25 ms·

Microsoft Edge is leaking the sites you visit to Bing

485 points by sphars 3y ago

aaws11 3y ago
It’s probably a good idea to disable Edge’s follow creator feature until this privacy issue is fixed.
- withinrafael 3y ago
  One note: I've noticed turning off this feature does not immediately turn off the feature. A browser restart (all instances) is required to take full effect (and stop sending traffic to that endpoint). Also keep an eye on the toggle--Microsoft Edge does not guarantee settings persist across updates.
  - pbhjpbhj 3y ago
    >Microsoft Edge does not guarantee settings persist across updates. // This sort of behaviour, which Firefox had indulged in in the past, is abhorrent. It needs punishment of the company and the controlling staff; they can not be trusted at all.
  - zelphirkalt 3y ago
    Also keep an eye on "bugs" in Edge's source code which might ignore the setting in some cases ...
- mxuribe 3y ago
  It’s probably a good idea to disable Edge...That is, stop using Edge (or Chorme), and start using an alternative browser...like Firefox. /s More seriously, I wish there was a web browser built in a sort of cameleon fashion: * layer 1 - the lowest layer would be some weird rotating engine that would use different browser engines to send disinformation to all websites, web apps. For example, at one moment websites see that i'm on FF, but the next moment on a version of (fake) "Chrome", etc. But, functionality, the user is unaware of what engine is actually driving the typical underlying browser processes. * layer 2 - the middle layer would hold my personal/private data, like saved passwords, cookies that i desire, etc. This layer is in total control of the user and their data. Whatever configs and preferences are set by the user are saved in this layer, and it persists across browser upgrades, browser synching platforms (like Firefox Accounts), etc. * layer 3 - is what the user sees as browser UI (the original term was "browser chrome" of coiurse), and interacts with the UX features...The user can use 1 of a few UI themes: 1 that "looks" like Firefox, another that looks like Chrome, another looks like Brave, Edge, etc. On top of these "browser skins", there could also be the typical browser-brand-specific themes that each native browser has available. I should state that i know nothing about how browsers are developed...And I acknowledge from my armchair that the above would make developing a new browser crazy complex...but, wow, such flexibility i think would be pretty neat!
stalfosknight 3y ago
Is anyone truly surprised by this?
- agilob 3y ago
  More surprised that theverge is using word "leaking", when it should be "sending" or "reporting". Leaking, make it look like an accidental behaviour.
  - sourcecodeplz 3y ago
    They are in love with Apple.
  - withinrafael 3y ago
    I think it's correct, but understand your view too. The feature they're referring to is configured remotely [1] with a set of domain filters that demonstrate the intent was to only capture a subset of sites. I think this is where I'm now supposed to refer to Hanlon's razor--Never attribute to malice that which is adequately explained by stupidity. [1] https://www.bingapis.com/api/v7/followweb/getdomainfilter?appId=F1E45C4A7B95B48AC3F411C6214F6B861D0C276B https://www.bingapis.com/api/v7/followweb/getdomainfilter?ap...
  - jug 3y ago
    But their point is that it looks like accidental behavior? That is, it’s doing this in way more instances than the intent is with this new feature that is enabled by default?
    - agilob 3y ago
      Do you believe in such accidents? What the explanation for that would be? Something like: "Oh no, we had this enabled by accident, and by accident had configured a high-availability API endpoint to collect such calls on a massive scale. This all got compiled, configured and deployed by accident without our clear intentions to do so. We are sorry."
marginalia_nu 3y ago
Everything you type in your URL bar in Chrome and Firefox is sent to Google.
- talal7860 3y ago
  What if we don't use google as our default search engine, is it still shared?
  - colmvp 3y ago
    No, it's only shared with the provider you choose (e.g. if your default search engine is DDG, then the search terms are shared with DDG, etc.)
- wuiheerfoj 3y ago
  Is this true if you aren’t using Google as your search engine?
  - rejectfinite 3y ago
    No. Atleast not on Firefox. I think? idk lol
    - rzzzt 3y ago
      The hashed form of the URL might still reach Google as part of the Safe Browsing initiative, although a copy of the List of Naughty Websites is kept locally as well, so if you visit a known deceptive site, it need not ping their servers.
  - soundnote 3y ago
    No. It's just that Firefox adverstises itself as private: https://imgur.com/a/p4CVBHb https://imgur.com/a/p4CVBHb "Power and privacy to the people. No need to dig into your security settings. Fierce privacy is our default." but has Google as the default search engine and defaults to having search suggestions on.
- 3y ago
manojlds 3y ago
Edge sends data to Bing. What's the leak here.
- AnimalMuppet 3y ago
  I wasn't searching Bing. That is the leak.
  - hollasch 3y ago
    And if Bing is the engine to provide keystroke-by-keystroke word completion, that's not a leak — it's an API the browser uses.
    - AnimalMuppet 3y ago
      Fair enough.
    - vb-8448 3y ago
      for what i understand, it sends all urls you visit event if you click on a link inside a page ...
  - CatWChainsaw 3y ago
    Which search engines were you using?
98codes 3y ago
24 ads and other trackers from The Verge attempted to load on that page alone; usually much more if those are allowed to succeed. That said, I disabled that creator follow nonsense the moment it landed. Not because of the URL tracking, but because it is stupid.
- _cenw 3y ago
  This is such a weird gotcha. It's like telling a communist that they should just stop using money. We're all subject to forces beyond our control. The journalists writing these articles do not control what executives and business people at Vox Media do.
  - karakot 3y ago
    Well yes, but they also could write another article - theverge leaks whatever you're doing on their site to all interested parties.
- UberFly 3y ago
  Amen brother. Also, windows, especially server, used to ship with everything enabled by default but MS learned it was a security nightmare. I wish a basic browser would ship with this stuff opt-in or add-in only. Keeping up with this kind of bloat is exhausting.
- 1vuio0pswjnm7 3y ago
  "24 ads and other trackers from The Verge attempted to load on that page alone; usually much more if those are allowed to succeed." None attempted to load with the browser I am using. I was able to read the text of the article and follow any links on the page no problem. One could hope that "web developers" will stop accepting money in return for putting this garbage into pages. IMHO this is unlikely to happen. Alternatively, for recreational web use, one can stop using the browsers that auto-load the garbage by default. I did this and has worked better and better for over 20 years. The popular browsers supplied by so-called "tech" companies have many "features" but they do not allow users to disable auto-loading.
AdrenalinMd 3y ago
I'm also wondering if they send data to the Russian Yandex search engine as they have an agreement to have this search engine by default in some countries ?
deleted 3y ago
[deleted]
summerlight 3y ago
I don't think this is something with malicious intentions. Those folks worked on this feature probably didn't want deal with all the mess on cross-organization stuff whenever they need to support new sites/networks. They probably told the Edge team something like "This is a super high priority project from the SVP, just give me the ownership of this piece of code". Instead of implementing a proper client side domain filtering. Which is a worse problem ingrained in the org structure IMHO. Looks like they have no security/privacy process for this level of feature launches?
- kccqzy 3y ago
  Having no security/privacy process is malicious by omission.
zpzapper 3y ago
This is literally the reason google chrome exists
ok_dad 3y ago
Can a browser just be a fucking browser? Every stupid fucking feature they cram in is yet another security issue waiting to explode in our face. Just make a damn browser and let us figure out how to "follow creators".
- racl101 3y ago
  Do Brave or Firefox do this?
  - hulitu 3y ago
    Firefox no.
  - kokanee 3y ago
    Brave does an enormous about of non-browser "stuff." Video calls, offline playlists, customizable news feeds, crypto wallet... they are trying to build a "super app" rather than a browser. The idea is that you can trust them because they aren't FAANG, but the problem is that if they actually were to succeed then they would be FAANG. I haven't used Firefox in ages but AFAIK it has very little bloatware. The problem, from the perspective of a web dev, is that it has quite a few rendering quirks/bugs. These days chromium sets the standard for the "correct" way to render things.
    - circuit10 3y ago
      I use Firefox and do some web development on it sometimes and I don’t really notice many/any bugs either with 3rd party sites or ones I’m making, apart from things that are unsupported on purpose like the file access API Though I have noticed some issues in Teams but that’s about it
    - alanwreath 3y ago
      Brave may do all that you touched on - but it also aggressively blocks tracking. And the added stuff is not pushed in your face - blocking tracking is though.
olliej 3y ago
is this any different from chrome “leaking” the sites you visit to Google?
- rchaud 3y ago
  Presumably this sends it to bingapis.com instead of googleapis.com
N0RMAN 3y ago
What‘s next? Bing Maps is „leaking“ data to Microsoft?
