4 ms·

Unless I'm blind, the article doesn't contain any actual evidence of telemetry being sent – just a list of domains contacted, and speculation on what their purp

by p-e-w 3y ago

Unless I'm blind, the article doesn't contain any actual evidence of telemetry being sent – just a list of domains contacted, and speculation on what their purpose might be. I don't doubt that Windows collects and transmits telemetry data (hell, text editors do that nowadays), but if an analysis of that exists, it is not in this article.

Nicksil 3y ago
>Unless I'm blind, the article doesn't contain any actual evidence of telemetry being sent – just a list of domains contacted, and speculation on what their purpose might be. > >I don't doubt that Windows collects and transmits telemetry data (hell, text editors do that nowadays), but if an analysis of that exists, it is not in this article. Crikey mate; second paragraph, first sentence.
- ninepoints 3y ago
  Yes and then if you read paragraphs 3, 4, 5, etc. there's no substance on what is actually sent. We all know what Wireshark is, and what it can do, but how it was utilized here is up in the air.
  - mcpackieh 3y ago
    > there's no substance on what is actually sent. Does Microsoft provide any transparency on what is sent?
  - eimrine 3y ago
    What enhancement do you expect from the tecnical writer considering lack of sources?
    - ninepoints 3y ago
      I was replying to someone.
coldtea 3y ago
>just a list of domains contacted, and speculation on what their purpose might be Yeah, they might be playing some patty cake protocol /s
pjc50 3y ago
Yeah, this comes up over and over again: people see that connections are being made, but because it's hard (not impossible! but considerable work) to trace where they're coming from and what they actually _contain_, we're left with ambiguity. (you'd need the Windows kernel debugger and to reboot the thing in developer mode. This is a pretty niche skillset)
- capableweb 3y ago
  > This is a pretty niche skillset Is it really? Seems you need to install ~2 packages, flip some switches, edit some files/run some terminal commands, reboot and connect the debugger and you're pretty much setup for it. Seems more like something you need to read an article about, rather than a skillset per se.
  - pjc50 3y ago
    Then why isn't the output in any of these articles?
    - capableweb 3y ago
      The author is a self-described "tech journalist" and it's not really news that most of them tend to be lazy and not really dive even surface-level deep into any topics. Author probably wrote the article with a deadline approaching fast, and editor said it was good enough, so published it became.
  - addandsubtract 3y ago
    "You don't pay the plumber for banging on the pipe. You pay him for knowing where to bang."
    - capableweb 3y ago
      Cute, I read the same submission yesterday too :) But, not really applicable in this case.
- 3y ago
freeflight 3y ago
> I don't doubt that Windows collects and transmits telemetry data (hell, text editors do that nowadays), but if an analysis of that exists, it is not in this article. Such an analysis does not exist because that traffic is encrypted. Which is also the reason why using Windows 10/11 is not fully compliant with EU privacy laws in places like Germany, as there is no telling what Windows is actually phoning home. Officially Windows 10/11 can be used but only after jumping through a lot of hoops that involve turning off the telemtry and phoning home, but even then only with an "acceptable residual risk" [0] The only reason this isn't a bigger topic is because there is no realistic alternative; Everything is tailored to MS, and MS spends absurd amounts of money and effort to prevent anything from changing that. So the majority just goes with the "easiest" and most convenient solution, even when it might actullay be an "illegal" solution that enables a ton of industrial espionage. [0] https://www.heise.de/news/Datenschutzkonferenz-Hohe-Huerden-fuer-den-Einsatz-von-Windows-10-4584678.html https://www.heise.de/news/Datenschutzkonferenz-Hohe-Huerden-...
- p-e-w 3y ago
  > Such an analysis does not exist because that traffic is encrypted. ... by software that resides on the same system, with keys that are in memory on the same system. I'm not saying it's trivial to decrypt the traffic, but it's certainly possible, and much, much harder reverse engineering is routinely being performed.
  - gnomewascool 3y ago
    > with keys that are in memory on the same system I'm not sure that actually holds — the encryption keys are in memory, but the decryption keys don't necessarily have to be. The pre-encrypted payloads definitely are in memory at some point; however snatching them probably involves larger-scale reverse-engineering.
    - heinrich5991 3y ago
      If they're using standard TLS, the actual data encryption is symmetric, so the encryption keys are the decryption keys and must be in memory during the encryption process.
Springtime 3y ago
This video it's based on was from earlier in the year and lacks any proper analysis, yet got picked up by some tech sites and continues to get posted for topics which mostly just results in users bikeshedding about their Windows pet peeves. Some examples: calls a service that helps companies comply with GDPR "1984" since the analysis is superficial and almost entirely gut reactions to random domains they observed. They have no issue with one CDN they observe but take issue with a Microsoft CDN literally only because they see 'geo' in the sub-domain, when if they'd taken a moment to check it's just used to locate the nearest data center like CDNs do generally. If the video were instead, 'let's look at what comes pre-installed with Windows 11 [Home, Pro, Education?] that connects online' then it may have been a more informative video. Instead it has a lot of assumptions but little evidence about DNS queries, leaving only casual viewers thinking they've learned something.
squarefoot 3y ago
You can easily transmit information hidden in web requests. If I own a web server at somedomain.com I can run code that asks for somedomain.com/someencryptedinformation.html, and I'm sure that someencryptedinformation will appear in the server logs. Automate encoding something in that string and you can send data using simple web requests that won't trigger anything looking for connections on non standard ports. And what if connecting to domain A followed by B within 2 seconds is translated as a 0 and the other way around as a 1? You can, albeit slowly, send whatever you want just by alternating those two connections. Yes, just contacting the outside is sending information.

