Research Finds Microsoft Edge Has Privacy-Invading Telemetry

Antus67

Level 9
Thread author
Verified
Well-known
Nov 3, 2019
413
While Microsoft Edge shares the same source code as the popular Chrome browser, it offers better privacy control for users. New research, though, indicates that it may have more privacy-invading telemetry than other browsers.

According to Microsoft, telemetry refers to the system data that is uploaded by the Telemetry components or browser's built-in services. Telemetry features aren't new to Microsoft and the company has been using Telemetry data from Windows 10 to identify issues, analyze and fix problems.

Professor Douglas J Leith, Chair of Computer Systems at Trinity College in Ireland, tested six web browsers to determine what data they were sharing. In his research, he pitted Chromium-based Microsoft Edge, Google Chrome, Brave, Russia's Yandex, Firefox and Apple Safari.

Unfortunately, Microsoft Edge didn't perform well in various privacy tests.

Too much telemetry in Microsoft Edge
When testing the Edge Browser, Leith saw that every URL that was typed into Edge would be sent back to Microsoft sites.

For example, every URL typed into the address bar is shared with Bing and other Microsoft services such as SmartScreen. This was confirmed by BleepingComputer who used Fiddler to see the JSON data being sent to Microsoft.

This could be fixed by using a technique similar to Google's Safe Browsing implementation that downloads a a list of known malicious sites and saves it locally. This list is the checked by the browser and if any data needs to be sent to Google's servers, will only send a hashed partial URL fingerprint that can be used to track browsing behavior.

The browser also sends unique hardware identifiers to Microsoft, which is a "strong and enduring identifier" that cannot be easily changed or deleted.

Russian web browser Yandex is also engaged in similar anti-privacy activities:

From a privacy perspective Microsoft Edge and Yandex are qualitatively different from the other browsers studied. Both send persistent identifiers than can be used to link requests (and associated IP address/location) to back end servers. Edge also sends the hardware UUID of the device to Microsoft and Yandex similarly transmits a hashed hardware identifier to back end servers. As far as we can tell this behaviour cannot be disabled by users. In addition to the search autocomplete functionality that shares details of web pages visited, both transmit web page information to servers that appear unrelated to search autocomplete.
It's important to note that Microsoft Edge for Enterprise gives administrators a lot of control in deployments to disable all these trackers, but the trackers are enabled by default in all Edge installations.

While Microsoft Edge didn't fare well in the tests, the researcher has also questioned Chrome's and other browser's behaviour.

Users have previously noticed that Chrome scans the entire computer and reports hashes of executable programs back to Google to build Chrome's Safe Browsing platform.

Chrome, Firefox and Safari share details of every webpage you visit with their services. All these browsers use autocomplete feature to send web addresses to their services in realtime.

Firefox's telemetry transmissions, which is silently enabled by default, can potentially be used to link these over time. In Firefox, there is also an open WebSocket for push notifications and it is linked to a unique identifier, which could be used for tracking, according to the researcher.

Source:Research Finds Microsoft Edge Has Privacy-Invading Telemetry
 

Stopspying

Level 19
Verified
Top Poster
Well-known
Jan 21, 2018
814
I don't trust even Google's SafeBrowsing. I don't trust ANYTHING that connects back to Google. Just my IP pinging Google's anything is what I don't want to happen.
I'm completely in agreement about not trusting anything to do with G**gle. Unfortunately they have their fingers in so many pies that avoiding them 100% more or less means being offline.

As for Edge, Microsoft and Bing combining to relay telemetry and other information back to base about users; I am not surprised and its why I've never used Edge either. With all of the telemetry in full-fat Win 10 I was not expecting anything else from Microsoft to be clean either
 

TairikuOkami

Level 35
Verified
Top Poster
Content Creator
Well-known
May 13, 2017
2,453
For example, every URL typed into the address bar is shared with Bing and other Microsoft services such as SmartScreen.
And people wonder, why I block those. I would like to keep at least some privacy, or at least pretend, that I do. :)
Users have previously noticed that Chrome scans the entire computer and reports hashes of executable programs back to Google to build Chrome's Safe Browsing platform.
Yandex once tried to implement HIPS into the browser to protect it. While it worked great from a security perspective, it was way too intrusive.
I don't trust ANYTHING that connects back to Google. Just my IP pinging Google's anything is what I don't want to happen.
Same, blocking ports 5222 and 5228 is basics using chromium based browsers. I have allowed 5222 to connect only to Yandex servers for sync.
 