- esafak 3y ago
  It depends on what you mean. If you mean "to be disseminated throughout the whole damn company" then hell no. What kind of privacy is that? I don't care that Edge and Bing belong to the same company. Microsoft is a huge company.
helmholtz 3y ago
Maybe this is a good moment to rant, but I just don't get what the fuck it is that Chrome does that people just _will not_ get off the Chromium ride. They will happily bend over a table for Google/MS, all in order to not have to use Firefox. I've used Firefox for a decade and a half now, and I've never understood it. It has never failed me, and I've never needed anything else. Email? Works. News websites? They work. Banking sites? Yep. Google Maps in 3D? Works. Which special, golden webshit is it that breaks on Firefox? And what do people mean Firefox is slow? I've tried Chrome, and boy either we live in differen universes, or there isn't, in fact, any difference in speed.
- bombela 3y ago
  There was a few too many years when Google Chrome was much faster. Used less CPU, battery life was noticably better on laptops etc. I find this no longer the case, and I am now back on Firefox :)
- pyr0hu 3y ago
  Not until a few years ago, Firefox on macOS just kept spinning the fans because it used that much CPU, for no reason. I stopped using FF since then, haven't bothered to install it again, might do it in the near future.
  - someNameIG 3y ago
    I tried using Firefox last year, I did for a few months. But it's the slowest out of all the major browsers on macOS. So I'm back to using Safari with Chrome/Edge for the few sites that don't work in it.
- Shorel 3y ago
  Firefox, for me, was very slow between 2019 and 2021. I used Firefox exclusively from 2016 to 2020, until I had to stop, because it just became unusable. Now in 2023 Firefox is fast again, but so is Edge. As soon as Edge was usable, I ditched Chrome, and will only consider Firefox again if they add native vertical tabs. My point is, browsers are continuously updated, so any claim about a characteristic must be specified in some timeframe.
hollasch 3y ago
Chrome uses APIs from google.com, Edge/IE use APIs from bing.com. This amazing discovery was in headlines in 2010. A more interesting blast from the past is the practice of capturing the search phrase in your browser sent to a competing search engine, and then noting the next visited page in your browser. This essentially captured the user's preferred link from your competitor's SERP (Search Engine Results Page), which led to legal challenges about search copying.
- kccqzy 3y ago
  Using an API does not mean sending URLs of every web page. I'm quite certain Chrome does not do that by default. There are a number of settings in Chrome that you can change to send URLs of every web page to Google, such as turning on history sync, the checkbox for "making searches better" or the "enhanced safe browsing" checkbox. None of that is enabled by default in a new installation of Chrome.
- ColinHayhurst 3y ago
  > the practice of capturing the search phrase in your browser sent to a competing search engine, and then noting the next visited page in your browser. This essentially captured the user's preferred link from your competitor's SERP what about today, and for browsers not from Microsoft and Google, that are also offering search?
  - jacooper 3y ago
    Brave has its own search
    - KomoD 3y ago
      Meanwhile Brave redirected people to referral links instead :)
      - jacooper 3y ago
        Which was a mistake that was fixed.
jsnell 3y ago
This doesn't seem particularly shocking. What I'm surprised by is that Edge wouldn't have been reporting the full browsing history already (with the settings you get when just clicking through every dialogue box at first startup), and only started doing so with this feature. At least the privacy policy [0] suggests the former: > Depending on your settings, this browsing history is sent to Microsoft, which helps us find and fix problems and improve our products and services for all users. So is the news that they're doing this even when the "Help improve Microsoft products by sending optional diagnostic data about how you use the browser, websites you visit, and crash reports" option is off? That'd be unfortunate. Or is the news that it's sent to a Bing domain rather than a Microsoft domain? That is just stupid reporting. [0] https://support.microsoft.com/en-us/windows/microsoft-edge-browsing-data-and-privacy-bb8174ba-9d73-dcf2-9b4a-c582b4e640dd https://support.microsoft.com/en-us/windows/microsoft-edge-b...
- withinrafael 3y ago
  Yes, the news is, as written, when the creator feature is on (and it is by default), all websites are reported to the Bing API endpoint. The other options you referred to aren't mentioned because their configured state is not relevant. Specfically, the following request is sent: GET /api/v7/followweb/isfollowable?appId=F1E45C4A7B95B48AC3F411C6214F6B861D0C276B&mediaUrl=https://www.domain.com/&edgechannel=stable HTTP/1.1 The endpoint then responds with a bit of JSON: { ..., "status": "UnFollowable" }
  - jsnell 3y ago
    The configuration state of the option that allows Edge to send browsing history to Microsoft is pretty damn relevant when talking about a feature that involves Edge sending browsing history to Microsoft. If the option is being ignored, it's the kind of thing that'll result in fines in multiple countries. If the option is being respected, it's not even a story. I assume you're the person quoted in the story and know the details, so thanks for clarifying. Sounds like it's the former then.
    - withinrafael 3y ago
TekMol 3y ago
It's a mistery to me why Microsoft does not do the simple and obvious thing to siphon of a gazillion users from Google: Just offer a simple clean interface to Bing + ChatGPT. Without all the visual clutter and dark patterns. Why do they keep the foot on the break by adding all that nonsense to their search engine? Google is bringing in $160 Billion a year with their clean search result pages. Why does Microsoft think they need to play clumsy tricks and add stuff on top of the search results to make a buck? I see more users coming to my sites via DuckDuckGo - which searches via Bing - than via Bing itself. And that while Bing is the default search engine on the majority of new desktops and laptops out there. And the default search engine on many new tablets. Plus they have ChatGPT integration. It's just ming boggling how Microsoft wastes all that power with a bad UI.
- fnordpiglet 3y ago
  Have you seen the start menu?
  - TekMol 3y ago
    Of Windows? No. I don't have Windows. What does it do?
    - fnordpiglet 3y ago
      Spams you with ads and cross sells you bing content
      - grouchomarx 3y ago
        comments like these strengthen my resolve to go down with the win10 ship then return to macOS when apple's chip line has matured
- bonney_io 3y ago
  > Google is bringing in $160 Billion a year with their clean search result pages. No, Google brings in $X billion a year with all the ads and garbage they stuff in between those clean search results. The same is true for Microsoft. There's no money to be made to run the service (let alone justify an American company's lust for growth and profit) without stuffing it full of ads to hopefully sell you something.
tlb 3y ago
One surprising thing is that MS can be receiving an API call per web page from all Edge users, without noticing that they have a vast increase in traffic. It must be many times more requests than Bing itself. That must have required some serious devops firefighting.
klabb3 3y ago
Follow creator feature? This must be the weakest reason I’ve seen in consumer tech and the bar is very low. Remember this is what the “…to improve your experience” refers to, from the privacy policy. Iirc Edge “telemetry” is also used for the WebView2 runtime which affects Tauri (an Electron alternative) as well, so for the people who think that installing Firefox fixes the problem, that’s not true. The Tauri devs were rightfully pissed and harassed Microsoft, but last I checked MS didn't care. So it wouldn’t surprise me if this new “feature” is also part of WebView2, just because of the code share.
- Xeamek 3y ago
  "This must be the weakest reason I’ve seen in consumer tech and the bar is very low." Wym? It's decent feature (if you are the target for it). Ability to track your subscriptions from all of the different websites in one unified place (in this case your browser) is not a terrible product
slowhadoken 3y ago
Impossible. I don’t use Edge.
e-master 3y ago
Loved using edge, was happy to have a good alternative to Chrome. Then they added this Bing button and some weird Toolbar to the side, and I never used it since. Went back to using Chrome. Would’ve used Firefox, but it doesn’t seem to have a built in translator which I often need, and I’m not keen at all on installing some no name extension.
- hansoolo 3y ago
  Well it has: https://www.mozilla.org/en-US/firefox/features/translate/ https://www.mozilla.org/en-US/firefox/features/translate/
- maroonmoon 3y ago
  Firefox translations https://addons.mozilla.org/en-GB/firefox/addon/firefox-translations/ https://addons.mozilla.org/en-GB/firefox/addon/firefox-trans...
dzink 3y ago
Google relies on duration of stay data from chrome and google analytics to rank search results. Without knowing how much time people spend on a page, you don’t know if the said page is someone’s wishlist, or a wishlist tool, or the wishlist brand, etc. That’s why they were rewarding verbose content, that’s why SEO optimizers were shoving as much text as possible and that’s why GPT made it even easier to rank pages higher on search engines. Bing will collect every data point it can get its hands on legally. Anyone with ambitions to build a better search engine outside of LLM and even with LLM will be only as good as their data.
