11 ms·

Does Windows 10's telemetry include sending *.doc files if Word crashed?

157 points by chupa-chups 8y ago

pixl97 8y ago
Any headline asking a question is generally no, but in this case yes. In theory you want the file causing the crash as it makes figuring out the fault many times easier. The problem comes in when this is your financial records being sent off to Microsoft
- simion314 8y ago
  When I was using Windows years ago you got a popup with the option to send a crash report, are the crash reports sent without you knowing? Is this feature on by default?
  - tinus_hn 8y ago
    That was during the same period you were allowed to chose when you installed updates, right?
- snazz 8y ago
  The only other question where the answer is almost always yes is “is this a scam?”.
- gruez 8y ago
  >but in this case yes not really, the answer even says it's his guess.
- cm2187 8y ago
  Or a document covered by attorney-client privilege.
  - chopin 8y ago
    At least in Europe using Win10 as an attorney (or physician for that matter) may bring you into hot waters.
    - grecy 8y ago
      I worked for Defence for a year. I'd be shocked if they allow this
  - craftyguy 8y ago
    Or HIPAA in the US
- jabberthemutt 8y ago
  Does this also happen with Office on MacOS?
ChrisSD 8y ago
The extremetech link[0] given in the answer is probably more generally interesting. That article also explains how to access the MS Diagnostic Dataviewer which allows you to explore the collected data after you switch it on (from the Settings app go to Privacy -> Diagnostic & feedback). It also links to Microsoft's explicit listing of everything that they might collect for basic diagnostics[1]. Of course Microsoft could be lying but in that case you shouldn't be using their OS. To borrow a phrase: They have root. If you don't trust them then you don't trust your PC. [0] https://www.extremetech.com/computing/247311-microsoft-finally-reveals-exactly-telemetry-windows-10-collects-pc https://www.extremetech.com/computing/247311-microsoft-final... [1] https://docs.microsoft.com/en-gb/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809 https://docs.microsoft.com/en-gb/windows/privacy/basic-level...
- bjpbakker 8y ago
  That _long_ list is limited to the "basic level" telemetry data and does not include e.g. automatic sample documents that Defender sends by default (those include you actual documents). Microsoft proves over and over again that they are not trust worthy. I agree you shouldn't be using their OS, but sadly many people don't consider this a choice since it comes pre-installed on most PCs.
  - ChrisSD 8y ago
    As far as I'm aware Defender will not send documents without prompting you first.
  - honestoHeminway 8y ago
    Its definatly not the installation. Its simply that linux is not a competetive offer - yes, even for free. My mum got linux pre installed on a laptop. She was not happy. As in- her software did not run, the user-experience she had was worthless and it all boiled down to reducing a laptop to a doorstopper. So off it went, and windows 10 came back. Maybe, just maybe, making a good desktop is really hard and microsoft set the standards, that all those amateurs cant adhere too. And thats why they get away with it.
- 8y ago
Tepix 8y ago
I use the free tool O&O ShutUp 10 to disable this https://www.oo-software.com/en/shutup10 https://www.oo-software.com/en/shutup10 Make sure you reboot after running it, disable telemetry again and do another reboot. Only then all three telemetry features will remain off. It‘s a shame that you have to work against your OS to protect your privacy. Use Linux unless you need Windows for a good reason.
- azhenley 8y ago
  Make sure your Linux distro doesn’t have telemetry!
- Someone1234 8y ago
  The same people running these freeware tools/scripts, are the same people for whom "Windows Update constantly breaks my install." It isn't a coincidence, most of these scripts intentionally break Windows' components in unsupported ways. Use at your own risk.
- craftyguy 8y ago
  Using 1 proprietary application to 'lock down' another proprietary application seems like an exercise in futility.
drfuchs 8y ago
I remember the NSA refusing to send a core file for us to debug a FrameMaker crash they ran into, since they knew that their document could be extracted from it. Perhaps this is the sense in which the .doc files are being sent; in the trivial case, they may simply be mapped into memory, which is then part of the dump that gets sent.
deleted 8y ago
[deleted]
vortico 8y ago
NASA is finding exoplanets every day, and the LHC is probing quarks at high energies, yet nobody seems to know what is and isn't sent to Microsoft on Windows 10, despite the relative simplicity of doing so (and arguably equal importance as this could be giving Microsoft access to billions of dollars of trade secrets for example). Are any security researchers actively researching this topic? Even if crash documents are encrypted over the network, couldn't these questions be answered by patching root certificates, setting up fake diagnostic servers, tracing the stack with a debugger, etc? Even a reproducable test of making Word crash 10 times, measuring the bandwidth, changing the document size slightly, and remeasuring could give some insight into this question.
