11 ms·
Researchers say MS Edge's telemetry has worst privacy of any major browser
- jacquesm 7y agoWorse than Chrome? That must have taken some doing then. Ah, here is the key in the article: "Notably, the study did not look at the web services provided by each of the companies, which also included Google, Apple, Brave, Mozilla. The focus was on the browsers themselves, rather than the ecosystem as a whole, which shows only one important part of the puzzle." That explains it. Is Brave even 'Major'?
- Spooky23 7y agoIt’s en vogue to complain about Google, but the stream of data flowing into Microsoft is incredible and who knows if or how it is being used. They have better competitive intelligence capability than any other company. Microsoft knows the org chart of millions of companies better than they do, knows who talks to who both in email and voice in some orgs, and knows where people work and where they move at work. The telemetry sent up for Windows and Office is pretty comprehensive and invasive as well. I wonder what they do with it. I see no evidence of improved product quality.
- JMTQp8lwXL 7y agoMicrosoft doesn't have eyeballs like Google and Facebook do. Even if they have the data, they aren't a central point of the internet (search) or the prevailing social network (Facebook). The monetization to serve ads isn't there.
- bad_user 7y agoMicrosoft operates Bing and Bing Ads. Nowadays they are also serving ads in Windows 10 itself. Market share is irrelevant, the incentive is there.
- JamesBarney 7y agoI haven't seen any ads in Windows 10. Is that a special version?
- als0 7y agoThey exist in the free version of Windows 10 (without a serial key). They're embedded in all sorts of places, including Solitaire.
- bad_user 7y agoNot only in the free version. I have a licensed Windows 10 at home installed from scratch, ISO downloaded from Microsoft. Before configuring it, yes, it had ads in it.
- kemotep 7y agoYou have never seen the messages on the lockscreen or the preinstalled windows store apps in the start menu?
- dhimes 7y agoI've never seen ads on the lockscreen- and pre-installed crapware has been with us forever. I'm on home edition- it came with the laptop (toshiba satellite, for completeness)
- kemotep 7y agoTo be clear if your lockscreen is the changing pictures there are messages on those that are "ads" in the sense that they can take you to promoted sites. Same with the built in Windows search. If web search is not disabled anything not found on your computer launches a bing search which like google search as results as ads.
- JamesBarney 7y ago
- gherkinnn 7y agoMS does run at the heart of most businesses though. No ads, but potential for other sources.
- est31 7y agoIt's very likely that they sell that data to the US intelligence community. One good example is Skype which they bought two years after rumors surfaced [1] that the NSA offered billions for solutions that can wiretap Skype calls. After they've bought it, they removed end to end encryption as well as the peer to peer system, sending all content over Microsoft servers. It's a bit better if it's "only" shared with the US intelligence community instead of anyone who names a price for it, but obviously still not really good for privacy. [1]: https://www.theregister.co.uk/2009/02/12/nsa_offers_billions_for_skype_pwnage/ https://www.theregister.co.uk/2009/02/12/nsa_offers_billions...
- tinus_hn 7y agoNo major video conferencing setup has peer to peer video because that is an ‘innovation’ patented by VirnetX.
- edoceo 7y agoWhat? So my self-hosted P2P WebRTC is in violation of a patent? And the companies I set these services up for too? Are all the others (zoom, go-to, uberconf, jitsi, etc) just not doing P2P?
- paulryanrogers 7y agoIIRC P2P doesn't scale beyond a few participants because all the streams are going to all participants. Centralized can reduce bandwidth and number of data exchanges
- Roboprog 7y agoCentralize on the peer who hosted/called the meeting?
- paulryanrogers 7y agoI think Skype P2P relied on super nodes which had the best bandwidth and processing
- dilippkumar 7y ago> Microsoft doesn't have eyeballs like Google and Facebook do [Citation needed]
- clairity 7y agocomplaining about google is nothing like the whims of fashion. google is a legitimate threat to privacy and liberty, and that should be laid bare repeatedly so we don't get complacent and forget. facebook as well, to a slightly lesser extent. microsoft is trying to compete on that front (poorly) and should also be called out. it's not an either-or proposition, but an all-of-the-above one.
- deleted 7y ago[deleted]
- threatofrain 7y agoMaybe people want to get their sense of priorities first.
- behnamoh 7y agoActually there's been evidence that repeatedly hearing certain types of news makes people less sensitive to them. In other words, if people constantly hear about GOOG or MSFT being privacy concerns in the 21st century, those people will think of it as the new norm. Sad, but true.
- clairity 7y agothat's definitely a valid concern, but i'm not sure we've reached that point. the constant pressure is certainly needed to get these companies to innovate away from products based on invasiveness and surveillance, or to have new companies pop up to out-compete them.
