11 ms·

Ask HN: Are privacy concerns around Microsoft Windows 11 overblown?

• GartzenDeHaes 4y ago
  I think the people at Microsoft have concluded that only suckers and dups are still using Windows. Young folks use their phones, neohipsters use Macs, and techbros use Linux. For the leftovers still on Windows, Microsoft is serving up Edge browser toolbar scams, taskbar "news" ads, lock screen ads for whatever it is that Bing is doing. Elon Musk should buy Microsoft so it can die too.
  • joemazerino 4y ago
    Linux is insecure OOB and generally misconfigured by it's users. Windows remains the defacto choice for bros who want security.
    • _Algernon_ 4y ago
      lol
    • dustymcp 4y ago
      That is a stretch lol
    • Woeps 4y ago
      I'm ignoring the first part of your sentence because meh. However "Windows remains the defacto choice for bros who want security". I'm genuinely curious about this part of the statement. Could you please elaborate
      • lpcvoid 4y ago
        I dislike Windows the same as everybody on here, but they do a lot of security engineering such as virtualization based security, for example their hypervisor enforced code integrity stuff.
    • encryptluks2 4y ago
      Stockholm syndrom, amiright? No seriously.. Windows has a continuous stream of security vulnerabilities. Linux has cryptsetup, dm-verity, secure boot signing, TPM, proper sandboxing, QEMU, etc.
  • rdevsrex 4y ago
    That last line was kinda surprising to hear. Not a big Elon fan, but generally I think you at least wait a quarter to see if they've run it into the ground or not.
    • encryptluks2 4y ago
      I remember saying the same about Donald Trump. All these people kept warning me, and although I didn't vote for him... I said, let's give him a chance. I really wish I could go back in time and take their warnings more seriously.
  • warent 4y ago
    I can't tell if you're joking so I'll assume not. Windows is still by far the de facto gaming OS. Mac and Linux cannot handle games like Windows can.
    • cjbgkagh 4y ago
      I’m getting constant stuttering in Win11 and have tried just about everything to fix it. They have this weird memory compaction thing running, and constant virus scans, and I don’t know what else. It’s been a total nightmare and for now I’ve quit gaming.
    • HomePhone 4y ago
      Not to mention the de facto OS in multiple industries.
    • thfuran 4y ago
      Consoles and iOS/Android are by far the dominant gaming OSes. PC gaming isn't even all that huge slice of video gaming, let alone computer usage as a whole.
      • gabelschlager 4y ago
        It's good to keep in mind that games like League of Legends alone have over 100 million monthly players. While I agree that mobile is far bigger (especially thanks to Asian countries), PC's slice is too big to ignore. And just going by Steam numbers, seems to be actively growing each year.
    • lpcvoid 4y ago
      There are very few games I cannot play on my Linux/Steam box with AMD hardware. Everything just works out of the box, I just click play.
      • AnIdiotOnTheNet 4y ago
        Good for you? Let me know when DCS runs on Linux consistently without issue. Or, like, literally any VR system.
  • ahelwer 4y ago
    This is unfortunately true and a reason I am finally installing linux at this very moment. The worst were those monthly post-login series of screens trying to override my consent for various options so some PM at Microsoft could hit their quarterly KPIs (because they Measure What Matters) followed by a smarmy screen at the end saying the computer was now "all yours" (so my own home computer I've had for 8 years isn't mine?). It was just such a gross, pushy thing to have respect for my consent clearly trashed in that way. I deserve not to be abused in this way by my own computer I use every day. I've decided to really dive deep in linux. This is a rest-of-my-life thing now. I'm going through the Arch install process, really enjoying reading the wiki and enabling the services and fiddling with all the options. Windows treated me poorly enough that I no longer care about things "just working". I need to take this stuff into my own hands.
