Microsoft Edge is one of the least private web browsers, as it sends back device identifiers and web browsing telemetry to back-end servers, according to new research.
An analysis of the browser, which comes bundled in Windows 10 by default, conducted by Trinity College Dublin found that Edge sends “persistent identifiers” to back-end services, as well as the URLs typed into the browser’s pages.
RELATED RESOURCE
Don’t just collect data, innovate with it.
Removing the barriers to the experience economy
Professor Douglas Leith from the university’s School of Computer Science and Statistics looked at the behaviour of other browsers as well and concluded that Edge and fellow browser Yandex were lacking in privacy protections.
“From a privacy perspective Microsoft Edge and Yandex are much more worrisome than the other browsers studied,” Leith explained. “Both send identifiers that are linked to the device hardware and so persist across fresh browser installs and can also be used to link different apps running on the same device.
“Edge sends the hardware UUID of the device to Microsoft, a strong and enduring identifier than cannot be easily changed or deleted. Similarly, Yandex transmits a hash of the hardware serial number and MAC address to back end servers.
“As far as we can tell this behaviour cannot be disabled by users. In addition to the search autocomplete functionality (which can be disabled by users) that shares details of web pages visited, both transmit web page information to servers that appear unrelated to search autocomplete.”
It's worth noting that the collection of user data and browser telemetry isn’t a privacy issue in itself, as such data can facilitate smooth upgrades and feedback when testing new features. But Leith noted that it becomes a problem when such data can be tied to a specific user.
“When the same identifier is used across multiple transmissions it allows these transmissions to be tied together across time,” Leith said. “While linking data to a browser instance does not explicitly reveal the user’s real-world identity, many studies have shown that location data linked over time can be used to de-anonymize.”
“A second way that issues can arise is when user browsing history is shared with backend servers. Previous studies have shown that it is relatively easy to de-anonymize browsing history, especially when combined with other data,” Leith added.
Not having the ability to opt-out of such privacy-sapping measures flies in the face of other efforts Microsoft has made in recent times to make its data collection and privacy option in Windows 10 and other services more transparent.
Conversely, Leith found that the Brave Browser was the most secure, followed by Google’s Chrome browser, Mozilla Firefox, and Apple’s Safari.
While Microsoft has put in plenty of work to make Edge into an appealing browser, it appears to have more work to do if it wishes to compete with rivals on privacy.
-
Bigger salaries, more burnout: Is the CISO role in crisis?In-depth CISOs are more stressed than ever before – but why is this and what can be done?
-
Cheap cyber crime kits can be bought on the dark web for less than $25News Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
-
Recall arrives for Intel and AMD devices after months of controversyNews Microsoft's Recall feature is now available in preview for customers using AMD and Intel devices.
-
With one year to go until Windows 10 end of life, here’s what businesses should do to prepareNews IT teams need to migrate soon or risk a plethora of security and sustainability issues
-
Microsoft is doubling down on Widows Recall, adding new security and privacy features – will this help woo hesitant enterprise users?
News The controversial AI-powered snapshotting tool can be uninstalled, Microsoft says
-
Microsoft patches rollback flaw in Windows 10News Patch Tuesday includes protection for a Windows 10 "downgrade" style attack after first being spotted in August
-
Companies “wary” of Windows 11 migration challenges as Windows 10 EOL draws closer
News A recent study shows that only a fraction are running Windows 11, despite a rapidly-approaching end of life deadline
-
New Windows vulnerability could repeatedly trigger the blue screen of death on millions of devicesNews Attackers could exploit the Windows vulnerability to repeatedly crash machines and trigger a blue screen of death, according to researchers at Fortra
-
Here’s how much Windows 10 could cost if you don’t upgrade this yearNews Windows 10 extended security updates will cost users dearly, with prices rising incrementally each year.
-
Linux just hit an all-time high share of the global desktop market — and surging popularity in India is driving uptake of the open source operating systemNews Linux is still dwarfed by operating systems such as Windows, but it’s making modest gains off the back of growing popularity in emerging markets