- rixed 7y agoYou forgot to say why Google would be a bigger threat than Microsoft, which is annoying given the person you are responding to clearly listed the reasons why Microsoft is actually collecting more informations than Google. Also, Microsoft has a much worse historical record than Google regarding protecting their users. For instance, at a time when Microsoft was happyly complying to every rules required to be allowed to do business in China, Google decided to not comply and close its offices in that country, all in the name of privacy. So yes, bashing Google in the comment section of an article about Microsoft Edge misbehavior certainly sounds like the whims of fashion, if not of organised business propaganda. edit: beating Android keyboard to oblivion
- mmPzf 7y agoOne of my guesses is security. The story behind the discovery of MS08-067 reads like a strong argument in favour of some telemetry. The TLDR is that someone at Microsoft noticed a strange crash in some telemetry bucket, and it turned out to be a wormable zero-day. There's a write up at https://docs.microsoft.com/en-us/archive/blogs/johnla/the-inside-story-behind-ms08-067 https://docs.microsoft.com/en-us/archive/blogs/johnla/the-in..., for those interested, and even though that story is twelve years old by now the general premise still stands.
- threentaway 7y agoYep. Every year the Windows security team catches 0days that are under development from the crash logs telemetry and is able to patch them before they're mass exploited.
- deleted 7y ago[deleted]
- post_below 7y agoIt's nice to hear this mentioned. Just Windows by itself is a privacy nightmare. It's always amazed me that it isn't talked about alongside other companies and software with privacy issues.
- m463 7y agoand they own linkedin and github...
- badrabbit 7y agoEdge is nothing compared to defender ATP telemetry. For those with it, they also know every site you go to (outside of edge),every program you open,every file you interact with and much more. They do a lot with it froma security perspective but I reckon they have plenty other uses for it as well.
- bla3 7y agoThe sentence you cite seems unrelated to "Worse than Chrome?". Google's web services have lots of tracking, but Chrome itself (like Firefox and Safari), according to this article, doesn't send a persistent tracking UUID, while Edge and Yandex browser do.
- kds3 7y ago> Chrome itself (like Firefox and Safari), according to this article, doesn't send a persistent tracking UUID According to the article: > Edge also sends the hardware UUID of the device to Microsoft and Yandex similarly transmits a hashed hardware identifier to back end servers.“ But Chrome also sends Chrome installation ID in X-Client-Data [0], which looks pretty much like hardware UUID. [0] https://news.ycombinator.com/item?id=22236106 https://news.ycombinator.com/item?id=22236106
- artjomb 7y agoIt does, but only to google domains and only in non-incognito mode. If you're still paranoid and clear your cookies after you close Chrome, you can add a commandline option to Chrome so that this UUID is randomized on each start of Chrome.
- tengbretson 7y agoI recommend brave to all my non technical friends and family. Of all the options it has the best out-of-the-box privacy settings. If Firefox's rise in the late 2000s taught us anything it's that being the recommended choice of technical people can spur on pretty big growth.
- nitrogen 7y agoI'm worried that is only true in the absence of a competing marketing budget. When nobody was pushing browsers, we had a voice. Now, it's hard to compete with the indoctrination of pervasive advertising of other browsers.
- Yizahi 7y agoYou can't really grow any more from >90% share currently. Chrome has won and you effectively just helping it to cement its monopoly by promoting Chrome-Pretending-To-Be-Not-Chrome. I understand that you do it with good intentions but the end would be zero privacy Googlenet. The only question is not "if" but "when".
- based2 7y agohttps://www.reddit.com/r/technology/comments/fmydx0/researchers_say_microsoft_edges_telemetry_has_the/ https://www.reddit.com/r/technology/comments/fmydx0/research...
- lucb1e 7y agoI'm guessing you want to point out the top comment? Reddit user CobraCabana wrote: > This article isn’t about the telemetry data it’s about the identifiers. > Edge sends over a unique identifier for the hardware > Chrome and safari send one based on installation instance. Chrome persists the identifier safari doesn’t > Firefox doesn’t send any identifier.
- halyconWays 7y agoThe worst telemetry of any major browser so far, son.
- yjftsjthsd-h 7y agoSince most researchers are unable to see the future, it's generally accepted that such studies are done on the present and/or past.
- halyconWays 7y agoBecause it's not possible to see that every version of Windows has invaded your privacy more than every previous version, nor is it possible to extrapolate that they're going to continue down this path unless something stops them.
- JMTQp8lwXL 7y agoWhy does this article keep resurfacing everywhere? I've seen it on /r/technology multiple times. I refuse to believe it. Chrome has to have the most telemetry: it is produced by an ad company after all. Of all organizations maintaining major browsers, Google is the most incentivized to collect data. Follow the money.
- bla3 7y agoMy guess: Everyone uses their services anyways, so they have no need to put as much telemetry in the browser.
- cwzwarich 7y agoGoogle also only needs to put enough telemetry in their browser to correlate your browsing with the other data they already have.
- kube-system 7y agoWhich is basically zero. They do that just fine without telemetry. GA is ubiquitous.
- bla3 7y agoFor pages visited, they likely get this for free for a good chunk of users who opt in to sync. What other interesting telemetry data is there? I think chrome is a good browser as long as your careful about which settings you toggle and you can live with the vendor having a mild incentive for adding new settings with bad (from a privacy pov) defaults. In return, you arguably get the most secure browser.
