Hacker News Reader

Comment by satysin | Hacker News Reader

Is there any accurate analysis of exactly what Microsoft collects in Windows 10? I understand you cannot totally disable the telemetry (with the exception of an Enterprise version) but when put down to the "basic" level is there any capture of what is being sent? Everything I have seen is bullshit anti-Microsoft fairy tale stuff.

I understand text and voice data will be captured and sent if you use Cortana but that is pretty obvious, the same is true of Google, Bing, Siri, etc. [0]

What I want to know is when I put things at the lowest setting possible what do MS get and how often?

Edit: [0] I mean captured and sent for processing. I expect (perhaps wrongly) for it to be deleted from Microsoft's servers as soon as my request has been answered. Unlike Google which stores everything you say to Google Now for example.

View on HN

> I understand text and voice data will be captured and sent if you use Cortana but that is pretty obvious.

Not really. I was surprised both by Google storing every voice recognition sample they've ever received, and I was also surprised that people weren't totally creeped out and outraged at discovering this. Most people admit to being a little creeped out, but get over it very quickly.

Most people don't know this, and I didn't expect it either. Having used voice recognition in the past (like, 8 years ago) they were just programs that worked very badly, but they were the state of the art back then. That they now upload everything ever is recent news to me.

It's not all "bullshit anti-{bigCorp} fairy tales" if it's something people genuinely didn't expect.

IMHO, Google storing voice recognition samples does freak me out, especially because voice recognition is automatically activated by "OK Google" and maybe other triggers and maybe depending on version or the hardware used it's not that good - for example when my wife plays songs on her LG phone, she gets Google's voice recognition activated erroneously all the time.

So basically random bugs can get your very private conversations recorded on servers that can be under the control of state agencies and disgruntled employees, possibly stored forever? That's a reason to freak out really.

"I will tell you my secret plans to world domination, but first need you to do something for me. OK? Google this for me and ..."

>IMHO, Google storing voice recognition samples does freak me out, especially because voice recognition is automatically activated by "OK Google"

I've had google search activate a few times by my wife watching TV in the background and once when it was sitting in front of my speakers while listening to a podcast. We've tried going back and replaying the same bits but can never get it to activate in the same place twice. Still, it is strange to be sitting there and suddenly have the Google mic pop up.

And how are we sure it isn't recording when you're NOT saying OK Google? :-)

Is there an analogue for a piece of scotch tape over the webcam for the paranoid (Zuckerbergs) of the world?

I think battery life and 4G network bandwidth are constraints for now. If it would record and stream data while in standby, battery wouldn't last for more than a few hours and would visibly consume your allocated bandwidth.

What they do is to introduce a dedicated processor that listens for these keywords and that is supposed to wake the phone up on detection. The danger of course is having that processor activate the phone on keywords other than "OK Google". And it doesn't even have to be on purpose. As I said, my wife's phone detection is totally broken for some reason.

It doesn't need to stream all the time, just record. The traffic is encrypted end-to-end anyway, you can only do an analysis on the size relative to how much time it's been idle.

This. 30* 24* 3600* 22000/(8e9) = 7.8 gigabytes per month for 24/7 surveillance at the bare minimum (AFAIK) of 22 kbps mono audio.

2.83GB.

Voice sounds fine at 8kbps. Reduce it even further if all you need is to understand what's being said.

Still, that would light up your data usage like a christmas tree.

Do you connect to wifi at least once a month?

You can also show per-app data usage over wifi on Android (it's a single click away on stock Android). If Google Now was transferring 2.8 GB of data each month, someone would have noticed. Also, the high battery usage argument.

If they were streaming spy data like that, I suspect that they wouldn't report the data usage. IMO, battery life is the strongest indicator that they aren't.

Who says it would use up your data usage? Of course this would require the network operator to allow it but it isn't anywhere near impossible to do without the user knowing.

That assumes people are speaking all the time -- the onboard processor can in fact translate most of the speech into text you know.

You only need to transmit if you detect frequencies in the range of human speech, and only in batches that can be masked with other data transfers.

