Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft is phoning home the content of PowerPoint slides

rogermexico.bearblog.dev

Post reply on HN
Print view View original

271–280 of 391 posts

Re: Microsoft is phoning home the content of PowerPoint slides

#271

Post by Kim_Bruning »

user3939382 wrote: post #64

What I want is Little Snitch on steroids built into the OS where every process, including all native ones, including UI apps, are blocked from network connectivity by default, and the user gets an easy monitor of outgoing traffic with TLS/SSL inspection built in (you'd need some OS API to enable that). Kind of like granular oauth permissions, apps should have to declare which outgoing they have, a description/why, an…

We could go to our EU representatives and ask for them to make it mandatory. Though I suspect it'll go down the same way as the GDPR, at least at first.

(Lessons have already been learned of course)

Re: Microsoft is phoning home the content of PowerPoint slides

#273

Post by real_dogbert »

criddell wrote: post #224
real_dogbert wrote: post #60

Earlier quoted context omitted.

Yeah, I'm surprised every healthcare related business doesn't either ban PowerPoint or block this "feature" somehow. HIPAA is a hell of a drug.

Wouldn't it be easier to ban putting HIPAA protected information into a PowerPoint? We don't ban telephones just because an employee can read patient records over the phone.

Of course putting ePHI in PowerPoint presentations should be against policy. The thing is, when it does happen, it's almost always inadvertent. Unfortunately, the "oops, my bad" defense isn't valid against violations of the HIPAA privacy rule.

Re: Microsoft is phoning home the content of PowerPoint slides

#274

Post by microtonal »

M95D wrote: post #237
exceptione wrote: post #133

Earlier quoted context omitted.

What I want is Little Snitch on steroids built into the OS where every process, You cannot trust an OS you cannot build yourself. That's why I see Linux as the only option for professionals and privacy minded people.

In fact, you cannot trust an OS you DIDN'T build yourself. And there are only two of those: Linux from scratch and Gentoo.

How do you know that the compiler that was used to compile your compiler was not backdoored (or binutils/glibc/bash)?

You may instead want to look at the bootstrapping work done using stage0, m2-planet, GNU Mes, etc.

https://bootstrapping.miraheze.org/wiki/Stage0

https://guix.gnu.org/manual/en/html_node/Reduced-Binary-Seed...

It starts with a hex monitor of less than 500 bytes and bootstraps all the way up to gcc, all from source.

Re: Microsoft is phoning home the content of PowerPoint slides

#275

Post by jyrkesh »

ssteel wrote: post #199
0xbadcafebee wrote: post #160

Earlier quoted context omitted.

No. DOD/Gov projects can be hosted in completely secure locations, and Azure for Government follows all the required standards. Office365/Sharepoint supports FedRAMP High. Most agencies are in the process of finishing migrations so that both their desktop and online apps use the same data in secure cloud installations.

Sometimes classified leaks onto unclassified networks via human mistake, coincidence, or ignorance. I've literally seen classified PowerPoint slides marked unclassified due to ignorance. This situation requires security to confiscate all machines the data may have leaked to.

Oh, I've absolutely seen similar, and I don't doubt it's extremely commonplace.

But Microsoft generally supports policies for enforced disabling features like the one referenced in the post. Similarly, data exfiltration from managed to non-managed devices is an entire cottage industry. And generally that's why govt employees are expected to use separate, locked down devices where their compliance-obsessed (hopefully, but not always in practice) admin has total root.

And I don't believe you're implying this, but certainly I don't think it makes sense for companies to _not_ build internet/cloud-connected experiences and features just because there's a possibility that govt officials won't follow their own security policies and best practices.

Re: Microsoft is phoning home the content of PowerPoint slides

#276

Post by Springtime »

mixmastamyk wrote: post #257
Springtime wrote: post #251

Earlier quoted context omitted.

I'd too be interested in further analysis (eg: ruling out false alarms, such as some update check) so that I can say to others with more certainty that something is of potential concern, rather than it being shot down later if someone does a more rigorous analysis. Just because one could say a company has done controversial things before doesn't mean there's no benefit in verifying claims.