by p-e-w 3y ago

Nicksil 3y ago

>Unless I'm blind, the article doesn't contain any actual evidence of telemetry being sent – just a list of domains contacted, and speculation on what their purpose might be. > >I don't doubt that Windows collects and transmits telemetry data (hell, text editors do that nowadays), but if an analysis of that exists, it is not in this article. Crikey mate; second paragraph, first sentence.

ninepoints 3y ago
Yes and then if you read paragraphs 3, 4, 5, etc. there's no substance on what is actually sent. We all know what Wireshark is, and what it can do, but how it was utilized here is up in the air.
- mcpackieh 3y ago
  > there's no substance on what is actually sent. Does Microsoft provide any transparency on what is sent?
- eimrine 3y ago
  What enhancement do you expect from the tecnical writer considering lack of sources?
  - ninepoints 3y ago
    I was replying to someone.

coldtea 3y ago

>just a list of domains contacted, and speculation on what their purpose might be Yeah, they might be playing some patty cake protocol /s

pjc50 3y ago

Yeah, this comes up over and over again: people see that connections are being made, but because it's hard (not impossible! but considerable work) to trace where they're coming from and what they actually _contain_, we're left with ambiguity. (you'd need the Windows kernel debugger and to reboot the thing in developer mode. This is a pretty niche skillset)

capableweb 3y ago
> This is a pretty niche skillset Is it really? Seems you need to install ~2 packages, flip some switches, edit some files/run some terminal commands, reboot and connect the debugger and you're pretty much setup for it. Seems more like something you need to read an article about, rather than a skillset per se.
- pjc50 3y ago
  Then why isn't the output in any of these articles?
  - capableweb 3y ago
    The author is a self-described "tech journalist" and it's not really news that most of them tend to be lazy and not really dive even surface-level deep into any topics. Author probably wrote the article with a deadline approaching fast, and editor said it was good enough, so published it became.
- addandsubtract 3y ago
  "You don't pay the plumber for banging on the pipe. You pay him for knowing where to bang."
  - capableweb 3y ago
    Cute, I read the same submission yesterday too :) But, not really applicable in this case.
3y ago

freeflight 3y ago

> I don't doubt that Windows collects and transmits telemetry data (hell, text editors do that nowadays), but if an analysis of that exists, it is not in this article. Such an analysis does not exist because that traffic is encrypted. Which is also the reason why using Windows 10/11 is not fully compliant with EU privacy laws in places like Germany, as there is no telling what Windows is actually phoning home. Officially Windows 10/11 can be used but only after jumping through a lot of hoops that involve turning off the telemtry and phoning home, but even then only with an "acceptable residual risk" [0] The only reason this isn't a bigger topic is because there is no realistic alternative; Everything is tailored to MS, and MS spends absurd amounts of money and effort to prevent anything from changing that. So the majority just goes with the "easiest" and most convenient solution, even when it might actullay be an "illegal" solution that enables a ton of industrial espionage. [0] https://www.heise.de/news/Datenschutzkonferenz-Hohe-Huerden-fuer-den-Einsatz-von-Windows-10-4584678.html https://www.heise.de/news/Datenschutzkonferenz-Hohe-Huerden-...

p-e-w 3y ago
> Such an analysis does not exist because that traffic is encrypted. ... by software that resides on the same system, with keys that are in memory on the same system. I'm not saying it's trivial to decrypt the traffic, but it's certainly possible, and much, much harder reverse engineering is routinely being performed.
- gnomewascool 3y ago
  > with keys that are in memory on the same system I'm not sure that actually holds — the encryption keys are in memory, but the decryption keys don't necessarily have to be. The pre-encrypted payloads definitely are in memory at some point; however snatching them probably involves larger-scale reverse-engineering.
  - heinrich5991 3y ago
    If they're using standard TLS, the actual data encryption is symmetric, so the encryption keys are the decryption keys and must be in memory during the encryption process.

Springtime 3y ago

This video it's based on was from earlier in the year and lacks any proper analysis, yet got picked up by some tech sites and continues to get posted for topics which mostly just results in users bikeshedding about their Windows pet peeves. Some examples: calls a service that helps companies comply with GDPR "1984" since the analysis is superficial and almost entirely gut reactions to random domains they observed. They have no issue with one CDN they observe but take issue with a Microsoft CDN literally only because they see 'geo' in the sub-domain, when if they'd taken a moment to check it's just used to locate the nearest data center like CDNs do generally. If the video were instead, 'let's look at what comes pre-installed with Windows 11 [Home, Pro, Education?] that connects online' then it may have been a more informative video. Instead it has a lot of assumptions but little evidence about DNS queries, leaving only casual viewers thinking they've learned something.

squarefoot 3y ago

You can easily transmit information hidden in web requests. If I own a web server at somedomain.com I can run code that asks for somedomain.com/someencryptedinformation.html, and I'm sure that someencryptedinformation will appear in the server logs. Automate encoding something in that string and you can send data using simple web requests that won't trigger anything looking for connections on non standard ports. And what if connecting to domain A followed by B within 2 seconds is translated as a 0 and the other way around as a 1? You can, albeit slowly, send whatever you want just by alternating those two connections. Yes, just contacting the outside is sending information.