Slashdot Mirror
Even With Telemetry Disabled, Windows 10 Talks To Dozens of Microsoft Servers (voat.co)
An esteemed reader writes: Curious about the various telemetry and personal information being collected by Windows 10, one user installed Windows 10 Enterprise and disabled all of the telemetry and reporting options. Then he configured his router to log all the connections that happened anyway. Even after opting out wherever possible, his firewall captured Windows making around 4,000 connection attempts to 93 different IP addresses during an 8 hour period, with most of those IPs controlled by Microsoft. Even the enterprise version of Windows 10 is checking in with Redmond when you tell it not to — and it's doing so frequently.
Is anybody surprised by this?
Microsoft has pretty clearly telegraphed they don't give a shit about what the people who own the machines want, and they're going to do whatever the fuck they want.
That Microsoft is doing this is surprising in no way to me.
Microsoft simply can't be trusted to not just do what they please here.
Lost at C:>. Found at C.
For the enterprise version we really need it predictable so it can be managed. Even if talking to MS is harmless and overall a good thing, it means you are having your computer talk to something you may not want too.
At work we are still on Windows 7 with little chance going over to 10 because of stuff like this. (I would prefer Linux, but our management is stuck in the 1990s)
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
I'm not sure how any company or business that deals with information that requires security by law could be using Windows 10. It would seem that defense contractors, law enforcement, financial and tax services as well as anyone subject to hippa laws would be in default automatically because what is sent is not documented.
Maybe it is time for a class action or something to get it turned off for real.
The Microsoft shills normally go down one of these paths:
1)- "You can turn it off if you pay for it"
(this ignores that you can't really buy enterprise and is malicious behavior in general, ignores that you can't turn stuff off in pro- but now it ALSO ignores that EVEN ENTERPRISE HAS NO TOGGLES!)
So it's BIG news because it means that even Enterprise is tucked into their botnet.
2)- "But google does this on their phone OS"
(this ignores that a phone OS isn't the same as a desktop OS, ignores that phones are pretty terrible at privacy and that this is due to several vendor lock-ins that don't have good outs, ignores that there's phones that DON'T do this, and is just generally so full of false equivalences that it's ludicrous on the face of it)
3)- "I have nothing to hide / you're old if you care"
(this is something a marketer would say, not a rational person- no one actually wants to buy or use spy tech)
4)- 'You can turn it off"
(this article is the latest showing that NO YOU CANNOT- someone will post one of the scripts or spybots or whatever that purports to disable it, and might even, but if you need some crazy tech solution to get your OS to MAYBE not spy on you ludicrously, it's a terrible OS)
So finding it in Enterprise destroys (1) even further, and is interesting for (4) as well.
I'm sure it won't stop them shills shilling though.
Any monetary transactions I do these days is on my PC-BSD laptop or on either of my phones. I don't keep ANY financial stuff on my Windows laptop. Which btw, the only reason I have is that my work requires it. For all personal stuff, it's PC-BSD
Hpw about if the NSA and google stopped doing it? How about microsoft doesnt do it. How about instead of cheering them on and saying, "if others are doing it why cant an OS" you just go die in a fire?
Has anyone analyzed the data being sent? Or is this a big assumption? Could this be other apps that were installed by default 'calling home'? I'm not doubting that MS might do this, but in all fairness, this seems example seems like unsubstantial speculation....and a pretty weak 'test to boot. Remember that high school class who put sprouts by a wifi router and found the 'closer plants died'? I did the same thing for fun, and found the closer sprouts actually grew faster and more abundantly, probably since they were warmer. Shouldn't we suspend judgement until further tests and confirmation is made...?
My question is: If you're running a small business with 20-50 computers running 10 Pro and each machine is phoning home even 1,000 times a day, how much is that effecting your internet connection? How much more traffic is your network having to handle? What kind of performance hit are your computers, network and internet taking?
If you block connections, what would have normally been one successful connection can become many connection attempts. It's also possible that retries for the same thing would use different IP addresses. Someone needs to try an experiment like this without the blocking. A log of the data being transmitted would also be interesting. A lot of that is probably encrypted, but https monitoring via wildcard certificate MITM could capture some in decrypted form.
> Ubuntu is worse, actually.
Lie.
>Not only does it send searches,
You can turn off the search send. It's being removed soon. If you care, don't use Ubuntu, use any other Linux. There's no one else providing distros of Windows to run to when Microsoft fails. They have failed.
> but each individual library or package can phone home to a different developer with different information collected about your system
First, it asks you each time, you can uncheck a box.
Second, here's your fix:
apt-get remove apport
Did you want to keep it around? Edit /etc/default/apport and change "enabled" to 0. Then it won't launch on boot.
It's optional, it can be disabled, and it asks you each fucking time anyway.