Marko :)

Level 20
Verified
Top Poster
Well-known
Aug 12, 2015
954
While Microsoft Edge shares the same source code as the popular Chrome browser, it offers better privacy control for users. New research, though, indicates that it may have more privacy-invading telemetry than other browsers...
Users probably be like "so what?!?! everyone collects data", and I'm like "then why are you using "privacy-oriented" web browser"?

giphy.gif

I don't trust even Google's SafeBrowsing. I don't trust ANYTHING that connects back to Google. Just my IP pinging Google's anything is what I don't want to happen.
Why?
Google SafeBrowsing doesn't collect URL of every page you visit, nor it sends to Google in any way. Instead, it downloads a list containing malicious websites every time you launch the browser, and checks for a match locally, on your device. If it finds a match, only part of URL is hashed and sent to Google, so even they don't know exact website you've visited.

Screenshot_1.png
 

Lenny_Fox

Level 22
Verified
Top Poster
Well-known
Oct 1, 2019
1,120
Please help me understand correctly, when I disable below options, Edge does not send URL to Microsoft (source1 and source2)

1584352061102.png

1584352568241.png


To compensate Smartscreen being disabled:
  1. Install AdGuard (only enable Peter's Low and your EasyList country specific filter when you use Edge anti-tracking) and enable Adguard's Browsing Security which is based on Google Safe Browsing (and when I am correct also Yandex's Safe browsing).
  2. Enable WD's network protection using ConfgureDefender
  3. Disable executable code download from insecure websites: edge://flags/#treat-unsafe-downloads-as-active-content
    95% of the malware is distributed from insecure (HTTP) websites. When you don't want to use Adguard you could use the Edge flag to prevent executable downloads from insecure sources, but (WARNING) this also blocks downloads from Microsoft's own extension webstore (yes it is ridiculous and typical Microsoft).
 
Last edited:

DDE_Server

Level 22
Verified
Top Poster
Well-known
Sep 5, 2017
1,168
Same, blocking ports 5222 and 5228 is basics using chromium based browsers. I have allowed 5222 to connect only to Yandex servers for sync.
so @TairikuOkami shall i block the ports you pointed out in your post for google chrome.i read in this form that if port 5222 it fall back to 443 for google chrome sync service may i try it
 

Marko :)

Level 20
Verified
Top Poster
Well-known
Aug 12, 2015
954
I will never understand the fear against telemetry. People forget that many cloud services depend upon it.
To be honest, I have nothing against telemetry if it doesn't send any data that could be used to identify the user and if it's really being used to enhance the product (and not for selling data to 3rd parties). Company has to be fully transparent to get my trust.

There are few reasons why I don't trust Microsoft;
1. Up until Windows 10 version 170x (don't remember exactly what version), we didn't know what data telemetry really sends. After a while, they released the list containing code strings which are collected. The problem is that average computer user still doesn't know exactly what data is collected as the published list can only be understood by the developers.

2. Microsoft uses telemetry to enhance Windows and yet Windows Updates are still more buggy than ever. Windows 7 got telemetry too (when Windows 10 came out) even though the OS itself wasn't in active development.

3. They were using malware-like tactics to get users to install Windows 10. They pushed users to install Windows 10. They even made Windows 10 recommended update so huge number of people simply woke up to the new OS. Some even lost their data because the installation was broken.

4. And last, more recent. The new Edge was caught sending full URLs of visited websites and tying them to user account IDs. Sure, Microsoft stopped tying URLs to user accounts, but full URLs are still being collected.
Check out more information regarding this on Bleeping Computer.
 
Last edited:
F

ForgottenSeer 72227

Interesting!

Playing devils advocate here, has MS been caught doing anything with said telemetry other than they said it was being used for? I'm not saying this is ok, or making excuses for MS, but if they say they are using the data to help improve smartscreen and using it to better their Bing search results, I don't see a major issue tbh.

It's not like Avast who was caught selling the data to 3rd parties.