- pjc50 8y ago
  Ultimately this will have to be dealt with by one of the Information Commissioners of the EU. I don't think anyone could argue either consent or business necessity for a process this opaque.
- fredley 8y ago
  Quarks and Exoplanets are deliberately trying to hide.
  - LandR 8y ago
    Are you missing a 'not' ?
    - squarefoot 8y ago
      And btw Quarks and Exoplanets usually don't employ armies of lawyers to protect against poor scientists attempting to reverse engineer their behaviour.
      - gruez 8y ago
        Any source that Microsoft ‘s suing people for this?
kgwxd 8y ago
Answer: you can't know for sure. Absolutely ridiculous.
- Someone1234 8y ago
  Diagnostic Data Viewer shows you the unencrypted data. The only way to get to "you can't know for sure" is by this logical leap: > But that does NOT guarantee or prove that there is documents privacy in any way. Using that specious logic you could say the same about any software on your machine.
  - sdfgsd3fgsdfg 8y ago
    You are missing the point: If we dont trust the OS, why would we trust it to be honest and display what it's actually reporting. You can't be sure until you wiretapped the communication and looked for yourself.
    - Someone1234 8y ago
      Seems I didn't miss the point at all. This is a conspiracy theory and not based on any fact, the theorist point to lack of proof as proof and ask us to disprove their ideas. The actual information we have indicates that isn't the case. If you disagree, then I'd suggest you dig up something supporting that viewpoint.
    - bradford 8y ago
      I'm not sure if it's going to impact your trust in Windows either way, but regulators do 'wiretap' the communication sent off Windows boxes in an effort to keep Microsoft compliant with law, and Microsoft is financially incentivized to be honest (at risk of hefty fines). Tech journalism is quick to print stories of malfeasance in the privacy/security area, but they've done very little to inform readers of accountability or legal obligations that are enforced by government entities. This leads to general distrust and unproductive online conversations. If you're interested in privacy/security, you should be paranoid about this stuff, but don't mistake yourself into thinking that Microsoft operates in vacuum of unaccountability. (Disclaimer, MS employee, and I have to state that this is my opinion)
kevin_b_er 8y ago
Are Windows 10 and Microsoft Office compatible with HIPPA given they may send off protected health information without protecting it themselves?
- techntoke 8y ago
  Would be very costly if actually pursued
deleted 8y ago
[deleted]
zwerdlds 8y ago
But Scott Hanselman thinks it's all about MS killin' our pappies.
- smacktoward 8y ago
  I appreciate Hanselman and his work a lot, but that answer riled me as well. He seems to not understand that Microsoft's underhanded behavior in the past actually did kill a lot of promising, pioneering companies -- Netscape, Stac (https://en.wikipedia.org/wiki/Stac_Electronics https://en.wikipedia.org/wiki/Stac_Electronics) and Digital Research (https://en.wikipedia.org/wiki/Digital_Research https://en.wikipedia.org/wiki/Digital_Research), to name just a few off the top of my head. It's one thing to argue that they don't do that sort of thing anymore, but quite another to pretend they never did it in the first place.
  - deogeo 8y ago
    > It's one thing to argue that they don't do that sort of thing anymore Even if you argued that, you'd be dead wrong - they won't reveal which Android patents they use for extortion, till very recently pushed for adoption of the FAT32 filesystem so they could extract patent fees from that. Now that those patents have expired, they're doing the same with ExFAT, all while lobbying against open document formats, and deliberately making their own as difficult to work with as possible. That's all just from the top of my head, without even going into Windows 10.
- atesti 8y ago
  Where did he comment on this issue?
  - zwerdlds 8y ago
    This is the article I am referencing. https://www.hanselman.com/blog/MicrosoftKilledMyPappy.aspx https://www.hanselman.com/blog/MicrosoftKilledMyPappy.aspx
dgudkov 8y ago
As a user I don't mind sending diagnostic information for debugging, but that should be transparent to me and controllable. Why not just show a dialog saying "a crash happened, here is what is going to be sent to us, uncheck items that you don't want to share with us"? Quietly retrieving documents without user permission is not acceptable.
- parliament32 8y ago
  Probably because they're just grabbing a core dump of the crash and sending it off. The dump of your memory may or may not include various items that you'd like "checkboxed", but it's not easy to clean out unchecked ones from that kind of dump.

