Hacker News Reader

So enough software information to know everything you do, and enough hardware information to fingerprint you.

How in the hell can this just be called analytics?

This level of data isn't anonymous. It can't be.

If another piece of software did this, Microsoft would label it spyware and Windows Defender would kill it.

Yet, they feel fine doing this with an OS that they actually sell. It's not even crap freeware. You pay to have your every move watched.

> This level of data isn't anonymous. It can't be.

is there some big list of the hardware I have bought? If not, sure, they can fingerprint me but I don't see how it de-anonymizes me.

I'm not sure that they do this, but all it would take is for it to be tied to the license key you bought from microsoft.

Which is conveniently taken care of when you sign in using your Microsoft account.

If you get enough info... and compare it to someone else's set of info... there is going to be an intersecting set of information.

Combine that with unique combinations... and you get an increasing confidence of who the end user is.

It's why they suggest you don't "full screen" browsers when using tor... Stuff like browser sizes can identify you:

https://security.stackexchange.com/questions/102133/how-can-...

It's easy to tell that if a custom screen size can identify you... what will other unique traits do?

De-anonymization is incredibly easy (bordering on trivial) with any rich data set. For example, 87% of the US population is uniquely identifiable by their combination of DoB, zip code, and sex [1]. The richer a dataset is, the easier it is to de-anonymize. This is a pretty rich dataset.

[1] http://latanyasweeney.org/work/identifiability.html

Give up your name in any transaction and bye bye your anonymity.

Between browsing, searching, Android phone telemetry, and GMail, Google already has better than that level of data on pretty much everyone already.

https://en.wikipedia.org/wiki/Whataboutism

Pointing out that Google/Android sucks just as hard doesn't excuse Microsoft.

aka, what dandelion_lover said.

> > "the number of crashes or hangs, and application state change details, such as how much processor time and memory were used, and the total uptime for an app."

> To e.g. determine when you used the TOR browser, since the difference in uptime between two time points is how much it was up during that interval.

Having personally talked with Microsoft engineers who handle what this data is used for, I can tell you they take PII very seriously and per user details aren't being shared with 3rd parties (at present). Could they be misusing this? Or start selling it? Yes, but it would be an incredibly dumb idea from a brand value perspective, and I trust them to at least protect that. (I do honestly think that like most people, Microsoft employees are well-meaning individuals with good intentions)

What is this data used for? The most common use is to tell a large software developer "you have a memory leak in version 3.1.x when running on 4th gen intel CPUs with driver version 11.3" or similar. So companies with wide install bases (Oracle, IBM, other Microsoft divisions, etc) can fix issues which impact literally millions of users.

If anyone reading this has ever received this sort of Microsoft communication about your software, could you share your experiences?

> Having personally talked with Microsoft engineers who handle what this data is used for, I can tell you they take PII very seriously and per user details aren't being shared with 3rd parties (at present). Could they be misusing this? Or start selling it? Yes, but it would be an incredibly dumb idea from a brand value perspective, and I trust them to at least protect that. (I do honestly think that like most people, Microsoft employees are well-meaning individuals with good intentions)

Being an American company, you also have to worry about Microsoft being compelled to disclose per-user details with law enforcement or the intelligence community. They have no choice when it comes to this, so allowing them to have this data at all is dangerous.

>it would be an incredibly dumb idea from a brand value perspective

Imagine how damaging it would be to their brand value if they put ads in the main OS interface.

> Microsoft employees are well-meaning individuals with good intentions

Then let me disable this telemetry completely, I'm fed-up with people that know better than me what's good for me.

ah, don't worry, if Google can't protect their intellectual property, I'm sure Microsoft can protect your PII!

It's typically systems and corporate structures that are the problem not individuals.

thanks for your input in this conversation. thats really informative.

i was being serious, i thought that was really helpful input.

Thanks dude.

While (like many here) I'm very privacy oriented, this is a situation where Occam's Razor applies.

https://en.wikipedia.org/wiki/Occam%27s_razor

> I can tell you they take PII very seriously

I'm sure they do, but that still doesn't make me trust them or feel any better about this.

This is awful, but if you use a smartphone, this is about the same telemetry that has been collected on you for years. Microsoft is just keeping up with the times.

There was a class action lawsuit over the preinstalled carrier iq agent that did this: https://en.wikipedia.org/wiki/Carrier_IQ

If you have a clean android phone I suspect there no monitoring going on. For example if you use a community built mod or build AOSP yourself.

One difference being that seriously privacy-sensitive or -critical smartphone users can avoid using Google's services on their phone and create a firewall whitelist, or a filtering loopback VPN, to avoid leakage.[0]

Not that's ideal, but it seems a lot better than Windows 10 seemingly indefatigible ways and means of sneaking data out. Ignoring hosts file and DNS responses is just rude.