- xnx 3y ago
  > Google relies on duration of stay data from chrome and google analytics to rank search results Has Google said this? They might infer duration from time between clicks on different search results, but I've never seen evidence they are using data from Chrome and Google Analytics.
  - explorer83 3y ago
    On one hand I find it hard to believe they do not use it. It's not like it's buried in the analytics dashboard. It's a pretty prominent metric. However, I have gotten websites organically ranked that I never implemented an Analytics tag on.
  - dafelst 3y ago
    They haven't said it, but they absolutely do it, or at least did about 7-8 years ago. Source: used to chat with Google search engineers about web spam back in the day at conferences.
    - xnx 3y ago
      “Google Analytics is not used in search quality in any way for our rankings.” -Matt Cutts (ex-Google) (2010) https://www.youtube.com/watch?v=CgBw9tbAQhU https://www.youtube.com/watch?v=CgBw9tbAQhU
      - 3y ago
Shorel 3y ago
I think this is the only way we can have a good search engine. It is potentially an invasion of privacy, but also is excellent to get good search results. Not everything is black and white. Search results have been abysmally bad for a decade now. Anything that can help fix them is welcome.
ecef9-8c0f-4374 3y ago
<% mild_shock_meme.png %> As if the trend was not clearly visible by windows 10 and carved in stone by windows 11.
cuuupid 3y ago
I switched from Chrome to Edge 4ish years ago. It was honestly faster, didn’t rev up my laptop fan, and over time they added things like the automatic privacy tooling that I enjoyed. Now they’re messing up where it matters. The endless promotion of Bing, making it hard to completely remove it from the browser, adding a huge fucking B button. All while ignoring glaring bugs that were making it impossible to use certain sites with Edge while working fine in its sister browsers. Now I’m swapping back to Chrome because this is purely intolerable. Sometimes software doesn’t need iteration or more features. Sometimes it just needs to work!
- pbhjpbhj 3y ago
  Edge has been passable, Edge gained users, someone at MS suggested they should exploit those users more -- 'they're enjoying it, we can make it shit and exploit them for money instead, go us' is how I imagine that thought went. If MS stay true to form then give it a year and Edge will be a fetid turd, but they'll add some lock-in from the OS; maybe Office online breaks in all the other browsers. The World will be worse, some middle-manager will get a promotion, shareholders will get a few more cents, so it goes...
  - esafak 3y ago
    At least Edge is consumer software; your boss can't shove it down your throat.
    - nr2x 3y ago
      Oh man, you must be too young to remember when companies had intranet sites that only worked on IE6 long after it was supported. That was pure hell as a young IT support drone. Good god.
      - esafak 3y ago
        I am familiar with the "This site is best viewed on X" and Netscape vs IE era but I thankfully entered the workforce later. My condolences to everyone who has to suffer stereotypical enterprise software.
kevwil 3y ago
LOL I'm sooooo surprised. /s
_cenw 3y ago
Sometimes I feel like Edge is made by 20+ different teams with no shared strategic goals that all work to make the business side of their slice of the browser look good, with no regard for long term health of the entire browser. Is Microsoft still doing stack ranking?
- NayamAmarshe 3y ago
  > Sometimes I feel like Edge is made by 20+ different teams with no shared strategic goals That's almost every modern Microsoft product, in my experience.
topherPedersen 3y ago
That's probably smart. Seeing where people go on the web would probably be helpful if you're running a search engine. Maybe we should give Microsoft a break on this one. Going up against Google is a daunting task. Microsoft should use every advantage they can get.
cryptoegorophy 3y ago
I hate to break the news but Chrome does that too. I used similarweb to check my website that only I visited pretty much and it showed “other viewed websites” that only I visited. I tried some other small websites and saw websites such as “pornhub” in other visited websites. I didn’t have any extensions or anything. I’ve reached out to similarweb and was conveniently ignored. Just assume that all sites you visit is a publicly available data.
- antoniojtorres 3y ago
  Would you happen to remember if you had any extensions or anything of that sort enabled on that chrome instance?
__MatrixMan__ 3y ago
I didn't realize that people used edge for anything other than talking to bing chat.
- freehorse 3y ago
  Me neither lol. It is weird that this is even considered news.
- EMM_386 3y ago
  That's the only reason I launch it. It's annoying that they force you to use Edge. Otherwise it would see no use from me. Which, I know ... that's exactly why they're doing it.
dschuetz 3y ago
/gasp/ nooooo way, really?! who would have thunk!!!
wsdookadr 3y ago
Irrelevant
cubefox 3y ago
For people who didn't read the article: Apparently this is a bug.
- freehorse 3y ago
  That is not what the article says, no. It says that microsoft answered that it is "investigating the issue" which is a pretty much standard response, but it does not confirm that microsoft did not implement this. But seeing that [they even have a master filter for which urls to send to the bingapis and which not](https://www.bingapis.com/api/v7/followweb/getdomainfilter?appId=F1E45C4A7B95B48AC3F411C6214F6B861D0C276B https://www.bingapis.com/api/v7/followweb/getdomainfilter?ap...) it seems definitely a feature.
  - andromeduck 3y ago
    Competitors, news and porn basically. So those they'd be liable to catch a lawsuit from and potentially the potentially embarrassing.
s1k3s 3y ago
Kind reminder that while a few people might be concerned and act upon this, the vast majority simply don't care and will opt into anything the program asks them to.
Aleklart 3y ago
Not a big deal. I have nothing to hide from Microsoft. I mean how them knowing chrome download page can hurt my privacy, right?
nr2x 3y ago
So it’s just Chrome all the way down.
GuyFromNorway 3y ago
This reminds me of a case I saw a couple of years, working for a company that delivered a document software. We had documents accessible through the web, open, but with a obfuscated URL, as a good amount of other companies in similar spaces. One morning we found a good amount of documents indexed in Bing, as well as invoices from some of Norways largest credit card companies, e-invoice suppliers etc. We never got to the bottom of how it happened, but our theory was that Edge would send browsing history back to MS; and MS/Bing would index based on this. So this seems to be a practice that has been going on for a long time Some old articles about it: https://www-nrk-no.translate.goog/norge/fodselsnummer-fra-bronnoysundregistrene-la-apent-pa-internett-1.13516877?_x_tr_sl=no&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp https://www-nrk-no.translate.goog/norge/fodselsnummer-fra-br... https://www-nrk-no.translate.goog/norge/felleskjopet-beklager-at-kundeopplysninger-la-ute-1.13523731?_x_tr_sl=no&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp https://www-nrk-no.translate.goog/norge/felleskjopet-beklage...
- senorrib 3y ago
  The fault here obviously doesn't fall exclusively on Microsoft. Security by obscurity was never an effective method.
steve1977 3y ago
„Leaking“ makes this sound unintentional
iamthirsty 3y ago
I finally got an invite to join Arc today. A lot of the excitement was dulled by the fact that a well designed, well engineered app needs money to pay those designers & engineers, and just like this instance, you can never really know whats being leaked or sold, unless it's a large open source project. Yes, I know the old adage that if you're not paying for a product you are the product, and as I try and simplify my life and focus on having just a few really high-quality items in any category of life, getting screwed so often because of the need for companies to have as much information as possible updated as often as possible is really making it harder and harder to be the technology and internet enthusiast I once was.
- yabatopia 3y ago
  I had to look up Arc, there are different arcs. You probably mean this one, a new kind of browser: https://thebrowser.company/ https://thebrowser.company/
  - Grimm665 3y ago
    Wow what is this and why does it have that vaguely petrichor-like scent of vaporware?
    - ubercore 3y ago
      It's actually pretty great, I really like it.
      - Grimm665 3y ago
        Despite my snark, I am genuinely curious after seeing a bit of what it actually looks like in their design meeting video. What are the unique features and what do you like about it?
        type0 3y ago
        We should like it, it's the Browser of New York!
TedDoesntTalk 3y ago
> Until Microsoft completes its investigation and presumably patches this problem, we’d highly recommend turning off the “follow creators” feature in Microsoft Edge. Or, you know, just don’t use Edge???
de6u99er 3y ago
>“Microsoft Edge now has a creator follow feature that is enabled by default,” says Rivera in a conversation with The Verge. “It appears the intent was to notify Bing when you’re on certain pages, such as YouTube, The Verge, and Reddit. But it doesn’t appear to be working correctly, instead sending nearly every domain you visit to Bing.” I don't believe for a second that this is a bug.
- Tozen 3y ago
  Until called out on it, thinking that Microsoft was quite happy with "follow creator" sending Bing what urls users go to. Another slick trick of Edge that I have noticed is that after updates, various settings can change or new ones added, particularly those that involving privacy. So users have to always be wary and vigilant about checking all settings after any update.
