Nvidia spying on you through drivers and selling/sharing your data ?

[Maxx Power]

Very interesting development over at Reddit, discussing Nvidia's privacy and data collection policies and Nvidia's "NvTmMon" process (default in recent drivers as part of their telemetry), which performs the user data capturing and submission. Link below:

https://www.reddit.com/r/Amd/comments/5bd0qz/nvidia_uses_malware_to_spy_collect_send_sell_your/

What does everyone here at MacRumors think ?


I'll quote a few relevant posts to get us started:

------------------------------------------------------------------------------------------------------------------------
"http://www.nvidia.com/object/privacy_policy.html

When you use our Services, we may collect "Personal information," which is any information that can be used to identify a particular individual which can include traditional identifiers such as name, address, e-mail address, telephone number and non-traditional identifiers such as unique device identifiers and Internet Protocol (IP) addresses....

We may from time to time share your Personal Information with our business partners, resellers, affiliates, service providers, consulting partners and others in order to provide our Services to you.

We also permit third party online advertising networks and social media companies to collect information about your use of our website over time so that they may play or display ads that may be relevant to your interests ...

We may combine personal information that we collect about you with the browsing and tracking information collected by these technologies. We or the online advertising networks use this information to make the advertisements you see online more relevant to your interests."


------------------------------------------------------------------------------------------------------------------------

"http://www.nvidia.com/object/privacy_policy.html

We do not sell Personal Information about our customers or users to any third parties.

I was making a quib at them because they differentiate between sell and "share"."


------------------------------------------------------------------------------------------------------------------------


"Yep, share the information and get business deals in return. They are technically not making money from the information. Ohh look Nvidia GPUs power one of Facebook's computers I wonder how they came to the decision to use Nvidia."

 

[cube]

NO to login for automatic driver updates.

 

[Maxx Power]

NO to login for automatic driver updates.

Is that the end of it ? I mean, this service used to be part of the Geforce Experience program, which was optional, then it was silently rolled into standard driver installs. Do you think Nvidia would make it override-able in the future ?
[doublepost=1478442722][/doublepost]This is what they used to send, according to an analysis of the traffic content 4+ months ago (contents may have changed now):

-------------------------------------------------------------------------------------------------------------------


Disclaimer: CanardPC Hardware is a printed magazine thus I do not have any link to an online article for now. They have already published online some popular articles in the past but it is still very uncommon and, if it happens for this one, it will be in French. I will add a scan of the article if they authorize me to do so (usually they don't mind if it is on a non-French website).


Anyway here is the best summary I could make in English:


When installing the latest driver (368.25), the process immediately send the current driver version and the PCI ID of your graphic card at gfswl.geforce.com using HTTP without encryption.


After transmitting some miscellaneous information like ID and size of your monitor to Adobe and a Google Analytics' tracker Nvidia will send information regarding your hardware such as CPU and SSD model reference to telemetry.nvidia.com.


Now if you agree to install GeForce Experience, which is the default option, a detailed description of your hardware is sent a few minutes later to gfe.nvidia.com/getsugar. This description includes: brand and model of your motherboard, serial number, BIOS version, information regarding USB drives currently plugged, RAM capacity, GPU frequency, etc.


But wait, there is more! GeForce Experience will communicate the software you use (not only games), when you use it, for how long and, if it is a game, a framerate history, current settings and various statistical data.


It will also record where you click on the various utilities provided and how long you stay on each page. Almost 100Ko of information, along with Google trackers, are sent to Nvidia.


A decrypted log intercepted from our test setup is available here.


This is clearly a breach of your privacy. Nvidia's privacy policy does not mention these activities in the French version, only in the English one.


Regarding AMD (Crimson 16.5.3), some basic information are sent during driver installation, just like Nvidia, but we detected nothing more afterwards even when launching various applications or games.


This short article is part of a 15-pages dossier regarding privacy. There is one page on Steam, Origin, Battle.Net and GoG if anyone is interested (spoiler: besides GoG they use a lot of third-party cookies/trackers).


Now regarding the magazine's reputation, they are not anti-Nvidia or pro-AMD. In the same issue of the magazine they blame various websites and AMD for what happened at Computex 2016 and their lack of ethics (here is one of their many tweets regarding this event). They have also advised their readers to chose Nvidia's graphic cards over AMD's in the mid/high-end segment for a while now.