Windows 11 collects an awful lot of telemetry about your PC

https://www.extremetech.com/computing/342941-windows-11-collects-an-awful-lot-of-telemetry-about-your-pc

by belter • 3 years ago

141 144 3 years ago

belter2• 3 years ago

"Has Windows become Spyware?" - https://youtu.be/IT4vDfA_4NI

Thoeu388• 3 years ago

Those requests are still relatively OK. But Win11 has buildin keylogger, ads and all sort of nasty stuff. It can also be auto reinstalled to Windows 12 anytime.

At this point it is basically a malware, and should be kept in sandboxed environment!

esperent• 3 years ago

What's the best tool for Windows 11 for disabling the telemetry? I know the ShutUp10 tools, does it work for W11 too?

supermatou• 3 years ago

I know the ShutUp10 tools, does it work for W11 too?

Yes. I've been using it for years now - first on 10, now on 11 (couple of years). Just make sure to check for new versions from time to time, as they keep adding new features and things to block.

eska• 3 years ago

It’s a lost cause. Updates will turn things back on, things will break because of unnecessary dependencies, etc.

Tozen• 3 years ago

Not necessarily, if using 3rd party tools to stop telemetry or to check settings. Though I do agree that Microsoft likes to re-enable whatever settings as they please after updates.

midoridensha4• 3 years ago

What's the best tool for Windows 11 for disabling the telemetry?

That's easy: a USB stick with a partition tool and a Linux installer. Wipe out your W11 partition and install something that isn't blatant spyware.

BizarroLand3• 3 years ago

That's like saying the best way to get rid of mosquitos in your back yard is with the Tsar Bomba.

holografix• 3 years ago

Can Pihole help with this?

mcwhy• 3 years ago

Windows Restricted Traffic Limited Functionality Baseline

https://learn.microsoft.com/en-us/windows/privacy/manage-con...

dspillett5• 3 years ago

The only reliable way is to simply not use it.

Unfortunately this is impractical for many.

pulpfictional• 3 years ago

Using one of the tools to change your edition to an Enterprise one, then disabling telemetry through Group Policy.

rootw0rm2• 3 years ago

on topic, from 2020:

https://www.bleepingcomputer.com/news/microsoft/windows-10-h...

tinus_hn• 3 years ago

Of course Windows needs your location, cookies and data, otherwise it wouldn’t be able to show you a weather widget and ‘relevant’ Bing News about the latest celebrity make-up flub.

mcpackieh7• 3 years ago

Weather is often presented as one legitimate case of location data necessarily being uploaded to an online service, but I think you could fit compressed county-resolution basic weather data for entire countries into a few kilobytes. Windows could easily download the current weather for the entire US and choose the user-local data out of that set.

TeMPOraL• 3 years ago

I think you could fit compressed county-resolution basic weather data for entire countries into a few kilobytes.

More than that, you could compress city-resolution detailed weather data into couple dozen kilobytes. The easiest way to see it is to observe that, if your app downloads some kind of weather map image generated on the server, then that image already encodes some of this data directly, through colors of the pixels. If you ignore human readability, you can pack much more information per pixel, at the resolution of... the image. And that is not even the most efficient encoding for it.

Hell, even dumb weather APIs that respond with weather predictions could pack several times as much data in the response if they ditched the horribly space-inefficient JSON response format. There's no technical excuse at all to not ship you the whole continent's worth of weather data with each update, removing the need for the server to know your location.

dist-epoch2• 3 years ago

Your IP already leaks city-level location. So you don't gain much from not sending it anyway. Presuming that Windows doesn't send GPS level location. I have no idea what it sends, but the weather widget asks just for city name.

vorticalbox• 3 years ago

simply having it opt in would be a better solution.

freeflight3• 3 years ago

That's the last ~10 years of web developement in a nutshell, instead we have darkpatterns as normalized "industry standard".

timbit42• 3 years ago

Due to my VPN, the weather widget is always wrong.

p-e-w4• 3 years ago

Unless I'm blind, the article doesn't contain any actual evidence of telemetry being sent – just a list of domains contacted, and speculation on what their purpose might be.

I don't doubt that Windows collects and transmits telemetry data (hell, text editors do that nowadays), but if an analysis of that exists, it is not in this article.

