5 ms·
I had an interview last year with the Windows and Devices Group. On the day of the interview, I was told it would be with people that work on telemetry. One in
by zerohp 8y ago
I had an interview last year with the Windows and Devices Group. On the day of the interview, I was told it would be with people that work on telemetry.
One interviewer told me that keystrokes were being measured by conhost.exe. Not just for internal testing. He clarified that it was done on customer machines. It wasn't clear if they collected individual key presses because we were discussing something you could infer by knowing keystroke timing.
Windows 10 is the most prolific malware in the world.
- DHowett 8y agoSpeaking as the engineering lead owning conhost.exe: I can't find anything in our code that would trace user input, or data effectively derived from user input, to even a local event stream. There are a couple instances where we trace API call timings, but only that of API calls initiated by an attached console application.
- cjones26 8y agoWhen are we going to see unlimited command line buffers :)?
- zadjii 8y agoHey, I work on the commandline team too - We can't give out exact timelines for anything we work on, but I can tell you that it's pretty high up on the backlog. It's closer now than it's ever been, that's for sure.
- mrtweetyhack 8y agoSaid the company whose device manager shows a webcam is disabled but can still be accessed by software.
- elken 8y agoOpen the code up then..
- earenndil 8y agoI highly doubt he is the one who has the power to make that happen.
- crumbshot 8y agoThat is such an outrageous claim I had to check for myself. From looking at conhost.exe in IDA Pro, there are some references to telemetry in a function HandleKeyEvent: https://i.imgur.com/MwaBLcW.jpg https://i.imgur.com/MwaBLcW.jpg But looking more closely it's just used to increase some counters when Ctrl+C or Ctrl+V are used: https://i.imgur.com/29e2qLD.png https://i.imgur.com/29e2qLD.png There is another one for Ctrl+A elsewhere in the function as well. Seems these are for when clipboard operations happen, there is other telemetry nearby for when key activity causes a paste: https://i.imgur.com/xONKrGJ.png https://i.imgur.com/xONKrGJ.png So Microsoft are indeed collecting keystroke telemetry in conhost.exe, but it's just some boring old counters to measure clipboard usage.
- russh 8y agoBut how can that be when "... the engineering lead owning conhost.exe: I can't find anything in our code that would trace user input, or data effectively derived from user input, to even a local event stream."
- crumbshot 8y agoI think this disassembly supports their assertion. The number of times a user copies and pastes isn't in itself input to the console, just a metric of some out of band events.
- DHowett 8y agoI mean, I suppose that the key sequences around copy/paste are technically user input. Those events get processed into telemetry as to whether they were done in processed or raw input mode, and whether Quick Edit was engaged at the time. Additional telemetry points include whether the "Find" dialog is being used (explicitly, whether "find next" has been clicked, and how long the search string is -- no other user-generated search content is included in event logs), when a process detaches from the console, and when the window is resized.
- jessaustin 8y agoHow about this one? https://news.ycombinator.com/item?id=19323560 https://news.ycombinator.com/item?id=19323560