Author Topic: Windows 10 Privacy Concerns (Read 120,864 times)

4wd · « **Reply #75 on:** September 01, 2015, 06:14 AM »

Quote from: bit on August 31, 2015, 07:10 AM

How about a nice DC coding snack macro to do it all automatically for Win 7, 8, and/or 10?

See here for an updated version.

bit · « **Reply #76 on:** September 02, 2015, 01:41 AM »

^That is really awesome. I'll see if I can figure out how to do it.
I do have questions, in case anyone can please help:
Will ^this 'elevated powershell' program work in Windows 7?
(One of the above links speaks only of running in Windows 8.
What does 'elevated' mean or refer to, please?

I already found one of the four spyware updates waiting to be installed on my Win 7 Pro (which has updates turned off), and set it to be 'hidden'.

Here are some YT vids about the Win 10 spyware scene;
Windows ten spying on every image you look at.
Top 5 Reasons To Not Upgrade to Windows 10
^btw, this guy hates 'Cortana'.

Would anybody mind if I posted my pix of 'Ex-Machina' & 'Ex-Cortana' here?
I worked so hard on it, and pic-mods like this usually don't come out so well.
To really understand what the pix mean, you need to see the film 'Ex-Machina', and I'm not giving spoilers.
BTW, I did say I was going to adopt a 'wait & see' attitude towards the 'free' Windows 10 upgrade, but I make no special claim to being smarter than anybody else; I still haven't 'upgraded' to owning a cellphone either, so it's more 'attitude' for me than 'smarts'.

bit · « **Reply #77 on:** September 02, 2015, 01:47 AM »

Cortana is an interactive virtual AI 'helper' created by Microsoft for Windows Phone 8.1 (where it now supersedes Bing Mobile), Microsoft Band, Windows 10, and coming to iOS, Android, and the Xbox One.
Firstly, here's a poster for the flick 'Ex-Machina', an innocuous but sinister robotic AI who spends most of the movie begging to be let out of the prison her creator keeps her locked up in.
[attach]

bit · « **Reply #78 on:** September 02, 2015, 01:48 AM »

With Paint Shop Pro 7 and 18 saves, I transformed her into... ...a live-action Ex-Cortana.
Do NOT let her out of the 'box', no matter how sweetly she begs!

[attach]

4wd · « **Reply #79 on:** September 02, 2015, 02:23 AM »

Quote from: bit on September 02, 2015, 01:41 AM

Will ^this 'elevated powershell' program work in Windows 7?

Yes, there's nothing Windows version specific in it as far as I'm aware. Providing the requirements are met, ie. elevated console, WUPM installed, and Powershell v4+ (it'll probably work with v2+ as that is the minimum for WUPM), it should work all the way back to XP if you want to use it for uninstalling other KBs.

In case it's not obvious, it requires WUSA.exe - I don't know which version of the Windows Installer this arrived in but here's the page for the last available for XP/Vista.

I've only tested on 8.1Pro because that's all I have across all my machines.

Quote

What does 'elevated' mean or refer to, please?

Elevated = Run as Admin

The link was only to show you the various methods to get an elevated Powershell console, same applies for Win7.

ewemoa · « **Reply #80 on:** September 03, 2015, 09:19 AM »

I came across a longer list ("List of Windows 7 telemetry updates to avoid"):

Quote

KB2952664 Compatibility update for upgrading Windows 7
KB2990214 Update that enables you to upgrade from Windows 7 to a later version of Windows
KB3021917 Update to Windows 7 SP1 for performance improvements
KB3022345 Update for customer experience and diagnostic telemetry
KB3035583 Update installs get windows 10 app in Windows 8.1 and Windows 7 SP1
KB3068708 (replaces KB3022345) Update for customer experience and diagnostic telemetry
KB3075249 Update that adds telemetry points to consent.exe in Windows 8.1 and Windows 7
KB3080149 Update for customer experience and diagnostic telemetry

via https://www.wilderssecurity.com/threads/list-of-windows-7-telemetry-updates-to-avoid.379151/

There may be more than one list there and a number of scripts, FWIW. A number of claims being made on the thread definitely got my attention.

Stoic Joker · « **Reply #81 on:** September 03, 2015, 11:50 AM »

Quote from: ewemoa on September 03, 2015, 09:19 AM

There may be more than one list there and a number of scripts, FWIW. A number of claims being made on the thread definitely got my attention.

Zoiks! Their advice to disable (completely) IPv6 definitely sounds wise to heed - I've been doing that for a while because of it's lack of NAT.