mrjin 3y ago
Lol, I stopped using Edge a couple of weeks ago as after an update, it took 30+s to just switching to another tab, note that the CPU usage was below 10% and 48+GB RAM available.
NayamAmarshe 3y ago
Jobs was right. Microsoft really is the McDonald's of the software world.
winstonprivacy 3y ago
Hmm, very interesting. It sounds like with a bit of wrapper code, futexes could be used instead of mutexes? If they are genuinely faster, there are many use cases where this would be valuable. Is there a production-ready library for this? I do see the code in the article but I'm not sure I'm ready to venture into these deep waters myself.
api 3y ago
It's safe to assume that stock Windows 11 leaks every single thing you do to Microsoft. That's the point.
- INeedMoreRam 3y ago
  [dead]
- sourcelang 3y ago
  I remember opening up a new HP laptop with Windows installed, around 2016. Out of curiosity I installed Wireshark and inspected some of the outgoing packets from pre-installed software on the Windows system. Alongside the usual telemetry, I found some packets being sent to an IP registered by the US military, straight to a military base, no proxy or anything. Maybe there’s a perfectly non-nefarious explanation but that investigation sure felt like it confirmed my suspicions…
  - linuxftw 3y ago
    Probably related to TLS CAs. Windows insists on phoning home to these CAs.
    - sourcelang 3y ago
      Interesting. Does this actually have any security implications or is my paranoia for nothing? In my head, “normal“ CAs used by browsers for example are held to a high standard of digital trust. Whereas trust in the US military as a CA sort of implies blind faith. But I honestly don’t feel that I know enough about TLS to know why I should trust, say, digicert or identrust, more or less than the US military.
      - linuxftw 3y ago
        The US Government issues their own certs for many agencies, so there's no commercial entity that acts as the CA. These CAs are installed by Windows just like most other CAs.
  - 3y ago
LorenPechtel 3y ago
While this certainly could be innocent (checking the URLs against a list of bad actors) I certainly wouldn't trust them.
- jeffbee 3y ago
  It seems like checking for malicious URLs without revealing the URLs to a central authority is a long-solved problem. https://developers.google.com/safe-browsing/v4#update-api-v4 https://developers.google.com/safe-browsing/v4#update-api-v4
SoftTalker 3y ago
And Chrome leaks to Google, unless you disable it. Why is this a surprise?
- classified 3y ago
  It's not, but still worth saying that the spy tentacle doesn't stop spying just because it serves a different master.
- webmobdev 3y ago
  And all browsers leak to Google if you have search suggestion in address bar enabled ...
  - SoftTalker 3y ago
    Yes, that's mainly what I was thinking of. Search suggestions, which are on by default. Chrome also has some sort of hostile site checker but that may use locally cached blacklists, I can't recall.
  - Tepix 3y ago
    Not if you use another search engine.
bgun 3y ago
Product from [Company] shares user data with other product from [Company]. A shocking and newsworthy revelation. /s
- classified 3y ago
  Yeah, if people would just stop complaining about these totally normal and OK privacy violations, the world would be a better place. /s
  - deleted 3y ago
    [deleted]
  - bgun 3y ago
    Is it not totally normal and OK (and not a violation of any kind) for Microsoft to share user data with Microsoft? Fighting for user privacy is a laudable goal but in this particular case what, if any, ethical breach has occurred? As others have commented, it's like being upset that Google Search is aware of websites you visited in Chrome. Is it unethical for that to be the case?
    - garbagecoder 3y ago
      Knee-jerk Internet commentators think any packet going anywhere is a breach of their privacy which is funny because that's sort of the point of a network. For me, this particular issue isn't about privacy, it's that these companies get to make their products better using my data and I get nothing out of it. Sort of how they train their AIs. Privacy has been popularly re-defined to be "any data." Remember when people's name, address, and phone number was published in a big yellow and white book and delivered to everyone's driveway? What we should want is compensation for the use of our non-PII data and a restriction on information about us that can be used to harm us, financial, medical, etc. to be restricted. Chrome not telling Google I went to Amazon.com would be great, but Amazon knows I went there and if I use 8.8.8.8 so does Google anyway.
    - akira2501 3y ago
      One is a product I pay for. The other is a loss leading product given away by a monopoly to support their ad business. In both cases, because of these factors, yes.. I consider it to be unethical.
albert_e 3y ago
Does this apply by default to enterprise installations of MS Edge? Any way to verify this as end user and raise it to our IT folk
- nazgulsenpai 3y ago
  As someone in Enterprise IT, if your org is anything like mine, they don't care.
winslow 3y ago
"leaking"
deleted 3y ago
[deleted]
Datagenerator 3y ago
Seen Librewolf?
skim_milk 3y ago
At a previous SaaS startup I worked for, we stored a bunch of clients' documents somewhere on e.g. example.com/documents - which included confidential items like checks and contracts. Customers would typically opt-out of requiring authentication for a lot of these documents so they could share them with others. I noticed that when you searched for the company on Bing, you would actually see a bunch of these documents, despite nothing linking to it! Of course I updated the robots.txt and yelled at leadership for the gaping security hole, but I was very surprised to see that Microsoft would send every link you crawled back to Bing to index. Distributed web crawling!
- that_guy_iain 3y ago
  >Of course I updated the robots.txt and yelled at leadership for the gaping security hole I've curious how there was a security hole when a client opted out of requiring auth? If the client wants them publically available then there was no security hole. Secondly, I am wondering why you are yelling at leadership for something that seems like it was your responsibility.
  - giancarlostoro 3y ago
    > I've curious how there was a security hole when a client opted out of requiring auth? If the client wants them publically available then there was no security hole. Its possible they wanted the link to be easier to share with very specific people, but not necessarily be something found on bing.
    - noja 3y ago
      Because the user expectation is that a browser won't leak their private URLs to a search engine? https://www.example.com/id/0ca6ade6b2bb1eea371d0b029f552cee/filename.pdf https://www.example.com/id/0ca6ade6b2bb1eea371d0b029f552cee/... may be "public" in the sense that it is accessible if you know the URL.
      - chasd00 3y ago
qalmakka 3y ago
Very conveniently Edge started crashing just yesterday whenever I visited gitlab, which gave me an excellent excuse to switch my work machine to Firefox. Edge is an overall nice browser, but it's less stable than plain Chrom(ium) IMHO and MS really pushes hard their nefarious features, way more than I can tolerate honestly
nicetryguy 3y ago
Also worth mentioning, it is practically impossible to remove Edge from a Win 10 (and probably 11) installation. I tried nuking everything i could find, registry entries, Trusted Installer stuff, nope, keeps reinstalling itself after every update. I gave up.
- kevingadd 3y ago
  It's the new ie in the sense that it provides an embeddable WebView for apps that need to securely display web content like oauth logins, so it's not realistic to remove all the files. :/
FinnKuhn 3y ago
how is "a Microsoft product sends data to a Microsoft API for a specific feature" a surprising thing, although this seems to malfunction and send data even though it shouldn't?
- senko 3y ago
  Are our standards/expectation of privacy so low that this is a genuine question?
- feoren 3y ago
  If I sold you a digital camera, would you be surprised if I was uploading every picture you took to my servers? (Without telling you, of course.) Your blasé reaction is rather worrying.
  - tokai 3y ago
    It wouldn't be surprising if it was a Microsoft camera.
  - FinnKuhn 3y ago
    I don't like this analogy for a number of reasons beginning with the difference between a free software that I know is internet connected and a purchased device that doesn't even need access to the internet. Let me ask this: Would you be surprised to learn that Google Chrome sends data to Google when you enter something in the task bar to give you auto complete predictions? I wouldn't. The same is also true for Microsoft Edge sending data to Microsoft Bing to enable a feature of the Webbrowser.
  - LexGray 3y ago
    At this point no. Virtually every IoT device requires upload to the manufacturer’s server to get even basic functionality, which of course breaks when the server goes offline. The privacy policies when they exist virtually never promise end-to-end encryption (a promise I wouldn’t trust anyway as corners are cut and there are unlikely to be security audits), and often imply sales of data to partners. In this age of AI scraping every shred of data I suspect anything connected to the internet will be compromised in a back room deals, through lack of security, or through sub-contractors sharing what they can get their hands on. I think reactions to this are more along the lines of horrified, but it is our accepted trade off in the name of cheap products.
boxed 3y ago
Outlook leaks private URLs from emails to Bing too. Yes, that includes your password reset emails.

