5 ms·

> Absolutely nothing on what data is being sent, if any, or why. Might have something to do with the fact that the data is almost certainly encrypted and the O

by bakugo 4y ago

> Absolutely nothing on what data is being sent, if any, or why. Might have something to do with the fact that the data is almost certainly encrypted and the OS is closed source. If I install a piece of software and it immediately connects to 20 random servers without asking or even telling me, for purposes other than to directly provide advertised features, I'm going to assume that those connections are being used to extract my personal data and the burden of proof is on the developer to prove otherwise.

DethNinja 4y ago
Wouldn’t transparent TLS with self signed certificates solve this problem? I’ll definitely try this in couple of weeks but I can’t be the only person to try this to uncover exact data that is being sent via Windows telemetrics. Another alternative would be remote debugging the kernel and hooking into some of the undocumented API calls but that would take lots of effort.
- horsawlarway 4y ago
  Just spin up Fiddler with a generated root CA on the device. Or if you don't trust the network stack on the OS - point the thing at a MITM proxy and trust the self-signed CA in the certificate store. It's really not all that hard to view https traffic... ex: https://www.telerik.com/fiddler/fiddler-classic https://www.telerik.com/fiddler/fiddler-classic
- ormax3 4y ago
  something like this using mitmproxy (from 2017): https://www.softscheck.com/en/blog/windows-10-enterprise-telemetry-analysis/ https://www.softscheck.com/en/blog/windows-10-enterprise-tel...
horsawlarway 4y ago
Look - I'm not really a Windows fan (almost exclusively on linux these days) but they ARE providing advertised features. Like - honestly - the machine is a fresh install of Windows, what exactly is the data you think is being exfiltrated? In most cases... there's just nothing there. At best, someone now knows that ip x.x.x.x is running windows version y.y.y.y, and possibly that the user account is z. And honestly - all of those pieces of information are actually reasonable to send when providing advertised features (such as weather data in widgets, or local news). There's literally just nothing else on the device to grab yet... There's no browsing data, there's no app usage data, there's no documents generated. It's a blank fucking OS outside of the MS account you signed on with. So again - without talking about the actual data in the requests (and not just a dns record...) this isn't really a helpful conversation to have.
- pessimizer 4y ago
  > the machine is a fresh install of Windows, what exactly is the data you think is being exfiltrated? In most cases... there's just nothing there. Then there shouldn't be any requests. > At best, someone now knows that ip x.x.x.x is running windows version y.y.y.y, and possibly that the user account is z. Is this something you have inside information about? How many requests does this take? Your sentence seems far longer than the single serialized string that would have to be sent. edit: and to be more direct, how is it all right for you to speculate about things you don't know but not all right for the OP? Is it only legitimate to make up excuses for suspicious behavior, and illegitimate to be suspicious of it?
  - horsawlarway 4y ago
    > So again - without talking about the actual data in the requests (and not just a dns record...) this isn't really a helpful conversation to have. I'm not fucking speculating. I'm saying DNS records are a trash excuse for actually looking at the data. If they want to make spurious claims - the burden of proof lies firmly with them. In the mean time: > Then there shouldn't be any requests. I literally just told you why they're making these requests... they're fetching data to display on widgets related to local news and weather, and they're tracking their install numbers. You can bitch and moan about that - but they're very clear that they're doing it at install time, and most times you can opt out.
- ninjagoo 4y ago
  > There's literally just nothing else on the device to grab yet... There's no browsing data, there's no app usage data, there's no documents generated. Well, there's your internal and external IP addresses, your MAC addresses, your Processor ID, your Mainboard serial #s, Hard Drive serial #s, along with your OS ID (I don't know if the Edge browser has a unique ID per install), all of which can be used to identify you/your machine uniquely. This data is now going to all these "Data Research" companies. I wonder why they need to collect this information.
  - crimsontech 4y ago

by bakugo 4y ago

DethNinja 4y ago

Wouldn’t transparent TLS with self signed certificates solve this problem? I’ll definitely try this in couple of weeks but I can’t be the only person to try this to uncover exact data that is being sent via Windows telemetrics. Another alternative would be remote debugging the kernel and hooking into some of the undocumented API calls but that would take lots of effort.

horsawlarway 4y ago
Just spin up Fiddler with a generated root CA on the device. Or if you don't trust the network stack on the OS - point the thing at a MITM proxy and trust the self-signed CA in the certificate store. It's really not all that hard to view https traffic... ex: https://www.telerik.com/fiddler/fiddler-classic https://www.telerik.com/fiddler/fiddler-classic
ormax3 4y ago
something like this using mitmproxy (from 2017): https://www.softscheck.com/en/blog/windows-10-enterprise-telemetry-analysis/ https://www.softscheck.com/en/blog/windows-10-enterprise-tel...

horsawlarway 4y ago

Look - I'm not really a Windows fan (almost exclusively on linux these days) but they ARE providing advertised features. Like - honestly - the machine is a fresh install of Windows, what exactly is the data you think is being exfiltrated? In most cases... there's just nothing there. At best, someone now knows that ip x.x.x.x is running windows version y.y.y.y, and possibly that the user account is z. And honestly - all of those pieces of information are actually reasonable to send when providing advertised features (such as weather data in widgets, or local news). There's literally just nothing else on the device to grab yet... There's no browsing data, there's no app usage data, there's no documents generated. It's a blank fucking OS outside of the MS account you signed on with. So again - without talking about the actual data in the requests (and not just a dns record...) this isn't really a helpful conversation to have.

pessimizer 4y ago
> the machine is a fresh install of Windows, what exactly is the data you think is being exfiltrated? In most cases... there's just nothing there. Then there shouldn't be any requests. > At best, someone now knows that ip x.x.x.x is running windows version y.y.y.y, and possibly that the user account is z. Is this something you have inside information about? How many requests does this take? Your sentence seems far longer than the single serialized string that would have to be sent. edit: and to be more direct, how is it all right for you to speculate about things you don't know but not all right for the OP? Is it only legitimate to make up excuses for suspicious behavior, and illegitimate to be suspicious of it?
- horsawlarway 4y ago
  > So again - without talking about the actual data in the requests (and not just a dns record...) this isn't really a helpful conversation to have. I'm not fucking speculating. I'm saying DNS records are a trash excuse for actually looking at the data. If they want to make spurious claims - the burden of proof lies firmly with them. In the mean time: > Then there shouldn't be any requests. I literally just told you why they're making these requests... they're fetching data to display on widgets related to local news and weather, and they're tracking their install numbers. You can bitch and moan about that - but they're very clear that they're doing it at install time, and most times you can opt out.
ninjagoo 4y ago
> There's literally just nothing else on the device to grab yet... There's no browsing data, there's no app usage data, there's no documents generated. Well, there's your internal and external IP addresses, your MAC addresses, your Processor ID, your Mainboard serial #s, Hard Drive serial #s, along with your OS ID (I don't know if the Edge browser has a unique ID per install), all of which can be used to identify you/your machine uniquely. This data is now going to all these "Data Research" companies. I wonder why they need to collect this information.
- crimsontech 4y ago