Hacker News Reader

Comment by biot | Hacker News Reader

  > I have configured the DD-WRT router to drop and log all
  > connection attempts via iptables...

I'd be more interested in seeing the result of letting the connections succeed while timing how long they stay open and how many bytes are sent/received. The fact that thousands of connections are opened is likely a result of retry mechanisms after the connections are dropped at the router. Perhaps the first thing Windows 10 does is let Microsoft know "this system has opted out of the following tracking: ..." so that connections to Windows Update, etc. don't end up logging additional information.

I'd also like to see a similar comparison for an average desktop Linux installation, OS X installation, and so on.

View on HN

"I'd also like to see a similar comparison for an average desktop Linux installation, OS X installation"

I agree. I'd really like to see an analysis of Android and ChromeOS. I'm glad to see Microsoft in the spotlight over tracking and analytics as this is a subject that gets far too little scrutiny from the tech community.

Tracking practices are widespread in the industry. Take Chromebooks for example, they are now used in many US schools. The kids have no choice in using these laptops, it's the adults who make the decision to deploy them (and Google that heavily promotes their use). The privacy implications of an OS that requires sign-in and then tracks every app and website you use are horrendous. Yet there's barely any scrutiny from the tech community.

We really need to apply this analysis of Windows 10 to other operating systems, especially ones that we know track you by default.

Which operating systems other than Win10 do we know track you by default?

OP gave an example: ChromeOS

Yea I know he mentions Android and ChromeOS, but I'm mostly asking where the info is to support his claim that "we know they're tracked by default". I've never come across anything yet related to ChromeOS that even comes close to the Win10 tracking by default, but it seems presumed for some reason.

I'm not very familiar with ChromeOS but I can cite an example in Android:

When you turn on Location in your Android phone, every time there is a disclaimer (unless you turn the notice off). It says that Google will collect your location data. If you decline, your phone's GPS is useless. So, in order to utilize the hardware you bought, you are forced to give up your privacy.

This is the definition of "tracked by default". Is there any hardware feature that Windows does not allow users to access if you turn off all the tracking?

I'm pretty familiar with Android and this isn't quite true. It prompts to ask if your phone can report nearby WiFi hotspots to Google and use that information to try to get a more accurate location than GPS provides.

But GPS still works. GPS even works with the WiFi and mobile radios turned off. GPS works without the Google Apps installed, and without the WiFi location being enabled.

All the android phones I've used do not let you turn on gps (even the non assisted gps) option without making you agree to data collection. It does work without a data connection but I assume they store the data till the next time you get Internet.

Edit: I read a bit about this. There is something called Google location history. It's on by default and tracks and reports your location to Google. You can turn it off (it's a bit non-obvious but not very much so). The wording is "Places you go with your devices will stop being added to your Location History map". So there, "tracked by default".

Not true.

The data collection is active only in 'High accuracy' and 'Battery saving' modes. Both these modes are services, the phone asks Google servers "I see wifi with SSID ABC and MAC 0:1:2:3:4:5, where am I?" or "I see celltower of provider 0123, with id 456, where am I?".

In 'Device only' mode, your location is determined purely by the device hardware. If anyone, it's Qualcomm who knows about you, due to AGPS request.

Then there is a separate service, Location History, that can be turned off.

>Then there is a separate service, Location History, that can be turned off.

Yes, exactly as I mentioned. And it is on by default.

It's turned on or off based on your choice in OOBE wizard. At least on Nexus and Sony devices, other vendors may do something else.

ChromeOS is mostly a cloud-based operating system. Although, there is an offline mode, apps and data reside in the 'cloud' (Google's servers). Cloud-based software makes it very easy to track users.

To use ChromeOS you must sign in with your Google account. Although you can use it as a "guest", this will limit what you can do.

Once you are signed-in, Google knows which web apps you use, including when and how often you use them. It knows (and records) the websites you visit (unless you browse constantly in private mode). It even knows when you print to your desktop printer because print jobs are routed through Google's cloud print service first.

To repeat: none of this is anonymous since you must be signed into use the OS properly. A Google account = your name, date-of-birth, gender, location and (optional) phone number. In other words, some of your most private and personal details.

In my view, this all amounts to a privacy-invasive OS that tracks you by default.

OS X also does this, even if you turn off all of its telemetry settings.

Source: Little Snitch and the log files on my OS X systems.

To the best of my knowledge the only telemetry that OSX provides is crash logs, and only if you opt into it. You could argue that spotlight's (and Safari's) web search should be included, but I disagree.

I'm curious, why wouldn't you include Safari and Spotlight?

Because they aren't metrics, but search integration. So as I understand it, they equivalent to google instant (safari literally; spotlight on the same vein) and they claim not to retain data on them.

> I'd be more interesting in seeing the result of letting the connections succeed

Or route them to an internal system with a promiscuous HTTP server that gives a 200 response to any request. One could then parse the logs to see which URLs were being requested.

Easiest way to see it on OSX is to install Little Snitch and disable all the default rules.

Reply on news.ycombinator.com