4 ms·

I had some very technical friends be incredibly surprised by the Edge form thing, I think that is not sufficiently called out! They send any text you type in a

by ctoth 1y ago

I had some very technical friends be incredibly surprised by the Edge form thing, I think that is not sufficiently called out! They send any text you type in a form to their AI cloud and hold on to it for 30 days. Any form. On any website. What the actual fuck?

smokel 1y ago
This is only true if you enable extended spell checks, which makes some sense. By default, no form data is sent to Microsoft AFAIK. Note that the same holds for Google Chrome.
- deleted 1y ago
  [deleted]
- atq2119 1y ago
  In what world does holding the user's private data for 30 days make sense for a spell checker? Even sending the data at all is sad. We've had offline spell checking for decades.
  - perching_aix 1y ago
    For the same reason Grammarly does it too, I'd assume.
  - justsomehnguy 1y ago
    To track when the user corrects it. Otherwise you can't adapt if somehow the correction is not what the user wanted. If there are a bunch of these corrections you know something is wrong there. IMO 30 days is quite modest and if this is properly anonymized.. Edit: dear HN user who decided to silently downvote - you could do better by actually voicing your opinion
    - perching_aix 1y ago
      > dear HN user who decided to silently downvote - you could do better by actually voicing your opinion Sure, I'll bite. Let's address the obvious issue first: what you're saying is speculation. I can only provide my own speculation in return, and then you might or might not find it agreeable, or at least claim either way. And there will be nothing I can do about it. I generally don't find this valuable or productive, and I did disagree with yours, hence my silent downvote. But since you're explicitly asking for other people's speculation, here I go. Advanced "spellchecking" necessitates the usage of AI, as natural languages cannot ever be fully processed using just hard coded logic. This is not an opinion, you learn this when taking formal languages class at university. It arises from formal logic only being able to wrangle formal logic abiding things, which natural languages aren't (else they'd be called formal languages). What the opinion is, and the speculation is, is that this is what the feature kicks off when it sends over input data to MS's servers for advanced "spellchecking", much like what I speculate Grammarly does too. Either that, or these services have some proprietary language engine that they'd rather keep on their own premises, because why put your moat out there if you don't strictly have to. Technologically speaking, at this point it might be possible to do this locally, on-device now. This further didn't use to be the case I believe (although I do not have sources on this), and so this would be another reason why you'd send people's inputs to the shadow realm.
      - demarq 1y ago
        It’s hard to read writing packed with defensive clauses. Better to say what you need to say. Leave the defense for the occasion someone misunderstood what you meant to say.
        perching_aix 1y ago
        It's further pretty hard to write like this, but I still prefer it over getting trivially checkmated by ill meaning people, and over being misinterpreted silently and that causing issues downstream. It's at this point an instinctual defense mechanism, that I've grown to organically develop in the low-trust environments that are forums like this.
        throw10920 1y ago
    - deleted 1y ago
      [deleted]
  - Xorlev 1y ago
    This is often (though not always) blanket statement. Logs are always generated, and logs include some amount of data about the user, if only environmental. It's quite plausible that the spellchecker does not store your actual user data, but information about the request, or error logging includes more UGC than intended. Note: I don't have any insider knowledge about their spellcheck API, but I've worked on similar systems which have similar language for little more than basic request logging.
    - HeavyStorm 1y ago
      Pii is stored _at most_ for 30 days.
- perching_aix 1y ago
  Reminds me to a video I saw on YouTube from the "PC Security Channel", who was utterly flabbergasted that the Start Menu would send all keypresses inputted into its search bar to MS. They had searching on the web enabled... Pretty hard to search the web using Bing without sending along a search term.
  - lucumo 1y ago
    Stuff like that and the one you replied to are why I stopped caring. The outrage is so often complete and utter nonsense that my default response is disbelief.
    - freeone3000 1y ago
      It came enabled by default. It is not as if this setting was searched for, then enabled, then had some unintended consequence - taskbar searches used to not search the internet, then they did.
      - perching_aix 1y ago
        Which would be a perfectly fine thing to take issue with. It just also wouldn't be quite as eye-catching as misleadingly portraying the thing as now being a keylogger.
        deleted 1y ago
        [deleted]
        troupo 1y ago
        It is essentially a keylogger. Enabled silently when it wasn't enabled (or didn't exist previously) The purpose of a system is what it does, after all
        perching_aix 1y ago
