There's a key logger in microsoft edge.

For everything that's not in any way related to PureBasic. General chat etc...
User avatar
idle
Always Here
Always Here
Posts: 5019
Joined: Fri Sep 21, 2007 5:52 am
Location: New Zealand

There's a key logger in microsoft edge.

Post by idle »

Seems microsoft edge has a key logger built in.
I noticed repeated requests to nleditor.osi.office.net, when I was writing a message in the forum.
It's supposedly a spelling and grammar service but the fact it's key logging should be a little worrying.
If it's unblocked it establishes a tls connection and sends off encrypted packets to nleditor.osi.office.net 52.109.112.219
I don't have the time to MITM it to see exactly what it sends but it seems to be a fairly recent as far as I can tell and it is also reported to be present in the webview2 browser control if anyone is using that.
Dnscope blocked it, which is why I saw it. see in the log.

Image
User avatar
Paul
PureBasic Expert
PureBasic Expert
Posts: 1243
Joined: Fri Apr 25, 2003 4:34 pm
Location: Canada
Contact:

Re: There's a key logger in microsoft edge.

Post by Paul »

idle wrote: Thu Oct 20, 2022 10:43 pm Seems microsoft edge has a key logger built in.
https://www.ghacks.net/2022/09/19/dont- ... -features/
Image Image
User avatar
idle
Always Here
Always Here
Posts: 5019
Joined: Fri Sep 21, 2007 5:52 am
Location: New Zealand

Re: There's a key logger in microsoft edge.

Post by idle »

yes that disables it
go to edge://settings/languages , and either turn writing assistance off or set it to basic.
The fact it's on by default is just wrong, the behavior's has been reported in the edge webview2 control just a week ago.
User avatar
Paul
PureBasic Expert
PureBasic Expert
Posts: 1243
Joined: Fri Apr 25, 2003 4:34 pm
Location: Canada
Contact:

Re: There's a key logger in microsoft edge.

Post by Paul »

The fact it's on by default is just wrong
Come on, it's Microsoft corporation.
They only have your best interests at heart :twisted:

LOL
Image Image
User avatar
idle
Always Here
Always Here
Posts: 5019
Joined: Fri Sep 21, 2007 5:52 am
Location: New Zealand

Re: There's a key logger in microsoft edge.

Post by idle »

Paul wrote: Fri Oct 21, 2022 1:39 am
The fact it's on by default is just wrong
Come on, it's Microsoft corporation.
They only have your best interests at heart :twisted:

LOL
I better be careful with the key words I use or a swat team might turn up.
The real worry is the risk it poses for developers using the webview2 control.
davido
Addict
Addict
Posts: 1890
Joined: Fri Nov 09, 2012 11:04 pm
Location: Uttoxeter, UK

Re: There's a key logger in microsoft edge.

Post by davido »

@idle,
Well spotted. Thank you.
DE AA EB
Little John
Addict
Addict
Posts: 4519
Joined: Thu Jun 07, 2007 3:25 pm
Location: Berlin, Germany

Re: There's a key logger in microsoft edge.

Post by Little John »

Thank you from me as well.
User avatar
tj1010
Enthusiast
Enthusiast
Posts: 621
Joined: Mon Feb 25, 2013 5:51 pm
Location: US or Estonia
Contact:

Re: There's a key logger in microsoft edge.

Post by tj1010 »

Android and Windows both have multiple telemetry subsystems... Even if a process isn't logging some native subsystem is sending keywords and source code and binary data along with stats and specs... I think MacOS does too.. Commercial Linux distros have some kind of telemetry around package managers...

Pretty sure they all collect data from cloud and sync services too despite claims of encryption...
The truth hurts.
BarryG
Addict
Addict
Posts: 3268
Joined: Thu Apr 18, 2019 8:17 am

Re: There's a key logger in microsoft edge.

Post by BarryG »

idle wrote: Thu Oct 20, 2022 10:43 pmIt's supposedly a spelling and grammar service but the fact it's key logging should be a little worrying.
Yes, but... any app that corrects spelling and grammar literally has to know what you've typed (and/or read your text).
User avatar
idle
Always Here
Always Here
Posts: 5019
Joined: Fri Sep 21, 2007 5:52 am
Location: New Zealand

Re: There's a key logger in microsoft edge.

Post by idle »

BarryG wrote: Sat Oct 22, 2022 2:34 am
idle wrote: Thu Oct 20, 2022 10:43 pmIt's supposedly a spelling and grammar service but the fact it's key logging should be a little worrying.
Yes, but... any app that corrects spelling and grammar literally has to know what you've typed (and/or read your text).
Spelling and grammar can easily be checked in the browser itself, it doesnt need to upload your key strokes to the cloud for processing or collection. The fact it does this by default and also does it in the webview2 control presents a pretty serious security risk which is rife for abuse in my opinion.
tj1010 wrote: Android and Windows both have multiple telemetry subsystems... Even if a process isn't logging some native subsystem is sending keywords and source code and binary data along with stats and specs... I think MacOS does too.. Commercial Linux distros have some kind of telemetry around package managers...

Pretty sure they all collect data from cloud and sync services too despite claims of encryption...


I expect they all do to some exent but we don't need to accept it.
In my current session, Dnscope has blocked 90% of the requests out of a total of 29,623 only ~3000 have got through, most of those domain requests are related to microsoft and google related domains and that's just on my desktop.
BarryG
Addict
Addict
Posts: 3268
Joined: Thu Apr 18, 2019 8:17 am

Re: There's a key logger in microsoft edge.

Post by BarryG »

idle wrote: Sat Oct 22, 2022 4:33 amit doesnt need to upload your key strokes to the cloud
Oops, I overlooked that bit. Yes, that's a worry, then.
User avatar
idle
Always Here
Always Here
Posts: 5019
Joined: Fri Sep 21, 2007 5:52 am
Location: New Zealand

Re: There's a key logger in microsoft edge.

Post by idle »

BarryG wrote: Sat Oct 22, 2022 5:13 am
idle wrote: Sat Oct 22, 2022 4:33 amit doesnt need to upload your key strokes to the cloud
Oops, I overlooked that bit. Yes, that's a worry, then.
Sure is. It's not so much the browser though but the implications it has for applications using the embedded controls.
Nituvious
Addict
Addict
Posts: 998
Joined: Sat Jul 11, 2009 4:57 am
Location: United States

Re: There's a key logger in microsoft edge.

Post by Nituvious »

I am not surprised Microsoft would do something like this. Years ago when I still used Windows I went on a crusade to turn off the forced updates and stumbled upon their data collection service that when toggled off warns you that you're making your system unsafe by not allowing them to collect your personal data. It's pretty scummy, and I would be very surprised if Google wasn't doing the same thing.

Image
▓▓▓▓▓▒▒▒▒▒░░░░░
AZJIO
Addict
Addict
Posts: 1298
Joined: Sun May 14, 2017 1:48 am

Re: There's a key logger in microsoft edge.

Post by AZJIO »

The worst thing is if the system sends the MFT of the hard disk, for example, when the OS boots, when the user cannot control the OS. Moreover, it will send it in a couple of seconds, and then someone will analyze the data structure and decide which data is of interest to him.
User avatar
bgeraghty
User
User
Posts: 52
Joined: Wed Apr 02, 2014 12:45 am
Location: irc.ibotched.it:+6697
Contact:

Re: There's a key logger in microsoft edge.

Post by bgeraghty »

Image
Amazing what they try to pass as legitimate software these days...
SolveMyIssue_() - No QuickHelp available.
Post Reply