12 ms·
Edge sends full URLs of pages visited to Microsoft
- octosphere 7y agoWhich is why I always harden Edge after setting up Windows by disabling SmartScreen
- bogwog 7y agoor you could just, you know, use Firefox
- ToFab123 7y agoTrue, but nothing beats MS Edge if you have a touch screen and that it a good enough reason for me to stay with Edge.
- ebg13 7y agoCan you save text files that you're looking at in Edge yet? Like if you navigate to a URL that goes https://foo.com/blah.txt https://foo.com/blah.txt can you hit Ctrl+S or right-click on the text page and save the document? The last time I looked at Edge the answer was no.
- stallmanite 7y agoWow how broken is that? Wondering what the heck was the reasoning there.
- currysausage 7y agoI guess that most people who know that you can save web pages to your disk (and make use of that feature) also know that you can disable telemetry (and make use of that feature).
- Santosh83 7y agoSeems like you can't save ANY page in Edge. Absurd lack of functionality.
- derimagia 7y agoFired up Edge Insider (The Chromium version). Works fine.
- Insanity 7y agoYou could just use another browser like Firefox. :)
- ahoka 7y agoAFAIK Mozilla does the same.
- amluto 7y agoNo, it doesn’t. The equivalent Firefox feature does not reveal your URLs to Mozilla. https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work#w_what-information-is-sent-to-mozilla-or-its-partners-when-phishing-and-malware-protection-are-enabled https://support.mozilla.org/en-US/kb/how-does-phishing-and-m...
- jchw 7y agoMozilla does not send full URLs to a third party. As mentioned in the thread, they use “4-byte URL hash prefixes.” Documentation: https://developers.google.com/safe-browsing/v4/urls-hashing https://developers.google.com/safe-browsing/v4/urls-hashing (Disclosure: I work for Google but have nothing to do with the safe browsing API.)
- 7373737373 7y agoWait, this is not happening locally, against bloom filters or something?
- est31 7y agoThere is a first step which uses bloom filters, and if the filter gives a result, it is hashed and the hash is sent to the google service to double-check. That being said, a four byte / 32 bit hash is enough to almost uniquely identify a website. There number of 32 bit numbers and websites is roughly the same order of magnitude. It's a problem without a good solution because if you create many collisions then you also generate plenty of sites falsely reported as phishing and which admin would want that to happen on their site. If you avoid creation of collisions, you have this identifyability problem. There is this CRLite proposal [1] using layered bloom filters to stop reliance on web services. Maybe it can be adopted for phishing sites, as well. [1]: https://ieeexplore.ieee.org/document/7958597 https://ieeexplore.ieee.org/document/7958597
- reaperducer 7y agoEvery time I see people on HN campaigning for Microsoft as some kind of reformed tech company that has seen the errors of its past and turned into a force for good, something like this comes up. Same old Microsoft. Second verse same as the first.
- xkqwe 7y agoPredictably downvoted. Cannot beat a 1T company that is randomly buying "open" source developer "mind share".
- alkonaut 7y agoThe good part of Microsoft is the division responsible for languages, compilers and cloud. Meanwhile an old Microsoft makes Windows, Office, etc. While the latter has improved somewhat, only the former has reformed.
- NullPrefix 7y ago>The good part of Microsoft is the division responsible for languages, compilers and cloud. Putting their telemetry in your compiled binaries is ... real good? Marketing is the only thing that changed.
- alkonaut 7y agoYes. I have absolutely no problem with the way that works. It’s clearly spelled out how it works and how it’s configured. Seems few who actually use these tools have problems with this...
- NMAK 7y agoThis is another lie. During the install process Windows 10 pretends to give the option to disable "telemetry". The you visit the control panel and find that something like 50 "telemetry" options are still enabled. This is deceitful and evil.
- 7y ago
- josho 7y agoI assumed every browser did this as a part of their safe browsing features. Or is this different somehow?
- antoineMoPa 7y agoFollowing tweets explain that other browsers send an hashed URL instead. (but I guess it's easy to associate the hash with actual URLs)
- shakna 7y agoOther browsers use a _truncated_ hash. Easy enough to match to a known list of bad sites, but exceptionally difficult to reverse engineer a list of sites the user has visited.
- ChrisLomont 7y agoThose hashes have to be essentially unique to prevent blocking good sites erroneous;y, and as such are easily associated to actual sites when you’re the scale of MS or Google.
- simias 7y agoNot if there's an other layer of verification locally. Then you can allow a few false positives with the hash on the remote and they'll get discarded when the full hash is compared locally. That being said 32bits of information seems like quite a lot and can probably used to match the original URL fairly accurately.
- liability 7y agoYou also need to consider the greater context. Suppose my history shows I sent a hash that could be one of 100 different known URLs. One of them is about model airplanes, but there is no way to know I picked that one. Chance I like model airplanes? All else being equal.. call it 1% But what if over the next hour I continue to send hashes with random subject matter sets that include model airplanes each time. Suppose the intersection of the possible subject matters shrinks with each additional hash, quite possibly contains only model airplanes. I visited 100 URLs in one hour. For each URL there are 100 others with the same hash but independent topics. Lets say there are 10,000 known topics, but every hash I sent has model airplanes associated with it. Now what are the chances I like model planes? It seems clear to me that this scheme, with logging, reveals a lot in theory. But maybe solving this problem in practice would cost more that the data is worth. For now.
- kryogen1c 7y agoNot to defend Microsoft, but SIDs are non unique. I think theyre only guaranteed to be unique per AD forest with the addition of the RID subauthority. Lots of domains are domain.local or other such commonalities and so may have duplicates. Microsoft would know this, so the intent does not appear surveillance or data collection.