[0] baseband attacks are still a problem, but at that level of threat then the BIOS or management subsystem on your PC isn't trustworthy either.

"avoid using Google's services" implies using an Android build that doesn't include Google Play Services, which means you're probably going to have to download and flash it yourself. If you're willing and able to do that, you can probably handle using Linux on your desktop, which is the analogous alternative on the PC.

... or even something as simple as blocking MS IP ranges and domains, which should be far simpler than rooting an Android phone.

CopperheadOS sells preflashed phones.

As well as Tehnoetic [0]. But unfortunately those phones are not very usable.

[0] https://tehnoetic.com/tehnoetic-s3-phone-replicant

I agree entirely, and I'm not happy with the current state of the smartphone landscape, but I was trying to illustrate the difference between 'user hostility' in Android, for example, and downright 'user evasion' in Win 10.

Not that I think Android is on a good trajectory in terms of user control, but hopefully alternatives such as Sailfish gain traction.

Just because you can handle it doesn't mean you want to, instead of lazily paying a company to worry about it for you. Of course, OSX is the more popular choice for that set. I wonder why...

If you're a PC gamer you're pretty much stuck with Windows.

Linux and WINE have made great strides over the last few years but it's still nowhere close to becoming a full replacement.

I disagree with this completely. It's drastically easier to control the network environment on a desktop platform, where it goes through routers and/or firewalls to get out to the Internet in most cases, and as you can be an admin on the PC and tamper with the OS enough to block it.

On the other hand, most mobile devices have locked bootloaders, actively work to prevent giving the owner root access, and speak directly out to the Internet using proprietary networking modules.

This isn't the detailed list, here it is: https://technet.microsoft.com/en-us/itpro/windows/configure/...

I know Windows is a large piece of SW, but this seems "quite" big for the "Basic" level... :/

"Telemetry gives users a voice"

Guess what mine is saying...

They mean this quite literally too, as Microsoft employees direct everyone to use the Windows Feedback app to submit feedback, and the Feedback app refuses to function without Enhanced or Full Telemetry.

So, if you don't enable at least enhanced telemetry, Microsoft does not want to hear from you, does not care about your feedback, and no Microsoft employee will respond to your query on the matter.

I've tried to engage the Windows Insider folks over a couple different mediums, as far as I can tell they're barred from talking to anyone who even mentions telemetry.

> Guess what mine is saying...

Hey, LANGUAGE!

> This is all in the 'basic' level, which you can't disable.

Incorrect. Please stop spreading this misinformation.

http://winaero.com/blog/how-to-disable-telemetry-and-data-co...

To be more precise, you can't disable telemetry entirely on Windows Home or Professional in a supported manner.

You have root, so you can run third-party programs to do it. I myself use O&O's Shutup10. But this is unsupported and Microsoft overwrites those settings with every major updates such as the 1703 update coming this month. So you need to run it again.

Using Regedit to change things in the registry is fully supported by Microsoft. They even tell you to do it in many, many support articles.

Also, I have Admin rights on my computer because I own the computer. If somebody else owns the computer than they are welcome to set the settings however they like to. So I don't really see the problem.

It's "Tor", not "TOR". From https://www.torproject.org/docs/faq.html.en#WhyCalledTor

> Note: even though it originally came from an acronym, Tor is not spelled "TOR". Only the first letter is capitalized. In fact, we can usually spot people who haven't read any of our website (and have instead learned everything they know about Tor from news articles) by the fact that they spell it wrong.

so you use the spelling of tOr to collect information about anonymous people on the internet.

> If your organization relies on Windows Update for updates, you shouldn’t use the Security level. Because no Windows Update information is gathered at this level, important information about update failures is not sent. Microsoft uses this information to fix the causes of those failures and improve the quality of our updates.

Note that they don't tell you which of the other levels enables Windows Update telemetry, which is apparently helpful.

It's enabled with Basic.

That's simply not true. Telemetry is not required to update Windows. I've had it disabled for nearly 2 years now with Shutup10 and my OS updates just fine.

That's just a single datapoint, but Shutup10 and other similar programs are very popular. If it broke updates people would be making noise about it.

> So ID numbers of all USB storage drives you've connected? Better not put sensitive data on a USB and send it to a journalist...

This should definitely work for hard disks, which have a serial number in their SMART data but do standard USB flash drives have any kind of unique identifier? There's the vendor ID but that covers every single instance of that model of device. Or is there some kind of identifier at the filesystem level?

USB mass storage devices have serial numbers.

You have a point, but you oversell it with the hyperbolic commentary and it makes me want to disagree with you. I don't like agreeing with people who exhibit such sloppy thinking.

> So ID numbers of all USB storage

Fairly certain USB drives don't have serial numbers, just vendor numbers that are far from unique.

They do. See section 4.1 of the USB mass storage spec.[1]

[1] http://www.usb.org/developers/docs/devclass_docs/usbmassbulk...