Slashdot Mirror
Microsoft's Telemetry Additions To Windows 7 and 8 Raise Privacy Concerns
WheezyJoe writes: ghacks and Ars Technica are providing more detail about Windows 10's telemetry and "privacy invasion" features being backported to Windows 7 and 8. The articles list and explain some of the involved updates by number (e.g., KB3068708, KB3022345, KB3075249, and KB3080149). The Ars article says the Windows firewall can block the traffic just fine, and the service sending the telemetry can be disabled. "Additionally, most or all of the traffic appears to be contingent on participating in the CEIP in the first place. If the CEIP is disabled, it appears that little or no traffic gets sent. This may not always have been the case, however; the notes that accompany the 3080149 update say that the amount of network activity when not part of CEIP has been reduced." The ghacks article explains other ways block the unwanted traffic and uninstall the updates.
Telemetry hack
Like shearing your back
The right suds keep it
From chopping your stack
Burma Shave
Get thee glass eyes, and, like a scurvy politician, seem to see things thou dost not.--King Lear
What the hell is CEIP? Editors, define your acronyms the first time they're used, especially if they're not common.
Can Editors Inspect Paragraphs?
There are consequences to every action
-- Tigger warning: This post may contain tiggers! --
I think a more apt comparison would be to compare this to the entire process of getting a colonoscopy, from the preparation the day before, to the actual "exam".....
Willie...
I am willing to contribute money for the development of (hopefully) simple software or scripts rid my system of this malware, once installed.
Also, some ongoing review system which only allows MS updates that are deemed benign.
Sheesh, it's getting tedious to wade through all the KB verbiage with my evil lawyer hat on.
Prove anything by multiplying Huge Number times Tiny Number
"Raises privacy concerns" is elliptical speech: it's made to be deliberately obscure. (It uses "causes concern" to convey the central point without giving any information about what the point is.)
It's also passive voice, in that there's no person performing the action, the action is simply "caused" by something. (For comparison, consider "we wrote reports" versus "reports were written".) Hence, there's no person or group responsible, it's simply an aspect of situation.
And finally, the phrase uses framing to soften the effect. Your personal information isn't being harvested, the system simply "raises some concerns".
Taken as a whole the headline tries to get the reader emotionally involved by stating something we should be concerned about, without saying in concrete terms *that* there is anything to be concerned about, and that it's *other people* who are concerned.
Meh. This didn't work on me, I'm not actually concerned, I'm going to ignore it.
(Propaganda success!)
I'll just try it again without the rest of the post. Now I get "Your comment has too few characters per line (currently 38.5)." Again, fuck you Slashdot. Let's see if this line can fix it. Let's see if this line can fix it. Let's see if this line can fix it. Let's see if this line can fix it. Let's see if this line can fix it. That didn't work "Your comment violated the "postercomment" compression filter. Try less whitespace and/or less repetition.". Try again.
ECHO OFF
REM --- remember to invoke from ELEVATED command prompt!
REM --- or start the batch with context menu "run as admin".
SETLOCAL
REM --- (as of 2015-08-26):
REM KB3012973 - Upgrade to Windows 10 Pro
REM KB3021917 - Update to Windows 7 SP1 for performance improvements
REM KB3035583 - GWX Update installs Get Windows 10 app in Windows 8.1 and Windows 7 SP1
REM KB2952664 - Compatibility update for upgrading Windows 7
REM KB2976978 - Compatibility update for Windows 8.1 and Windows 8
REM KB3022345 - Telemetry [Replaced by KB3068708]
REM KB3068708 - Update for customer experience and diagnostic telemetry
REM KB2990214 - Update that enables you to upgrade from Windows 7 to a later version of Windows
REM KB3075249 - Update that adds telemetry points to consent.exe in Windows 8.1 and Windows 7
REM KB3080149 - Update for customer experience and diagnostic telemetry
REM KB3044374 - W8,8.1 Nagware for W10
REM KB2977759 - W10 Diagnostics Compatibility Telemetry
REM KB3050265 - Windwos Update services update to upgrade to W10
REM KB3068707 - Customer experience telemetry point. W7,8,8.1
REM --- uninstall updates ... /b /wait wusa.exe /kb:3012973 /uninstall /quiet /norestart /b /wait wusa.exe /kb:3021917 /uninstall /quiet /norestart /b /wait wusa.exe /kb:3035583 /uninstall /quiet /norestart /b /wait wusa.exe /kb:2952664 /uninstall /quiet /norestart /b /wait wusa.exe /kb:2976978 /uninstall /quiet /norestart /b /wait wusa.exe /kb:3022345 /uninstall /quiet /norestart /b /wait wusa.exe /kb:3068708 /uninstall /quiet /norestart /b /wait wusa.exe /kb:2990214 /uninstall /quiet /norestart /b /wait wusa.exe /kb:3075249 /uninstall /quiet /norestart /b /wait wusa.exe /kb:3080149 /uninstall /quiet /norestart /b /wait wusa.exe /kb:3044374 /uninstall /quiet /norestart /b /wait wusa.exe /kb:2977759 /uninstall /quiet
echo uninstalling updates
start "title"
echo - done.
