8

There are various reports of Windows 10 automatically sending out data when the user opens the start menu. Can that information or other information that Windows 10 automatically sends out to the internet be used to link an individual PC to an IP address? Does it communicate IDs or other information with its requests that can be used to link IP addresses to specific PCs?

If I'm at an internet café with my notebook and go online, does Windows 10 send out information that can be used to link my notebook to the IP I'm using when I open the start menu?

If a systemwide proxy is set, does Windows 10 use that proxy to do its automatic requests?

11
+50

Is Windows 10 Leaking my IP Address?

Almost everything is leaking your IP address.

I'm going to avoid telling you your IP address isn't secret. You seem to already know that. Instead, I'm going to tell you what you're looking for: Yes, Windows 10 leaks information about your IP address ten over a hundred times until Sunday, even if you're behind a proxy!

Can that information or other information that Windows 10 automatically sends out to the internet be used to link an individual PC to an IP address?

Yes, see below

----------


## Web Search Group Policy ##

Registry Keys: 

1. HKEY_LOCAL_MACHINE\SOFTWARE\Polices\Microsoft\Windows\Windows Search\DisableWebSearch
2. HKEY_LOCAL_MACHINE\SOFTWARE\Polices\Microsoft\Windows\Windows Search\ConnectedSearchUseWeb\
3. HKEY_LOCAL_MACHINE\SOFTWARE\Polices\Microsoft\Windows\Windows Search\ConnectedSearchUseWebOverMeteredConnections

-----

## Cortana Group Policy ##

Registry keys:

1. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\Experience\AllowCortana\value
2. HKEY_LOCAL_MACHINE\SOFTWARE\Polices\Microsoft\Windows\Windows Search\Allow Cortana

-----------

## OneDrive Service ##

Windows Services:

1. Sync Host (OneSyncSvc)
2. Sync Host_Session1 (OneSyncScv_Session1)

------------


## OneDrive Group Policy ##

Registry key: 

- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\OneDrive\DisableFileSyncNGSC

----------

## Remote Registry Service ##

Service: (RemoteRegistry)

-------------------

## Built-In Bing Search ##

Contacts Bing for things such as web searching. If a patch is made that circumvents the above fixing, you'll need to block Bing.

----------------

## Office 15 (2015) Telemetry Group Policy ##

Registry keys:

1. HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\15.0\osm\enablelogging
2. HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\15.0\osm\enablefileobfuscation
3. HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\15.0\osm\enableupload

-----------

## Office 15 (2013) Telemetry Scheduled Tasks ##

Tasks: 

1. Microsoft\Office\OfficeTelemetryAgentFallBack
2. Microsoft\Office\OfficeTelemetryAgentLogOn

---------

## Office 16 (2016) Telemetry Group Policy ##

Registry keys:

1. HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\16.0\osm\enablelogging
2. HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\16.0\osm\enablefileobfuscation
3. HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\16.0\osm\enableupload


--------


## Office 16 (2016) Telemetry Scheduled Tasks ##

Tasks: 

1. Microsoft\Office\OfficeTelemetryAgentFallBack2016
2. Microsoft\Office\OfficeTelemetryAgentLogOn2016

---------


## Telemetry Services ##

Services:

1. Connected User Experience and Telemetry (DiagTrack)
2. dmwappushscv (dmwappushservice)

---------

## Telemetry Group Policy ##

- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection\AllowTelemetry


-------

## Consumer Experience Improvement Program Group Policy ##

- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SQMClient\Windows\CEIPEnable


---------

## Customer Experience Improvement Program Scheduled Tasks ##

Tasks:

1. Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser
2. Microsoft\Windows\Application Experience\ProgramDataUpdater
3. Microsoft\Windows\Autochk\Proxy
4. Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector
5. Microsoft\Windows\Customer Experience Improvement Program\Consolidator

----------


## Application Impact Telemetry Group Policy ##

- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AppCompat\AITEnable

-----

## Steps Recorder Group Policy ##

- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AppCompat\DisableUAR

------

## WiFi Sense (HotSpot Sharing) Group Policy ##

Registry keys:

1. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\WiFi\AllowWiFiHotSpotReporting\value
2. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\WiFi\AllowAutoConnectToWiFiSenseHotSpots\value

-------

## P2P Windows Update outside local network ##

Registry keys:

1. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode
2. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\SystemSettingsDownloadMode

-----

TLDR: Registry Keys, Tasks, Hosts, and Services

I could go on and on. But download Spybot Anti-Beacon, and it will block most of these, and more. You don't want to block Windows Update because software updates help maintain the security and integrity of your machine.