157 points by chupa-chups 8y ago

Any headline asking a question is generally no, but in this case yes. In theory you want the file causing the crash as it makes figuring out the fault many times easier. The problem comes in when this is your financial records being sent off to Microsoft

simion314 8y ago
When I was using Windows years ago you got a popup with the option to send a crash report, are the crash reports sent without you knowing? Is this feature on by default?
- tinus_hn 8y ago
  That was during the same period you were allowed to chose when you installed updates, right?
snazz 8y ago
The only other question where the answer is almost always yes is “is this a scam?”.
gruez 8y ago
>but in this case yes not really, the answer even says it's his guess.
cm2187 8y ago
Or a document covered by attorney-client privilege.
- chopin 8y ago
  At least in Europe using Win10 as an attorney (or physician for that matter) may bring you into hot waters.
  - grecy 8y ago
    I worked for Defence for a year. I'd be shocked if they allow this
- craftyguy 8y ago
  Or HIPAA in the US
jabberthemutt 8y ago
Does this also happen with Office on MacOS?

ChrisSD 8y ago

The extremetech link[0] given in the answer is probably more generally interesting. That article also explains how to access the MS Diagnostic Dataviewer which allows you to explore the collected data after you switch it on (from the Settings app go to Privacy -> Diagnostic & feedback). It also links to Microsoft's explicit listing of everything that they might collect for basic diagnostics[1]. Of course Microsoft could be lying but in that case you shouldn't be using their OS. To borrow a phrase: They have root. If you don't trust them then you don't trust your PC. [0] https://www.extremetech.com/computing/247311-microsoft-finally-reveals-exactly-telemetry-windows-10-collects-pc https://www.extremetech.com/computing/247311-microsoft-final... [1] https://docs.microsoft.com/en-gb/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809 https://docs.microsoft.com/en-gb/windows/privacy/basic-level...

bjpbakker 8y ago
That _long_ list is limited to the "basic level" telemetry data and does not include e.g. automatic sample documents that Defender sends by default (those include you actual documents). Microsoft proves over and over again that they are not trust worthy. I agree you shouldn't be using their OS, but sadly many people don't consider this a choice since it comes pre-installed on most PCs.
- ChrisSD 8y ago
  As far as I'm aware Defender will not send documents without prompting you first.
- honestoHeminway 8y ago
  Its definatly not the installation. Its simply that linux is not a competetive offer - yes, even for free. My mum got linux pre installed on a laptop. She was not happy. As in- her software did not run, the user-experience she had was worthless and it all boiled down to reducing a laptop to a doorstopper. So off it went, and windows 10 came back. Maybe, just maybe, making a good desktop is really hard and microsoft set the standards, that all those amateurs cant adhere too. And thats why they get away with it.
8y ago

Tepix 8y ago

I use the free tool O&O ShutUp 10 to disable this https://www.oo-software.com/en/shutup10 https://www.oo-software.com/en/shutup10 Make sure you reboot after running it, disable telemetry again and do another reboot. Only then all three telemetry features will remain off. It‘s a shame that you have to work against your OS to protect your privacy. Use Linux unless you need Windows for a good reason.

azhenley 8y ago
Make sure your Linux distro doesn’t have telemetry!
Someone1234 8y ago
The same people running these freeware tools/scripts, are the same people for whom "Windows Update constantly breaks my install." It isn't a coincidence, most of these scripts intentionally break Windows' components in unsupported ways. Use at your own risk.
craftyguy 8y ago
Using 1 proprietary application to 'lock down' another proprietary application seems like an exercise in futility.

drfuchs 8y ago

I remember the NSA refusing to send a core file for us to debug a FrameMaker crash they ran into, since they knew that their document could be extracted from it. Perhaps this is the sense in which the .doc files are being sent; in the trivial case, they may simply be mapped into memory, which is then part of the dump that gets sent.

deleted 8y ago

[deleted]

vortico 8y ago

NASA is finding exoplanets every day, and the LHC is probing quarks at high energies, yet nobody seems to know what is and isn't sent to Microsoft on Windows 10, despite the relative simplicity of doing so (and arguably equal importance as this could be giving Microsoft access to billions of dollars of trade secrets for example). Are any security researchers actively researching this topic? Even if crash documents are encrypted over the network, couldn't these questions be answered by patching root certificates, setting up fake diagnostic servers, tracing the stack with a debugger, etc? Even a reproducable test of making Word crash 10 times, measuring the bandwidth, changing the document size slightly, and remeasuring could give some insight into this question.