485 points by sphars 3y ago

aaws11 3y ago

It’s probably a good idea to disable Edge’s follow creator feature until this privacy issue is fixed.

withinrafael 3y ago
One note: I've noticed turning off this feature does not immediately turn off the feature. A browser restart (all instances) is required to take full effect (and stop sending traffic to that endpoint). Also keep an eye on the toggle--Microsoft Edge does not guarantee settings persist across updates.
- pbhjpbhj 3y ago
  >Microsoft Edge does not guarantee settings persist across updates. // This sort of behaviour, which Firefox had indulged in in the past, is abhorrent. It needs punishment of the company and the controlling staff; they can not be trusted at all.
- zelphirkalt 3y ago
  Also keep an eye on "bugs" in Edge's source code which might ignore the setting in some cases ...
mxuribe 3y ago
It’s probably a good idea to disable Edge...That is, stop using Edge (or Chorme), and start using an alternative browser...like Firefox. /s More seriously, I wish there was a web browser built in a sort of cameleon fashion: * layer 1 - the lowest layer would be some weird rotating engine that would use different browser engines to send disinformation to all websites, web apps. For example, at one moment websites see that i'm on FF, but the next moment on a version of (fake) "Chrome", etc. But, functionality, the user is unaware of what engine is actually driving the typical underlying browser processes. * layer 2 - the middle layer would hold my personal/private data, like saved passwords, cookies that i desire, etc. This layer is in total control of the user and their data. Whatever configs and preferences are set by the user are saved in this layer, and it persists across browser upgrades, browser synching platforms (like Firefox Accounts), etc. * layer 3 - is what the user sees as browser UI (the original term was "browser chrome" of coiurse), and interacts with the UX features...The user can use 1 of a few UI themes: 1 that "looks" like Firefox, another that looks like Chrome, another looks like Brave, Edge, etc. On top of these "browser skins", there could also be the typical browser-brand-specific themes that each native browser has available. I should state that i know nothing about how browsers are developed...And I acknowledge from my armchair that the above would make developing a new browser crazy complex...but, wow, such flexibility i think would be pretty neat!

stalfosknight 3y ago

Is anyone truly surprised by this?

agilob 3y ago
More surprised that theverge is using word "leaking", when it should be "sending" or "reporting". Leaking, make it look like an accidental behaviour.
- sourcecodeplz 3y ago
  They are in love with Apple.
- withinrafael 3y ago
  I think it's correct, but understand your view too. The feature they're referring to is configured remotely [1] with a set of domain filters that demonstrate the intent was to only capture a subset of sites. I think this is where I'm now supposed to refer to Hanlon's razor--Never attribute to malice that which is adequately explained by stupidity. [1] https://www.bingapis.com/api/v7/followweb/getdomainfilter?appId=F1E45C4A7B95B48AC3F411C6214F6B861D0C276B https://www.bingapis.com/api/v7/followweb/getdomainfilter?ap...
- jug 3y ago
  But their point is that it looks like accidental behavior? That is, it’s doing this in way more instances than the intent is with this new feature that is enabled by default?
  - agilob 3y ago
    Do you believe in such accidents? What the explanation for that would be? Something like: "Oh no, we had this enabled by accident, and by accident had configured a high-availability API endpoint to collect such calls on a massive scale. This all got compiled, configured and deployed by accident without our clear intentions to do so. We are sorry."

marginalia_nu 3y ago

Everything you type in your URL bar in Chrome and Firefox is sent to Google.

talal7860 3y ago
What if we don't use google as our default search engine, is it still shared?
- colmvp 3y ago
  No, it's only shared with the provider you choose (e.g. if your default search engine is DDG, then the search terms are shared with DDG, etc.)
wuiheerfoj 3y ago
Is this true if you aren’t using Google as your search engine?
- rejectfinite 3y ago
  No. Atleast not on Firefox. I think? idk lol
  - rzzzt 3y ago
    The hashed form of the URL might still reach Google as part of the Safe Browsing initiative, although a copy of the List of Naughty Websites is kept locally as well, so if you visit a known deceptive site, it need not ping their servers.
- soundnote 3y ago
  No. It's just that Firefox adverstises itself as private: https://imgur.com/a/p4CVBHb https://imgur.com/a/p4CVBHb "Power and privacy to the people. No need to dig into your security settings. Fierce privacy is our default." but has Google as the default search engine and defaults to having search suggestions on.
3y ago

manojlds 3y ago

Edge sends data to Bing. What's the leak here.

AnimalMuppet 3y ago
I wasn't searching Bing. That is the leak.
- hollasch 3y ago
  And if Bing is the engine to provide keystroke-by-keystroke word completion, that's not a leak — it's an API the browser uses.
  - AnimalMuppet 3y ago
    Fair enough.
  - vb-8448 3y ago
    for what i understand, it sends all urls you visit event if you click on a link inside a page ...
- CatWChainsaw 3y ago
  Which search engines were you using?

98codes 3y ago

24 ads and other trackers from The Verge attempted to load on that page alone; usually much more if those are allowed to succeed. That said, I disabled that creator follow nonsense the moment it landed. Not because of the URL tracking, but because it is stupid.

_cenw 3y ago
This is such a weird gotcha. It's like telling a communist that they should just stop using money. We're all subject to forces beyond our control. The journalists writing these articles do not control what executives and business people at Vox Media do.
- karakot 3y ago
  Well yes, but they also could write another article - theverge leaks whatever you're doing on their site to all interested parties.
UberFly 3y ago
Amen brother. Also, windows, especially server, used to ship with everything enabled by default but MS learned it was a security nightmare. I wish a basic browser would ship with this stuff opt-in or add-in only. Keeping up with this kind of bloat is exhausting.
1vuio0pswjnm7 3y ago
"24 ads and other trackers from The Verge attempted to load on that page alone; usually much more if those are allowed to succeed." None attempted to load with the browser I am using. I was able to read the text of the article and follow any links on the page no problem. One could hope that "web developers" will stop accepting money in return for putting this garbage into pages. IMHO this is unlikely to happen. Alternatively, for recreational web use, one can stop using the browsers that auto-load the garbage by default. I did this and has worked better and better for over 20 years. The popular browsers supplied by so-called "tech" companies have many "features" but they do not allow users to disable auto-loading.

AdrenalinMd 3y ago

I'm also wondering if they send data to the Russian Yandex search engine as they have an agreement to have this search engine by default in some countries ?

deleted 3y ago

[deleted]

summerlight 3y ago

I don't think this is something with malicious intentions. Those folks worked on this feature probably didn't want deal with all the mess on cross-organization stuff whenever they need to support new sites/networks. They probably told the Edge team something like "This is a super high priority project from the SVP, just give me the ownership of this piece of code". Instead of implementing a proper client side domain filtering. Which is a worse problem ingrained in the org structure IMHO. Looks like they have no security/privacy process for this level of feature launches?

kccqzy 3y ago
Having no security/privacy process is malicious by omission.

zpzapper 3y ago

This is literally the reason google chrome exists

ok_dad 3y ago

Can a browser just be a fucking browser? Every stupid fucking feature they cram in is yet another security issue waiting to explode in our face. Just make a damn browser and let us figure out how to "follow creators".

racl101 3y ago
Do Brave or Firefox do this?
- hulitu 3y ago
  Firefox no.
- kokanee 3y ago
  Brave does an enormous about of non-browser "stuff." Video calls, offline playlists, customizable news feeds, crypto wallet... they are trying to build a "super app" rather than a browser. The idea is that you can trust them because they aren't FAANG, but the problem is that if they actually were to succeed then they would be FAANG. I haven't used Firefox in ages but AFAIK it has very little bloatware. The problem, from the perspective of a web dev, is that it has quite a few rendering quirks/bugs. These days chromium sets the standard for the "correct" way to render things.
  - circuit10 3y ago
    I use Firefox and do some web development on it sometimes and I don’t really notice many/any bugs either with 3rd party sites or ones I’m making, apart from things that are unsupported on purpose like the file access API Though I have noticed some issues in Teams but that’s about it
  - alanwreath 3y ago
    Brave may do all that you touched on - but it also aggressively blocks tracking. And the added stuff is not pushed in your face - blocking tracking is though.

olliej 3y ago

is this any different from chrome “leaking” the sites you visit to Google?