  • cjbgkagh 4y ago
    I work with a few big companies and there seems to be a general push to put everything in the browser as part of the plan to get rid of windows. Plus the browser acts like a thin client for those wanting to get rid of Citrix. Microsoft isn’t helping the matters by completely failing at building new UI toolkits. Internally Azure is seen as the future, but they burned a lot of their biggest customers already by overselling capacity to them in three year contracts. Those contracts are not getting renewed at the same level. I’ve never before seen a company sabotage itself so badly.
  • scantis 4y ago
    That is not true, Microsoft is still widely regarded as the industry standard. It doesn't matter how horrific their products are or become. I have so many measurement devices that run some form of windows on them and are impossible to port to anything else. I still run windows XP and 7 in private networks for some machines and still have to use windows 95 to rewrite some 8bit routines to floppy to run some ancient controllers. Not because I want to, but because I have to. Windows 11 is a giant problem, as it uses ridiculous amounts of ram. Around 2025 we will not be allowed to have win10 on the network. So this is serious question for some, is windows 11 any good with privacy? Well I certainly hope so, as I'm not in the position where I have any choice.
  • booleandilemma 4y ago
    I think the people at Microsoft have concluded that only suckers and dups are still using Windows. I really hope that's not true. I'm a programmer and I still prefer Windows. The UI is nicer than macOS, and the UX is smoother than Linux. Every now and then I try to install Ubuntu and find that it still doesn't work well with my headphones, or it randomly disconnects from my wifi. Efforts like the Windows Terminal and WSL lead me to believe that you're wrong.
• _trackno5 4y ago
  Disclaimer: I worked at MSFT in the past. I think it depends on whose perspective you're talking about. For some people it'll be overblown. In my case, I don't really like what MSFT has been doing with their OS. It's clear for years now that they are intent on creating some form of ads platform and they'll likely do it in a way that is directly integrated with the OS. You can't even install Windows 11 without a Microsoft account (so they obviously have a way to identify you). This seems in line with what Apple seems to be planning for their own platform [0]. All of these companies will claim they'll build something in a privacy-conscious manner, which might be true. The question I ask myself is: Am I comfortable with that? Even if it has privacy safeguards, I am not. I'm not willing pay $130 for a Windows license AND have ads presented to me. If Microsoft said they were going to offer a freemium model, where people that don't wanna pay for the OS will get ads I'd be fine. I'd just pay for the license to get rid of all ad tech and the respective tracking. But regarding the future, I have no idea. I don't think there's any stopping this anymore. The only way would be for governments to get their shit together and regulate this space. The only way to keep your privacy IMO is to choose "pain": - Move to an OS that won't track you (Linux, *BSD, etc) – I don't care what Linux zealots say, the Desktop experience is still not even close to what Windows and macOS offer - Avoid being online as much as possible and when you are, use tools to mask your presence [0] https://digiday.com/media/apple-is-building-a-demand-side-platform/ https://digiday.com/media/apple-is-building-a-demand-side-pl...
  • grammers 4y ago
    > The question I ask myself is: Am I comfortable with that? Even if it has privacy safeguards, I am not. I'm not willing pay $130 for a Windows license AND have ads presented to me. Exactly this. It's bad enough if it's free, you are the product. But if you pay, it definitely must not be this way. That's the worst form of capitalism in tech.
    • HomePhone 4y ago
      Advertising to paid users. Apple, Twitter, Microsoft, Google already do this. I don’t think it’ll end. It will become normal.
    • 4y ago
• deleted 4y ago
  [deleted]
• sb057 4y ago
  As far as I'm aware, Microsoft has never been transparent with what exactly is sent to them as part of the telemetry, which cannot be turned off in consumer versions. However, they added the same telemetry updates to Windows 7 and 8, so it was a concern a decade ago as well. https://support.microsoft.com/en-us/topic/update-for-customer-experience-and-diagnostic-telemetry-2649a645-0d3d-fa61-0773-ef84c0a8c8ac https://support.microsoft.com/en-us/topic/update-for-custome...
