zlacker

>>myster+(OP)
Vindicated once again for turning off any update checks the moment I install any new piece of software.

Even if this sort of (obviously rare) attack is not a concern, it baffles me how few otherwise-intelligent people fail to see the way these updaters provide the network (which itself is always listening, see Room 641A and friends) with a fingerprint of your specific computer and a way to track its physical location based on the set of software you have installed, all of which want to check for updates every goddamn day.

>>Lammy+Nc
If the people with access to Room 641A want you, you're toast unless you're ready to make some REALLY big digital lifestyle changes that most people would not be amenable to, because you would have to be extremely paranoid on multiple fronts all the time. That kind of heightened vigilance is exhausting and really not worth it.

Threat modeling: it keeps things realistic.

>>arcfou+cd
Sorry for assuming you'd be able to extrapolate from one example. It could be at any level of the funnel from your local machine to the wider Internet. Closer to home: this sort of fingerprinting could defeat things like MAC randomization in a PSK-authed business/university setting if those IT departments had some reason to want to track you.

I once worked at a company where the Security team were very proud of this and all the other tricks they used to catch leakers by figuring out who was on campus, where, at what time, usually via fingerprinting personal devices carried alongside corporate devices.

>>Lammy+9e
Ah, so, in addition to turning off automatic updates (everyone knows patches are for wimps! The real threat is supply chain compromise, not 1-days!), you also have taken all of the other necessary steps to protect yourself from the NSA? What if they just compel Microsoft to backdoor Windows/WinGet against you?

And these updaters almost universally use HTTPS, which network-based adversaries can't see except for SNI, and even that's going away...?