It’s in their TOS and stated as a feature. https://news.ycombinator.com/item?id=33509159 There’s an expression, paraphrased as “when someone tells you who they are, believe them.”

I mean, it's fine if one is personally satisfied with not explicitly having evidence of the specific alleged data collection here, but speaking from experience when the time comes and people inevitably prod further for sources and only hand-wavy arguments can be produced I've found it's not the strongest/most compelling result for motivating a potential change of behavior.

Anyone here could believe this is occurring and it wouldn't likely surprise them but actually knowing concretely can have the effect of changing things. Consider the difference between people assuming various things about the NSA pre-Snowden vs post leaks and how it affected change (or at the least a better basis for it).

Re: Microsoft is phoning home the content of PowerPoint slides

#277

Post by simiones »

jeroenhd wrote: post #183

Like I said last time: > Did we consent to this? Yes, unless Microsoft doesn't ask for consent in whatever country the author is from. There's a consent popup that you need to click through that informs you that the content of your slides are shared with Microsoft. This is part of "intelligent services" in case you're looking for the details. The author should be able to turn this feature off easily, but yes, they di…

The text on that page is extraordinarily misleading, if indeed "Connected experiences" are sending your data to MS servers. Nothing on the page is explicit about the apps sending your data to MS, the only hint that this is happening is the footnote that these "Connected experiences" do not work if you are not connected to the Internet.

For example, here is the description of the first type of such experiences:

> Connected experiences that analyze your content

> Connected experiences that analyze your content are experiences that use your Office content to provide you with design recommendations, editing suggestions, data insights, and similar features. For example, PowerPoint Designer or Translator.

> The following table provides a list of connected experiences that analyze your content and also provides links to more information about them.

They are going to quite long lengths to avoid mentioning where the data is analyzed.

Re: Microsoft is phoning home the content of PowerPoint slides

#278

Post by kibwen »

twawaaay wrote: post #265
kibwen wrote: post #235

Earlier quoted context omitted.

You know how you can do Ctrl+Shift+K in Firefox to open up the browser console and inspect all the bits of the page, see the code (and fuck with it), see all the network traffic, and so on? I dream of being able to do that for arbitrary applications. Imagine having a Super+Ctrl+Shift+K that opened an OS-level GUI showing all the pertinent details of the running program.

You know that this only pertains to webapps and there is still a lot of software running on your machine that you have no idea what it does?

I am specifically referring to the ability to have the same sort of interface with non-webapps as we do with webapps.

Re: Microsoft is phoning home the content of PowerPoint slides

#279

Post by NietzscheanNull »

twawaaay wrote: post #265
kibwen wrote: post #235

Earlier quoted context omitted.

You know how you can do Ctrl+Shift+K in Firefox to open up the browser console and inspect all the bits of the page, see the code (and fuck with it), see all the network traffic, and so on? I dream of being able to do that for arbitrary applications. Imagine having a Super+Ctrl+Shift+K that opened an OS-level GUI showing all the pertinent details of the running program.

You know that this only pertains to webapps and there is still a lot of software running on your machine that you have no idea what it does?

I believe the parent commenter is aware of that - they’re describing their wish for a tool that makes monitoring native application requests easy and transparent, similar to the experience of using browser devtools with web apps.

Re: Microsoft is phoning home the content of PowerPoint slides

#280

Post by dhaavi »

user3939382 wrote: post #64

What I want is Little Snitch on steroids built into the OS where every process, including all native ones, including UI apps, are blocked from network connectivity by default, and the user gets an easy monitor of outgoing traffic with TLS/SSL inspection built in (you'd need some OS API to enable that). Kind of like granular oauth permissions, apps should have to declare which outgoing they have, a description/why, an…

Ha, what a timing! Just 2 days ago on HN front page:

Portmaster 1.0 – Open-Source Network Monitor and Privacy Firewall https://news.ycombinator.com/item?id=33481518

Disclaimer: I'm the CTO.

Post reply on HN