Privacy concerns raised that SmartScreen in Edge shares browsing history with Microsoft

guest · Jul 23, 2019

Privacy concerns raised that SmartScreen in Edge shares browsing history with Microsoft
July 23, 2019
https://betanews.com/2019/07/23/edge-privacy-smartscreen/

A security researcher has revealed that the SmartScreen feature of Microsoft Edge is sharing full URLs of pages visited with the Windows-maker. Also shared are users' account IDs, raising concerns about privacy-invading tracking of browsing history.

SmartScreen is a security feature that Microsoft uses to identify phishing and malware websites [...]
Checks and tests carried out by Bleeping Computer confirmed his report that unmasked URLs were being shared with Microsoft, as well as the fact that "Windows 10 also transmits a great deal of potentially sensitive information about your applications to SmartScreen when you attempt to run them".

Edge apparently sends the full URL of pages you visit (minus a few popular sites) to Microsoft. And, in contrast to documentation, includes your very non-anonymous account ID (SID). pic.twitter.com/zHMLUGwo9w
— scriptjunkie (@scriptjunkie1) July 19, 2019
Click to expand...

While the report may be disturbing, Microsoft is actually fairly honest about what is happening: the company reveals that URLs are shared in documentation.
In the Chromium-based version of Edge, Microsoft has opted to continue to share unhashed URLs, but it no longer shares SIDs.
Click to expand...

Bleeping Computer: Windows 10 SmartScreen Sends URLs and App Names to Microsoft

While they are not doing anything sneaky, Microsoft can modify how URLs are sent so that they are hashed in a similar way that Chrome SafeBrowsing does it.

The alternative approach is to do what SafeBrowsing does, which is push the hash list to the client. Which is fine, but it's a tradeoff, data freshness and transfer size, vs. value of a threat model in which you don't trust the people who wrote the code you're running.
— Eric Lawrence (@ericlaw) July 22, 2019
Click to expand...

mirimir · Jul 23, 2019

I always disable that URL-checking stuff.

threat model in which you don't trust the people who wrote the code you're running
Click to expand...

That's not the point. The code may be fine, and (if open-source) can be verified. But giving them full browsing history is a separate issue. And there's no way to know what they do with it.

Rasheed187 · Jul 27, 2019

mirimir said: ↑

I always disable that URL-checking stuff.
Click to expand...

Exactly, just how dumb can you be. I always disable that SmartScreen crap. There should be no need for them to collect your browsing info.

lucd · May 13, 2020

mirimir said: ↑

I always disable that URL-checking stuff.
Click to expand...

I don't think it's a great idea I thought the same and once I mispelled twitter one the browser search box and it got me to a malware infested site and the Url-checking "saved me", so it's about deciding who gets your data first and when

Log in or Sign up

Privacy concerns raised that SmartScreen in Edge shares browsing history with Microsoft

guest Guest

mirimir Registered Member

Rasheed187 Registered Member

lucd Registered Member

Log in or Sign up

Privacy concerns raised that SmartScreen in Edge shares browsing history with Microsoft

guest Guest

mirimir Registered Member

Rasheed187 Registered Member

lucd Registered Member

Useful Searches