Dutch DPA's use of Microsoft's Data Viewer Tool reveals that no Windows 10 telemetry is anonymous

[captain_to_fire]

@Delicieuxz Did you have a phone conversation with the Dutch DPA or is it via email? Is it okay to share the private correspondence? 

[ElZamo92]

Well, Jerry (AKA BarnaculesNerdgasm) warned us about this about half a year ago. 

   

[Taf the Ghost]

40 minutes ago, Kumaresh said:

Yet another win for the tin foil hats...... At this point, it would seem that I would be best informed about tech by reading stuff from Julian Assange, /pol/ and The_Donald

/pol/ sees all. Laugh at the power of weaponized autism at your own peril.

 

On topic, this isn't too surprising. It was pretty clear the depth of the telemetry, at the beginning, was simply too much. Your real IP + some login names are enough to start connecting you to databases of IDs.  But that's also not the real issue, going forward.

 

Who could get the data? We know the NSA has it, since they actually do signal intercepts. (Pre-Snowden, they didn't encrypt intra-business traffic across the backbones, as the only people that could tap that? Yeah, just a few intelligence services.) Who else? And it's going to get really fun with someone in a court case demands information from M$FT. Or a criminal case.

 

I didn't migrate to Win 10, mostly for this reason. 

[divito]

A good chunk of this has been mentioned before. There are several articles, including this one that were made quite some time ago and go over some or most of what's mentioned here.

As for all that, all I can really say is meh; Microsoft is far from the only company collecting identifying information about our technology usage.

[SansVarnic]

Welcome to the cloud people.

Apple and Google did it then MS hopped on and followed suit. It was inevitable.

 

I may use Win10 but I have my reasons, but I will say that FB is far far worse than Apple, Google or MS in this aspect.

[captain_to_fire]

10 hours ago, SansVarnic said:

I may use Win10 but I have my reasons, but I will say that FB is far far worse than Apple, Google or MS in this aspect.

Given how Facebook usage is correlated to depression notwithstanding the fact that Facebook doesn’t really respect user privacy, I could see a future when EU countries will demand ISPs to block Facebook. 

 

[SansVarnic]

OT: My question though is was this test conducted on a fresh install with all telemetry opt in or out? that makes a difference.

[mr moose]

5 hours ago, Syntaxvgm said:

I made my first facebook account today for my new job, because I was forced to. Still salty. Didn't use anything but my first name and DOB. New email. No phone number, Never been on that connection before. New computer. 

Immediately got friend suggestions for family, classamtes in college, and even people I hadn't seen in years. 

They bought advertising data for that. 

An advertising ID is just to tie all the data from source, and when you have multiple sources you can very easily figure out which two users from different data sets are the same. You need VERY little info to uniquely identify someone. First name and DOB are enough to uniquely identify a large portion of the US population, and my location in the same town was icing on the cake. 

Yep, they can get all that info from cookies too, you buy anything from amazon, ebay or just visit a handful of web stores and the data is all matched up just the same (even if you use linux).  

[samcool55]

4 hours ago, Jito463 said:

*glances back and forth at image*

I'm guessing most of that is in Dutch, because only one word that I can see is in English.

Actually "dis gon be gud" isn't Dutch at all

It's just botched english for "This is going to be good".

 

Rough "correct" translation would be "'Dit gaat goed zijn / Dit gaat goed worden" but it's not something the average dutch guy would say. It's more likely they will say something like "Dit gaat interessant worden" which means "This is going to be interesting".

[dfsdfgfkjsefoiqzemnd]

4 hours ago, SansVarnic said:

My question though is was this test conducted on a fresh install with all telemetry opt in or out? that makes a difference.

from the PDF file :

 

Quote

In September 2016 and at the end of December 2016, the Dutch DPA obtained its own temporary copy of the tool, and performed a number of activities in

8 different scenario's (that is, with or without Microsoft account, basic, enhanced or full telemetry, device in or out sample).
In December 2016, the Dutch DPA also specifically tested switching off other settings after installation.
The Dutch DPA performed these activities on the Anniversary update version of Windows 10 Pro

 

Quote

Between May and June 2017, the Dutch DPA obtained a new temporary copy of the tool, and performed a number of activities in

9 different scenario´s in the Creators Update (with or without Microsoft account, basic or full telemetry, device in or out sample, and 1 privacy paranoid setting, with all options manually turned off, including 'Smartscreen' in the browser Edge

 

I'd say they've tested plenty of options, including one where everything was turned off.  If the "privacy paranoid setting" didn't send data, they would have mentioned that users can turn off the data collection.  So it sounds like Win10 is still collecting identifiable data even if you turn everything off.

[Delicieuxz]

11 hours ago, M.Yurizaki said:

I'm trying to figure out how a bunch of randomly generated numbers can be tied to me personally then.

Because with a local account, and with telemetry set to the Basic level, the data Microsoft collects still includes:

 

Multiple device IDs
A local user ID
Your installed hardware and software, including drivers and the names of the manufacturers
Your region and your lanugage settings
A list of other devices connectes on the same network as your system
A list of what web browser you have set as default and your most commonly-used applications

 

And still more.

 

6 hours ago, hey_yo_ said:

@Delicieuxz Did you have a phone conversation with the Dutch DPA or is it via email? Is it okay to share the private correspondence? 

I don't have any specific permission to share our correspondence. What's posted is what's immediately pertinent, though.

