Sunday, November 6th 2016
NVIDIA Telemetry Spooks Privacy-sensitive Users, How to Disable it
Over the past few versions of NVIDIA GeForce drivers, the company has been bundling a telemetry tool that is enabled by default, auto-runs on Windows startup by default, and doesn't appear in the list of things you can choose not to install, when doing a custom-installation with NVIDIA GeForce driver installers. Very little is known about this new Telemetry component. For all we know, it could be a means for NVIDIA to collect crash-reports that help it improve its drivers down the line. Not everyone is convinced with this explanation.
Spanning across three separate startup tasks (a bit much for a crash reporter?), Telemetry is allegedly a means for NVIDIA to send data "back and forth." Users that are the privacy equivalent of germ-freaks might see this as a means for NVIDIA to spy on its users, for a plethora of data, such as usage patterns, etc. MajorGeeks posted a brief tutorial on how to disable Telemetry (and other bloatware included in NVIDIA drivers), using Sysinternals, but you can use Task Manager, msconfig, or Registry Editor to disable these as well.
Source:
MajorGeeks
Spanning across three separate startup tasks (a bit much for a crash reporter?), Telemetry is allegedly a means for NVIDIA to send data "back and forth." Users that are the privacy equivalent of germ-freaks might see this as a means for NVIDIA to spy on its users, for a plethora of data, such as usage patterns, etc. MajorGeeks posted a brief tutorial on how to disable Telemetry (and other bloatware included in NVIDIA drivers), using Sysinternals, but you can use Task Manager, msconfig, or Registry Editor to disable these as well.
69 Comments on NVIDIA Telemetry Spooks Privacy-sensitive Users, How to Disable it
I want to see a wireshark of this shit (and not just false reddit claims of one)... though it's likely encrypted.
Like OnePlus sending your IMEI/MEID with ever update request clearwire...
There was this log from reddit (summary and link below, click on "here"), although it originated from a magazine (about 4+ months ago, telemetry may have changed since then):
Disclaimer: CanardPC Hardware is a printed magazine thus I do not have any link to an online article for now. They have already published online some popular articles in the past but it is still very uncommon and, if it happens for this one, it will be in French. I will add a scan of the article if they authorize me to do so (usually they don't mind if it is on a non-French website).
Anyway here is the best summary I could make in English:
When installing the latest driver (368.25), the process immediately send the current driver version and the PCI ID of your graphic card at gfswl.geforce.com using HTTP without encryption.
After transmitting some miscellaneous information like ID and size of your monitor to Adobe and a Google Analytics' tracker Nvidia will send information regarding your hardware such as CPU and SSD model reference to telemetry.nvidia.com.
Now if you agree to install GeForce Experience, which is the default option, a detailed description of your hardware is sent a few minutes later to gfe.nvidia.com/getsugar. This description includes: brand and model of your motherboard, serial number, BIOS version, information regarding USB drives currently plugged, RAM capacity, GPU frequency, etc.
But wait, there is more! GeForce Experience will communicate the software you use (not only games), when you use it, for how long and, if it is a game, a framerate history, current settings and various statistical data.
It will also record where you click on the various utilities provided and how long you stay on each page. Almost 100Ko of information, along with Google trackers, are sent to Nvidia.
A decrypted log intercepted from our test setup is available here.
This is clearly a breach of your privacy. Nvidia's privacy policy does not mention these activities in the French version, only in the English one.
Regarding AMD (Crimson 16.5.3), some basic information are sent during driver installation, just like Nvidia, but we detected nothing more afterwards even when launching various applications or games.
This short article is part of a 15-pages dossier regarding privacy. There is one page on Steam, Origin, Battle.Net and GoG if anyone is interested (spoiler: besides GoG they use a lot of third-party cookies/trackers).
Now regarding the magazine's reputation, they are not anti-Nvidia or pro-AMD. In the same issue of the magazine they blame various websites and AMD for what happened at Computex 2016 and their lack of ethics (here is one of their many tweets regarding this event). They have also advised their readers to chose Nvidia's graphic cards over AMD's in the mid/high-end segment for a while now.
then i followed instruction in wccftech to get rid all...
but that does not mean you can't collect a little bit of metadata on the side and lets be honest show me a company who does not to that today.
Oh wait, I don't have a geforce card! whew~
If I know what exactly they collect and how they send and who they share it with, I'm ok with that. There is just one BUT here. It has to have an option to turn it off EASILY. Meaning you can opt out of this. It shouldn't be like "Accept our EULA or stop using our graphic card/latest drivers". They can't enforce such terms on you AFTER you already have a 800€ graphic card for example which was bought under the old terms. Same goes for drivers. They can't force you in such submission after such expensive purchase and be on outdated drivers just because you disagree with their methods.
They have to add the switch for this in NV Contro Panel. Every serious program that shares data/telemetry has this.
avast! Antivirus for example goes even further in this regard. They have two options (checkboxes), one is to share info with AVAST Software and second checkbox to opt out of 3rd party sharing. So you can still share data with parent company, but you don't allow them to share it further. That's the level of transparency every company should have. Yes, including NVIDIA.
If all they send is driver version and device ID, that's not really that problematic. That's actual telemtry.
I think it's only the 10-installer that does it.
EDIT: Yep, a quick test confirms that.
You're being followed your entire life.
Ultimately, I don't see this as sinister, but is a bit intrusive. After all every product maker wants to know as much as possible about how their products are being used and about the customers using it, their habits etc so this is a good way to go about getting that info. It puts that registration requirement for GFE into context now, doesn't it? It's all about identifying YOU. ;)
While I'd prefer it if they didn't do this, I won't be stripping it out and engaging in an endless game of cat and mouse whenever I install the latest driver. I have more important things to worry about.
Also, if anyone is thinking of going AMD over this, don't worry they'll start doing this soon as well.