undefined | Better HN

0 pointscrumbshot7y ago0 comments

That is such an outrageous claim I had to check for myself.

From looking at conhost.exe in IDA Pro, there are some references to telemetry in a function HandleKeyEvent: https://i.imgur.com/MwaBLcW.jpg

But looking more closely it's just used to increase some counters when Ctrl+C or Ctrl+V are used: https://i.imgur.com/29e2qLD.png

There is another one for Ctrl+A elsewhere in the function as well.

Seems these are for when clipboard operations happen, there is other telemetry nearby for when key activity causes a paste: https://i.imgur.com/xONKrGJ.png

So Microsoft are indeed collecting keystroke telemetry in conhost.exe, but it's just some boring old counters to measure clipboard usage.

0 comments

russh7y ago

But how can that be when "... the engineering lead owning conhost.exe: I can't find anything in our code that would trace user input, or data effectively derived from user input, to even a local event stream."

DHowett7y ago

I mean, I suppose that the key sequences around copy/paste are technically user input. Those events get processed into telemetry as to whether they were done in processed or raw input mode, and whether Quick Edit was engaged at the time.

Additional telemetry points include whether the "Find" dialog is being used (explicitly, whether "find next" has been clicked, and how long the search string is -- no other user-generated search content is included in event logs), when a process detaches from the console, and when the window is resized.

jessaustin7y ago

How about this one?

https://news.ycombinator.com/item?id=19323560

1 more reply

crumbshotOP7y ago

I think this disassembly supports their assertion. The number of times a user copies and pastes isn't in itself input to the console, just a metric of some out of band events.

reaperducer7y ago

it's just some boring old counters to measure clipboard usage.

Today. After the next (forced?) upgrade...?

j / k navigate · click thread line to collapse