[SOLVED] Professional questions about Win11

[AJAshinoff]

I am an IT manager with a lot of experience, going back to DOS 3.3. that's pre-windows for the younger folks . Today a new group of systems came in with Win11 installed. Having extensive history with MS and knowing how they operate, I'm wary of being on their bleeding edge when it comes to anything. Needless to say, particularly today, I refuse to trust them more than I need to. My questions are related to a subject that I spend way more time on these days, with pretty much everything being ON and/or online by default, security.

I recall VAX and dumb terminals. I remember the revelation of distributed processing which created the home PC/Small Biz boom and placed Unix in the realm of major companies and institutions. I also remember how MS became what it is today, which is why trust for MS, even though I use many of their products, doesn't come easy.

Objectively, how secure is Win11 from Microsoft itself? I'm not referring to updates (unless they are now automatic by default), but about someone from Microsoft getting in for any reason or rolling things back to a previous state without my authorization? If ON by default, can it be terminated?
Is any of your disk storage or processing now dedicated to anything or anyone's else's disposal ?

I have 88 systems running Win10. I can't just upgrade without considering security and the expense. I'm savvy enough to know just because you don't see something happening doesn't mean that nothing is going on. Incidentally, a friend working for the VA told me they've been instructed not to load win11 on anything due to security concerns.

Legit?

 

[Math Geek]

many have and made it public, back when win 10 was still in beta. that's why the gov asked for the gov edition.

while working on my cybersecurity degree, a few classmates and i (along with our instructor who heads a rather specific cyber division for the military) did exactly what you are asking about. it's pretty crazy how much data goes to MS right away and continuously. i say what i say having done the testing myself, guided by a true expert in security/hacking/cyber defense and offense. win 10 is a complete keylogger. turn on wireshark, press a key and watch the packet go. press another and watch the next one go and so on.

we were told that testing when/where the data was created and encrypted was very deep in the kernel itself so it happens mostly before any software gets in the way.that's why turning on/off any settings and installing stuff and so on makes little difference.

you can do nothing on the pc itself to stop it so far as i know. the only thing we could do was to put a firewall outside the pc to stop the packets from getting off the network. but we could not stop them all no matter what we did to windows. the packets are encrypted so we could not inspect them sadly. i would love to know what was being sent. everyone i have spoken with in the field won't use win 10/11/spyware edition. i don't and won't be either, ever.

 

[TerryLaze]

win 10 is a complete keylogger. turn on wireshark, press a key and watch the packet go. press another and watch the next one go and so on.

Well depends on if this happens everywhere, if is example is about the search bar or internet explorer then, well duh, you want search results how do you think you are going to get them?
If this happens in text editor/office then sure much more of an issue.

 

[hotaru.hino]

many have and made it public, back when win 10 was still in beta. that's why the gov asked for the gov edition.

while working on my cybersecurity degree, a few classmates and i (along with our instructor who heads a rather specific cyber division for the military) did exactly what you are asking about. it's pretty crazy how much data goes to MS right away and continuously. i say what i say having done the testing myself, guided by a true expert in security/hacking/cyber defense and offense. win 10 is a complete keylogger. turn on wireshark, press a key and watch the packet go. press another and watch the next one go and so on.

we were told that testing when/where the data was created and encrypted was very deep in the kernel itself so it happens mostly before any software gets in the way.that's why turning on/off any settings and installing stuff and so on makes little difference.

you can do nothing on the pc itself to stop it so far as i know. the only thing we could do was to put a firewall outside the pc to stop the packets from getting off the network. but we could not stop them all no matter what we did to windows. the packets are encrypted so we could not inspect them sadly. i would love to know what was being sent. everyone i have spoken with in the field won't use win 10/11/spyware edition. i don't and won't be either, ever.

And until that data can be decrypted and verified what exactly is in it, it could be anything and someone's falling into correlation implying causation. I mean, I could scare some people by opening up an SSH connection, having wireshark sniff what's going on, and showing packets flying by every time I press a key. I just have to make sure they don't see the man behind the curtain.

Also realistically speaking, the OS is only part of the equation. How do you know your hardware isn't spying on you? How do you know your router isn't forwarding packets elsewhere? How do you know your modem isn't doing the same thing? How much trust can you put in the entire communication chain if you can't verify every last bit, byte, and electrical signal along the way?

 

[Math Geek]

well you've convinced me.

win 10/11 is awesome and in no way spies on users. wow all this time i relied on experts and my own tests but in the end all i really needed was someone to just tell me "nope, didn't happen. you can't prove it well enough so give up. fake news, nothing to see here citizen"

i'm cured folks, no more tin foil hat for me. thanks for setting me straight. what a relief, really....

 

[USAFRet]

well you've convinced me.

win 10/11 is awesome and in no way spies on users. wow all this time i relied on experts and my own tests but in the end all i really needed was someone to just tell me "nope, didn't happen. you can't prove it well enough so give up. fake news, nothing to see here citizen"

i'm cured folks, no more tin foil hat for me. thanks for setting me straight. what a relief, really....

Sigh....no one is saying that.

However, to your previous comment:
"win 10 is a complete keylogger. turn on wireshark, press a key and watch the packet go. press another and watch the next one go and so on. "

I just tested this.
Win 10 Pro, VirtualBox VM
Wireshark

Win 11 Pro Host
Also running wireshark.

Blank notepad.exe on the VM.
Type, save, whatever....

I saw no evidence of this packet capture and sending, either in the guest VM instance, or going out through the host.

 

[hotaru.hino]

well you've convinced me.

win 10/11 is awesome and in no way spies on users. wow all this time i relied on experts and my own tests but in the end all i really needed was someone to just tell me "nope, didn't happen. you can't prove it well enough so give up. fake news, nothing to see here citizen"

i'm cured folks, no more tin foil hat for me. thanks for setting me straight. what a relief, really....

Oh so you ran a test too? Then tell us exactly what we need to do in order to replicate your results, since apparently @USAFRet 's testing wasn't enough to replicate it.