start "title"
echo - done.
start "title"
echo - done.
start "title"
echo - done.
start "title"
echo - done.
start "title"
echo - done.
start "title"
echo - done.
start "title"
echo - done.
start "title"
echo - done.
start "title"
echo - done.
start "title"
echo - done.
start "title"
I really want to like Windows 10. It seems to have a lot of nice features, was a smooth upgrade from 7, and probably the single most painless OS upgrade I've had on any MS platform (I had to correct a single driver, for a minor issue, and that was it).
But I'm really, really sick of just how blatantly Microsoft is trying to jam every single stupid thing into this, and tie it back to their cloud based bit. And I might even be okay with some of that, because I'm well aware that I wind up giving a lot to Google when I'm using stuff on Android. I might even use some of it, if they weren't going far beyond even what Google does.
The final straw was when they wanted to essentially remove my local account on the machine and replace it with me using a Microsoft account for my local login. No, sorry, but Redmond can go get fucked if they want that. It's one thing to have stuff in a cloud based application that has its own password, but it's another thing for that cloud based password to be my entire system. Perhaps I'm being overly negative, but it's just too much, that they want all this personal data, and they want to tie it all not just to what I do in application land with Outlook/Bing/Edge/Cortana/Skype whatever, but down to the OS level? No. And if it gets worse, I may just have to bite the bullet and do my PC gaming on Linux, and give up on doing anything bleeding edge.
No, the guys who wanted more tracking took that guy out for a beer. That's the guy who killed off DoNotTrack. Like Private Browsing in Firefox or Incognito Mode in Chrome, DNT was about the balance between privacy on one hand and convenience/features on the other hand. DNT was supposed to mean that the user valued privacy more than convenience and features at the moment. Here's what was supposed to happen, what DNT was intended for:
Case 1, no DNT header:
I go to Slashdot, and have not set a specific DNT header. I therefore get the DEFAULT tracking/personalization behaviors of Slashdot, including:
I'm not redirected to Beta, because Slashdot tracks that I set "do not showme beta".
On my mobile device, I'm not redirected to m.slashdot.org, because again Slashdot tracks my preferences based on some identifier/cookie.
Case2, with DNT header:
I launch a Private Browsing window in Firefox, or an Incognito tab in Chrome.
The browser prompts "DNT: Do you want to tell web sites to avoid identifying you or tracking your preferences? Some features and preferences may not work in DNT mode."
I click "yes, send the DNT header".
Slashdot sees that I have expressed that I want a higher level of privacy than the default, that I am willing to give up personalization in exchange for privacy.
Slashdot does not set a cookie, and I get redirected to m.slashdot.org or beta.slashdot.org each time. It does not track me to know my preferences between sessions.
It's all about the balance between privacy and convenience. Much like Incognito / Private Browsing mode disables the browser history, autocomplete, and other useful features in exchange for better privacy.
In short, the purpose of DNT was to communicate the user's desire to value privacy over convenience.
By violating the spec and sending DNT as the DEFAULT, the DNT header in IE suddenly meant "the user probably wants the DEFAULT balance between privacy and convenience". Since IE sent DNT by default, it no longer provided any information about the user's priorities regarding convenience vs privacy. It therefore became completely useless for it's purpose. That guy killed DNT.
-----
Here's a concrete example. Quoting from the DNT policy:
| all user identifiers, such as unique or nearly unique
| cookies, "supercookies" and fingerprints are discarded
Do you really think that all sites are going to get rid of cookies, including "don't show me Beta" cookies, for anyone and everyone using IE? Just because Microsoft thought it was a good idea? No friggin way. If the USER chose to actively ticked the box, perhaps so. Because Microsoft's marketing team thought that "Do Not Track" sounded good and that breaking most web sites was an acceptable side effect? I don't think so.
Would the editors consider adding a section for analysis of Windows updates so we can read then decide if we want them instead of having to go on click marathons through the desktop client? Even some sort of Patch Tuesday digest just indicating which of the updates are actual security patches would do it.
Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
Seems a rather lengthy and convoluted batch file - just use this: http://pastebin.com/B3DjTSX1
- In Soviet Korea, only old people loose all their bases to Natalie Portman's petrified hot grits overlords.
Both scripts fail to make use of a simple FOR command.
FOR %A IN (list) DO command [ parameters ]
The funny thing about this is until this I was willing to send telemetry to Microsoft. I understand how them knowing when my system crashes helps them fix bugs. I understand the wealth of good-for-everyone knowledge that comes with reports of which precise system file had a problem performing what kind of information. I would block crash reports sometimes, and I would allow other basic telemetry most of the time.
But due to their new privacy policy and other privacy rapine I've blocked every form of telemetry on my machine. They no longer get to hear a damn thing. Surely this was predictable. And how many regular and corporate sales has Microsoft lost already over this? Everyone knows to ask their local nerd what OS and other software to use. Stupid, stupid, stupid.
If video games influenced behavior the Pac Man generation would be eating pills and running away from their problems.
I put this in my tomato "Scripts" section. Basically grabbed all of the dig output for settings-win.data.microsoft.com and vortex-win.data.microsoft.com, cnames, and authorities for them.
Possibly excessive. I'm ok with that. YMMV.
iptables -I FORWARD -d 8.26.215.27 -j DROP
iptables -I FORWARD -d 64.4.54.254 -j DROP
iptables -I FORWARD -d 8.26.204.25 -j DROP
iptables -I FORWARD -d 198.78.199.155 -j DROP
iptables -I FORWARD -d 204.160.105.155 -j DROP
iptables -I FORWARD -d 4.23.46.155 -j DROP
iptables -I FORWARD -d 65.55.44.108 -j DROP
Why, again, do people still use Windows?
Because it runs the programs they need to run and works with the devices they use. That is the primary purpose of an operating system, nobody turns on their computer just to use the operating system.
The fact that you have to explicitly say you want privacy makes it a bad spec to begin with, just like having to explicitly say you dont want to participate in Windows' CEIP rather than it being something you opt-in to is bad for privacy (even though in that case it's just telemetry data).
Microsoft has already solved your workaround by making all new KBs entirely nondescript. Enjoy your black box updates.
Do what thou wilt shall be the whole of the Law
Makes much more sense to un-install those privacy downgrades. Worth the effort as there is a distinct improvement in boot times as well as general performance. Those M$ anal probes do come with more than one cost, not just your privacy taken but also a system performance cost, obviously they run better in windows 10 built in than added in windows 7 and 8, which is why windows 10 outperforms fully privacy downgraded windows 7 and 8. I wonder how well windows 7 clean install no M$ recommended privacy downgrades compares against windows 10.
Chaos - everything, everywhere, everywhen
Makes much more sense to un-install those privacy downgrades.
An easier option is probably just to disable them, it looks like the sole purpose of the Diagnostics Tracking Service is to send data back to Microsoft so if you prevent it from running you should be fine.
Disclaimer: I haven't run Snort on this yet so I don't know if there isn't something else phoning home with my data, but DTS seems the obvious candidate to kill.
Here's mine, rather more brief than yours since it was written purely as a memo for future reference:
The thing that worries me it that there are now dozens of articles about which updates to remove to disable telemetry or the Windows 10 update nagbox. We've been saying that installing security updates is fundamental to keeping your computer secure. This goes against that. Do we really want to teach people to uninstall random updates based on shady blog articles?
Earlier I had all automatic update checkboxes checked, because I trusted that security updates are just that - security updates. From now on I'll be checking all the updates manually before installing, and I really hate to have to do that.
And before anybody recommends switch to Linux, I already use Linux as my main OS.
Only dumb birds land downwind.
There is no reason why in your example Slashdot could not remember your preferences without tracking you. A simple anonymous cookie with no unique ID for beta/no beta and mobile/desktop is all that is required.
Even logging in is possible without violating DNT. Just discard any tracking data not essential for the provision of logged in services. DNT doesn't mean "do not set cookies", it means "don't track my browsing habits for any reason other than the provision of the services I ask for (e.g. advertising)."
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
I followed the instructions here...
https://www.hackread.com/microsoft-updates-spy-on-windows7-8-users/
It details how to see if you have those KBs installed and if so, how to remove them.
I'm really a low 5-digit Slashdotter, but this ID is where I am now.
A 5/16" drill through the CPU works, too, but is just as off topic..