Live data from Hacker News

Edge sends full URLs of pages visited to Microsoft

twitter.com

91–100 of 161 posts

Re: Edge sends full URLs of pages visited to Microsoft

#91

Edge is the number one browser in the world for installing chrome.

You shouldn't need Edge, Chrome, or Firefox to install each other. If you know the URL of the file you want to download, you could use curl or wget. (Of course, that won't work if you do not know the URL. But hopefully someone will tell you if you are unable to find it on your own computer.)

Re: Edge sends full URLs of pages visited to Microsoft

#92
post #21

Earlier quoted context omitted.

Other browsers use a _truncated_ hash. Easy enough to match to a known list of bad sites, but exceptionally difficult to reverse engineer a list of sites the user has visited.

Those hashes have to be essentially unique to prevent blocking good sites erroneous;y, and as such are easily associated to actual sites when you’re the scale of MS or Google.

Here's what all the browsers do (Firefox, Google and Safari all use Google's Safe Browsing service).

1. The truncated hash is checked against local database.

2. If there's a hit, send the truncated hash to Google, and receive a list of full hashes for the truncated hashes.

3. Check if the full hash is in that list. If so, warn.

I'm not certain that the hash is truncated enough, but the general idea is a pretty straightforward trade-off between the amount of information Google needs and the amount of information your computer needs.

Re: Edge sends full URLs of pages visited to Microsoft

#93
post #61
post #40

Earlier quoted context omitted.

Doesn't Chrome send your entire browsing history to Google as well? Edit: I thought this was a well know fact and if it isn't I might have been to harsh about Google and Chrome. Edit 2: Thinking about it and searching a bit I conclude that IIRC Google at least used to have access to your browsing history as part of syncing it unencrypted.

Only through sync, which you can encrypt with a separate password to your Google account. My sync is encrypted so I can't test this for you but I believe if it's not, you can check (and clear) your history here: https://myactivity.google.com/myactivity Google's privacy policy seems to make it clear that this happens unless encryption is turned on: https://www.google.com/chrome/privacy/index.html#signed-in

you missed the obvious one (that is actually related to the linked edge issue): SafeBrowse. SafeBrowse gets ALL your traffic from most browsers.

Re: Edge sends full URLs of pages visited to Microsoft

#95

Eric Lawrence (PM on Edge, previously on Chrome, previously author of fiddler) showing screenshots of documentation that explains all that, and saying it's been documented this way for 14 years: https://twitter.com/ericlaw/status/1152933704198758401

...and for 14 years no ordinary user has understood what those default settings do, instead assuming “their software provider wouldn’t do that...”

I am all for bashing bad privacy options, but from the linked tweet at least, this IS off by default. I can certainly see enterprise scenarios where this feature is very useful for security reasons. Did I miss some context?

Edit: oh, this is in addition to the Mirror stuff. Yea this should never be a thing.

Re: Edge sends full URLs of pages visited to Microsoft

#96
post #87

Earlier quoted context omitted.

...and for 14 years no ordinary user has understood what those default settings do, instead assuming “their software provider wouldn’t do that...”

I think you're making a big assumption that ordinary users care if Microsoft knows what URLs they visit--how many of them use blockers or another technology to opt out of e.g. Facebook tracking?

That doesn't make it any better, though.

Most people don't care what's in their food exactly, but that doesn't mean the producer has no responsibility.

Re: Edge sends full URLs of pages visited to Microsoft

#97
post #87

Earlier quoted context omitted.

...and for 14 years no ordinary user has understood what those default settings do, instead assuming “their software provider wouldn’t do that...”

I think you're making a big assumption that ordinary users care if Microsoft knows what URLs they visit--how many of them use blockers or another technology to opt out of e.g. Facebook tracking?

Ordinary users don't know what a URL even is. But they do assume every site they visit isn't being logged by Microsoft, much like they assume their car's manufacturer isn't recording the places they drive to using GPS.

"Users don't care" is such an intellectually dishonest argument when users aren't technical enough to understand the subject.

Re: Edge sends full URLs of pages visited to Microsoft

#98
post #61

Earlier quoted context omitted.

Only through sync, which you can encrypt with a separate password to your Google account. My sync is encrypted so I can't test this for you but I believe if it's not, you can check (and clear) your history here: https://myactivity.google.com/myactivity Google's privacy policy seems to make it clear that this happens unless encryption is turned on: https://www.google.com/chrome/privacy/index.html#signed-in

you missed the obvious one (that is actually related to the linked edge issue): SafeBrowse. SafeBrowse gets ALL your traffic from most browsers.

Ah I was wrong about this!!! SafeBrowse uses hashes.

Edit: never be afraid to admit your were wrong folks :) So it only gets a “potential list” of sites you visited. Wonder if the operators could aggregate the data enough to deanonymize things

Re: Edge sends full URLs of pages visited to Microsoft

#99
post #40

Earlier quoted context omitted.

Doesn't Chrome send your entire browsing history to Google as well? Edit: I thought this was a well know fact and if it isn't I might have been to harsh about Google and Chrome. Edit 2: Thinking about it and searching a bit I conclude that IIRC Google at least used to have access to your browsing history as part of syncing it unencrypted.

Everything you type into the address bar gets considered for possible completion, right? And part of that quite possibly entails sending it off to Google servers which take a stab at finding completions for it. Your claim seems plausible at least.

Also note there is a “roulette” feature in most address bars, where the browser starts loading and rendering the site before you ever hit submit. Very handy for sites wanting to pursue persistence

Re: Edge sends full URLs of pages visited to Microsoft

#100

Edge is the number one browser in the world for installing chrome.

You shouldn't need Edge, Chrome, or Firefox to install each other. If you know the URL of the file you want to download, you could use curl or wget. (Of course, that won't work if you do not know the URL. But hopefully someone will tell you if you are unable to find it on your own computer.)

Does curl or wget ship with Windows?
Post reply on HN