For those that haven't run across this yet, you can't just uncheck it in Network Connection properties. To fully disable it:

HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\

Create new DWORD named DisabledComponents, and set its value to 0xffffffff

Then reboot.

tomos · « **Reply #82 on:** September 03, 2015, 12:25 PM »

Quote from: ewemoa on September 03, 2015, 09:19 AM

via https://www.wilderssecurity.com/threads/list-of-windows-7-telemetry-updates-to-avoid.379151/

I presume that link is okay (?)
PaleMoon and Firefox give warnings on it

4wd · « **Reply #83 on:** September 03, 2015, 12:40 PM »

Might have to tweak my waiting for return code from WUSA, using the list from this post I got the following output:

Edit: I wasn't detecting if a restart was required, (Exit code 3010), should be OK now.

Quote from: tomos on September 03, 2015, 12:25 PM

I presume that link is okay (?)
PaleMoon and Firefox give warnings on it

Yes, it's fine.

TaoPhoenix · « **Reply #84 on:** September 03, 2015, 05:37 PM »

Quote from: Stoic Joker on September 03, 2015, 11:50 AM

Zoiks! Their advice to disable (completely) IPv6 definitely sounds wise to heed - I've been doing that for a while because of it's lack of NAT.

I think this is close to a new thread!

Can y'all explain what any of "this" (in what level of Douglas Hofstadter context) this means!?

Other parts of "the tech world" are screaming about the end of address for IPv4, so to *disable* IPv6 ... is ... an explosion in a sphaghetti factory as the saying goes!

Stoic Joker · « **Reply #85 on:** September 03, 2015, 06:07 PM »

@tomos - It's just an SSL error, so drop the s from the link and it works fine.

Quote from: TaoPhoenix on September 03, 2015, 05:37 PM

Quote from: Stoic Joker on September 03, 2015, 11:50 AM
Zoiks! Their advice to disable (completely) IPv6 definitely sounds wise to heed - I've been doing that for a while because of it's lack of NAT.

I think this is close to a new thread!

Can y'all explain what any of "this" (in what level of Douglas Hofstadter context) this means!?

Other parts of "the tech world" are screaming about the end of address for IPv4, so to *disable* IPv6 ... is ... an explosion in a sphaghetti factory as the saying goes!

Let me make this simple. Even when they run out of IPv4 addresses, the addresses are/will still be good. So the only thing it really means is that:

You start with 10 bananas
10 people get 1 banana
the 11th person that shows has to get orange.

...So, yes the have to have/get the IPv6 oranges ready to go ... But the IPv4 bananas are, will, and shall continue to work for a very long time (e.g. easy back on the drum hammering FFS, because..).

The ever popular NAT layer of security was intentionally left out of the IPv6 standard...so everything will be a public address.

Everything...

I call ^that^ an issue.

JavaJones · « **Reply #86 on:** September 03, 2015, 07:48 PM »

ALSO, some people are unnecessarily hoarding bananas because at the time they got (or requested) theirs, nobody was worried about running out (no one realized that everyone would want bananas), or they thought they'd need more than they actually did. If we got serious about IPV4 address recycling/reclaiming, I think there'd be quite a few more years of availability.

- Oshyan

wraith808 · « **Reply #87 on:** September 03, 2015, 07:50 PM »

Quote from: JavaJones on September 03, 2015, 07:48 PM

ALSO, some people are unnecessarily hoarding bananas because at the time they got (or requested) theirs, nobody was worried about running out (no one realized that everyone would want bananas), or they thought they'd need more than they actually did. If we got serious about IPV4 address recycling/reclaiming, I think there'd be quite a few more years of availability.

Now, that's just bananas!

ewemoa · « **Reply #88 on:** September 03, 2015, 09:57 PM »

Here's another IPv6 issue IMO (depending on configuration):

Quote

if you use IPv6, your machine may obtain an automatically allocated IPv6 address, and the scheme for creating such addresses uses MAC addresses, as described here. In that case, your MAC address can be inferred from the source address in the IP packets your machine emits.

via https://security.stackexchange.com/questions/70904/is-the-mac-address-encapsulated-in-the-internet-packets/70906#70906

Innuendo · « **Reply #89 on:** September 05, 2015, 02:51 PM »

ewemoa, when the IPv6 specification was originally drawn up, the bright idea was to incorporate a device's MAC address into the creation of the allocated IPv6 address. This was back before we knew what we know today so along the lines someone got smart & designed a smarter, better way to create those addresses and this is the preferred method used today.

Modern OSes all use this newer method, but that older method is still in the code, but disabled, for compatibility and fail-safe purposes if it's ever needed...or someone's nutty enough to want to use it.

As for NAT, a lot of us old-timers have always seen it as as security feature, but honestly, the days of it helping secure one's network or machine has past. NAT on its own is just a convenience feature these days that allows one to use multiple devices through one IP address. NAT, on its own, is easily circumvented by script monkeys as its design focus was never security.