I think if this were happening, people would eventually be able to tell by watching the network traffic. You may not be able to decode the network traffic, but if you run it through an analyzer like wireshark, while you say "OK, Google" and you see the bandwith increase, then if you see a similar bandwidth pattern other times you might have a clue that its recording. Of course that assumes they aren't saving to the disk and sending it later.

>and disgruntled employees,

that at least does not really worry me. Google is very paranoid over who can access customer data from the inside.

Government access is way more of an issue IMO. I would be way more creeped out by somebody going over my whole gmail history than my searches (audio or not) though.

Ah I should clarify I was talking about it being "captured and sent" as part of Cortana using "the cloud" to do the "heavy lifting" on the server. I wasn't talking about it being stored. I do not know if Cortana saves everything you say like Google does? If it does I cannot find any option to view and delete this data like I can in the Google Dashboard.

And yes I agree it is disturbing that so much is saved. I remember the first time I opened the audio recordings area in Google Dashboard and my jaw hit the floor at just how much it had captured. Thankfully you can delete it easily. Well delete it from view, I don't believe for a second it is truly gone.

As far as I understand it, there is no way to know what Microsoft sends, unless you work at Microsoft.

As such, the "bullshit anti-Microsoft fairy tale stuff" is just as valid as whatever you believe that they send. Especially also under the connotation, that Microsoft does actually reserve the right to send anything they want in their Privacy Statement.

And we shouldn't treat privacy as "innocent until proven guilty". If they cannot provide a lower boundary where you have a guarantee that they respect it, then we should assume the worst.

> just as valid as whatever you believe that they send

Just because multiple things are possible in this case, that doesn't inherently mean all things are equally plausible. Otherwise we'd have to pretend that the lizard people conspiracy theory is as likely as anything else that has yet to be proven. Your premise drops the critical consideration of plausibility and declares all possibilities equal, no matter how fantastical.

That's the same logic error that leads people to believe one roulette wheel spin influences the next, and that if you have two possibilities then the odds must always be 50/50 regardless of context.

Right, I didn't expect someone to put my comment through their formal logic interpreter which doesn't make any assumptions about context and meaning whatsoever.

What I meant was that any bullshit anti-Microsoft fairy tale stuff, which is not trivially disprovable as physically impossible or clearly illogical for Microsoft to do, is just as valid as whatever he/she believes. That is, as long as his/her beliefs are also within this same range of thinkable things that Microsoft could do, as otherwise those other claims would actually be more valid.

Why would Microsoft reserve the right to upload absolutely anything they want from your computer if they had no plans of uploading things you don't expect them to?

You can claim that Microsoft spying on their clients again¹ is a fantastical proposition all you want. It does not make it so.

1 - They were caught a few times doing that already, and even stealing IP.

But why just target Microsoft? What about Google? Apple?

Big data is huge and there is no end in sight as far as growth goes! Telemetry is a big success. And we're talking about regular usage now. Hospitals use new state of the art EMR software with all kinds of telemetry built it as well.

People do target Google and Apple too.

Is this a calculated derailment technique? Why MS? Because MS is the subject being discussed in this post, is why. Wanna talk Apple? Open up an Apple privacy related article's comments and you'll read the same concerns accompanied by more red herrings asking 'why just Apple?'. Repeat for Goggle, if you need further clarification.

Why not Verizon? Why not NSA? Why not the traffic strips counting cars? why not the ticket guy @ the cinema?

Let's rephrase that, why isn't the French government going after Google, Apple, and others for telemetry?

They have. Repeatedly. And for whatever reasons most are unaware of, they appear to be getting away with their actions more or less. Why? I don't know, ask a lawmaker. Or better yet, ask a lobbyist. Even better, ask the DHS PAC:

Edit: US example, I have no idea how France government works. http://www.boilingfrogspost.com/2011/11/30/bfp-report-meet-t...

Google; no idea, but they're not in the desktop market or used as a business OS exclusively so that may be why.

Apple; there's a toggle switch to turn off telemetry and it works. But it's also not a primary business operating system and doesn't hold the market capital the same way either.

