Every time I install Windows 10, I painstakingly go through every setting that can be found in any GUI setting for the OS, disabling everything that sounds creepy.
One of the most disturbing things I've found is what I believe is called "automatic sample submission", which means that the built-in anti-virus tool in Windows 10 can, by default, decide to upload any file it deems "potentially risky" to Microsoft, "for further analysis". It also mentions that it doesn't do this for files which "may contain personal data".
But how can it know that? Does it:
- Simply look at the file extension and only upload .EXE and other "obvious binaries"?
- Does it ignore the file extension and instead look inside the file to check if it contains executable code?
- A combination of both?
What happens if I have a word processing document full of private information, but which also has a malicious macro or something accidentally baked (embedded) into it?
What happens if I have an EXE which actually has had all data files baked into it while I'm developing a game as to be a single file? (This is an actual situation I've been in in the past.)
Does it deem the data files for my local PostgreSQL database full of ultra-private information as "potentially dangerous" and upload those?
I can think of numerous situations where even the smartest code in the world would not be able to determine what contains private data or not. And, frankly, I have virtually zero confidence left in Microsoft's judgment at this point, having wasted a huge amount of my life fighting the OS to be able to use it at all. I've found numerous typos in their "stable" releases, making me extremely scared of how much data has been uploaded in spite of all the care I've tried to take to avoid it.
I also remember that it eagerly wanted to re-enable this feature, even harassing me about it. I can imagine that the vast majority of users have no idea about this, let alone have gone through the trouble of force-disabling it.