Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft is phoning home the content of PowerPoint slides

rogermexico.bearblog.dev

Post reply on HN
Print view View original

311–320 of 391 posts

Re: Microsoft is phoning home the content of PowerPoint slides

#311

Post by A4ET8a8uTh0 »

What I am kinda waiting ( and it is coming ) is for someone to find out that Excel actually gathers all interesting data under guise of automatic analysis ( ala copilot ). The financial sector will tremble as almost the entire human population existing in the spreadsheets in one form or another ( as long as they are on o365_v2 ) will have their data harvested daily and banks will be unlikely do anything about it.

Oh, look. We don't need enter Jenkins account. Everything auto populates. And we did not even map it yet...

Re: Microsoft is phoning home the content of PowerPoint slides

#313

Post by dhaavi »

snapplebobapple wrote: post #301
user3939382 wrote: post #64

What I want is Little Snitch on steroids built into the OS where every process, including all native ones, including UI apps, are blocked from network connectivity by default, and the user gets an easy monitor of outgoing traffic with TLS/SSL inspection built in (you'd need some OS API to enable that). Kind of like granular oauth permissions, apps should have to declare which outgoing they have, a description/why, an…

Isn't this what safing does basically?

Yes! For reference: https://safing.io/

Re: Microsoft is phoning home the content of PowerPoint slides

#314

Post by autoexec »

ziml77 wrote: post #282
M95D wrote: post #232

Earlier quoted context omitted.

It uses the windows firewall. Do I trust Windows firewall to block itself? NO!

Even if it was a wrapper over Windows Firewall, why would that make you trust the filtering less? Like even if it was running fully custom ring 0 code, there's still also Windows kernel code running at the same level. Microsoft could make the kernel interfere however they want.

Like how MS ignored the hosts file if you tried to use it to block windows update. Ultimately MS has final say on what you're allowed to do on windows and they can force updates that disable or enable any kind of behavior they want. It's their system.

If you don't trust MS, don't use windows or at least never ever let connect to the internet. In a fight between you wanting to keep your privacy and an OS designed and determined to exploit you for profit, you will always lose.

Re: Microsoft is phoning home the content of PowerPoint slides

#315

Post by prmoustache »

squarefoot wrote: post #307
prmoustache wrote: post #293

Earlier quoted context omitted.

From what I understand opensnitch use ebpf to match where the exiting packets are going. TCP being TCP, it is easy to know where the incoming answer will be delivered to as well.

Not sure if this would work also for connectionless protocols such as UDP. That is, if I open a socket and send some datagrams to an external address:port to exfiltrate users data, then close the socket and exit, I don't think it would be able to tell which program did that, unless it detects it live.

I believe opensnitch catches them.

Re: Microsoft is phoning home the content of PowerPoint slides

#316

Post by autoexec »

real_dogbert wrote: post #60
semi-extrinsic wrote: post #35

I've raised this point repeatedly in different orgs. It's met with some combination of indifference and lack of understanding and not-my-responsibility-ism, but I'm sure that this will eventually blow up hard in some company's face - like 9-digit settlement for breach of contract, or worse things like breach of export control laws. Enterprise data security on the "MS Office level" at this point is like driving 60 mph…

Yeah, I'm surprised every healthcare related business doesn't either ban PowerPoint or block this "feature" somehow. HIPAA is a hell of a drug.

I can't believe how many companies in general are leaking massive amounts of sensitive data to Microsoft. With Outlook alone MS much have an incredible amount of data on nearly every business and an unprecedented amount of insight into what they are doing.

Windows 10 has only made the problem worse. The last desktop PC I got from my company's IT department had windows 10 on it and it was configured to send every last keypress to MS. Why they had the Windows 10 keylogger enabled I'll never understand, but at least it was easy enough to disable.

Re: Microsoft is phoning home the content of PowerPoint slides

#317

Post by zmmmmm »

giaour wrote: post #227
real_dogbert wrote: post #60

Earlier quoted context omitted.

Yeah, I'm surprised every healthcare related business doesn't either ban PowerPoint or block this "feature" somehow. HIPAA is a hell of a drug.

If you're putting PHI in a presentation, you probably already have HIPAA problems.

Doctors routinely need to present cases to each other. It often involves pictures of the patient and other identifying information that is essential to describe the case in detail. They need some way to do this.

Re: Microsoft is phoning home the content of PowerPoint slides

#319

Post by mynameisvlad »

Semaphor wrote: post #302
mynameisvlad wrote: post #150

Earlier quoted context omitted.

Have you used the Designer feature? That’s what’s being talked about. It should prompt you when you first use it. If you’re on a work account, your admin may have enabled or disabled it already with GPO/MDM.

> Have you used the Designer feature? Yes. > If you’re on a work account, your admin may have enabled or disabled it already with GPO/MDM. It has to be a global Office 365 setting, my computer is not in the domain, I’m the only admin for it. That’s why I’m asking where the setting for the permission is, so I can have a look at it (I’m secondary admin for the O365 account) and potentially disable it.

Do you have Microsoft 365? It's a requirement for the feature.

It's part of "connected experiences" so this is the article on GPO: https://learn.microsoft.com/en-us/deployoffice/privacy/manag...

On a Mac, one thing to note is:

> If the user has an Office 365 (or Microsoft 365) subscription and is signed in with a work or school account, or if the user has Office LTSC Standard for Mac 2021 or Office Standard 2019 for Mac, then the user can't turn off connected experiences that analyze content.

Re: Microsoft is phoning home the content of PowerPoint slides

#320

Post by nosmokewhereiam »

Someone1234 wrote: post #23

This is a one paragraph claim that doesn't provide resources to show that their claim has basis. It could very well be entirely accurate, but there's no information contained here to know one way or the other. For example there have been numerous claims made previously that link ANY network traffic to a supposed invasion of privacy, but once you delve into the underlying traffic it isn't nearly as nefarious as it ini…

Can Wireshark render this in PCAP?

Would it just be encoded and Wireshark could decode it out of the box?

Post reply on HN