31 ms·

Meh. This is a content-less article, that seems to be exclusively about how many DNS requests Windows 11 makes on first boot. Absolutely nothing on what data i

Meh. This is a content-less article, that seems to be exclusively about how many DNS requests Windows 11 makes on first boot. Absolutely nothing on what data is being sent, if any, or why.

nehal3m 4y ago
It’d be great if the OS told you the how and why in plain English.
- pathartl 4y ago
  While I realize it's not a solution to the issue you raised, it's worth pointing out that Microsoft does a decent* job of documenting the types of telemetry taken across the Windows platform: https://learn.microsoft.com/en-us/windows/privacy/configure-windows-diagnostic-data-in-your-organization https://learn.microsoft.com/en-us/windows/privacy/configure-... * When I say decent, I mean this absolutely should be the bare minimum, but this type of thing feels rare in the industry.
- MikusR 4y ago
  https://learn.microsoft.com/en-us/windows/privacy/diagnostic-data-viewer-overview https://learn.microsoft.com/en-us/windows/privacy/diagnostic...
  - nehal3m 4y ago
    That would work for anything MS considers diagnostic data, but that is not a complete picture of what it's sending and why.
    - smileybarry 4y ago
      Couple that with monitoring the vast amount of ETW logging providers Windows gives you, and you'll see why. E.g.: the WinHTTP provider of who (PID) contacted where including URL, DNS ETW for lookups and who (PID), etc.
- wkat4242 4y ago
  It'd be even better if it allowed us to turn it off completely.
bakugo 4y ago
> Absolutely nothing on what data is being sent, if any, or why. Might have something to do with the fact that the data is almost certainly encrypted and the OS is closed source. If I install a piece of software and it immediately connects to 20 random servers without asking or even telling me, for purposes other than to directly provide advertised features, I'm going to assume that those connections are being used to extract my personal data and the burden of proof is on the developer to prove otherwise.
- DethNinja 4y ago
  Wouldn’t transparent TLS with self signed certificates solve this problem? I’ll definitely try this in couple of weeks but I can’t be the only person to try this to uncover exact data that is being sent via Windows telemetrics. Another alternative would be remote debugging the kernel and hooking into some of the undocumented API calls but that would take lots of effort.
  - horsawlarway 4y ago
    Just spin up Fiddler with a generated root CA on the device. Or if you don't trust the network stack on the OS - point the thing at a MITM proxy and trust the self-signed CA in the certificate store. It's really not all that hard to view https traffic... ex: https://www.telerik.com/fiddler/fiddler-classic https://www.telerik.com/fiddler/fiddler-classic
  - ormax3 4y ago
    something like this using mitmproxy (from 2017): https://www.softscheck.com/en/blog/windows-10-enterprise-telemetry-analysis/ https://www.softscheck.com/en/blog/windows-10-enterprise-tel...
- horsawlarway 4y ago
  Look - I'm not really a Windows fan (almost exclusively on linux these days) but they ARE providing advertised features. Like - honestly - the machine is a fresh install of Windows, what exactly is the data you think is being exfiltrated? In most cases... there's just nothing there. At best, someone now knows that ip x.x.x.x is running windows version y.y.y.y, and possibly that the user account is z. And honestly - all of those pieces of information are actually reasonable to send when providing advertised features (such as weather data in widgets, or local news). There's literally just nothing else on the device to grab yet... There's no browsing data, there's no app usage data, there's no documents generated. It's a blank fucking OS outside of the MS account you signed on with. So again - without talking about the actual data in the requests (and not just a dns record...) this isn't really a helpful conversation to have.
user3939382 4y ago
> what data is being sent, if any Obviously the Windows crapware isn't doing explicit DNS lookups for no reason, they're implicit because it's making requests.
jmclnx 4y ago
That could be because Microsoft encrypts the data, I would be shocked if the data being sent was not encrypted. To to me, this means M/S could be grabbing everything and sending it across, fo example browser history, files accessed, info typed into your edge browser, etc. No way to tell and no way to dispute this except for trusting M/S. So, in reality, people should dump all M/S products.
- phendrenad2 4y ago
  Maybe it's encrypted, or maybe the data they're sending is not noteworthy and you're just assuming the worst?