rchaud 3y ago
Presumably this sends it to bingapis.com instead of googleapis.com

N0RMAN 3y ago

What‘s next? Bing Maps is „leaking“ data to Microsoft?

esafak 3y ago
It depends on what you mean. If you mean "to be disseminated throughout the whole damn company" then hell no. What kind of privacy is that? I don't care that Edge and Bing belong to the same company. Microsoft is a huge company.

helmholtz 3y ago

Maybe this is a good moment to rant, but I just don't get what the fuck it is that Chrome does that people just _will not_ get off the Chromium ride. They will happily bend over a table for Google/MS, all in order to not have to use Firefox. I've used Firefox for a decade and a half now, and I've never understood it. It has never failed me, and I've never needed anything else. Email? Works. News websites? They work. Banking sites? Yep. Google Maps in 3D? Works. Which special, golden webshit is it that breaks on Firefox? And what do people mean Firefox is slow? I've tried Chrome, and boy either we live in differen universes, or there isn't, in fact, any difference in speed.

bombela 3y ago
There was a few too many years when Google Chrome was much faster. Used less CPU, battery life was noticably better on laptops etc. I find this no longer the case, and I am now back on Firefox :)
pyr0hu 3y ago
Not until a few years ago, Firefox on macOS just kept spinning the fans because it used that much CPU, for no reason. I stopped using FF since then, haven't bothered to install it again, might do it in the near future.
- someNameIG 3y ago
  I tried using Firefox last year, I did for a few months. But it's the slowest out of all the major browsers on macOS. So I'm back to using Safari with Chrome/Edge for the few sites that don't work in it.
Shorel 3y ago
Firefox, for me, was very slow between 2019 and 2021. I used Firefox exclusively from 2016 to 2020, until I had to stop, because it just became unusable. Now in 2023 Firefox is fast again, but so is Edge. As soon as Edge was usable, I ditched Chrome, and will only consider Firefox again if they add native vertical tabs. My point is, browsers are continuously updated, so any claim about a characteristic must be specified in some timeframe.

hollasch 3y ago

Chrome uses APIs from google.com, Edge/IE use APIs from bing.com. This amazing discovery was in headlines in 2010. A more interesting blast from the past is the practice of capturing the search phrase in your browser sent to a competing search engine, and then noting the next visited page in your browser. This essentially captured the user's preferred link from your competitor's SERP (Search Engine Results Page), which led to legal challenges about search copying.

kccqzy 3y ago
Using an API does not mean sending URLs of every web page. I'm quite certain Chrome does not do that by default. There are a number of settings in Chrome that you can change to send URLs of every web page to Google, such as turning on history sync, the checkbox for "making searches better" or the "enhanced safe browsing" checkbox. None of that is enabled by default in a new installation of Chrome.
ColinHayhurst 3y ago
> the practice of capturing the search phrase in your browser sent to a competing search engine, and then noting the next visited page in your browser. This essentially captured the user's preferred link from your competitor's SERP what about today, and for browsers not from Microsoft and Google, that are also offering search?
- jacooper 3y ago
  Brave has its own search
  - KomoD 3y ago
    Meanwhile Brave redirected people to referral links instead :)
    - jacooper 3y ago
      Which was a mistake that was fixed.

jsnell 3y ago

This doesn't seem particularly shocking. What I'm surprised by is that Edge wouldn't have been reporting the full browsing history already (with the settings you get when just clicking through every dialogue box at first startup), and only started doing so with this feature. At least the privacy policy [0] suggests the former: > Depending on your settings, this browsing history is sent to Microsoft, which helps us find and fix problems and improve our products and services for all users. So is the news that they're doing this even when the "Help improve Microsoft products by sending optional diagnostic data about how you use the browser, websites you visit, and crash reports" option is off? That'd be unfortunate. Or is the news that it's sent to a Bing domain rather than a Microsoft domain? That is just stupid reporting. [0] https://support.microsoft.com/en-us/windows/microsoft-edge-browsing-data-and-privacy-bb8174ba-9d73-dcf2-9b4a-c582b4e640dd https://support.microsoft.com/en-us/windows/microsoft-edge-b...

withinrafael 3y ago
Yes, the news is, as written, when the creator feature is on (and it is by default), all websites are reported to the Bing API endpoint. The other options you referred to aren't mentioned because their configured state is not relevant. Specfically, the following request is sent: GET /api/v7/followweb/isfollowable?appId=F1E45C4A7B95B48AC3F411C6214F6B861D0C276B&mediaUrl=https://www.domain.com/&edgechannel=stable HTTP/1.1 The endpoint then responds with a bit of JSON: { ..., "status": "UnFollowable" }
- jsnell 3y ago
  The configuration state of the option that allows Edge to send browsing history to Microsoft is pretty damn relevant when talking about a feature that involves Edge sending browsing history to Microsoft. If the option is being ignored, it's the kind of thing that'll result in fines in multiple countries. If the option is being respected, it's not even a story. I assume you're the person quoted in the story and know the details, so thanks for clarifying. Sounds like it's the former then.
  - withinrafael 3y ago

TekMol 3y ago

It's a mistery to me why Microsoft does not do the simple and obvious thing to siphon of a gazillion users from Google: Just offer a simple clean interface to Bing + ChatGPT. Without all the visual clutter and dark patterns. Why do they keep the foot on the break by adding all that nonsense to their search engine? Google is bringing in $160 Billion a year with their clean search result pages. Why does Microsoft think they need to play clumsy tricks and add stuff on top of the search results to make a buck? I see more users coming to my sites via DuckDuckGo - which searches via Bing - than via Bing itself. And that while Bing is the default search engine on the majority of new desktops and laptops out there. And the default search engine on many new tablets. Plus they have ChatGPT integration. It's just ming boggling how Microsoft wastes all that power with a bad UI.

fnordpiglet 3y ago
Have you seen the start menu?
- TekMol 3y ago
  Of Windows? No. I don't have Windows. What does it do?
  - fnordpiglet 3y ago
    Spams you with ads and cross sells you bing content
    - grouchomarx 3y ago
      comments like these strengthen my resolve to go down with the win10 ship then return to macOS when apple's chip line has matured
bonney_io 3y ago
> Google is bringing in $160 Billion a year with their clean search result pages. No, Google brings in $X billion a year with all the ads and garbage they stuff in between those clean search results. The same is true for Microsoft. There's no money to be made to run the service (let alone justify an American company's lust for growth and profit) without stuffing it full of ads to hopefully sell you something.

tlb 3y ago

One surprising thing is that MS can be receiving an API call per web page from all Edge users, without noticing that they have a vast increase in traffic. It must be many times more requests than Bing itself. That must have required some serious devops firefighting.

klabb3 3y ago

Follow creator feature? This must be the weakest reason I’ve seen in consumer tech and the bar is very low. Remember this is what the “…to improve your experience” refers to, from the privacy policy. Iirc Edge “telemetry” is also used for the WebView2 runtime which affects Tauri (an Electron alternative) as well, so for the people who think that installing Firefox fixes the problem, that’s not true. The Tauri devs were rightfully pissed and harassed Microsoft, but last I checked MS didn't care. So it wouldn’t surprise me if this new “feature” is also part of WebView2, just because of the code share.

Xeamek 3y ago
"This must be the weakest reason I’ve seen in consumer tech and the bar is very low." Wym? It's decent feature (if you are the target for it). Ability to track your subscriptions from all of the different websites in one unified place (in this case your browser) is not a terrible product

slowhadoken 3y ago

Impossible. I don’t use Edge.

e-master 3y ago

Loved using edge, was happy to have a good alternative to Chrome. Then they added this Bing button and some weird Toolbar to the side, and I never used it since. Went back to using Chrome. Would’ve used Firefox, but it doesn’t seem to have a built in translator which I often need, and I’m not keen at all on installing some no name extension.

hansoolo 3y ago
Well it has: https://www.mozilla.org/en-US/firefox/features/translate/ https://www.mozilla.org/en-US/firefox/features/translate/
maroonmoon 3y ago
Firefox translations https://addons.mozilla.org/en-GB/firefox/addon/firefox-translations/ https://addons.mozilla.org/en-GB/firefox/addon/firefox-trans...

dzink 3y ago

Google relies on duration of stay data from chrome and google analytics to rank search results. Without knowing how much time people spend on a page, you don’t know if the said page is someone’s wishlist, or a wishlist tool, or the wishlist brand, etc. That’s why they were rewarding verbose content, that’s why SEO optimizers were shoving as much text as possible and that’s why GPT made it even easier to rank pages higher on search engines. Bing will collect every data point it can get its hands on legally. Anyone with ambitions to build a better search engine outside of LLM and even with LLM will be only as good as their data.