Nicksil• 3 years ago

Unless I'm blind, the article doesn't contain any actual evidence of telemetry being sent – just a list of domains contacted, and speculation on what their purpose might be.
I don't doubt that Windows collects and transmits telemetry data (hell, text editors do that nowadays), but if an analysis of that exists, it is not in this article.

Crikey mate; second paragraph, first sentence.

ninepoints2• 3 years ago

Yes and then if you read paragraphs 3, 4, 5, etc. there's no substance on what is actually sent. We all know what Wireshark is, and what it can do, but how it was utilized here is up in the air.

coldtea• 3 years ago

just a list of domains contacted, and speculation on what their purpose might be

Yeah, they might be playing some patty cake protocol /s

pjc505• 3 years ago

Yeah, this comes up over and over again: people see that connections are being made, but because it's hard (not impossible! but considerable work) to trace where they're coming from and what they actually _contain_, we're left with ambiguity.

(you'd need the Windows kernel debugger and to reboot the thing in developer mode. This is a pretty niche skillset)

capableweb4• 3 years ago

This is a pretty niche skillset

Is it really? Seems you need to install ~2 packages, flip some switches, edit some files/run some terminal commands, reboot and connect the debugger and you're pretty much setup for it. Seems more like something you need to read an article about, rather than a skillset per se.

MikusR3• 3 years ago

Google - truly an niche skill.

What addresses are connected: https://learn.microsoft.com/en-us/windows/privacy/manage-win...

What data is sent: https://learn.microsoft.com/en-us/windows/privacy/required-d...

The Diagnostic Data Viewer is a Windows app that lets you review the Windows diagnostic data your device is sending to Microsoft, grouping the info into simple categories based on how it's used by Microsoft. https://learn.microsoft.com/en-us/windows/privacy/diagnostic...

freeflight3• 3 years ago

I don't doubt that Windows collects and transmits telemetry data (hell, text editors do that nowadays), but if an analysis of that exists, it is not in this article.

Such an analysis does not exist because that traffic is encrypted. Which is also the reason why using Windows 10/11 is not fully compliant with EU privacy laws in places like Germany, as there is no telling what Windows is actually phoning home.

Officially Windows 10/11 can be used but only after jumping through a lot of hoops that involve turning off the telemtry and phoning home, but even then only with an "acceptable residual risk" [0]

The only reason this isn't a bigger topic is because there is no realistic alternative; Everything is tailored to MS, and MS spends absurd amounts of money and effort to prevent anything from changing that.

So the majority just goes with the "easiest" and most convenient solution, even when it might actullay be an "illegal" solution that enables a ton of industrial espionage.

[0] https://www.heise.de/news/Datenschutzkonferenz-Hohe-Huerden-...

p-e-w4• 3 years ago

Such an analysis does not exist because that traffic is encrypted.

... by software that resides on the same system, with keys that are in memory on the same system.

I'm not saying it's trivial to decrypt the traffic, but it's certainly possible, and much, much harder reverse engineering is routinely being performed.

Springtime• 3 years ago

This video it's based on was from earlier in the year and lacks any proper analysis, yet got picked up by some tech sites and continues to get posted for topics which mostly just results in users bikeshedding about their Windows pet peeves.

Some examples: calls a service that helps companies comply with GDPR "1984" since the analysis is superficial and almost entirely gut reactions to random domains they observed. They have no issue with one CDN they observe but take issue with a Microsoft CDN literally only because they see 'geo' in the sub-domain, when if they'd taken a moment to check it's just used to locate the nearest data center like CDNs do generally.

If the video were instead, 'let's look at what comes pre-installed with Windows 11 [Home, Pro, Education?] that connects online' then it may have been a more informative video. Instead it has a lot of assumptions but little evidence about DNS queries, leaving only casual viewers thinking they've learned something.

squarefoot• 3 years ago

You can easily transmit information hidden in web requests. If I own a web server at somedomain.com I can run code that asks for somedomain.com/someencryptedinformation.html, and I'm sure that someencryptedinformation will appear in the server logs. Automate encoding something in that string and you can send data using simple web requests that won't trigger anything looking for connections on non standard ports. And what if connecting to domain A followed by B within 2 seconds is translated as a 0 and the other way around as a 1? You can, albeit slowly, send whatever you want just by alternating those two connections. Yes, just contacting the outside is sending information.

mcpackieh7• 3 years ago

Telemetry is spyware, I don't care how useful it is. The privacy of users is more important than convenience for developers.

mrob• 3 years ago

Telemetry that runs without the user explicitly requesting it is spyware. Opt-in telemetry, such as Debian's "popularity contest", is not.

mcpackieh7• 3 years ago

Agreed.