> There's also more incentive for Linux software to monetize user activity
There's no incentive for Linux (a kernel) to do this. There's no incentive for Linux as a general OS to do this. There is incentive for SOME companies that have Linux distributions to try to "monetize users", but you can, of course, simply not use their products- because Linux is a whole set of distributions.
Are you done with the fud? We'll never know AC, we'll never know.
He's talking about apport, I'm pretty sure. I responded to that. He's also pretending that a box you can uncheck using a program you can disable or uninstall in one single distro out of hundreds (and not even the most common one) is the same or worse than Microsoft dumping data that only they can decrypt over thousands of connections silently.
One problem with the approach used is that the firewall is configured to drop all connections. This is not a realistic picture.
An analysis of the content would also be interesting because even with telemetry disabled, there are plenty of reason for connecting to Microsoft servers such as software updates. Most of them are port 80 and port 443. Port 80 is normal http traffic and is easy to analyse, port 443 is encrypted so it is a bit harder but if you can add your own certificate authority to the windows install, you can try doing man-in-the-middle. There is also UDP port 3544 which is related to IPv4 - IPv6 transition, which in itself is probably harmless but may hide other connection attempts (that's one of the reasons why you won't get a realistic picture by dropping everything).
The only thing this experiment tells us is that Windows communicates with MS servers even with telemetry disabled. It smells but without further analysis, it is not very useful information.
So I can log into a terminal session on my home router. The router also supports blocking hosts by either IP address or by hostname. Somewhere on it those hosts must be in a config file, and I can probably just edit that file via a console. This means I can run a script. A script that can periodically check for an updated list of hosts to block. Either I or someone else can maintain such a list.
This list puts all their shit out of business. This is the way of the future then. I look forward to the new generation of broadband modems coming out to support blocklist technology exactly for this purpose: To block evil companies from spying on and tracking us.
My guess is, if the author were to carefully track this, that eventually it will be noticed that, following upcoming system updates to Windows, that the hosts he has listed will magically change and there will be new ones. Microsoft and its evil cohorts can easily shuffle around IP addresses in response to this. So running a blocklist filter on home broadband modems/routers is the way to go now for the future of privacy.
> Will Win10 stop working?
Not yet it won't. That's the game the Windows users are playing right now- a bunch of firewall settings. Some data is passed ignoring hosts files, so there's talk about an application firewall so you can keep using Windows.
Of course, all Microsoft has to do is a throw Switch-A and everything changes and all those guys have to change their block settings, or throw Switch-B and your system stops working if it hasn't spied on you in a while.
But in the meantime, Windows users are so desperate that they are basically considering building and using a guard.
Are we to the point of a class action lawsuit or a Congressional investigation?
If all we're talking about is everybody here boycotting Microsoft, it's not going to work. We're a very tiny percentage of computer users.
What realistically can be done about it?
[ I can't tell if others have commented on this ]
The kind of traffic matters. Some external communication is reasonable.
NTP, to synchronize clocks.
Checking for certificate revocation.
Checking for the existence of security updates.
Downloading lists of sites known to be malicious.
You can take responsibility for these functions, but servers need to get them done.
Don't mess with The Phone Company. Piss them off and you'll be using two tin cans and a piece of string.
Only use Microsoft to play computer games on. Keep that AV updated and use real OS's for other tasks.
Domestic spying is now "Benign Information Gathering"
I don't think I've ever once said this -- or anything like it. But, it's seemingly reached that point. I guess, if I'm going to say it, I should make it a point to say it differently, perhaps better, than others. So...
If you have to go through all of that just to have your OS behave the way you tell it to behave, if you have to use hardware to stop your computer from doing what you tell it to do, if you have to work to keep things from the OS vendor, then do you *really* trust the OS at all? Do you really feel so compelled to use it?
http://cdimage.ubuntu.com/lubu...
That said, I don't use Windows. If I were using Windows, I'd leave the telemetry data enabled. Yes, I'd let them collect that data - knowingly and willfully. I'd rather they have my data (it's seemingly anonymous and they've a decent history at keeping that data in their own hands and a vested interest in keeping that data for themselves) about my computer usage so that they could understand how I used my computer and what hardware I was using. It'd mean a greater potential for a better computing experience.
So, I'd leave it enabled. However, I can understand that some folks don't want it enabled and I think the OS should obey that choice. Off means off - not partially off. I use Linux but not because I want to keep my computer usage metrics from Microsoft nor because I have a dislike for proprietary software. I use Linux because I like to break stuff and learn new things. Breaking and fixing is how I learn.
But, if you've gotta go through all those hoops then should you trust it at all? At that point, you might as well go with a whitelist approach. Or, really, you might as well find an alternative even if it means some sacrifice. I wasn't learning anything new with Microsoft products so I simply stopped using them. I doubt you'd have the same motives as I. I do know that if I wanted to disable telemetry and had to go through all of that, I'd use a whole other OS instead.
"So long and thanks for all the fish."