Note that blocking all of these telemetry options isn't going to prevent information gathering, so don't trust in them. This program is simply there to help you opt out of Windows 10 telemetry stuff.

They can still find out what accounts were connected to what IP address at each time, even if the proxy is system-wide. If you wanted to hide your information from Microsoft, you would literally have to blacklist all connections, and whitelist only the ones you want.


Communicating Other IDs

Does it communicate IDs or other information with its requests that can be used to link IP addresses to specific PCs?

If I'm at an internet café with my notebook and go online, does Windows 10 send out information that can be used to link my notebook to the IP I'm using when I open the start menu?

If a systemwide proxy is set, does Windows 10 use that proxy to do its automatic requests?

Yes. Yes. Yes, and yes. Look at Application User ID Tracking:

Registry key:

  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion AdvertisingInfo\Enabled

Answers to your main questions

Now that we've demonstrated a small fraction of IP-leaking processes behind Windows 10, let's talk about what can be done with this data.

If I'm at an internet café with my notebook and go online, does Windows 10 send out information that can be used to link my notebook to the IP I'm using when I open the start menu?

Yes, application advertising IDs, connecting to Windows Update with your Windows 10 account, etc. In fact, connecting to any of these services, of which there are many, during your Internet Cafe visit, can easily tell Microsoft where you've been.

It doesn't matter if you were behind a proxy or 40: all connections to Microsoft services are recorded. Every single IP address for every single instance of your advertising ID / windows key / windows account, is recorded.

7

Since your IP address is essentially the internet equivalent of your postal address and since it is required for routing your request (and especially the response) over the internet, any website that you connect to will have access to it. Any email server you connect to will have access to it, etc. Every time you connect to another computer, that computer can see your IP address.

The Windows 10 Start Menu has a variety of features designed to make it more useful. This includes a search functionality when you start typing which by default will send your typed text to Bing to perform a web search. The Windows 10 Start Menu also has live tiles, which will periodically connect to their service provider(s) to fetch updates.

  • Does it send any ID, that's constant for a PC? If it does multiple IP addresses can be linked together to come from the same computer. If it doesn't they can't. What does the Windows 10 Start Menu do? – Christian Apr 5 '16 at 0:00
  • @Christian you may want to add that comment to your question. I think it will make the question clearer. – Neil Smithline Apr 5 '16 at 4:40
  • It sends an ID for certain requests, such as for updates and for crash dumps. It does not send an ID to stackexchange when you connect to it, though. – forest Apr 7 '16 at 0:04
  • I find it very presumption of Microsoft that they assume their users want to use bing. Bing is pretty garbage. – Magisch Apr 7 '16 at 12:14
0

The start menu only fires web requests if either Cortana or the search bar is enabled. If both are turned off, you're not leaking your IP to Microsoft.

  • 1
    How do you know? On what sources are you basing your answer? – Christian Apr 7 '16 at 11:56
  • 1
    I read an article about some wireshark? analysis of w10 connections. I'll try to find it and paste the link. – Rápli András Apr 7 '16 at 12:59
  • I imagine any "live tiles", like weather, Bing news, etc. would have the same effect. – WorseDoughnut Apr 8 '16 at 20:20
  • That seems logical. – Rápli András Apr 9 '16 at 8:13
0

This is something a LOT of people asked a LOT of times, and honestly the information is outlined pretty easily in your Terms of Service and how the internet works as a WHOLE.

However more specifically in the start menu there is the smart panels, which have web based content, which will send your IP address out to the web servers(same with the search pane). This is also sent to their advertising group if you opted in to receive focused ads.

This IP address however is just that. Microsoft leeks no identity information from your computer more so than a cookie or a session identifier. It does not send out your computer unique identifier. However it does send out something that let's it know it is the same user for tailoring purposes. This user can use multiple computers with windows 10, and as long as they use a Microsoft account, then a profile for them is beings built. If they use a local account only, that information stays on that computer alone and stays only on that computer.

This is no more dangerous, insidious, or less secure than you using your web browser. Their TOS outline exactly what the data is for and where it goes and none of it raises a red flag unless you are the type of person who doesn't want anything to be leaked(in which case why are you even using the internet?).

