😱 Edge apparently sends the full URL of pages you visit (minus a few popular sites) to Microsoft. And, in contrast to documentation, includes your very non-anonymous account ID (SID).
Conversation
Reposting for everybody; Firefox, Chrome, and Safari do not send your browsing history to their cloud overlords like Edge does. They compare 4-byte URL hash prefixes with downloaded bad hash lists.
Quote Tweet
Replying to @BrandonPadgett
Chrome, Firefox, and Safari use the Safe Browsing Update API which only sends hashed versions of the URL.
7
122
299
Adding repro steps to main thread
Quote Tweet
Replying to @SwiftOnSecurity
Full repro steps:
- Setup new Ubuntu VM with NAT and host only NIC's, install mitmproxy and start mitmweb logging.
- Download developer.microsoft.com/en-us/windows/ extract and place in host only net.
- Boot Windows VM, set static IP to use proxy, install certs
- Visit the URL
- See the above
1
13
71
Also happens on a clean updated Win 10 iso install with default settings. The "diagnostic data" install item mentions "info about the websites you browse" but I'd guess users would still be surprised ("diagnostic" sounds like just error/crash info, not all-the-time)
1
8
Sending the websites isn't a shock due to what smartscreen filter is, but sending the sid is odd.
1
2
9
Chrome, Firefox, and Safari use the Safe Browsing Update API which only sends hashed versions of the URL.
2
3
50
Show replies
So I’m going to follow up on this, from what I recall this is only supposed to fire for the full URL when heuristics find something. I don’t recall full fidelity forwarding but I might be wrong.
2
1
42
Full repro steps:
- Setup new Ubuntu VM with NAT and host only NIC's, install mitmproxy and start mitmweb logging.
- Download developer.microsoft.com/en-us/windows/ extract and place in host only net.
- Boot Windows VM, set static IP to use proxy, install certs
- Visit the URL
- See the above
5
6
54
Show replies
I believe this is classic, but I don't see why that would change with chromium, since they keep a lot of the stuff outside the renderer
1
1
4
Show replies