pjc50 8y ago
Ultimately this will have to be dealt with by one of the Information Commissioners of the EU. I don't think anyone could argue either consent or business necessity for a process this opaque.
fredley 8y ago
Quarks and Exoplanets are deliberately trying to hide.
- LandR 8y ago
  Are you missing a 'not' ?
  - squarefoot 8y ago
    And btw Quarks and Exoplanets usually don't employ armies of lawyers to protect against poor scientists attempting to reverse engineer their behaviour.
    - gruez 8y ago
      Any source that Microsoft ‘s suing people for this?

kgwxd 8y ago

Answer: you can't know for sure. Absolutely ridiculous.

Someone1234 8y ago
Diagnostic Data Viewer shows you the unencrypted data. The only way to get to "you can't know for sure" is by this logical leap: > But that does NOT guarantee or prove that there is documents privacy in any way. Using that specious logic you could say the same about any software on your machine.
- sdfgsd3fgsdfg 8y ago
  You are missing the point: If we dont trust the OS, why would we trust it to be honest and display what it's actually reporting. You can't be sure until you wiretapped the communication and looked for yourself.
  - Someone1234 8y ago
    Seems I didn't miss the point at all. This is a conspiracy theory and not based on any fact, the theorist point to lack of proof as proof and ask us to disprove their ideas. The actual information we have indicates that isn't the case. If you disagree, then I'd suggest you dig up something supporting that viewpoint.
  - bradford 8y ago
    I'm not sure if it's going to impact your trust in Windows either way, but regulators do 'wiretap' the communication sent off Windows boxes in an effort to keep Microsoft compliant with law, and Microsoft is financially incentivized to be honest (at risk of hefty fines). Tech journalism is quick to print stories of malfeasance in the privacy/security area, but they've done very little to inform readers of accountability or legal obligations that are enforced by government entities. This leads to general distrust and unproductive online conversations. If you're interested in privacy/security, you should be paranoid about this stuff, but don't mistake yourself into thinking that Microsoft operates in vacuum of unaccountability. (Disclaimer, MS employee, and I have to state that this is my opinion)

kevin_b_er 8y ago

Are Windows 10 and Microsoft Office compatible with HIPPA given they may send off protected health information without protecting it themselves?

techntoke 8y ago
Would be very costly if actually pursued

deleted 8y ago

[deleted]

zwerdlds 8y ago

But Scott Hanselman thinks it's all about MS killin' our pappies.

smacktoward 8y ago
I appreciate Hanselman and his work a lot, but that answer riled me as well. He seems to not understand that Microsoft's underhanded behavior in the past actually did kill a lot of promising, pioneering companies -- Netscape, Stac (https://en.wikipedia.org/wiki/Stac_Electronics https://en.wikipedia.org/wiki/Stac_Electronics) and Digital Research (https://en.wikipedia.org/wiki/Digital_Research https://en.wikipedia.org/wiki/Digital_Research), to name just a few off the top of my head. It's one thing to argue that they don't do that sort of thing anymore, but quite another to pretend they never did it in the first place.
- deogeo 8y ago
  > It's one thing to argue that they don't do that sort of thing anymore Even if you argued that, you'd be dead wrong - they won't reveal which Android patents they use for extortion, till very recently pushed for adoption of the FAT32 filesystem so they could extract patent fees from that. Now that those patents have expired, they're doing the same with ExFAT, all while lobbying against open document formats, and deliberately making their own as difficult to work with as possible. That's all just from the top of my head, without even going into Windows 10.
atesti 8y ago
Where did he comment on this issue?
- zwerdlds 8y ago
  This is the article I am referencing. https://www.hanselman.com/blog/MicrosoftKilledMyPappy.aspx https://www.hanselman.com/blog/MicrosoftKilledMyPappy.aspx

dgudkov 8y ago

As a user I don't mind sending diagnostic information for debugging, but that should be transparent to me and controllable. Why not just show a dialog saying "a crash happened, here is what is going to be sent to us, uncheck items that you don't want to share with us"? Quietly retrieving documents without user permission is not acceptable.

parliament32 8y ago
Probably because they're just grabbing a core dump of the crash and sending it off. The dump of your memory may or may not include various items that you'd like "checkboxed", but it's not easy to clean out unchecked ones from that kind of dump.