        I disagree. Being covert and having access to user input are necessary criteria for a keylogger, but not sufficient. They also have to, well, log. And since keyloggers are a kind of malware, using these logs for malicious purposes is also implied, and so is that the data would be tied to your identity. They also tend to operate all the time, rather than just in specific contexts. But the criterion of "having access to user input" is also necessary for goofy unneeded features like showing web search results in the Start Menu though, which they shove down people's throat like they do with every other feature their product team thinks is a great idea (explaining the "being covert" bit), at which point you have a complete, non-malicious explanation for the entire thing. The reasonable thing to do then is to apply Hanlon's razor, at which point no, it's no longer reasonable to believe or portray it to be a keylogger anymore. Not essentially, not otherwise. Not only that, but the YouTuber in question made this portrayal knowing full well that it's impossible for them to actually properly demonstrate this feature doubling as a keylogger, as they have no access to the server side. They relied on people being gullible enough to simply not grasp this, and leveraged people's preexisting privacy concerns to farm views. Having the capability to engage in crime doesn't make a criminal. Imagine if I portrayed 107M (!) of the 340M residents of the U.S. as a criminal because they own a gun, despite knowing full well that gun ownership sensibilities are just fundamentally different over there.
- foolswisdom 1y ago
  What setting is this? I can only find "Enable machine learning powered autofill suggestions" which seems to have defaulted to on.
  - perching_aix 1y ago
    Here you go, from the horse's mouth: https://www.microsoft.com/en-us/edge/learning-center/improve-writing-and-grammar https://www.microsoft.com/en-us/edge/learning-center/improve... Note that this is from 2023. Their legal docs, last updated in 2024, claim a bit different: https://learn.microsoft.com/en-us/legal/microsoft-edge/privacy https://learn.microsoft.com/en-us/legal/microsoft-edge/priva... > By default, Microsoft Edge provides spelling and grammar checking using Microsoft Editor. When using Microsoft Editor, Microsoft Edge sends your typed text and a service token to a Microsoft cloud service over a secure HTTPS connection. The service token doesn't contain any user-identifiable information. A Microsoft cloud service then processes the text to detect spelling and grammar errors in your text. All your typed text that's sent to Microsoft is deleted immediately after processing occurs. No data is stored for any period of time.
- deleted 1y ago
  [deleted]
Teever 1y ago
Something I heard a while back but have never had confirmed is that the Nvidia driver sends the content of every window title to Nvidia. Does anyone know if that is true?
- morkalork 1y ago
  There was a smart tv that did that with the titles of any media played too wasn't there?
  - heavyset_go 1y ago
    You can safely assume the same is happening with streaming sticks/boxes
- svnt 1y ago
  This was when you had to create an account for GeForce Experience and they started sending crash stats. Some people checked it with wireshark at the time and didn’t find anything other than what was stated. [0] 0: https://gamersnexus.net/industry/2672-geforce-experience-data-transfer-analysis https://gamersnexus.net/industry/2672-geforce-experience-dat...
IgorPartola 1y ago
Whoa how is this not all over the news at all times?
- NewJazz 1y ago
  People are tired of hearing about it. They don't feel like they can do anything about it.
- saparaloot 1y ago
  The caring cohort has mortages and kids
  - jbaber 1y ago
    And Linux for desktop is finally easy enough for those of us with both. Microsoft ordered me to buy a new computer for Win 11, so I took said kids to Microcenter, asked for a machine whose specs could play a particular steam game on Linux, returned to my mortgage, installed Ubuntu and haven't given Windows a second thought in months.
- fkrkrkgkgk 1y ago
  Anyone remember when Ubuntu sent every keystroke to amazon?
  - aspenmayer 1y ago
    Richard Stallman probably. Hopefully EFF. https://www.omgubuntu.co.uk/2016/01/ubuntu-online-search-feature-disabled-16-04 https://www.omgubuntu.co.uk/2016/01/ubuntu-online-search-fea...
  - pas 1y ago
    yes, and it was a correct outrage, and the solution was also nice and easy (remove this modular thing instead of switch to FreeBSD) and importantly it seems that Canonical/Ubuntu is not doing something like that right now, whereas MSFT is all in on online only mode.
- 1y ago
Lu2025 1y ago
Any form meaning passwords too?
- perching_aix 1y ago
  Looked into it, the answer seems like it can be both a yes or a no, depending on the website and user actions. By default, when you implement a form that takes a password, you (the developer) are going to be using the "input" HTML element with the type "password". This element is exempt from spellchecking, so no issues there. However, many websites also implement a temporary password reveal feature. To achieve this, one would typically change the type of the "input" element to "text" when clicking the reveal button, thereby unintentionally allowing spellchecking. You (the developer) can explicitly mark an element to be ineligible for spellchecking by setting the "spellchecking" attribute to "false", remediating this quirk: https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Global_attributes/spellcheck https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/... You (the developer) can of course also just use a different approach for implementing a password reveal feature. As the MDN docs remark, this infoleak vector is known as "spelljacking".
IlikeKitties 1y ago
[flagged]
tspivey 1y ago
I was surprised by this. I don't use Edge much, and I don't remember being asked about it.

