While Microsoft Edge shares the same source code as the popular Chrome browser, it offers users better control of privacy. New research, however, indicates that it may have more telemetry data that invade privacy than other browsers.
According to Microsoft, telemetry refers to system data that is loaded by telemetry components or integrated browser services. Telemetry features are not new to Microsoft and the company uses telemetry data from Windows 10 to identify problems, analyze and resolve problems.
Professor Douglas J Leith, president of computer systems at Trinity College in Ireland, tested six web browsers to determine what data they shared. In his research, he presented Chromium-based Microsoft Edge, Google Chrome, Brave, Yandex, Firefox and Apple Safari.
Unfortunately, Microsoft Edge didn’t perform well in various privacy tests.
Too much telemetry in Microsoft Edge
During the Edge browser test, Leith saw that all the URLs typed in Edge would be sent back to Microsoft sites.
For example, each URL typed in the address bar is shared with Bing and other Microsoft services such as SmartScreen. This was confirmed by BleepingComputer who used Fiddler to view JSON data sent to Microsoft.
This could be solved using a technique similar to Google’s Safe Browsing implementation that downloads a list of known malicious sites and saves it locally. This list is controlled by the browser and if all data is to be sent to Google’s servers, it will only send a hashed partial URL fingerprint which can be used to monitor browsing behavior.
The browser also sends unique hardware identifiers to Microsoft, which is a “strong and durable identifier” that cannot be easily changed or eliminated.
The Russian web browser Yandex is also engaged in similar anti-privacy activities:
From the point of view of privacy, Microsoft Edge and Yandex are qualitatively different from the other browsers studied. Both send persistent identifiers that can be used to link requests (and the associated IP address / location) to the back-end servers. Edge also sends the hardware UUID of the device to Microsoft and Yandex similarly transmits a hashed hardware identifier to the back-end servers. As far as we know, this behavior cannot be disabled by users. In addition to the auto-complete search feature that shares the details of the web pages you visit, they both pass the web page information to servers that appear unrelated to the auto-complete search.
It is important to note that Microsoft Edge for Enterprise offers administrators great control in distributions to disable all these trackers, but trackers are enabled by default in all Edge installations.
While Microsoft Edge didn’t perform well in tests, the researcher also questioned the behavior of Chrome and other browsers.
Previously, users have noticed that Chrome crawls the entire computer and reports the hashes of executable programs on Google to create Chrome’s Safe Browsing platform.
Chrome, Firefox and Safari share the details of each web page you visit with their services. All these browsers use the auto-complete feature to send web addresses to their services in real time.
Firefox telemetry transmissions, silently enabled by default, can potentially be used to connect them over time. In Firefox, there is also an open WebSocket for push notifications and it is linked to a unique identifier, which could be used for monitoring, according to the researcher.