  • encryptluks2 4y ago
    True, but just logging into a Microsoft accounts sends every app ever opened to Microsoft and they do show you that in your account history. If this isn't scary, then I don't know what is.
• emurillo510 4y ago
  I'm currently a Microsoft employee, I feel like your data is secure, at least from my experiences. we are audited by consultants regularly and have internal teams making sure there are no security breaches. even things like log messages are scrubbed and strictly PR reviewed, but that's just my org. It could be different elsewhere
  • sophacles 4y ago
    Why do you want to spy on me to begin with?
    • noasaservice 4y ago
      That's simple. After they fired all their beta testers and QA department, MS converted all non-business Windows OSes to be 'automatic-and-irrevocable-opt-in'. Well, and it's also some of the richest user datasets. Google is doing it. Apple is doing it. Amazon is doing. So why not MS? It's not like we have hard privacy laws in this country!
    • Firmwarrior 4y ago
      It's pretty funny actually. Nobody really uses the data they slurp up, except as an excuse not to fix any bugs or improve anything "Oh, only 1% of users are hitting this one!" (Reduce priority, ignore, automatically close for "zero bug bounce")
      • vezycash 4y ago
        >Nobody really uses the data they slurp up, except as an excuse not to fix any bugs or improve anything And they remove necessary features then lie, "Our telemetry suggests that people don't use those features."
  • vladvasiliu 4y ago
    I'm not a regular Windows user (mostly use it for games), so maybe this doesn't apply fully to me. Although I'm not particularly confident in MS's security competence (judging by Windows' security track record), I don't think the main issue people take with this data collection is related to breaches by outside entities. At least in my case, it's not. What I take issue with is the same as for Google et al.: I find it creepy and don't want MS (or Goog / Apple / etc) to keep tabs on me, on what I do, and to try to find a way to make me buy more random crap with their ads. I'm also uncomfortable with the avenues this opens for State-level surveillance and the use of wonky "IA" to check on whether I'm doing anything "illegal" on my device. Cf the guy whose Google account got suspended for sending pictures of his son to a doctor.
• Apreche 4y ago
  Although they default everything to being on, you can turn off every privacy-centric feature in Windows. That depends on whether you believe they are lying about those settings actually doing what they say they do. On top of that, you can use network-level tools to block your data from leaving your home. This could be something like a pihole that blocks the relevant domains, and/or a firewall that blocks them entirely. At least on paper, Apple does seem to be doing better on privacy. They are private by default. Again, this all depends on how much you believe they aren't lying. There are also edge cases with them. For example, iMessage is encrypted end to end, but if you make an iCloud backup of your iMessages, those are not completely protected. If someone is that paranoid about the OS being the point of failure their privacy, open source OSes are available for them to use. I'm personally not concerned about using Windows, MacOS, iOS, or even Android as long as I am thorough about configuring all the settings in the OS and my network appropriately.
  • g_p 4y ago
    For anyone interested in blocking or looking at what is happening through Windows, the "Restricted Traffic Limited Functionality Baseline" may be worth looking at. It's a set of group policy settings that can be used to manage and prevent almost all of the "phoning home", and it documents what is done etc. https://learn.microsoft.com/en-gb/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services https://learn.microsoft.com/en-gb/windows/privacy/manage-con... It would be interesting to then do a private CA intercept (a la mitmproxy) on the resulting system to validate whether this correctly stops everything.
  • LinuxBender 4y ago
    Nice, I had not see that option before. Another method that stops some phoning home and can remove some cruft is O&O's ShutUp10 freeware [1]. There are powershell scripts that do all the same things but this has a happy-clicky GUI that prompts the person to make a restore-point and displays which options are known to work, which may have limited efficacy and which are unlikely to work after updates. It will also show what has changed since the last time it was run. i.e. after OS updates [1] - https://www.oo-software.com/en/shutup10 https://www.oo-software.com/en/shutup10
• bravetraveler 4y ago
  I think the weight of defaults is easy to overlook. While the options are available and most things people fear can be disabled... it's reasonable to look at this and ask, "What don't we know about?" This, in combination with the trend of less and less autonomy over our time, equipment, and purchasing.... I think it's perfectly valid to be loud about.