- yjftsjthsd-h 7y ago> Microsoft would know this, so the intent does not appear surveillance or data collection. Personally identifiable data collection. The goal is obviously data collection.
- gruez 7y agoAccording to wikipedia, a SID looks like this S-1-5-21-3623811015-3361044348-30300820-1013 The 3 long numbers in the middle are called "Domain or local computer identifier". Further down it says that each of those numbers are encoded as a 32 bit integer. Assuming they're randomly generated, that's 96 bits of entropy, which is more than enough to uniquely identify every computer on the planet[1]. [1] There might be a few duplicates due to the birthday paradox.
- seaish 7y agoDoesn't it send full URLs anyway when you're signed into Edge or Chrome to sync your history?
- acollins1331 7y agoEdge is the number one browser in the world for installing chrome.
- kabes 7y agoBecause google is any better? And engine-wise they're the same these days.
- hiciu 7y agobecause the rumor has it that "Edge sends full URLs of pages visited to Microsoft" and we haven't yet caught google in such embarrassing situation
- Yoric 7y agoWell, by default, Chrome sends whatever you're typing in the URL bar to Google for auto-completion. No need to catch Google in such situation, it's a feature of Chrome.
- eitland 7y agoDoesn't Chrome send your entire browsing history to Google as well? Edit: I thought this was a well know fact and if it isn't I might have been to harsh about Google and Chrome. Edit 2: Thinking about it and searching a bit I conclude that IIRC Google at least used to have access to your browsing history as part of syncing it unencrypted.
- auslander 7y agoNot so easy to do this mitm trick with Chrome, it has google certs pinned down. I think Chrome sends no less info to Google.
- noobermin 7y agoCan this be changed to the normal twitter URL, not the mobile version?
- marsrover 7y agoWhen I removed the "mobile" it looks exactly the same. I guess there is no non-mobile version of Twitter anymore.
- maximente 7y agono, it's likely you're either on a mobile device or your cookies are set so that it's redirecting you to it. the non-mobile version works fine and is clearly different.
- cannabis_sam 7y agoThere’s a super-fast, no bullshit, mobile-friendly, absolutely wonderful version of twitter you can get if you disable javascript... (i’ve only used it through tor tho)
- PhantomGremlin 7y ago
- OnlyRepliesToBS 7y agoa new class action lawsuit is required
- kerng 7y agoPoster might use preview versions, where Microsft does these things (not just Edge) if I recall correctly.
- wolf550e 7y agoEric Lawrence (PM on Edge, previously on Chrome, previously author of fiddler) showing screenshots of documentation that explains all that, and saying it's been documented this way for 14 years: https://twitter.com/ericlaw/status/1152933704198758401 https://twitter.com/ericlaw/status/1152933704198758401
- jammygit 7y ago...and for 14 years no ordinary user has understood what those default settings do, instead assuming “their software provider wouldn’t do that...”
- arijun 7y agoI think you're making a big assumption that ordinary users care if Microsoft knows what URLs they visit--how many of them use blockers or another technology to opt out of e.g. Facebook tracking?
- Elpomm 7y agoAgreed, the average user simply does not care about privacy to that degree. FaceApp is yet another example. On the bright side, most of the tools we need to "cover up" are available to us. You can't ask for more than freedom of choice, I suppose.
- amelius 7y agoThat doesn't make it any better, though. Most people don't care what's in their food exactly, but that doesn't mean the producer has no responsibility.
- badrabbit 7y agoOrdinary users don't know what a URL even is. But they do assume every site they visit isn't being logged by Microsoft, much like they assume their car's manufacturer isn't recording the places they drive to using GPS. "Users don't care" is such an intellectually dishonest argument when users aren't technical enough to understand the subject.
- deleted 7y ago[deleted]
- thebeefytaco 7y agoAnyone know if "full URL" here would include a hash from the url?
- userbinator 7y agoIs there even a "pure" browser anymore? By that, I mean one which by default will do this: if I enter a URL in the address bar, it will fetch that page and its associated resources. If I click a link on a page, it will fetch its destination (this is obviously a simplified view, ignoring things like JS on the page etc.) No other network activity, no "recommendations", no other attempts to be "smart" or "helping" by doing anything beyond "pure" browsing. I see a lot of this extra functionality being justified in the name of "security", but I don't think the gradual erosion of personal responsibility and agency that results is something which should continue. "The road to hell is paved with good intentions."
- tga 7y agoSomewhat related, I recently realized that Microsoft Outlook on Android fetches _all mail_ on Microsoft servers, then sends it over to the app. If this is mentioned anywhere when setting up the account, I totally missed it. This led me to look for a "pure" email client that would _only_ contact my server. Popular apps like Blue Mail and myMail did not work at all behind a firewall that blocked random internet access. I am happy to report that K-9 mail (open source) was what I was looking for: it never tried to access anything other than my mail server. I wholeheartedly recommend using NoRoot firewall (or similar) to see just how many random servers your (flashlight) apps talk to (and watch them fail miserably when you block that).
- dontbenebby 7y agoFirefox might not meet your definition but with a few extensions (Containers, NoScript, uBlock origin) it's quite good at protecting your privacy.
- gumby 7y agoThis is one of the reasons I don't use chrome. Google tracks which search links I click on any browser but I assume they simply track everything else done with Chrome.
- skarz 7y agoNo one should be surprised by this. Microsoft is Google, just with a price tag attached. (Google services are usually free of charge because they mine your data and target you with ads; Microsoft has discovered the concept of double-dipping and has now joined the party, while still charging for Windows.) Getting you to sign into your computer with a Microsoft account is all about tracking and monitoring everything you do all of the time and selling a record of it to the highest bidder.