Data Collection
0:00
so it's commonly said that Windows is a
0:02
form of spyware but how bad is it really
0:05
and what is it really sending home
0:07
that's what we're going to learn one of
0:08
the things I've seen a lot of videos
0:10
that will simply show that Windows sends
0:11
a lot of requests but what they don't
0:13
know with a custom SSL certificate
0:16
installed on the VM it is possible to
0:18
actually find out what it is saying not
0:21
just that it is saying so that's what
0:23
we're going to do so we're going to see
0:25
what actions in Windows trigger calls
0:28
and what data is actually
0:31
so first of all the main one that people
0:33
are probably a bit alarm to learn is it
0:37
doesn't matter if you're doing anything
0:39
online or not if you type anything in
0:42
this box on
0:43
Windows look what happens so let's say
0:46
you want to open up
0:47
paint
0:49
paint okay now note all these API calls
0:53
now it's pretty obvious that this is uh
0:56
going somewhere we can tell pretty
0:58
clearly this is being as API Windows
1:01
Cortana pain okay so how does this
1:05
actually
1:06
work so a bunch of bunch of codes this
1:09
is just for authentication for this API
1:13
a cookie okay that's another way of
1:17
identifying the user agent which is not
1:20
which is totally standard and here we go
1:23
so our language of course in our country
1:27
uh I I'm not entirely sure what the
1:29
these are probably just uu IDs and if we
1:33
go to the
1:35
response we can see a few things ranking
1:41
signals suggestions so this is if you
1:43
were using a web browser this would be
1:45
what the Omni box would show and it kind
1:48
of correlates we got paint
1:52
paint CC event counts okay this is I
1:56
guess like the ai's confidence and what
1:58
we want uh resources okay
2:03
suggestions and it seems that this is
2:06
only what is pulled from the web but it
2:09
means that there is an API call going
2:12
every single time which is not great uh
2:17
it also with a prefetch confidence I it
2:19
would preload it to make it faster now
2:21
we can see if we can trigger that with
2:22
something that is more likely to be an
2:24
internet so if you ask if you put
2:27
YouTube
2:28
in okay prediction shown uh oh and it
2:33
does pull that
2:35
up this is the actual uh first query
2:39
that triggered the second one uh
2:42
suggestions additional info text video
2:44
sharing platform
2:46
okay and that is something that comes
2:49
from
2:50
this and
2:52
then we go
2:55
down we can see the prefetch confidence
3:01
and that is what triggers it actually
3:04
calling the Bing search and opening that
3:07
page is if the prefetched confidence is
3:09
high enough now I'm not sure if we can
3:10
open CoPilot without a Microsoft account
3:12
but let's see what happens if we do
3:14
what's good pizza near me and I don't
3:16
know what whether it's going to use my
3:17
real location or the uh oh I guess I
3:23
will never know the answer cuz I hit my
3:25
conversation look so let's see what else
3:27
might
3:28
trigger hits
3:32
so does so what other ways of opening
3:36
programs we can hit Windows key L no
3:38
head so far now what if we open a
3:42
program okay opening the command prompt
3:44
doesn't doesn't trigger
3:46
oh oh okay that goes to SM screen and
3:51
now we're sending a bunch of stuff off
3:53
to install
3:55
office now I'm going to guess that's
3:57
just cuz I recently installed this VM
3:59
that's probably not actual so if we
4:02
wanted to actually open
4:04
paint oh instant hit there positive but
4:08
that felt too convenient okay oh meta
4:14
Services whatever that is doing is quite
4:17
encrypted now let's open up
4:19
settings oh instant hit oh and that's to
4:25
get the tips but it actually didn't work
4:27
so now let's let's see see so for
4:30
example some people think that Windows
4:33
is phoning home cuz Microsoft seems to
4:35
know uh the popularity of various
4:37
personalization settings so let's try
4:39
and see if that's true so one simple
4:41
thing we can do that a lot of people on
4:43
Windows 11 will do is we can move tuskar
4:47
to the
4:51
left okay no hits so far on
4:54
that doesn't mean that they don't
4:57
oh did Mark okay
5:02
so far so good now of course what we
5:05
can't so easily prove as well with t Tre
5:08
is if it's not being sent instantly but
5:11
being rolled up that could still happen
5:14
okay these are just ABS or silently
5:17
installing in the background happen now
5:19
what if we open File
5:23
Explorer uh now of course CU it's got
5:26
one drive built in that triggers a coal
5:28
but nothing
5:30
else seemingly
5:34
problematic metadata
5:38
s see I don't
5:41
oh I don't know what that file is
5:44
containing looks like oh okay okay let's
5:48
take a closer look at this
5:51
file now I don't know why it's not
5:53
showing up properly there but it does
5:55
here okay device metadata batch request
5:59
so it's just sending some information
6:01
that's generated a hardware
6:04
ID local print queue okay nothing super
6:08
interesting but this meta Services
6:09
domain is probably at least a p of where
6:13