• mihaic 4y ago
  I think we need a concentrated effort to separate "privacy" from "targeted invasive advertising". I know they're related, since ads are the main reason big tech break privacy, but as used now it's a term that clouds both legislative response and general public sentiment. Sending back stack traces of crash reports is not the same as gathering data for targeting and pushing manipulative ads while you're browsing your folders. I for one don't care about privacy that much, and that's how most consumers are. Almost everyone hates with a fury being shown ad over ad. Keep ads out of my OS, it's that simple.
  • arkh 4y ago
    > I for one don't care about privacy that much, and that's how most consumers are. So you would not mind sharing your credit card infos. Or your social security number if you're in the US? Also I bet you like going around naked outside when the weather is right.
    • mihaic 4y ago
      "That much" doesn't mean "none at all", you're doing a textbook strawman here. I for instance don't care if my conversations are end-to-end encrypted, or if my financial transactions are anonymous. I do care if any random employee can just pull up my data, or if the company that's storing that data abuses its position and pushes ads in my face based on what date I have on their servers. Common sense protection like payment method tokenization and SSL connections are the norm already, I don't want regression. In the end, I meant that the privacy conversation should be moved into more concrete terms as an invasive ads discussion, not turned into something more abstract about which discussion is meaningless.
  • deafpolygon 4y ago
    > I for one don't care about privacy that much I really value my privacy, and it's not that I have anything to hide. I think that's a stupid argument for less privacy. If we're not careful, they'll start installing microphones and cameras to monitor you - for the improvement of your security and service, of course! I can't help but think of the analogy of the frog and the pot, with the boiling water. We're all in the pot and the heat is just being turned up slowly, so we're not aware of what's happening to us. The amount of data social media collects on people is a wet dream for any autocratic state. The default setting should be opt-in, not out-out.
• whalesalad 4y ago
  > What's the best way to go forward if this is the case? Linux, OSS.
• concinds 4y ago
  Forensic experts are a good information source on this: https://arxiv.org/pdf/2002.12506.pdf https://arxiv.org/pdf/2002.12506.pdf (Windows 10) "Required diagnostics" seem reasonable: https://learn.microsoft.com/en-us/windows/privacy/required-diagnostic-events-fields-windows-11-22h2 https://learn.microsoft.com/en-us/windows/privacy/required-d... Do note that "optional diagnostics" seem to include collecting filenames/authors/modification dates for Office files; the names of installed and removed applications, hardware information (with serial numbers), process execution history, Start Menu pins, app usage history, and more: https://learn.microsoft.com/en-us/windows/privacy/windows-diagnostic-data https://learn.microsoft.com/en-us/windows/privacy/windows-di...
• ridgered4 4y ago
  They're only overblown in that I haven't seen anything to suggest it is any worse than Windows 10, which was already horrible from a privacy perspective.
  • dislikedtom2 4y ago
    I remember people saying that windows 11 requires internet connection and microsoft account. Not sure if it's true.
    • kyriakos 4y ago
      There are workarounds but when installing you really need to choose 4 times that you are good with a local account. Every time the question is phrased differently.
    • ridgered4 4y ago
      I don't believe it is technically true, perhaps with Win 11 home? But the process is full of dark patterns and opaque enough that you could argue it is effectively true.
• Froedlich 4y ago
  You mean "Microsoft deliberately pwning your computer" instead of "the same level of abysmal security Microsoft has delivered since DOS; expect someone to pwn your system Real Soon Now"? Add TPM and UEFI, and the CPU and chipset backdoors, and it's a real horrorshow down at the hardware level, too.