xnx 3y ago
> Google relies on duration of stay data from chrome and google analytics to rank search results Has Google said this? They might infer duration from time between clicks on different search results, but I've never seen evidence they are using data from Chrome and Google Analytics.
- explorer83 3y ago
  On one hand I find it hard to believe they do not use it. It's not like it's buried in the analytics dashboard. It's a pretty prominent metric. However, I have gotten websites organically ranked that I never implemented an Analytics tag on.
- dafelst 3y ago
  They haven't said it, but they absolutely do it, or at least did about 7-8 years ago. Source: used to chat with Google search engineers about web spam back in the day at conferences.
  - xnx 3y ago
    “Google Analytics is not used in search quality in any way for our rankings.” -Matt Cutts (ex-Google) (2010) https://www.youtube.com/watch?v=CgBw9tbAQhU https://www.youtube.com/watch?v=CgBw9tbAQhU
    - 3y ago

Shorel 3y ago

I think this is the only way we can have a good search engine. It is potentially an invasion of privacy, but also is excellent to get good search results. Not everything is black and white. Search results have been abysmally bad for a decade now. Anything that can help fix them is welcome.

ecef9-8c0f-4374 3y ago

<% mild_shock_meme.png %> As if the trend was not clearly visible by windows 10 and carved in stone by windows 11.

cuuupid 3y ago

I switched from Chrome to Edge 4ish years ago. It was honestly faster, didn’t rev up my laptop fan, and over time they added things like the automatic privacy tooling that I enjoyed. Now they’re messing up where it matters. The endless promotion of Bing, making it hard to completely remove it from the browser, adding a huge fucking B button. All while ignoring glaring bugs that were making it impossible to use certain sites with Edge while working fine in its sister browsers. Now I’m swapping back to Chrome because this is purely intolerable. Sometimes software doesn’t need iteration or more features. Sometimes it just needs to work!

pbhjpbhj 3y ago
Edge has been passable, Edge gained users, someone at MS suggested they should exploit those users more -- 'they're enjoying it, we can make it shit and exploit them for money instead, go us' is how I imagine that thought went. If MS stay true to form then give it a year and Edge will be a fetid turd, but they'll add some lock-in from the OS; maybe Office online breaks in all the other browsers. The World will be worse, some middle-manager will get a promotion, shareholders will get a few more cents, so it goes...
- esafak 3y ago
  At least Edge is consumer software; your boss can't shove it down your throat.
  - nr2x 3y ago
    Oh man, you must be too young to remember when companies had intranet sites that only worked on IE6 long after it was supported. That was pure hell as a young IT support drone. Good god.
    - esafak 3y ago
      I am familiar with the "This site is best viewed on X" and Netscape vs IE era but I thankfully entered the workforce later. My condolences to everyone who has to suffer stereotypical enterprise software.

kevwil 3y ago

LOL I'm sooooo surprised. /s

_cenw 3y ago

Sometimes I feel like Edge is made by 20+ different teams with no shared strategic goals that all work to make the business side of their slice of the browser look good, with no regard for long term health of the entire browser. Is Microsoft still doing stack ranking?

NayamAmarshe 3y ago
> Sometimes I feel like Edge is made by 20+ different teams with no shared strategic goals That's almost every modern Microsoft product, in my experience.

topherPedersen 3y ago

That's probably smart. Seeing where people go on the web would probably be helpful if you're running a search engine. Maybe we should give Microsoft a break on this one. Going up against Google is a daunting task. Microsoft should use every advantage they can get.

cryptoegorophy 3y ago

I hate to break the news but Chrome does that too. I used similarweb to check my website that only I visited pretty much and it showed “other viewed websites” that only I visited. I tried some other small websites and saw websites such as “pornhub” in other visited websites. I didn’t have any extensions or anything. I’ve reached out to similarweb and was conveniently ignored. Just assume that all sites you visit is a publicly available data.

antoniojtorres 3y ago
Would you happen to remember if you had any extensions or anything of that sort enabled on that chrome instance?

__MatrixMan__ 3y ago

I didn't realize that people used edge for anything other than talking to bing chat.

freehorse 3y ago
Me neither lol. It is weird that this is even considered news.
EMM_386 3y ago
That's the only reason I launch it. It's annoying that they force you to use Edge. Otherwise it would see no use from me. Which, I know ... that's exactly why they're doing it.

dschuetz 3y ago

/gasp/ nooooo way, really?! who would have thunk!!!

wsdookadr 3y ago

Irrelevant

cubefox 3y ago

For people who didn't read the article: Apparently this is a bug.

freehorse 3y ago
That is not what the article says, no. It says that microsoft answered that it is "investigating the issue" which is a pretty much standard response, but it does not confirm that microsoft did not implement this. But seeing that [they even have a master filter for which urls to send to the bingapis and which not](https://www.bingapis.com/api/v7/followweb/getdomainfilter?appId=F1E45C4A7B95B48AC3F411C6214F6B861D0C276B https://www.bingapis.com/api/v7/followweb/getdomainfilter?ap...) it seems definitely a feature.
- andromeduck 3y ago
  Competitors, news and porn basically. So those they'd be liable to catch a lawsuit from and potentially the potentially embarrassing.

s1k3s 3y ago

Kind reminder that while a few people might be concerned and act upon this, the vast majority simply don't care and will opt into anything the program asks them to.

Aleklart 3y ago

Not a big deal. I have nothing to hide from Microsoft. I mean how them knowing chrome download page can hurt my privacy, right?

nr2x 3y ago

So it’s just Chrome all the way down.

GuyFromNorway 3y ago

This reminds me of a case I saw a couple of years, working for a company that delivered a document software. We had documents accessible through the web, open, but with a obfuscated URL, as a good amount of other companies in similar spaces. One morning we found a good amount of documents indexed in Bing, as well as invoices from some of Norways largest credit card companies, e-invoice suppliers etc. We never got to the bottom of how it happened, but our theory was that Edge would send browsing history back to MS; and MS/Bing would index based on this. So this seems to be a practice that has been going on for a long time Some old articles about it: https://www-nrk-no.translate.goog/norge/fodselsnummer-fra-bronnoysundregistrene-la-apent-pa-internett-1.13516877?_x_tr_sl=no&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp https://www-nrk-no.translate.goog/norge/fodselsnummer-fra-br... https://www-nrk-no.translate.goog/norge/felleskjopet-beklager-at-kundeopplysninger-la-ute-1.13523731?_x_tr_sl=no&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp https://www-nrk-no.translate.goog/norge/felleskjopet-beklage...

senorrib 3y ago
The fault here obviously doesn't fall exclusively on Microsoft. Security by obscurity was never an effective method.

steve1977 3y ago

„Leaking“ makes this sound unintentional

iamthirsty 3y ago

I finally got an invite to join Arc today. A lot of the excitement was dulled by the fact that a well designed, well engineered app needs money to pay those designers & engineers, and just like this instance, you can never really know whats being leaked or sold, unless it's a large open source project. Yes, I know the old adage that if you're not paying for a product you are the product, and as I try and simplify my life and focus on having just a few really high-quality items in any category of life, getting screwed so often because of the need for companies to have as much information as possible updated as often as possible is really making it harder and harder to be the technology and internet enthusiast I once was.

yabatopia 3y ago
I had to look up Arc, there are different arcs. You probably mean this one, a new kind of browser: https://thebrowser.company/ https://thebrowser.company/
- Grimm665 3y ago
  Wow what is this and why does it have that vaguely petrichor-like scent of vaporware?
  - ubercore 3y ago
    It's actually pretty great, I really like it.
    - Grimm665 3y ago
      Despite my snark, I am genuinely curious after seeing a bit of what it actually looks like in their design meeting video. What are the unique features and what do you like about it?
      - type0 3y ago
        We should like it, it's the Browser of New York!

TedDoesntTalk 3y ago

> Until Microsoft completes its investigation and presumably patches this problem, we’d highly recommend turning off the “follow creators” feature in Microsoft Edge. Or, you know, just don’t use Edge???

de6u99er 3y ago

>“Microsoft Edge now has a creator follow feature that is enabled by default,” says Rivera in a conversation with The Verge. “It appears the intent was to notify Bing when you’re on certain pages, such as YouTube, The Verge, and Reddit. But it doesn’t appear to be working correctly, instead sending nearly every domain you visit to Bing.” I don't believe for a second that this is a bug.

