Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft is phoning home the content of PowerPoint slides

rogermexico.bearblog.dev

Post reply on HN
Print view View original

121–130 of 391 posts

Re: Microsoft is phoning home the content of PowerPoint slides

#121

Post by planede »

mynameisvlad wrote: post #33
yjftsjthsd-h wrote: post #18

Earlier quoted context omitted.

I don't really care that it has a feature that's the reason they're sending data off to Microsoft, I care that they're sending data off to Microsoft and it's not blatantly obvious to the user.

> The first time you try out Designer, it may ask your permission to get design ideas for you. If you want to use Designer, select Turn on. https://support.microsoft.com/en-us/topic/53c77d7b-dc40-45c2... Considering it has to be explicitly enabled and includes a privacy policy, I’m going to say it’s “blatantly obvious” to the user.

> The first time you try out Designer, it may ask your permission to get design ideas for you.

I don't know the wording for the dialog itself, so I will comment on this wording instead.

Asking permission to "get design ideas for you" is absolutely wrong. They are asking permission for the wrong thing. They should be asking permission to "collect content from your slides". They can then explain that the upside is that in return you get access to design ideas.

Depending on the context of the dialog an appropriate wording would be something along the lines of this: "In order to access design ideas, up-to-date slide contents need to be regularly sent to Microsoft servers. ".

edit:

- Would you like some chocolate sprinkles with that ice cream?

- Sure!

- Cool, it will cost $100 and your left kidney.

Re: Microsoft is phoning home the content of PowerPoint slides

#123

Post by nbzso »

user3939382 wrote: post #64

What I want is Little Snitch on steroids built into the OS where every process, including all native ones, including UI apps, are blocked from network connectivity by default, and the user gets an easy monitor of outgoing traffic with TLS/SSL inspection built in (you'd need some OS API to enable that). Kind of like granular oauth permissions, apps should have to declare which outgoing they have, a description/why, an…

Since 2014 I don't trust my macs. There is no Apple computer without LS installed on in my company. Actually, if LS is not available, I will not use Apple computers at all. Period.

Re: Microsoft is phoning home the content of PowerPoint slides

#125

Post by thomascgalvin »

semi-extrinsic wrote: post #35

I've raised this point repeatedly in different orgs. It's met with some combination of indifference and lack of understanding and not-my-responsibility-ism, but I'm sure that this will eventually blow up hard in some company's face - like 9-digit settlement for breach of contract, or worse things like breach of export control laws. Enterprise data security on the "MS Office level" at this point is like driving 60 mph…

> worse things like breach of export control laws

The entire Department of Defense runs on PowerPoint, along with all of their contractors. It is not at all uncommon to produce slide decks that are either classified or covered by ITAR; this is a disaster waiting to happen.

Re: Microsoft is phoning home the content of PowerPoint slides

#126

Post by Semaphor »

mynameisvlad wrote: post #37
deafpolygon wrote: post #2

You did consent to it, in the fine print. Unfortunately.

Not even. It’s an explicit feature that must be separately enabled, and requires Microsoft 365. > The first time you try out Designer, it may ask your permission to get design ideas for you. If you want to use Designer, select Turn on. https://support.microsoft.com/en-us/topic/53c77d7b-dc40-45c2...

> it may ask your permission

I wonder when that is? Because I haven’t used PP yet, and it didn’t ask me. Of course, we use Office 365, and maybe my boss turned it on globally?

Does anyone know where the setting is?

Re: Microsoft is phoning home the content of PowerPoint slides

#127

Post by MasterYoda »

I use "simplewall" [1], a firewall to windows. What I like about it is you get a popup window every time a new program want to send data out, then you could block or accept it or temporary accept it. It's crazy how many programs that wants to talk to the internet constantly.

[1] https://www.henrypp.org/product/simplewall

Re: Microsoft is phoning home the content of PowerPoint slides

#128

Post by sammy2255 »

Someone1234 wrote: post #23

This is a one paragraph claim that doesn't provide resources to show that their claim has basis. It could very well be entirely accurate, but there's no information contained here to know one way or the other. For example there have been numerous claims made previously that link ANY network traffic to a supposed invasion of privacy, but once you delve into the underlying traffic it isn't nearly as nefarious as it ini…

I was expecting at LEAST some screenshots lol

Re: Microsoft is phoning home the content of PowerPoint slides

#129

Post by jimnotgym »

thomascgalvin wrote: post #125
semi-extrinsic wrote: post #35

I've raised this point repeatedly in different orgs. It's met with some combination of indifference and lack of understanding and not-my-responsibility-ism, but I'm sure that this will eventually blow up hard in some company's face - like 9-digit settlement for breach of contract, or worse things like breach of export control laws. Enterprise data security on the "MS Office level" at this point is like driving 60 mph…

> worse things like breach of export control laws The entire Department of Defense runs on PowerPoint, along with all of their contractors. It is not at all uncommon to produce slide decks that are either classified or covered by ITAR; this is a disaster waiting to happen.

Do they run on the same infrastructure as the rest of us?

Re: Microsoft is phoning home the content of PowerPoint slides

#130

Post by kccqzy »

3pt14159 wrote: post #87
user3939382 wrote: post #64

What I want is Little Snitch on steroids built into the OS where every process, including all native ones, including UI apps, are blocked from network connectivity by default, and the user gets an easy monitor of outgoing traffic with TLS/SSL inspection built in (you'd need some OS API to enable that). Kind of like granular oauth permissions, apps should have to declare which outgoing they have, a description/why, an…

> with TLS/SSL inspection built in (you'd need some OS API to enable that). I'm not sure of that. Provided you can add a cert to your OS, you should be able to get away with a piece of protocol downgrade network gear that you can then pipe to a different (ideally, offline other than UDP receive) computer for analysis. You'd need to disable HSTS, but other than that I think it should be the solution you're looking for…

A well-designed OS API doesn't need to do MitM and therefore would work with HSTS or cert pinning enabled.

Of course for obvious reasons, few commercial apps would actually use this API unless they have some other incentive.

Post reply on HN