by ctoth 1y ago

smokel 1y ago

This is only true if you enable extended spell checks, which makes some sense. By default, no form data is sent to Microsoft AFAIK. Note that the same holds for Google Chrome.

deleted 1y ago
[deleted]
atq2119 1y ago
In what world does holding the user's private data for 30 days make sense for a spell checker? Even sending the data at all is sad. We've had offline spell checking for decades.
- perching_aix 1y ago
  For the same reason Grammarly does it too, I'd assume.
- justsomehnguy 1y ago
  To track when the user corrects it. Otherwise you can't adapt if somehow the correction is not what the user wanted. If there are a bunch of these corrections you know something is wrong there. IMO 30 days is quite modest and if this is properly anonymized.. Edit: dear HN user who decided to silently downvote - you could do better by actually voicing your opinion
  - perching_aix 1y ago
    > dear HN user who decided to silently downvote - you could do better by actually voicing your opinion Sure, I'll bite. Let's address the obvious issue first: what you're saying is speculation. I can only provide my own speculation in return, and then you might or might not find it agreeable, or at least claim either way. And there will be nothing I can do about it. I generally don't find this valuable or productive, and I did disagree with yours, hence my silent downvote. But since you're explicitly asking for other people's speculation, here I go. Advanced "spellchecking" necessitates the usage of AI, as natural languages cannot ever be fully processed using just hard coded logic. This is not an opinion, you learn this when taking formal languages class at university. It arises from formal logic only being able to wrangle formal logic abiding things, which natural languages aren't (else they'd be called formal languages). What the opinion is, and the speculation is, is that this is what the feature kicks off when it sends over input data to MS's servers for advanced "spellchecking", much like what I speculate Grammarly does too. Either that, or these services have some proprietary language engine that they'd rather keep on their own premises, because why put your moat out there if you don't strictly have to. Technologically speaking, at this point it might be possible to do this locally, on-device now. This further didn't use to be the case I believe (although I do not have sources on this), and so this would be another reason why you'd send people's inputs to the shadow realm.
    - demarq 1y ago
      It’s hard to read writing packed with defensive clauses. Better to say what you need to say. Leave the defense for the occasion someone misunderstood what you meant to say.
      - perching_aix 1y ago
        It's further pretty hard to write like this, but I still prefer it over getting trivially checkmated by ill meaning people, and over being misinterpreted silently and that causing issues downstream. It's at this point an instinctual defense mechanism, that I've grown to organically develop in the low-trust environments that are forums like this.
      - throw10920 1y ago
  - deleted 1y ago
    [deleted]
- Xorlev 1y ago
  This is often (though not always) blanket statement. Logs are always generated, and logs include some amount of data about the user, if only environmental. It's quite plausible that the spellchecker does not store your actual user data, but information about the request, or error logging includes more UGC than intended. Note: I don't have any insider knowledge about their spellcheck API, but I've worked on similar systems which have similar language for little more than basic request logging.
  - HeavyStorm 1y ago
    Pii is stored _at most_ for 30 days.
perching_aix 1y ago
Reminds me to a video I saw on YouTube from the "PC Security Channel", who was utterly flabbergasted that the Start Menu would send all keypresses inputted into its search bar to MS. They had searching on the web enabled... Pretty hard to search the web using Bing without sending along a search term.
- lucumo 1y ago
  Stuff like that and the one you replied to are why I stopped caring. The outrage is so often complete and utter nonsense that my default response is disbelief.
  - freeone3000 1y ago
    It came enabled by default. It is not as if this setting was searched for, then enabled, then had some unintended consequence - taskbar searches used to not search the internet, then they did.
    - perching_aix 1y ago
      Which would be a perfectly fine thing to take issue with. It just also wouldn't be quite as eye-catching as misleadingly portraying the thing as now being a keylogger.
      - deleted 1y ago
        [deleted]
      - troupo 1y ago
        It is essentially a keylogger. Enabled silently when it wasn't enabled (or didn't exist previously) The purpose of a system is what it does, after all
        perching_aix 1y ago
        I disagree. Being covert and having access to user input are necessary criteria for a keylogger, but not sufficient. They also have to, well, log. And since keyloggers are a kind of malware, using these logs for malicious purposes is also implied, and so is that the data would be tied to your identity. They also tend to operate all the time, rather than just in specific contexts. But the criterion of "having access to user input" is also necessary for goofy unneeded features like showing web search results in the Start Menu though, which they shove down people's throat like they do with every other feature their product team thinks is a great idea (explaining the "being covert" bit), at which point you have a complete, non-malicious explanation for the entire thing. The reasonable thing to do then is to apply Hanlon's razor, at which point no, it's no longer reasonable to believe or portray it to be a keylogger anymore. Not essentially, not otherwise. Not only that, but the YouTuber in question made this portrayal knowing full well that it's impossible for them to actually properly demonstrate this feature doubling as a keylogger, as they have no access to the server side. They relied on people being gullible enough to simply not grasp this, and leveraged people's preexisting privacy concerns to farm views. Having the capability to engage in crime doesn't make a criminal. Imagine if I portrayed 107M (!) of the 340M residents of the U.S. as a criminal because they own a gun, despite knowing full well that gun ownership sensibilities are just fundamentally different over there.
foolswisdom 1y ago
What setting is this? I can only find "Enable machine learning powered autofill suggestions" which seems to have defaulted to on.
- perching_aix 1y ago
  Here you go, from the horse's mouth: https://www.microsoft.com/en-us/edge/learning-center/improve-writing-and-grammar https://www.microsoft.com/en-us/edge/learning-center/improve... Note that this is from 2023. Their legal docs, last updated in 2024, claim a bit different: https://learn.microsoft.com/en-us/legal/microsoft-edge/privacy https://learn.microsoft.com/en-us/legal/microsoft-edge/priva... > By default, Microsoft Edge provides spelling and grammar checking using Microsoft Editor. When using Microsoft Editor, Microsoft Edge sends your typed text and a service token to a Microsoft cloud service over a secure HTTPS connection. The service token doesn't contain any user-identifiable information. A Microsoft cloud service then processes the text to detect spelling and grammar errors in your text. All your typed text that's sent to Microsoft is deleted immediately after processing occurs. No data is stored for any period of time.
deleted 1y ago
[deleted]