Xeamek• 3 years ago

Do you consider even automatic crash reports as a spyware? (Asssuming they are properly anonymized)

qwezxcrty• 3 years ago

I consider that is. Unless as most software used to do, show a popup to politely ask me, can it report the crash to vendor.

harry8• 3 years ago

As per mrob's ammendment. Opt in. Every single time. No exceptions.

mcpackieh7• 3 years ago

Automatic? Absolutely. "Proper anonymization" is a joke, supposedly anonymized datasets are shown to reveal PII all the time. Informed user consent is paramount, and if informed consent isn't possible because the nature of the report is too technical for the users then the report shouldn't be sent.

Even if some rare few developers can properly anonymize data and for instance, scrub core dumps of any user data, them doing so normalizes the practice of opt-out telemetry and most other developers won't be so careful.

pjc505• 3 years ago

It's very hard to anonymize a crash report if it's more than just a backtrace. If it contains any user data - which might be relevant and useful to debugging! - it's not anonymous.

Edit: wondering if the correct approach is actually a GDPR one ...

Xelbair• 3 years ago

Yes, as they can expose sensitive data.

Doubly so if user isn't informed about that.

throwbadubadu• 3 years ago

Without consent? Definitely.

johnnyworker• 3 years ago

What is the pipeline from a random application crashing, 99% of the time because of misconfiguration or a bug in the application, to Microsoft doing anything that fixes that? How could they even?

Dead_Lemon• 3 years ago

Its amazing how the old Windows OS's managed to improve with out telemetry and analytics. Now we have that, the OS is in a downward spiral of how much one can harvest from the user and other dark patterns to prevent the user from having control over it. While the desktop experience has worsened.

charcircuit4• 3 years ago

The goal of spyware is to gain information about who the user is and what they are doing.

The goal of telemtry is to gain information about the software and how it is being used.

They have 2 very different purposes and goals.

mcpackieh7• 3 years ago

The goal of spy satellites is to count hardware and look at infrastructure, etc. The goal of hiding a camera in a public restroom is prurient behavior. Two very different purposes and goals. But both are spying.

It really doesn't matter what motivates opt-out or mandatory telemetry; it's spying. It's wrong because it violates user privacy, regardless of the motive.

trustingtrust• 3 years ago

Microsoft had a good licensing model that sort of worked. Instead, they are going towards selling malware for free or at a very low cost to manufacturers. It is kind of sad. The UX on Windows 10 for me still feels better for an average Joe compared to Apple and Gnome or KDE. Windows 10 also had WSL2 which made it an okay development system. Then they made a UI that sort of drifted off into something unknown and put in a bunch of telemetry and spyware. Their browser is now riddled with ads. Microsoft and Google have such talent, then talent that is basically making large surveillance software at this point.

LoganDark3• 3 years ago

Windows 10 also had WSL2 which made it an okay development system.

To be honest, I would have preferred WSL1 which implemented the syscalls directly under Windows for the best possible integration, but they eventually just threw that away and switched to using virtual machines!

ht85• 3 years ago

To be honest, I would prefer to have my guts sprayed with honey and exposed to a large colony of ants.

rootw0rm2• 3 years ago

agreed, WSL1 was an ambitious, cool project

lloeki2• 3 years ago

To be fair it's quite impressive WSL1 got this far, but ultimately it was doomed from the start if one targets perfect compatibility.

Given there's no "Linux specification" the spec is the actual code, nooks and crannies and all, down to nitty gritty details and implicit behaviours that end up indirectly getting relied upon. The only solution is to basically implement these in excruciating details, which may or may not possible depending on the Windows things being wrapped. Then the question of intellectual property, copyright, and licensing come in, as MS would have to ensure that it's a clean room implementation or be subject to GPL terms (cue the Oracle Java vs Android shenanigans).

So at some point it makes sense to just throw a VM at the job, cleanly separating realms, sidestepping any legal landmines, and ensuring perfect compatibility, especially as the whole HyperV infrastructure is quite solid and used throughout the MS ecosystem as a general strategy, e.g the Xbox uses HyperV to isolate games and apps.