• nonrandomstring 4y ago
  At this point it's moot to me. Privacy concerns may well be overblown if one were able to objectively assess facts. Perhaps Windows 11 is the most secure OS Microsoft have ever produced :) But I would still not use or trust it, for reasons the frog would not ride on the scorpion's back, no matter how desperately it wants to cross the river. I've lived long enough to witness all of Microsoft's shenanigans, the hostile takeovers, the insults to free software, the lies, the threatening behaviour, the bribery, court cases, criminal convictions and fines. Insomuch as a company can be, Microsoft are unethical to the core. Indeed they are the paradigmatic untrustworthy company. If you were to offer me a water-tight mathematical formal proof that Microsoft's code was secure and private, I would still choose to use to use something else.
  • Fatnino 4y ago
    I think you mean the frog should not give the scorpion a ride on its back. Frog on top of a scorpion is a recipe for flat scorpion.
    • nonrandomstring 4y ago
      Damnit your're right. And gingerbread men shouldn't carry foxes on their backs either. I get confused. :)
  • Rhedox 4y ago
    > Perhaps Windows 11 is the most secure OS Microsoft have ever produced :) Security != Privacy
    • kyriakos 4y ago
      Security can lead to privacy. It's not just Microsoft that will get access to your data if the operating system is not secure in the first place.
    • ridgered4 4y ago
      No, but security can provide privacy and privacy may provide security.
• UI_at_80x24 4y ago
  These same concerns/arguments have been repeated since Windows XP (I don't remember Win9x or NT/2000 having the same scope of privacy concerns). The FUD has never changed. But, that doesn't mean the concerns are unwarranted. That's why I first started using Linux around 1994. I was concerned about my privacy, and I've been viewed a paranoid freak. I feel like Cassandra.
  • deafpolygon 4y ago
    Which distro has worked really well for you in regard to privacy, usability, etc.?
• M95D 4y ago
  1. Spyware started with XP and was greatly improved in Win7. If you are asking this only now, then Microsoft and everyone else already knows everything there is to know about you. 2. When a company tells you that their product protects your privacy, what they mean is that they will try to be the only ones that have personal data about you (and that private data about you can only be bought from them). NOT that you will have any privacy. ---- How you go forward? Best way is to stop using the internet. Go live in a cabin in the woods. (I'm only half joking.) If you live in Europe you can ask for your account and data to be deleted, but that doesn't affect the companies that your data was sold to, nor anon / aggregate statistics your data is part of. To have privacy about what you do/think/like in the future, you can try Linux, but you're not safe even there. Firefox will track your internet activity (can be disabled) and there is spyware such as Ubuntu's popularity-contest package that monitors and reports what you run on your Linux machine. If you want to keep using Windows, the best way would be to wipe your HDD, install clean, activate it, update it (or not), and then cut the direct internet connection. From then on, use a whitelist filtering proxy as the only possible internet access. No DHCP or any usable gateway. I'm using this and is a pain to manage. I have to manually add to the whitelist every new site I want to visit (it gets easier after a while). Another way to do it is to have an non-filtering but password-protected proxy, and don't tell Windows about it. Firefox can use a proxy that is different than Windows' proxy setting. This way you can navigate the web without allowing Windows access to the internet.
  • deafpolygon 4y ago
    > How you go forward? Best way is to stop using the internet. Go live in a cabin in the woods. (I'm only half joking.) I'm half tempted to! But that's not going to work in the real world for me. Jeez, Firefox... https://www.privateinternetaccess.com/blog/the-firefox-browser-is-a-privacy-nightmare-on-desktop-and-mobile/#:~:text=%E2%80%9CBy%20default%2C%20Mozilla%20collects%20limited,or%20number%20of%20webpages%20visited https://www.privateinternetaccess.com/blog/the-firefox-brows.... > use a whitelist filtering proxy as the only possible internet access How does this work in practice?
    • M95D 4y ago
• coding123 4y ago
  It's not even really about our OS's and what not. I don't understand that people still aren't fucking pissed that you can type in someone's full name in Google and shit sites still broadcast phone numbers, addresses, age, history. It's a trainwreck that's already been there for 20 years people.