. But I can't tell what script language it is written in, so I cannot be entirely sure. Can someone have a closer look and tell me what this does exactly and how to run it? Seems interesting for those who want to get the complete picture of what Windows is recording.

voltagex_ 8y ago
WinDBG possibly https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/-----------------------a---run-script-file- https://docs.microsoft.com/en-us/windows-hardware/drivers/de...

bhengaij 8y ago

Note to power users who don't subscribe to hacker news FUD against Microsoft (while using Gmail) remember how disappointed most of us were when start menu jumplists disappeared. This is how it wont happen again. Please don't turn it off- I don't want Microsoft removing power features

heybrendan 8y ago

(More) direct link to the publication: https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Cyber-Sicherheit/SiSyPHus/Workpackage4_Telemetry.pdf https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Cyber-Si... Page 31 of the report was of primary interest--hosts hard-coded in diagtrack.dll: geo.settings-win.data.microsoft.com.akadns.net db5-eap.settings-win.data.microsoft.com.akadns.net settings-win.data.microsoft.com db5.settings-win.data.microsoft.com.akadns.net asimov-win.settings.data.microsoft.com.akadns.net db5.vortex.data.microsoft.com.akadns.net v10-win.vortex.data.microsft.com.akadns.net geo.vortex.data.microsoft.com.akadns.net v10.vortex-win.data.microsft.com us.vortex-win.data.microsft.com eu.vortex-win.data.microsft.com vortex-win-sandbox.data.microsoft.com alpha.telemetry.microsft.com oca.telemetry.microsft.com At this point, I would recommend choosing to treat the {akadns.net, microsoft.com, microsft.com} TLDs with general distrust. Also in the report: 40.77.226.249 40.77.226.250 13.92.194.212 52.178.38.151 52.229.39.152 52.183.114.173 13.78.232.226 For convenience, I've enumerated the corresponding CIDRs: 13.104.0.0/14 13.64.0.0/11 13.96.0.0/13 40.112.0.0/13 40.120.0.0/14 40.124.0.0/16 40.125.0.0/17 40.74.0.0/15 40.76.0.0/14 40.80.0.0/12 40.96.0.0/12 52.145.0.0/16 52.146.0.0/15 52.148.0.0/14 52.152.0.0/13 52.160.0.0/11 52.224.0.0/11 I'm not sure how to react to the observation of the usage of "microsft.com". I'll admit my instinct is to perceive this as, at worst, a rather clandestine attempt at circumventing basic DNS black-holing techniques--in which case, well played MSFT. Now if you'll excuse me, I have some firewall policies to update.

jlgaddis 8y ago
If you put in a block for *.akadns.net you will very likely experience quite a bit of collateral damage. A lot of large, popular companies use Akamai. Likewise, Ii you drop all traffic from and to those CIDR ranges, well, I hope you don't use any services or sites that are hosted on Azure.
- heybrendan 8y ago
  Excellent point, and I'm well aware. Vigilance (and a proactive security posture) are the price of privacy--and I suspect nothing of actual value will be lost. It's preferable (to me) to blacklist /everything/ and deal with any future connectivity issues on a case-by-case basis.

MikusR 8y ago

Note that they analyzed only version 1607. Before Microsoft started publishing Telemetry documentation and before GDPR. Also akadns.net or microsft.com does not appear in a current (1809) diagtrack.dll.

BurnGpuBurn 8y ago
I noted that yeah. It's a shame that it takes so much time and effort to get to the information that Microsoft should just be open about. I think, with the current short release cycle, audits on Windows will always lag behind the real world a year or two. So at best you know how Microsoft was spying on you two years ago.

msla 8y ago

How sure are we they found everything? Did they have official source code to work from, or documentation only, or did they disassemble binaries?

msla 8y ago
I've never seen downvotes used as a tacit admission before.

a_imho 8y ago

Will MSFT act surprised when the inevitable GDPR fine comes?

ttty 8y ago

Is there any way for getting an alert every time any program wants to access any IP/domain and let me decide if I let it pass or block it.

TheRealDunkirk 8y ago
You made me look. Apparently, there is a tool on Windows called NetLimiter (https://www.netlimiter.com https://www.netlimiter.com) that can do this. Discussion: https://superuser.com/questions/261440/whats-the-closest-equivalent-of-little-snitch-mac-program-on-windows https://superuser.com/questions/261440/whats-the-closest-equ...

anime_forever 8y ago

Holy shit, there's not a single useful comment in this entire thread

dvfjsdhgfv 8y ago

Slightly off-topic, from one of the comments to the original article: > as a foreigner living in Germany you definitely see a big difference when it comes to web privacy. One thing I found surprising is that many German people will use nicknames on social sites like Facebook as to not reveal their identity online. It has more to do with common sense, doesn't it? Unless you want to promote yourself, you will probably want to use a nickname, and change these nicknames from site to site so that an individual or organization targeting you for whatever reason can't reveal your identity and do any real harm. A reasonable person doesn't shout it on the rooftops where they live, how wealthy they are, what they kids look like and so on. And yet, this is what people do when posting things online while using real names (as required by Facebook and a couple of other companies).

jeisc 8y ago

I am going to wait for Windows 11 before giving up Windows 8.1