- AlexMax 7y agoI don't necessarily agree with your argument - I think it's a perfectly reasonable conclusion that either Microsoft and Google could have worse telemetry in their browser. That said, I noticed the strange behavior around this article as well. I've seen it pop up multiple times in various content aggregators, and the /r/technology mods even removed the post that I happened to notice and comment in. I'm not sure why, it seemed like a completely reasonable article on its face. But maybe there's something underhanded going on behind the scenes?
- heartbeats 7y agoTitle is not ideal - suggest change to "Researchers say MS Edge's telemetry has worst privacy among major browsers"
- dang 7y agoWe've changed it above.
- kojoru 7y agoNote there's Microsoft's reply here: https://winbuzzer.com/2020/03/20/microsoft-responds-to-researchers-claim-that-edge-is-the-worst-for-privacy-xcxwbn/ https://winbuzzer.com/2020/03/20/microsoft-responds-to-resea... Apparently this hardware identifier is used to be able to comply with gdpr data deletion requests.
- gentleman11 7y agoNonsense. You have to track people in order to know that you are not tracking some people?
- piinthesky 7y agoGDPR data does not have to be deleted if its used for law enforcement or scientific research, so someone like MS can claim the data is kept for AI research, just like Google or Facebook or practically any other company. Show me a business which is not interested in developing their own little AI's? https://www.legislation.gov.uk/ukpga/2018/12/body https://www.legislation.gov.uk/ukpga/2018/12/body
- bdcravens 7y agoSite posts article about browser privacy while asking if they can send you notifications.
- seemslegit 7y agoIn Microsofts defense - this could simply be due to the authors inability to address the multitude of different data exfiltration surfaces in FF and Chrome
- alister 7y ago> Chrome, Safari, and Firefox, meanwhile, tag requests with identifiers, but that information is reset when the browser is re-installed. All send details of the webpages visited to the backend via auto-complete, but with verifying identifiers. Chrome is, in this case, are persistent, while Safari’s are ephemeral and Mozilla doesn’t have identifiers at all. First it says, Firefox tags with identifiers, then it says, Mozilla [Firefox] doesn’t have identifiers at all. What explains this apparent contradiction?
- officialjunk 7y agoto me it seems they may think firefox and mozilla are two different things.
- Roboprog 7y agoOr perhaps Brave was supposed to be one of those items? Clearly, the article needed editorial proof reading in a few spots.
- theferalrobot 7y agoI think what they meant to say is Firefox has identifiers but they do not have persistent identifiers.
- dang 7y agoThe paper is here: https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf. Should we change the URL to it above? The comments are pretty tied to the claims of the current article at this point.
- mrtweetyhack 7y agoWho cares? I'll never use it
- Sephr 7y agoThere is something much more concerning that nobody is mentioning: Microsoft Edge removed encrypted sync. This sync data can include all of your browser history, which is arguably a much more serious privacy violation. Chrome allows you to set a separate encryption passphrase for syncing your preferences & history to Google's servers. Edge does not allow this.
- modeless 7y agoThis feature (end-to-end encrypted sync) is huge for privacy, and nobody knows about it. It's never mentioned when people talk about privacy issues in browsers. It seems like people don't actually care to do slightly inconvenient things that will improve their privacy, they just like to be outraged about it on the internet.
- what-the-grump 7y agoAm I missing something or the paper is not linked? Or are my ad-blockers blocking something on the page. Also, how are the virtualized tabs tracked?
- 5cott0 7y agoI'm starting to think Google PR's favorite channel is the editorial content advertisement.
- ryanmarsh 7y agoIt just makes up for their lack of a major search engine. I'm pretty sure it's safe to say Google knows more about you than Microsoft.
- blibble 7y agothe company behind the ad and spyware infested Windows 10 continued that abuse with their new browser? I'm surprised, I really am
- thekyle 7y agoI don't understand Microsoft's angle with all of their telemetry in products like Windows, VS Code, Edge, etc. Microsoft's biggest businesses are; * Azure * Software licensing fees (Windows/Office/etc) * Gaming stuff (XBox, etc) None of these benefit from having tons of data on their customers. Some of them might even lose sales because of it (do enterprises want their data sucked up into the cloud when using Office or Windows). Bing Ads make up such a small amount of Microsoft's income that they're pretty much irrelevant. It seems to me that the rational thing would be to take the Apple approach. Use privacy as a feature that Google can't copy. Take advantage of the fact that one of their biggest competitors is mostly funded by targeted advertising and go where they cannot. Since Microsoft is not doing that, and they're not stupid I must assume that I am missing something.
- ngold 7y agoWhat a world we could live in if Microsoft was a privacy champion. It would make a massive amount of fans.
- justlexi93 7y agoAnd I need to remind you that we’re talking about Out the Box here, not with add ins and extensions. Brave is capable of installing any extension found in the Chrome web apps page so you probably could tweak it further.