Tangent: I wish (the VM part of) WSL2 would be available on Xbox, allowing one to run Linux while keeping the whole regular OS and features!

realitythreek2• 3 years ago

WSL v1 hasn’t gone anywhere. It likely won’t until they fix the issues with v2 and VPNs.

JohnFen• 3 years ago

I'd never used WSL1, but I use WSL2 at work (where I'm forced to use Windows). It's OK. I don't understand all the fanfare about it, though, because it's only OK. I still need to have a real Linux system around. WSL2 isn't an adequate replacement.

p-e-w4• 3 years ago

Microsoft had a good licensing model that sort of worked.

Microsoft is the second-most valuable company in the world, with revenue comparable to the GDP of a small country.

Seems like it's still working quite well.

jeltz• 3 years ago

They also had a similar valuation with the old non-abusive model so that does not contradict the grandparent comment.

belter2• 3 years ago

"With high quality software that everybody loves" - Said no one ever...

Teever• 3 years ago

The secret ingredient is crime.

Microsoft is as big as if is today because it broke the law in the past and avoided severe punishment from the DoJ.

blibble• 3 years ago

Seems like it's still working quite well.

one could say the same about exxonmobil, chevron and haliburton

blodkorv4• 3 years ago

In my view Windows has always been a great development system. Been doing both php and c# development on windows for years and it always been "start computer, install wamp/editor or visual studio" then you are set and can develop great software.

capableweb4• 3 years ago

it always been "start computer, install wamp/editor or visual studio"

How is it any different on any other mainstream/moderately popular OS? macOS, Ubuntu and a couple of others basically have the same experience.

midasz• 3 years ago

As a Java dev it's kinda fun to compare the experience.

## Installing a JDK on windows

-Search google/whatever

-Click on first link

-Find .exe

-Agree to terms and conditions

-Click download

-Have to login with oracle account

-(I stopped here)

## Installing JDK on ubuntu

-Open terminal

-sudo apt install openjdk-8-jdk

- y, enter

-done

clhodapp• 3 years ago

Windows 10 may have been your last benefits-outweigh-drawbacks release, but I'd argue the the blatant user hostility really started in Windows 8 (and tainted 10 as well).

WillAdams2• 3 years ago

For me the turning point was Fall Creators Update.

I bought a Samsung Galaxy Book 12 bundled w/ a Staedtler Noris Digital Stylus, and it was perfect --- then Fall Creators Update crippled the stylus making it impossible to select text --- rolled back to 1703 twice, but finally broke down and bought a Samsung Galaxy Book 3 Pro 360.

Currently trying out a Wacom One paired w/ a Linux box and wishing someone would make a nicer screen w/ touch which used standard pens (don't want to go to a Cintiq since it would lose on the synergy/compatibility of _all_ my devices using the same pen technology).

jug• 3 years ago

Windows 10 isn’t much different in terms of data collection. For example, for each USB drive you connect, it sends the serial number, partitions etc to Microsoft, as well as when you connect and disconnect it. And they probably know what smart TV you have in your living room even if you haven’t used it from your PC.

Windows 10 is terrible at privacy. It is known to broadcast to 400 IP addresses. It’s not the OS to use to avoid privacy issues in Windows 11.

realitythreek2• 3 years ago

Edit: Wrong parent

mavhc2• 3 years ago

He compared it to Windows XP not Windows 10? What's the point?, we already know that Windows 10 collects all the data

dspillett5• 3 years ago

XP is a good baseline for comparison: it is the starting point of this lineage of Windows being what everyone had. 2000 was uncommon on the desktop for home or small/medium business use, NT even more so, those environments being sold 95/98 (and earlier 3.x) instead.

mavhc2• 3 years ago

But we're moving from Windows 10 to 11, are there any changes? Or is it just the same as Windows 10?

awinter-py• 3 years ago

flashback, but reminds me of this

https://slate.com/technology/2015/02/lenovo-superfish-scanda...