Meh. This is a content-less article, that seems to be exclusively about how many DNS requests Windows 11 makes on first boot. Absolutely nothing on what data is being sent, if any, or why.

nehal3m 4y ago

It’d be great if the OS told you the how and why in plain English.

pathartl 4y ago
While I realize it's not a solution to the issue you raised, it's worth pointing out that Microsoft does a decent* job of documenting the types of telemetry taken across the Windows platform: https://learn.microsoft.com/en-us/windows/privacy/configure-windows-diagnostic-data-in-your-organization https://learn.microsoft.com/en-us/windows/privacy/configure-... * When I say decent, I mean this absolutely should be the bare minimum, but this type of thing feels rare in the industry.
MikusR 4y ago
https://learn.microsoft.com/en-us/windows/privacy/diagnostic-data-viewer-overview https://learn.microsoft.com/en-us/windows/privacy/diagnostic...
- nehal3m 4y ago
  That would work for anything MS considers diagnostic data, but that is not a complete picture of what it's sending and why.
  - smileybarry 4y ago
    Couple that with monitoring the vast amount of ETW logging providers Windows gives you, and you'll see why. E.g.: the WinHTTP provider of who (PID) contacted where including URL, DNS ETW for lookups and who (PID), etc.
wkat4242 4y ago
It'd be even better if it allowed us to turn it off completely.

bakugo 4y ago

> Absolutely nothing on what data is being sent, if any, or why. Might have something to do with the fact that the data is almost certainly encrypted and the OS is closed source. If I install a piece of software and it immediately connects to 20 random servers without asking or even telling me, for purposes other than to directly provide advertised features, I'm going to assume that those connections are being used to extract my personal data and the burden of proof is on the developer to prove otherwise.

DethNinja 4y ago
Wouldn’t transparent TLS with self signed certificates solve this problem? I’ll definitely try this in couple of weeks but I can’t be the only person to try this to uncover exact data that is being sent via Windows telemetrics. Another alternative would be remote debugging the kernel and hooking into some of the undocumented API calls but that would take lots of effort.
- horsawlarway 4y ago
  Just spin up Fiddler with a generated root CA on the device. Or if you don't trust the network stack on the OS - point the thing at a MITM proxy and trust the self-signed CA in the certificate store. It's really not all that hard to view https traffic... ex: https://www.telerik.com/fiddler/fiddler-classic https://www.telerik.com/fiddler/fiddler-classic
- ormax3 4y ago
  something like this using mitmproxy (from 2017): https://www.softscheck.com/en/blog/windows-10-enterprise-telemetry-analysis/ https://www.softscheck.com/en/blog/windows-10-enterprise-tel...
horsawlarway 4y ago
Look - I'm not really a Windows fan (almost exclusively on linux these days) but they ARE providing advertised features. Like - honestly - the machine is a fresh install of Windows, what exactly is the data you think is being exfiltrated? In most cases... there's just nothing there. At best, someone now knows that ip x.x.x.x is running windows version y.y.y.y, and possibly that the user account is z. And honestly - all of those pieces of information are actually reasonable to send when providing advertised features (such as weather data in widgets, or local news). There's literally just nothing else on the device to grab yet... There's no browsing data, there's no app usage data, there's no documents generated. It's a blank fucking OS outside of the MS account you signed on with. So again - without talking about the actual data in the requests (and not just a dns record...) this isn't really a helpful conversation to have.

user3939382 4y ago

> what data is being sent, if any Obviously the Windows crapware isn't doing explicit DNS lookups for no reason, they're implicit because it's making requests.

jmclnx 4y ago

That could be because Microsoft encrypts the data, I would be shocked if the data being sent was not encrypted. To to me, this means M/S could be grabbing everything and sending it across, fo example browser history, files accessed, info typed into your edge browser, etc. No way to tell and no way to dispute this except for trusting M/S. So, in reality, people should dump all M/S products.

phendrenad2 4y ago
Maybe it's encrypted, or maybe the data they're sending is not noteworthy and you're just assuming the worst?