Again not saying this is ok, but in all honesty it seems blown out of proportion a little, that's just my opinion.
 

Marko :)

Level 20
Verified
Top Poster
Well-known
Aug 12, 2015
954
Interesting!

Playing devils advocate here, has MS been caught doing anything with said telemetry other than they said it was being used for? I'm not saying this is ok, or making excuses for MS, but if they say they are using the data to help improve smartscreen and using it to better their Bing search results, I don't see a major issue tbh.

It's not like Avast who was caught selling the data to 3rd parties.

Again not saying this is ok, but in all honesty it seems blown out of proportion a little, that's just my opinion.
Well;
  • they did say collected URLs in Edge won't be tied to user accounts, yet they were
  • when Windows 10 came out, no one knew it was collecting data way more than previous versions of Windows and that there will be a lot of preinstalled 3rd party apps
  • they never said Windows 10 has ads built-in
  • they didn't immediately release information for what is telemetry used and what exactly it sends to Microsoft's servers
  • they did say telemetry helps solving issues and improving updates, yet they are still buggy and causing a lot of problems
These are just a few examples why I don't trust Microsoft. Of course, there are plenty more of these. And, keep in mind, the real issue isn't telemetry. It's the data which is collected by telemetry but isn't necessary for product development. Just take a look what Full setting (which is set by default) sends to Microsoft; you'll understand what are we talking about.

 
L

Local Host

Interesting!

Playing devils advocate here, has MS been caught doing anything with said telemetry other than they said it was being used for? I'm not saying this is ok, or making excuses for MS, but if they say they are using the data to help improve smartscreen and using it to better their Bing search results, I don't see a major issue tbh.

It's not like Avast who was caught selling the data to 3rd parties.

Again not saying this is ok, but in all honesty it seems blown out of proportion a little, that's just my opinion.
Considering Microsoft success with Microsoft Edge (Chromium), I'm not surprised to see articles like this, reminds me of Windows 10 release were the media had nothing to complain about so they turned to telemetry as well.
 

Marko :)

Level 20
Verified
Top Poster
Well-known
Aug 12, 2015
954
Experienced issue with videos showing as black screen when I first upgraded to Windows 10, yet that issue was mysteriously fixed a few days later without me doing anything. I would like to believe it was due to the telemetry that was send.
If you had problems playing videos inside of the web browser, developer of the browser fixed the issue, not Microsoft. After all, to fix something in Windows, Microsoft has to send update through Windows Update otherwise it cannot be fixed. Web browsers (like Chrome) silently install updates; you don't even get notified once update is ready or is installed.
Considering Microsoft success with Microsoft Edge (Chromium), I'm not surprised to see articles like this, reminds me of Windows 10 release were the media had nothing to complain about so they turned to telemetry as well.
Yeah, media is always the bad guy and not the company collecting user data. 🙄
 
Last edited:
F

ForgottenSeer 72227

Well;
  • they did say collected URLs in Edge won't be tied to user accounts, yet they were
  • when Windows 10 came out, no one knew it was collecting data way more than previous versions of Windows and that there will be a lot of preinstalled 3rd party apps
  • they never said Windows 10 has ads built-in
  • they didn't immediately release information for what is telemetry used and what exactly it sends to Microsoft's servers
  • they did say telemetry helps solving issues and improving updates, yet they are still buggy and causing a lot of problems
I hear what you are saying and your not wrong.

For me it's about looking at the bigger picture. There are way more data harvesting issues on the internet in general that make this look completely innocent by comparison. I mean the likes of Google, Facbook, heck even your bank knows more about you than you do and they didn't get that info from MS.

To be fair, aside from the user ID issue, MS seems to be using the data the way they said they are using it for, as no one has proven otherwise. The whole issue about not telling us initially is MS fault, but in all honesty that was just your typical big brother talk, "oh man they must be doing something nefarious because... gulp oh man, they didnt tell us, gulp, gulp oh man the police are at my door."

In regards to fixing issues:
1. They got rid of the QA team, (or the vast majority of it anyways), so that one explains itself.
2. The windows ecosystem is so complex, with an infinite number of hardware/software configurations, makes it impossable to test every scenario.
3. They can stop all this data collection and I will bet you every dollar that I have that this wont stop the bugs/issues from happening. That's just the nature of the beast especially for Windows.