  • If I log into StackExchange with my account or browse the website with a cookie, then StackExchange can link my identity to an IP address. If I don't log into an account and my browser uses no cookies then StackExchange can't easily link my IP address to my identity. Which of the cases do we have with Windows 10? – Christian Apr 6 '16 at 23:40
  • what do you understand by "identity"? on the web your IP address is your identity – Elzo Valugi Apr 7 '16 at 12:43
  • @ElzoValugi : The IP address I use on the web changes all the time. It's no constant identity. – Christian Apr 7 '16 at 13:03
  • 2
    the IP address identifies you at the moment that you make a request. The cookie is not an identity either. The cookie is something that a website sets on your computer - usually a unique string - so they can identify you through several sessions, but the identity is something that is set and stored by the website. Windows has a unique identifier for your machine installation - the windows product id - but that is not sent to websites. – Elzo Valugi Apr 7 '16 at 14:20
  • @ElzoValugi: Actually you can be pretty sure that the OS activation process does send the product key to Microsoft servers in a trackable format (possibly hashed or otherwise scrambled, but still unique so that the number of times the same product key is activated can be tracked) – Ben Voigt Apr 9 '16 at 23:58
0

To be more simple, lets assume, you have set internet time sync on your windows. By default it contacts time.windows.com to fetch the time. When a client connects to a server, the IP is disclosed, because IP is the metadata of the established connection.

Let that be any kind of connection on any OS irrespective of Windows 10, the answer is so so so simple.

When a client connects with a server, the IP is disclosed, unless you are in a VPN or ProxyServer.

If you want to hide your IP address while opening a website, to stay Anonymous, use any VPN services. There are tons of free VPN services available out there. My personal favourite is ToR and Hotspot Shield.

You cannot simply prevent your windows to hide your IP address unless your connection is in a relay.

And yea, you are correct. If a system wide proxy is set, it upto some extent for known schema and ports, will hide the IP address.

  • An IP address that can't be linked to another piece of information just tells Microsoft that there a PC running Windows at IP address X. It doesn't tell Microsoft that this happen to be my PC. If the request does send an ID that's linked to myself along with each request, a VPN that takes redirects all traffic of my PC doesn't give me any anonymity. – Christian Apr 8 '16 at 20:29
0

This is a question you should answer for yourself. The most accurate way to know what you're sending is to download and install Wireshark, and set it to capture from your WiFi network interface. Connect to the cafe's wireless hotspot, and observe the start menu for a minute or so. Terminate the capture.

You'll see literally hundreds or thousands of IP packets representing dozens of TCP sockets and other communications that your computer is initiating. You'll likely be dismayed to see your machine advertising its own name, and attempting to communicate to other Windows machines by name on your home network as it searches for things like printers. You'll also find network traffic to Microsoft requesting updates for news items, weather reports, advertisements, software updates, etc. And there are all manner of traffic to various hosts and ports, including twitter, facebook, etc., all depending on the software packages you've installed. Every Windows 10 machine is different; but they're all sharing way too much information.

Any packets that go out over the network can certainly be sniffed by the cafe's access point or ISP. This means if one of your live tiles doesn't use TLS 1.2, it's possible the cafe could see the cookies in your requests, cookies that may contain more specific ID information.

You can mitigate a little bit of this easily: turn off live tiles that you don't need to see, and shut off services you're not interested in, such as twitter. You can also block much of this traffic with Windows Firewall, but be aware that some features will be impacted or even disabled. Make sure that the services you do intend to connect to, like IMAP, are encrypted. In general, though, be prepared for bitter disappointment at all the private information you scatter about your neighborhood as you connect to public access points.

-1

Windows "leaks" your IP Address to Microsoft since there's Internet Support.

The Network Connectivity Status requests a file from Microsofts servers to check if your connection works.

This can not be connected with your computer, tho.

If I'm at an internet café with my notebook and go online, does Windows 10 send out information that can be used to link my notebook to the IP I'm using when I open the start menu?

If you connected a Microsoft Account to your Notebook, Microsoft will know that your account used the Internet Connection of the Café.

If a systemwide proxy is set, does Windows 10 use that proxy to do its automatic requests?

It'll use the proxy for almost all requests (I'm not excactly sure if there are features that bypass the Proxy, by design there shouldn't), however that's limited depending of the protocol. DNS Requests for example aren't proxied, nor is any third party application forced to use the proxy.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.