With IPv6 there's no need to share IP addresses among devices so that's why it's going away. NAT is no substitute for a firewall and even when used in conjunction with a firewall should only be seen as a feature of convenience rather than an additional layer of security. A good hardware firewall at the entrance to your network and a good software firewall on each machine is what will be needed with IPv6 just as it's needed with IPv4. The only difference is NAT won't be needed (or desired) anymore.

ewemoa · « **Reply #90 on:** September 06, 2015, 12:04 AM »

Quote from: Innuendo on September 05, 2015, 02:51 PM

Modern OSes all use this newer method, but that older method is still in the code, but disabled, for compatibility and fail-safe purposes if it's ever needed...or someone's nutty enough to want to use it.

Ah, do you happen to have a handy reference for the specifics (i.e. which versions of which operating systems)? I hadn't realized some degree of sanity had prevailed.

Innuendo · « **Reply #91 on:** September 06, 2015, 06:59 PM »

Quote from: ewemoa on September 06, 2015, 12:04 AM

Ah, do you happen to have a handy reference for the specifics (i.e. which versions of which operating systems)? I hadn't realized some degree of sanity had prevailed.

Sadly, the only reference I have handy at the moment is a rather dryly written college text book sitting on my bookshelf. I can tell you that all versions of Windows have "let's naively use the MAC address to create our IPv6 address!!" disabled by default and I believe the setting is buried far enough in either the registry or the group policy editor that someone would have to set out with the purpose of enabling it. It's definitely not where the casual user will inadvertently activate it.

ewemoa · « **Reply #92 on:** September 07, 2015, 12:10 AM »

Thanks!

wraith808 · « **Reply #93 on:** September 07, 2015, 02:56 AM »

We need to have a thread where Ewomoa posts, followed by Innuendo, back and forth... followed by someone with an O. What is it with the green and black letter blocks for your avatars?

4wd · « **Reply #94 on:** September 07, 2015, 04:10 AM »

Quote from: wraith808 on September 07, 2015, 02:56 AM

What is it with the green and black letter blocks for your avatars?

Isn't that the new default forum avatar, (first letter) ?

I'm guessing that their old avatar, (if they had one), didn't migrate across.

Innuendo · « **Reply #95 on:** September 07, 2015, 04:51 PM »

Indeed those are the new forum's default avatars...which, I admit, are better than the new forum's old 'new' avatars which were weird squiggly images of which the system chose to make mine an unsightly orange.

I never had an avatar. Never use an avatar wherever I go & now since the forum switch I'm toying with trying to make a clear/invisible/transparent image to see if that will work to 'fake' not having an avatar.

Deozaan · « **Reply #96 on:** September 08, 2015, 04:00 PM »

Quote from: https://plus.google.com/+MauroRibeiro-mdrjr/posts/hMPGdaEZLL1

If you don't want Microsoft getting your free data...

Those are the IP's to be blocked on your router:
address-group MS_WIN10 {
address 65.55.252.63
address 65.52.100.91
address 65.55.44.109
address 65.55.252.92
address 65.55.252.93
address 65.52.100.7
address 93.184.215.200
address 64.4.54.32
address 23.56.203.122
address 168.62.187.13
address 65.55.176.90
address 134.170.115.60

You are welcome.

ewemoa · « **Reply #97 on:** September 08, 2015, 11:31 PM »

Quote from: ewemoa on August 28, 2015, 09:43 AM

On a related note, is there a convenient tool to help with preventing the installation of a specific set of updates?

I wonder if it's technically feasible / easy to have a program that scans / parses the appropriate Windows Update window for update identifiers and warns if certain ones look about to be installed.

Perhaps something in AutoHotkey?

4wd · « **Reply #98 on:** September 09, 2015, 01:59 AM »

Quote from: ewemoa on September 08, 2015, 11:31 PM

Quote from: ewemoa on August 28, 2015, 09:43 AM
On a related note, is there a convenient tool to help with preventing the installation of a specific set of updates?

I wonder if it's technically feasible / easy to have a program that scans / parses the appropriate Windows Update window for update identifiers and warns if certain ones look about to be installed.

You could do it with Powershell by using it to do the updates rather than relying on the Windows Update application, so rather than the reactive approach in the script above it would be proactive.

ie. Powershell fetches a list of updates available, compares against a list of unwanted KBs, hides any if found, and then invokes auto-update (which will automatically skip Hidden updates), or does the other updates itself.

So goes the theory.

wraith808 · « **Reply #99 on:** September 09, 2015, 02:42 AM »

I'm running WinPrivacy on Windows 10... and I just got the weirdest request for internet access.

C:\Program Files\WindowsApps\Microsoft.BingFinance_4.5.168.0_x86__8wekyb3d8bbwe\Microsoft.MSN.Money.exe

I don't even have money installed!