If the country was running on apple products for mail, appointment making, meetings, and all national work was done on apple OS, then it would be open to the same scrutiny. But even so, they've been good about keeping their nose out of your operating system.

> Open up an Apple privacy related article's comments

Because people post those to HN all the time.

Or not, because that's not as fun as bashing MS.

MS, Apple, Google... distinguishing the parties from the actions serves only to muddy the argument for privacy over monetization with red herrings.

Thank you for stating the obvious! I'm getting tired of people getting away with hijacking the conversation.

You could certainly start by adding a lines to your /etc/hosts file:

  google.com 0.0.0.0

Besides they not being the subject, Apple and Google do not reserve the right to upload anything accessible from your computer into their servers without some kind of authorization. Yes, some times it's opt-out, but it's still different.

So, why are you trying to include them?

but we do know what they are logging, and they are logging everything and the kitchen sink compared to retail Win 7 install.

> Is there any accurate analysis of exactly what Microsoft collects in Windows 10?

Microsoft could easily demystify this by writing detailed document detailing what is being sent but unfortunately there isn't one. Even if it was, part of the outrage is that some most egregious options are opt-out and easy to miss if you are not technically inclined and just went through unintended upgrade.

https://technet.microsoft.com/en-us/itpro/windows/manage/con...

Most lists are open-ended, they will start with "such as" so you can't be sure there isn't anything more. Even then under basic level I fail to see why they'd need to take my IMEI number or device attributes of presumably every piece of hardware I connect to my computer.

Then there's another group of settings related to privacy, the most troublesome is "Send Microsoft info about how I write" which seems intentionally vague about what it does, but it's been suggested that it sends keystrokes to Microsoft and we know this feature is included in Windows due to this bit from privacy statement: "Microsoft collects and uses data about your speech, inking (handwriting), and typing on Windows devices to help improve and personalize our ability to correctly recognize your input."

I think it is to allow drivers to be looked for on Windows Update.

> "Send Microsoft info about how I write"

I obviously have no more definitive insight than you, but it seems most people agree that this refers to inking. It's data about handwriting and character recognition. We can't say for certain that it doesn't include information about keystrokes and sentence structures/patterns, but it's the most obvious. Occam, Hanlon, and a bunch of other razor manufacturers and all that jazz.

I wonder if the safer approach at this point is to assume that Microsoft can collect anything, including keystrokes, audio/video input, screen captures, etc. until proven otherwise.

Further, and something I don't see discussed as much, is their apparent ability to force through whatever "improvements" they want to this tracking via their now-impossible-to-fully-disable Windows Updates system.

Is it entirely unreasonable to expect them to use that for targeted delivery of payloads on "terror suspects" or what not? I realize that might be a bit in the tin-foil hat territory, but until proven otherwise, I feel like we need to assume that capability now exists.

You and a large number of others would like to know what is in the telemetry. If I recall correctly, the problem is that it's all TLS wrapped with pinned certs (no source on that at the moment). You'd be doing the internet community a favour if you figured out a way to decode the "telemetry" packets to see what's actually in there.

Yeah network capture isn't going to be any use as it is all encrypted. I was wondering if anyone had registry and file system captures on what was being collected, if that is even possible. It wouldn't surprise me to see Microsoft using private APIs to collect data and bypass monitoring tools. If they are it would look even worse though.

All of the FUD and other misinformation from random people on YouTube is annoying. I just want a straight answer.

The "private API, telemetry data doesn't go the normal route through the stack" is claimed in the most recent release of "Canard PC Hardware" (n°29) which is a half decent french computer magazine.

I'm still kind of surprised this hasn't been reverse-engineered. It ought to be possible to find the process that's doing it and hijack its use of the crypto DLLs to record what data is passed in.

Do you still get telemetry data when it's run in a VM?

> I'm still kind of surprised this hasn't been reverse-engineered.

Yeah. Maybe another sign of Microsoft's increasing lack of relevance if no enterprising hacker cares to investigate it.