[Mihle]

I hope EU go after it and make it stop, in other companies as well.

[Mihle]

I have a question, is the reason why I have not seen any adds at all in Windows 10 because I have 10 Pro, or because I am in Norway or something? Anyone knows?

[Delicieuxz]

36 minutes ago, Mihle said:

I have a question, is the reason why I have not seen any adds at all in Windows 10 because I have 10 Pro, or because I am in Norway or something? Anyone knows?

AFAIK, the only reason you should not be seeing ads in Windows 10 Pro is because you have done things to remove and disable them.

 

But, if you haven't, then I don't know why.

[captain_to_fire]

43 minutes ago, Mihle said:

I have a question, is the reason why I have not seen any adds at all in Windows 10 because I have 10 Pro, or because I am in Norway or something? Anyone knows?

You can opt out of advertising in Windows 10.

[captain_to_fire]

49 minutes ago, Mihle said:

I hope EU go after it and make it stop, in other companies as well.

Other tech companies like Google and Apple have followed the EU rulings already. Microsoft on the other hand is stubborn.

[Jito463]

5 hours ago, samcool55 said:

Actually "dis gon be gud" isn't Dutch at all

It's just botched english for "This is going to be good".

 

Rough "correct" translation would be "'Dit gaat goed zijn / Dit gaat goed worden" but it's not something the average dutch guy would say. It's more likely they will say something like "Dit gaat interessant worden" which means "This is going to be interesting".

_{*psst* I was being sarcastic.} 

[samcool55]

1 hour ago, hey_yo_ said:

You can opt out of advertising in Windows 10.

-snip-

-snip-

You can partially opt-out but not enough to go fully anonymous. Even going full paranoid and turning off everything manually isn't enough. There's still enough data send to uniquely identify you. Halfway page 2 there's a nice post from Capitain Chaos with quotes from the PDF that explain the DPA used multiple scenario's and the result was basically always the same.

[captain_to_fire]

1 minute ago, samcool55 said:

You can partially opt-out but not enough to go fully anonymous. Even going full paranoid and turning off everything manually isn't enough. There's still enough data send to uniquely identify you. Halfway page 2 there's a nice post from Capitain Chaos with quotes from the PDF that explain the DPA used multiple scenario's and the result was basically always the same.

Well he's asking on why ads no longer appear in his PC. But yeah even with basic telemetry it still contained personalized telemetry data.

[Mira Yurizaki]

4 hours ago, Delicieuxz said:

Because with a local account, and with telemetry set to the Basic level, the data Microsoft collects still includes:

 

Multiple device IDs
A local user ID
Your installed hardware and software, including drivers and the names of the manufacturers
Your region and your lanugage settings
A list of other devices connectes on the same network as your system
A list of what web browser you have set as default and your most commonly-used applicationsi

If one never provided any personally identifying information such as a name or some sort of ID number that is tied to them (e.g., SSN, DL#), then how can you use this information to go "Yup, that's John Doe at 1234 Main St. Podunk, XX, USA"?

[Mihle]

2 hours ago, Delicieuxz said:

AFAIK, the only reason you should not be seeing ads in Windows 10 Pro is because you have done things to remove and disable them.

 

But, if you haven't, then I don't know why.

I haven't done anything to remove them at all.

 

Only thing I have ever done is turning those "use my data to make windows better" or whatever off. And  Cortana is off via windows setting.

[Mihle]

2 hours ago, hey_yo_ said:

You can opt out of advertising in Windows 10.

 

Oh, if that setting turn ads of, why do people complain about adds? Isn't those the settings you get when installing windows 10? One thing is the collection of data, another is ads.

I didn't remember that there was all those settings btw and I don't know what I have them on.

 

I have never seen any kind of win 10 ads on my computer.

[captain_to_fire]

3 minutes ago, Mihle said:

Oh, if that setting turn ads of, why do people complain about adds? Isn't those the settings you get when installing windows 10? One thing is the collection of data, another is ads.

I didn't remember that there was all those settings btw and I don't know what I have them on.

 

I have never seen any kind of win 10 ads on my computer.

I don't know. I know some parts of Windows 10 is problematic but I want to be factual as well. I don't see ads on my PC like in Start menu where I used to see it.

[LAwLz]

3 hours ago, Mihle said:

I have a question, is the reason why I have not seen any adds at all in Windows 10 because I have 10 Pro, or because I am in Norway or something? Anyone knows?

Some ads are only for specific countries, for example I believe the super bowl ad was only in the US.

Most if not all ads can be turned off, but the options to do so are very spread out.

[Delicieuxz]

1 hour ago, M.Yurizaki said:

If one never provided any personally identifying information such as a name or some sort of ID number that is tied to them (e.g., SSN, DL#), then how can you use this information to go "Yup, that's John Doe at 1234 Main St. Podunk, XX, USA"?

Well, every PC connected to the internet has an IP address, which locates that specific PC in the world. Also, the Windows installation process gives your system an ID, and gives your offline user account a hidden ID, which are included with telemetry that is sent to Microsoft.

 

And your installed apps, app usage, and Windows settings are like a fingerprint, which is also sent along with telemetry your system send to Microsoft. So, even if Microsoft doesn't have your particular name, or if you haven't added you address to your PC, any data that comes from your PC includes the identifiers for your particular PC, user account, location, etc.