Slashdot Mirror
Even With Telemetry Disabled, Windows 10 Talks To Dozens of Microsoft Servers (voat.co)
An esteemed reader writes: Curious about the various telemetry and personal information being collected by Windows 10, one user installed Windows 10 Enterprise and disabled all of the telemetry and reporting options. Then he configured his router to log all the connections that happened anyway. Even after opting out wherever possible, his firewall captured Windows making around 4,000 connection attempts to 93 different IP addresses during an 8 hour period, with most of those IPs controlled by Microsoft. Even the enterprise version of Windows 10 is checking in with Redmond when you tell it not to — and it's doing so frequently.
Is anybody surprised by this?
Microsoft has pretty clearly telegraphed they don't give a shit about what the people who own the machines want, and they're going to do whatever the fuck they want.
That Microsoft is doing this is surprising in no way to me.
Microsoft simply can't be trusted to not just do what they please here.
Lost at C:>. Found at C.
For the enterprise version we really need it predictable so it can be managed. Even if talking to MS is harmless and overall a good thing, it means you are having your computer talk to something you may not want too.
At work we are still on Windows 7 with little chance going over to 10 because of stuff like this. (I would prefer Linux, but our management is stuck in the 1990s)
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
I'm not sure how any company or business that deals with information that requires security by law could be using Windows 10. It would seem that defense contractors, law enforcement, financial and tax services as well as anyone subject to hippa laws would be in default automatically because what is sent is not documented.
Maybe it is time for a class action or something to get it turned off for real.
3)- "I have nothing to hide / you're old if you care"
I, and I'll easily assume that many, many others, are getting pretty damned sick and tired of hearing that line from idiots who have been so thoroughly indoctrinated, that they probably don't even consciously know that they're parroting it. It is a fact that, after a certain point in the development of a human being, desiring privacy is a normal, natural, healthy thing for a person to want. Not wanting or caring about your private life being private is an abberation, a sign that something is wrong. This whole faux culture of 'sharing everything with everyone' is some sort of a sickness and it needs to stop.
By the way, cfalcon, just to be sure you understand me: I'm agreeing with you on all counts, not attacking you.
Are YOU using the TOOL, or is the TOOL using YOU? Think about it!
Has anyone analyzed the data being sent? Or is this a big assumption? Could this be other apps that were installed by default 'calling home'? I'm not doubting that MS might do this, but in all fairness, this seems example seems like unsubstantial speculation....and a pretty weak 'test to boot. Remember that high school class who put sprouts by a wifi router and found the 'closer plants died'? I did the same thing for fun, and found the closer sprouts actually grew faster and more abundantly, probably since they were warmer. Shouldn't we suspend judgement until further tests and confirmation is made...?
Response: "I may have nothing to hide, but my personal information is none of your gorram business."
If my information is valuable to you, you need to compensate me for it, if I'm interested in selling it. You have no right to take what is mine.
If you block connections, what would have normally been one successful connection can become many connection attempts. It's also possible that retries for the same thing would use different IP addresses. Someone needs to try an experiment like this without the blocking. A log of the data being transmitted would also be interesting. A lot of that is probably encrypted, but https monitoring via wildcard certificate MITM could capture some in decrypted form.
> Ubuntu is worse, actually.
Lie.
>Not only does it send searches,
You can turn off the search send. It's being removed soon. If you care, don't use Ubuntu, use any other Linux. There's no one else providing distros of Windows to run to when Microsoft fails. They have failed.
> but each individual library or package can phone home to a different developer with different information collected about your system
First, it asks you each time, you can uncheck a box.
Second, here's your fix:
apt-get remove apport
Did you want to keep it around? Edit /etc/default/apport and change "enabled" to 0. Then it won't launch on boot.
It's optional, it can be disabled, and it asks you each fucking time anyway.
> There's also more incentive for Linux software to monetize user activity
There's no incentive for Linux (a kernel) to do this. There's no incentive for Linux as a general OS to do this. There is incentive for SOME companies that have Linux distributions to try to "monetize users", but you can, of course, simply not use their products- because Linux is a whole set of distributions.
Are you done with the fud? We'll never know AC, we'll never know.
I don't know about Ubuntu but the flavors of Linux I use most frequently don't appear to be connecting to anything other than the usual network services during a simple audit of network activity I've conducted; just the usual dns queries, web requests, smtp connections, time updates, etc. And I've walled them off completely they still boot normally, so, whatever.
Python: 'And then suddenly you have a language which says "we're all stuck with whatever the whiniest coder wants".'
One problem with the approach used is that the firewall is configured to drop all connections. This is not a realistic picture.
An analysis of the content would also be interesting because even with telemetry disabled, there are plenty of reason for connecting to Microsoft servers such as software updates. Most of them are port 80 and port 443. Port 80 is normal http traffic and is easy to analyse, port 443 is encrypted so it is a bit harder but if you can add your own certificate authority to the windows install, you can try doing man-in-the-middle. There is also UDP port 3544 which is related to IPv4 - IPv6 transition, which in itself is probably harmless but may hide other connection attempts (that's one of the reasons why you won't get a realistic picture by dropping everything).
The only thing this experiment tells us is that Windows communicates with MS servers even with telemetry disabled. It smells but without further analysis, it is not very useful information.
So I can log into a terminal session on my home router. The router also supports blocking hosts by either IP address or by hostname. Somewhere on it those hosts must be in a config file, and I can probably just edit that file via a console. This means I can run a script. A script that can periodically check for an updated list of hosts to block. Either I or someone else can maintain such a list.
This list puts all their shit out of business. This is the way of the future then. I look forward to the new generation of broadband modems coming out to support blocklist technology exactly for this purpose: To block evil companies from spying on and tracking us.
My guess is, if the author were to carefully track this, that eventually it will be noticed that, following upcoming system updates to Windows, that the hosts he has listed will magically change and there will be new ones. Microsoft and its evil cohorts can easily shuffle around IP addresses in response to this. So running a blocklist filter on home broadband modems/routers is the way to go now for the future of privacy.