Yeah, media is always the bad guy and not the company collecting user data. 🙄

The whole issue about media is correct to a degree. MS is just the tech media's whipping boy for anything and everything. Some of which is their fault, others are just looking to make headlines.

Let's be real here, the new version of Edge has people talking because it's an excellent browser. You have Google trying to still push people away because they know that MS hit this one out of the park. Then you have skeptics that will do anything and everything to hate on MS and will look for any fault and run with it no matter how small it is.

I'm not saying this is what happened here, but the timing is a little funny and further more, what about the original Edge? No one complaining about that one and my guess is that it was doing the same thing. :whistle: (whistling quietly away).
 
Last edited by a moderator:

Ink

Administrator
Verified
Staff Member
Well-known
Jan 8, 2011
22,361
Bumping thread before an influx of new "MS Edge fails Privacy test" threads.

Source: Microsoft Edge browser flunks privacy test, Redmond cries foul
  • A new study about browser privacy ranks Microsoft Edge last among several popular browsers.
  • A critical difference between Edge and other browsers is that Edge sends data about people's hardware.
  • Microsoft seems to disagree with the findings, or at least the conclusions people took from them.
 

Aggravatorx

Level 4
Verified
Well-known
Jan 30, 2013
204
I think no matter what browser you use they all do it as mentioned above its like the saying free security program is it ask Avast
that question these browsers have to survive somehow they are free and if its from putting some ads in that i just shopped for better that then something i dont like .

and off topic but a browser has any one checked out opera gx game browser it is cool if you are a gemer has a huge gaming start page and have your system with lights or like themes


GX DESIGN
You can customize your browser with any color you want and choose from different special effects and themes.



GX SOUND
Opera GX has in-browser sound effects, composed in collaboration with sound designer Rubén Rincón and the band Berlinist, who recently received a nomination in the BAFTA Games Awards for the original game soundtrack to Gris. Sound effects can be toggled on and off in the settings.




1585053146103.png
 
F

ForgottenSeer 72227

Bumping thread before an influx of new "MS Edge fails Privacy test" threads.

Source: Microsoft Edge browser flunks privacy test, Redmond cries foul
  • A new study about browser privacy ranks Microsoft Edge last among several popular browsers.
  • A critical difference between Edge and other browsers is that Edge sends data about people's hardware.
  • Microsoft seems to disagree with the findings, or at least the conclusions people took from them.

I want to hear more from MS on this study, but from what they've said so far makes sense. The problem I have with this study and those that like to cry foul, is that the simple fact that all they have proven thus far is that data is being sent home. Everything else is based on assumptions with no proof. For example, people read this study and they assume that MS is doing something nefarious with the data (ie: selling it, tracking your every move, reporting you to the police, etc....), but no one, including this study has proven any of that. Again I am not saying it's ok, but if all it's being used for is to improve the product and nothing else, who cares. As MS said, you can easily delete this data, and turn it off if you want.
 
Last edited by a moderator:
L

Local Host

I think no matter what browser you use they all do it as mentioned above its like the saying free security program is it ask Avast
that question these browsers have to survive somehow they are free and if its from putting some ads in that i just shopped for better that then something i dont like .
There's not much in terms of costs when it comes to maintaining a Chromium Browser, especially for companies like Microsoft which have other sources of income, now companies like Brave, Vivaldi and others which rely entirely on the browser that are another history.
I want to hear more from MS on this study, but from what they've said so far makes sense. The problem I have with this study and those that like to cry foul, is that the simple fact that all they have proven thus far is that data is being sent home. Everything else is based on assumptions with no proof. For example, people read this study and they assume that MS is doing something nefarious with the data (ie: selling it, tracking your every move, reporting you to the police, etc....), but no one, including this study has proven any of that. Again I am not saying it's ok, but if all it's being used for is to improve the product and nothing else, who cares. As MS said, you can easily delete this data, and turn it off if you want.
Is exactly the same as all the studies which targetted Windows 10, all it takes is Windows 10 connecting to Microsoft Servers to check for updates that everyone starts whining is collecting data on you.
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top