Tozen 3y ago
Until called out on it, thinking that Microsoft was quite happy with "follow creator" sending Bing what urls users go to. Another slick trick of Edge that I have noticed is that after updates, various settings can change or new ones added, particularly those that involving privacy. So users have to always be wary and vigilant about checking all settings after any update.

mrjin 3y ago

Lol, I stopped using Edge a couple of weeks ago as after an update, it took 30+s to just switching to another tab, note that the CPU usage was below 10% and 48+GB RAM available.

NayamAmarshe 3y ago

Jobs was right. Microsoft really is the McDonald's of the software world.

winstonprivacy 3y ago

Hmm, very interesting. It sounds like with a bit of wrapper code, futexes could be used instead of mutexes? If they are genuinely faster, there are many use cases where this would be valuable. Is there a production-ready library for this? I do see the code in the article but I'm not sure I'm ready to venture into these deep waters myself.

api 3y ago

It's safe to assume that stock Windows 11 leaks every single thing you do to Microsoft. That's the point.

INeedMoreRam 3y ago
[dead]
sourcelang 3y ago
I remember opening up a new HP laptop with Windows installed, around 2016. Out of curiosity I installed Wireshark and inspected some of the outgoing packets from pre-installed software on the Windows system. Alongside the usual telemetry, I found some packets being sent to an IP registered by the US military, straight to a military base, no proxy or anything. Maybe there’s a perfectly non-nefarious explanation but that investigation sure felt like it confirmed my suspicions…
- linuxftw 3y ago
  Probably related to TLS CAs. Windows insists on phoning home to these CAs.
  - sourcelang 3y ago
    Interesting. Does this actually have any security implications or is my paranoia for nothing? In my head, “normal“ CAs used by browsers for example are held to a high standard of digital trust. Whereas trust in the US military as a CA sort of implies blind faith. But I honestly don’t feel that I know enough about TLS to know why I should trust, say, digicert or identrust, more or less than the US military.
    - linuxftw 3y ago
      The US Government issues their own certs for many agencies, so there's no commercial entity that acts as the CA. These CAs are installed by Windows just like most other CAs.
- 3y ago

LorenPechtel 3y ago

While this certainly could be innocent (checking the URLs against a list of bad actors) I certainly wouldn't trust them.

jeffbee 3y ago
It seems like checking for malicious URLs without revealing the URLs to a central authority is a long-solved problem. https://developers.google.com/safe-browsing/v4#update-api-v4 https://developers.google.com/safe-browsing/v4#update-api-v4

SoftTalker 3y ago

And Chrome leaks to Google, unless you disable it. Why is this a surprise?

classified 3y ago
It's not, but still worth saying that the spy tentacle doesn't stop spying just because it serves a different master.
webmobdev 3y ago
And all browsers leak to Google if you have search suggestion in address bar enabled ...
- SoftTalker 3y ago
  Yes, that's mainly what I was thinking of. Search suggestions, which are on by default. Chrome also has some sort of hostile site checker but that may use locally cached blacklists, I can't recall.
- Tepix 3y ago
  Not if you use another search engine.

bgun 3y ago

Product from [Company] shares user data with other product from [Company]. A shocking and newsworthy revelation. /s

classified 3y ago
Yeah, if people would just stop complaining about these totally normal and OK privacy violations, the world would be a better place. /s
- deleted 3y ago
  [deleted]
- bgun 3y ago
  Is it not totally normal and OK (and not a violation of any kind) for Microsoft to share user data with Microsoft? Fighting for user privacy is a laudable goal but in this particular case what, if any, ethical breach has occurred? As others have commented, it's like being upset that Google Search is aware of websites you visited in Chrome. Is it unethical for that to be the case?
  - garbagecoder 3y ago
    Knee-jerk Internet commentators think any packet going anywhere is a breach of their privacy which is funny because that's sort of the point of a network. For me, this particular issue isn't about privacy, it's that these companies get to make their products better using my data and I get nothing out of it. Sort of how they train their AIs. Privacy has been popularly re-defined to be "any data." Remember when people's name, address, and phone number was published in a big yellow and white book and delivered to everyone's driveway? What we should want is compensation for the use of our non-PII data and a restriction on information about us that can be used to harm us, financial, medical, etc. to be restricted. Chrome not telling Google I went to Amazon.com would be great, but Amazon knows I went there and if I use 8.8.8.8 so does Google anyway.
  - akira2501 3y ago
    One is a product I pay for. The other is a loss leading product given away by a monopoly to support their ad business. In both cases, because of these factors, yes.. I consider it to be unethical.

albert_e 3y ago

Does this apply by default to enterprise installations of MS Edge? Any way to verify this as end user and raise it to our IT folk

nazgulsenpai 3y ago
As someone in Enterprise IT, if your org is anything like mine, they don't care.

winslow 3y ago

"leaking"

deleted 3y ago

[deleted]

Datagenerator 3y ago

Seen Librewolf?

skim_milk 3y ago

At a previous SaaS startup I worked for, we stored a bunch of clients' documents somewhere on e.g. example.com/documents - which included confidential items like checks and contracts. Customers would typically opt-out of requiring authentication for a lot of these documents so they could share them with others. I noticed that when you searched for the company on Bing, you would actually see a bunch of these documents, despite nothing linking to it! Of course I updated the robots.txt and yelled at leadership for the gaping security hole, but I was very surprised to see that Microsoft would send every link you crawled back to Bing to index. Distributed web crawling!

that_guy_iain 3y ago
>Of course I updated the robots.txt and yelled at leadership for the gaping security hole I've curious how there was a security hole when a client opted out of requiring auth? If the client wants them publically available then there was no security hole. Secondly, I am wondering why you are yelling at leadership for something that seems like it was your responsibility.
- giancarlostoro 3y ago
  > I've curious how there was a security hole when a client opted out of requiring auth? If the client wants them publically available then there was no security hole. Its possible they wanted the link to be easier to share with very specific people, but not necessarily be something found on bing.
  - noja 3y ago
    Because the user expectation is that a browser won't leak their private URLs to a search engine? https://www.example.com/id/0ca6ade6b2bb1eea371d0b029f552cee/filename.pdf https://www.example.com/id/0ca6ade6b2bb1eea371d0b029f552cee/... may be "public" in the sense that it is accessible if you know the URL.
    - chasd00 3y ago

qalmakka 3y ago

Very conveniently Edge started crashing just yesterday whenever I visited gitlab, which gave me an excellent excuse to switch my work machine to Firefox. Edge is an overall nice browser, but it's less stable than plain Chrom(ium) IMHO and MS really pushes hard their nefarious features, way more than I can tolerate honestly

nicetryguy 3y ago

Also worth mentioning, it is practically impossible to remove Edge from a Win 10 (and probably 11) installation. I tried nuking everything i could find, registry entries, Trusted Installer stuff, nope, keeps reinstalling itself after every update. I gave up.

kevingadd 3y ago
It's the new ie in the sense that it provides an embeddable WebView for apps that need to securely display web content like oauth logins, so it's not realistic to remove all the files. :/

FinnKuhn 3y ago

how is "a Microsoft product sends data to a Microsoft API for a specific feature" a surprising thing, although this seems to malfunction and send data even though it shouldn't?

senko 3y ago
Are our standards/expectation of privacy so low that this is a genuine question?
feoren 3y ago
If I sold you a digital camera, would you be surprised if I was uploading every picture you took to my servers? (Without telling you, of course.) Your blasé reaction is rather worrying.
- tokai 3y ago
  It wouldn't be surprising if it was a Microsoft camera.
- FinnKuhn 3y ago
  I don't like this analogy for a number of reasons beginning with the difference between a free software that I know is internet connected and a purchased device that doesn't even need access to the internet. Let me ask this: Would you be surprised to learn that Google Chrome sends data to Google when you enter something in the task bar to give you auto complete predictions? I wouldn't. The same is also true for Microsoft Edge sending data to Microsoft Bing to enable a feature of the Webbrowser.
- LexGray 3y ago
  At this point no. Virtually every IoT device requires upload to the manufacturer’s server to get even basic functionality, which of course breaks when the server goes offline. The privacy policies when they exist virtually never promise end-to-end encryption (a promise I wouldn’t trust anyway as corners are cut and there are unlikely to be security audits), and often imply sales of data to partners. In this age of AI scraping every shred of data I suspect anything connected to the internet will be compromised in a back room deals, through lack of security, or through sub-contractors sharing what they can get their hands on. I think reactions to this are more along the lines of horrified, but it is our accepted trade off in the name of cheap products.

boxed 3y ago

Outlook leaks private URLs from emails to Bing too. Yes, that includes your password reset emails.