When Lenovo preinstalled Superfish adware on its laptops, it betrayed its customers and sold out their security. It did it for no good reason, and it may not even have known what it was doing. I’m not sure which is scarier. The various news reports of this catastrophe don’t quite convey the sheer horror and disbelief with which any technically minded person is now reacting to Lenovo’s screw-up. Security researcher Marc Rogers wrote that it’s “quite possibly the single worst thing I have seen a manufacturer do to its customer base. … I cannot overstate how evil this is.” He’s right. The Lenovo Superfish security hole is really, really bad.

'it did it for no good reason, and it may not have known what it was doing'

Incipient3• 3 years ago

As a developer that has has countless users spew bile at me for being unable to fix "it didn't save properly"...I'm quite split on the debate of telemetry.

pacifika3• 3 years ago

Perhaps allow a telemetry session from the help menu in that case

Incipient3• 3 years ago

No one actively goes in to enable telemetry. In the tech space, possibly. Dealing with people that don't know what a save icon is? They're not even capable of understanding telemetry let alone provide informed consent.

All the user knows is their button doesn't work, and they're angry.

mtlmtlmtlmtl3• 3 years ago

One of the many reasons I never run Windows natively any more. If for some reason I need it(rare), it's always in a VM, preferably with no internet access.

Turns out it was a good policy to have, because when I built a new desktop/home workstation system recently I happened to go with a gigabyte mobo, which has that firmware hole enabled by Windows essentially willy nilly downloading and installing whatever unsigned blobs you throw at it.

Had I ever installed windows directly on that machine, I would have had to assume every component with any form of non-volatile storage on it(i.e pretty much every component except maybe the CPU itself) was potentially compromised, making it useless as a workstation, at least in doing any kind of work for customers, which I prefer to do from home. Because once the firmware is compromised, all bets are off.

dantyti• 3 years ago

Is there a writeup of Windows enabling the firmware hole anywhere? I'd like to know more about this

mtlmtlmtlmtl3• 3 years ago

https://eclypsium.com/blog/supply-chain-risk-from-gigabyte-a...

phantompeace• 3 years ago

Just curious, how often do you audit the compilers that you use? Specifically, how often have you read the compiler source code line by line and when is the last time you compiled those compilers using known, clean compilers?

mtlmtlmtlmtl3• 3 years ago

Why, are you trying to argue that all security concerns are trivial because I can't check everything at all times?

charcircuit4• 3 years ago

The title and its contents don't match. The article is about DNS queries that Windows makes and does not actually look at the data being collected. These requests are also not even from telemetry. For example sb.scorecardresearch.com is likely from some browser or web view with msn.com.

This article is full of speculation and is trying to just appeal to paranoid people by trying to make Windows out to be doing something bad.

eur0pa• 3 years ago

Patiently waiting for 11 LTSC

mihaaly2• 3 years ago

But at least with the loads of available data on software usage and hard work they make their applications worse than before.

My latest 'favourite' is the snipping tool and how it became much more difficult to use. Also it is made for the default app for png at some point as well not having navigation (next/prev pic in a folder) showing itself in a thumbnail size by default, unsuitable for picture viewing and have to switch back manually to photos. From app settings it jumps back again to a thumbnail sized state, someone have a real fetish about this minimal size view out there in handling screenshots....

smusamashah• 3 years ago

Win + Shift + S is your friend. I use it all the time at work for quickly snipping anything and pasting in chat and notes and elsewhere.

mihaaly2• 3 years ago

The point was the usability degradation through an example not the ways of making screenshots...

FreshStart• 3 years ago

Microsoft is training the average office worker NN replacement? It would be incredibly ironic if the house of excel and word, created the machines to do away with them forever, for a price.

Tepix• 3 years ago

Clearly we are watching the enshittification of Microsoft operating systems.

At first, the user was the customer. These days we have ads and user data that microsoft earns even more money with.

Has microsoft already started screwing over developers? I'm not paying attention.

Anyway, this slow-mo trainwreck is painful to watch.

rekabis• 3 years ago

Win10Privacy can turn off the vast majority of these data spigots.

The downside is that it’s a pretty advanced tool that can seriously screw up your system if you don’t know what you are doing. For example, several settings require Office to be already installed, otherwise it will never successfully install with those settings enabled. Plus, you need to make note of them to back them out in case you ever want to upgrade to the next version.

But otherwise, it’s an awesome product that can effectively lock down both Windows 10 and 11.

Windows 11 collects an awful lot of telemetry about your PC

Related Stories