Teever 1y ago

Something I heard a while back but have never had confirmed is that the Nvidia driver sends the content of every window title to Nvidia. Does anyone know if that is true?

morkalork 1y ago
There was a smart tv that did that with the titles of any media played too wasn't there?
- heavyset_go 1y ago
  You can safely assume the same is happening with streaming sticks/boxes
svnt 1y ago
This was when you had to create an account for GeForce Experience and they started sending crash stats. Some people checked it with wireshark at the time and didn’t find anything other than what was stated. [0] 0: https://gamersnexus.net/industry/2672-geforce-experience-data-transfer-analysis https://gamersnexus.net/industry/2672-geforce-experience-dat...

IgorPartola 1y ago

Whoa how is this not all over the news at all times?

NewJazz 1y ago
People are tired of hearing about it. They don't feel like they can do anything about it.
saparaloot 1y ago
The caring cohort has mortages and kids
- jbaber 1y ago
  And Linux for desktop is finally easy enough for those of us with both. Microsoft ordered me to buy a new computer for Win 11, so I took said kids to Microcenter, asked for a machine whose specs could play a particular steam game on Linux, returned to my mortgage, installed Ubuntu and haven't given Windows a second thought in months.
fkrkrkgkgk 1y ago
Anyone remember when Ubuntu sent every keystroke to amazon?
- aspenmayer 1y ago
  Richard Stallman probably. Hopefully EFF. https://www.omgubuntu.co.uk/2016/01/ubuntu-online-search-feature-disabled-16-04 https://www.omgubuntu.co.uk/2016/01/ubuntu-online-search-fea...
- pas 1y ago
  yes, and it was a correct outrage, and the solution was also nice and easy (remove this modular thing instead of switch to FreeBSD) and importantly it seems that Canonical/Ubuntu is not doing something like that right now, whereas MSFT is all in on online only mode.
1y ago

Lu2025 1y ago

Any form meaning passwords too?

perching_aix 1y ago
Looked into it, the answer seems like it can be both a yes or a no, depending on the website and user actions. By default, when you implement a form that takes a password, you (the developer) are going to be using the "input" HTML element with the type "password". This element is exempt from spellchecking, so no issues there. However, many websites also implement a temporary password reveal feature. To achieve this, one would typically change the type of the "input" element to "text" when clicking the reveal button, thereby unintentionally allowing spellchecking. You (the developer) can explicitly mark an element to be ineligible for spellchecking by setting the "spellchecking" attribute to "false", remediating this quirk: https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Global_attributes/spellcheck https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/... You (the developer) can of course also just use a different approach for implementing a password reveal feature. As the MDN docs remark, this infoleak vector is known as "spelljacking".

IlikeKitties 1y ago

[flagged]

tspivey 1y ago

I was surprised by this. I don't use Edge much, and I don't remember being asked about it.