0

When installing new software and it gives the option to allow automatic updates, is there any security or privacy reason that it might be preferable not to allow this?

  • Do you mean because of the timing or because of any potential data that is sent by the updater? If the latter, then it does not matter about the timing. – schroeder Sep 3 '18 at 23:08
2

Privacy Leaks

The simplest leak is your IP address. Your IP address is a powerful tracking tool, but only one of many used to track you around the web. This can be mitigated with a VPN, Tor, proxy, etc. but...

Auto updaters usually trigger on network connection changes, so if you have a software VPN running and change Wi-Fi networks (or reconnect), the updater could hit the network before the VPN engages, leaking your real IP address.

During the update process, the server will likely be made aware of certain details about your machine. OS, bit depth (32 vs 64), maybe the browser you use, possibly other running programs, any plug-ins or add-ons of the program, fonts, certificates, etc. These details can also be used to fingerprint you.

Security Dangers

Supply Chain Attacks

There have been subversions of the update process, called supply chain attacks, and last year CCleaner was a victim of such an attack.

Telemetry, analytics, ads

These three antifeatures have become commonplace buzzwords to mask their usually unwanted behavior: tracking. These sorts of things will get pushed down with auto updates, and you won't have the notice or option to remove them unless they become newsworthy on the Internet at large.

Other antifeatures

Other antifeatures are known to come through the auto update process. Microsoft is bundling and changing a lot of things every few months with Windows 10. Your file extensions will get changed, you'll get new software that you can't remove, or you'll have problems digesting the update.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.