some of our data is going now I guess
6:16
the next interesting question now that
6:18
we've uh determined that Windows spying
6:22
does not seem to be fake
6:24
oh whoosh let's try out some of these uh
6:29
anti-spying tools so if you download o
6:32
Ando shut up 10 which is one of the more
6:35
popular ones that claims it can make
6:37
Windows 10 not do this let's see how
6:40
well it works
6:42
and of course you're going to have there
6:44
there's different kinds of spying and
How to Reduce the data collection with O&O shutup 10
6:46
some of it you might be more okay with
6:48
like small screen for example is quite
6:51
uh you know that's going to send files
6:54
that's never seen before but that's for
6:56
antivirus that that's a lot more
6:58
desirable than say for advertising
7:01
in Type transmission of typing
7:09
information that's a bit concerning
7:11
let's see if we can can we reproduce
7:13
this okay so far so good but that is
7:17
concerning if that is
7:20
at okay no it's just more updates
7:24
[Music]
7:25
suggestions uh
7:29
I don't care this is VM so yeah we'll
7:32
definitely want to get rid of that get
7:33
rid of that get rid of
7:35
that now that we saw that was actually
7:38
something we saw happen over the wire
7:40
live disable suggesting to finish setup
7:44
of device okay app notifications local
7:54
language I don't use the software
7:56
keyboard but if you do you might not
7:57
want to turn that off okay to access to
8:00
local language
8:05
browsers no I'm not going to kill that
8:10
uh I I don't find that to be necessary
8:13
uh most websites can tell your you speak
8:15
English but probably doesn't matter
8:16
anyways if you don't use Edge okay
8:19
disable storage of clipboard
8:22
History app access user account
8:24
information
8:25
yeah device location yeah if you're
8:28
using a desktop disabl if you're using a
8:30
laptop maybe not uh these two I
8:34
believe I I don't use voice Comm
8:43
on these are not Windows related these
8:45
are just going to be and this doesn't
8:49
matter yeah I I don't like
8:52
synchronization of Windows settings for
8:53
a lot of reasons disable
8:57
Cortana okay
9:05
yeah I don't use copilot but if you do
9:07
you might want to leave
9:10
that yes this is this is I think some of
9:13
the worst
9:15
fenders oh did we just get a hit for
9:19
that before we even ran
9:25
it now this is how we killed but yeah
9:29
you might find that useful and my my
9:32
general like pragmatic view is that a
9:33
lot of this is kind of a tradeoff like
9:36
I'm not personally that worried about
9:39
all of this
9:42
information
9:44
but I'm also
9:47
not thrilled about this level of
9:52
collection now let's see loc machine yes
9:56
this is this is another one you should
9:59
not disable if you have a device that
10:00
uses it I
10:02
don't yes don't want any of
10:08
this now this is the app privacy ones to
10:11
be clear these are for apps not directly
10:13
windows so I'm not as
10:15
concerned we
10:18
yeah definitely say no to
10:22
that the rest of these are kind of
10:24
homeless
10:30
and these are all going to depend like
10:31
disabling online speech recognition if
10:33
you use speech recognition is probably
10:34
not a good
10:41
idea another one you probably do not
10:44
want
10:46
enabled this one as well this
10:50
is basically it allow your computer to
10:53
upload to other computers I I don't know
10:55
why that is a default enabled other than
10:56
it saves Microsoft money on bandwidth
10:59
this one probably don't want I would not
11:01
enable the rest updates are important
11:03
for
11:05
security and these just depends I I use
11:08
it some people
11:10
don't yeah these are useless in my
11:15
opinion get rid of
11:18
that uh and that should be good to
11:24
go now that we've set this up let's
11:27
reboot
11:30
okay so we're still getting a few live
11:31
hits now let's try typing something in
11:34
St menu
11:38
again zero activity so that is no longer
11:43
being sent over the wire now let's try
11:45
opening oh those are just updates okay
11:48
let's try opening our settings
11:50
up that still does send a call but it
11:53
seems like whatever API this was going
11:55
to is
11:58
dead and now we're getting a hit to
12:00
being on the settings
12:03
task okay that's kind of weird
12:06
but definitely less
12:09
activity now let's just see what are
12:11
Telemetry
12:14
settings all of this is
12:18
off
12:23
good and you can also ask them to delete
12:26
it now that doesn't send any request
12:29
okay now none of this is oh oh something
12:33
something got hit
12:42
up the throws an error
12:46
okay so it seems it definitely seems
12:49
like we're getting a lot less activity
12:51
uh let's try opening task manager of
12:54
course when you open Edge you're still
12:55
going to get a ton of hits but that's
12:57
more acceptable so it does seem like o
13:00
and shut up does do quite a bit and gets
13:03
rid of quite a
13:04
bit that's going to be all for now I
13:07
hope this was interesting in terms of
13:09
knowing what data does Windows actually
13:11
collect

summarize in a list in detail