I administer a network of about 100 computers. One night I was monitoring the logs for the web proxy on the front of the network. It was around 2 AM and no one was there but me, so I was surprised to see dozens of connections streaming by with URLs like microsoft.com/userdata.aspx. I figured out it was the one box on the network that upgraded itself to Windows 10. Very disconcerting.

> I figured out it was the one box on the network that upgraded itself to Windows 10. Very disconcerting.

Sounds like an oversight by IT. On corporate/enterprise network the Windows 10 upgrade should be disabled through group policy.

"IT" is me :) And yes it was an oversight, the rest of the network is comprised of thin clients running RDP, this was the one regular Windows box. Since replaced.

This is a good starting point.

https://technet.microsoft.com/en-us/itpro/windows/manage/man...

I'm planning on a getting a null modem and connecting a Windows 10 box to it, and also do some kind of TCPDUMP on the wire. I'm hoping this will be easy to do.

I've actually read the privacy policy that is linked from the Windows 8.1 operating system. It's pretty frighting what they collect. They're browser is basically spyware with the things it collects.

What I want to know is this:

If I use Chrome, or Firefox, are they still somehow collecting my browsing data?

I know that IE is actually built into the Windows operating system.

> I'm planning on a getting a null modem and connecting a Windows 10 box to it, and also do some kind of TCPDUMP on the wire. I'm hoping this will be easy to do.

Actually seeing everywhere a local machine is sending data to is easy. Figuring out what it is sending is significantly harder if the traffic is encrypted in transit, which Windows 10 telemetry is.

_EVERYTHING_

every mouse click, every letter typed, every program installed, timestamps of start/shutdown of every executable, serial number of every usb drive plugged in, etc etc etc

Do you have a source on which this rather strong claim is based?

Windows 10 telemetry is encrypted. Anyone can state anything about what's sent. Non one knows for sure. Do have any evidence that is only sent what Microoft states it would? Trust but verify.

All the things I listed are logged in W10, and most of them were never logged in W7/W8.

install W10 and watch your total host writes (for example crystaldiskinfo) per day just browsing the web for couple of days. It will average ~5-10GB/day, most of it is logs.

too late to edit, people thing im lying/joking/trolling. Ever wondered whats in C:\Windows\System32\LogFiles\WMI\RtBackup ? you cant look inside, system only. Performance Monitor > Data Collector Sets > Event Trace Sessions will give you an idea.

> you cannot totally disable the telemetry (with the exception of an Enterprise version)

Are we sure that the Enterprise version doesn't send anything ? Honestly I'd be ready to pay a premium for having an otherwise good OS respect my privacy.

The enterprise edition allows you to disable more telemetry than the other versions, but it still sends some data back.

There is currently no Microsoft-endorsed way to disable all telemetry, no matter how much money you pay, or which version of the software you buy.

I'm excited by France's decision. I hope the telemetry-free version of Windows 10 will be available outside of France, because I'd happily pay a bunch of money for it.

As it stands, I'm stuck on Windows 7 because I don't like the UI in Windows 8, and I'm not a fan of the telemetry in Windows 10. I've only run into a handful of apps that don't work because my OS isn't compatible with very new versions of DirectX/.NET, but these problems will only become more common with time.

You do realize you are missing out on huge performance boost by not upgrading to 8 just because you don't like the UI, right?

Yes, I do. I have a hard enough time with the UI that I'm willing to accept a performance penalty.

I'm colorblind, and the flat design makes it very hard for me to figure out what's clickable. Things like borders, shadow, and shading provide valuable visual hints about which parts of the UI can be interacted with. I've heard that Windows 10 has walked back some of the more problematic design changes.

Oh, come on! There is no huge performance boost. In fact, based on most properly done benchmarks, there isn't any performance boost at all!

The whole "myth" of a performance boost probably started simply because they added a new startup mode in W8, called "Fast Startup", which is basically just partial hibernation. So even saying that it boots faster isn't correct; regular boot, sleep and hibernation are still just as fast as they were on W7.

Reply on news.ycombinator.com