13 ms·

Wacom tablets track every app you open

• onlyrealcuzzo 7y ago
  More importantly, don't iOS and Android track every app you open also?
  • oarsinsync 7y ago
    An operating system needs to be aware of every application running on it. (It doesn't need to be reporting that back to the mothership, though) I'm not sure what that has to do with a third party peripheral. You may be confusing a Wacom tablet for something like an iPad or Nexus 7? EDIT: For others who may be confused, a Wacom tablet is used to provide a pen/stylus interface to a computer. It's an additional peripheral, similar to your keyboard or mouse, for your computer. It is not a standalone independent computing platform.
    • dmitryminkovsky 7y ago
      Maybe I’m confusing it too. I searched “Wacom tablet” and it seems to be a... tablet.
      • hokumguru 7y ago
        You could think of it as more like a touchscreen computer monitor. They don't run standalone.
      • marcinzm 7y ago
        Wacom produces multiple devices, the simplest are basically a pen based touchpad. No display and no real computing power, needs to be plugged into a computer to function in any way. The more high end ones are a pen touchpad+display but still requires a computer (ie: they're a monitor). There are also standalone tablets that use Wacom technology although I'm not sure offhand if Wacom makes any directly.
        • egypturnash 7y ago
          You can buy tablet computers from Wacom, I have a “Wacom Mobile Studio” gathering dust that I really should get rid of someday. Just didn’t fit into my art workflow better than a laptop and an old Wacom Intuos 4 stuffed into the bag next to it. They do mostly make external pen input devices, with or without screens. Which people have been calling “drawing tablets” since loooong before “tablet computer” was a phrase anyone used outside of maybe science fiction.
      • aylons 7y ago
        A Wacom tablet is what used to be called a digitizer tablet, ie, a HID that uses a pen and a surface to allow for easier and better drawing. Essentially an odd-shaped mouse with some extra pressure sensitivity. GP must have confused with the currently better known use of tablet, which is a full-blown computer with touch screen and no keyboard.
    • onlyrealcuzzo 7y ago
      So why is the operating system providing peripherals this information? What's provided will be used for tracking...
  • dmitryminkovsky 7y ago
    This is getting voted down, but is this not true? My iPhone knows all my top apps and shows them on whatever that screen is called, with the search, and adjusts them over time as usage changes. Maybe it’s not “more important,” but why vote this down? How do I know that data doesn’t go back to Apple with “telemetry”?
    • gruez 7y ago
      Because it’s like saying “well iOS/Android knows your contacts, so what’s the issue with Wacom siphoning your contacts?” > How do I know that data doesn’t go back to Apple with “telemetry”? By checking the privacy policy. Also, you can opt out of telemetry on iOS.
      • dmitryminkovsky 7y ago
        Is OP saying that? The question I interpreted was “how is this different, such that I’m seeing this on the homepage of HN?”
      • deleted 7y ago
        [deleted]
    • cmcd 7y ago
      A Wacom tablet is not the same as a phone, it is a peripheral. This is like your Dell keyboard tracking your keystrokes and what application they go into.
      • deleted 7y ago
        [deleted]
      • diffeomorphism 7y ago
        A specialized keyboard using different button layouts and settings per app. Also, not tracking keystrokes at all but rather "used special keyboard with app foo". As a better example, suppose it were a game controller. Then the question "what games are people using this controller with?" seems quite reasonable. Filter to games only and anonymize the data and that would be fine.
  • deleted 7y ago
    [deleted]
  • throwaway55554 7y ago
    Being actual operating systems, I can understand why. I mean, it's pretty convenient to know what's installed on my phone. However, a writing/drawing tablet doesn't need to. At all. Ever.
    • buddylw 7y ago
      Wacom tablet drivers have application specific settings for compatibility. We should scrutinize all data collection, and this may be too far, but "[no need for tablet data collection] at all. Ever" is simply not true.
      • deleted 7y ago
        [deleted]
      • janfoeh 7y ago
        I strongly disagree. The driver does not have to collect an event log in order to react to focus changes and switch settings. It much less has to transmit this event log, let alone to a third party such as Google.
  • otachack 7y ago
    An OS with this data is different than an app.
  • the_snooze 7y ago
    I think the egregious thing with Wacom is that 1) no one expects a drawing pad to have any need for remote connectivity and 2) use said remote connectivity to share usage information with third parties. More broadly, we need to get away from this whole "but don't other people do the same thing?" dialogue when it comes to privacy. Yes, these issues are prevalent. That doesn't mean it's trivial---quite the opposite, in fact.
  • klodolph 7y ago
    When you set up an iPhone, you get this screen: > Help Apple improve its products and services by allowing analytics of usage and data from your iPhone. It’s enabled by default, but when you set up a new iPhone, it prompts you and gives you a button to turn it off (it’s not just buried in settings).
• wrkronmiller 7y ago
  > as far as I can tell anyone with the presence of mind to decline it could do so with no adverse consequences Makes me think one should try declining these kinds of agreements to see what happens, before accepting. As someone who also has an "anti-privacy-policy-policy," I wonder how many of these kinds of things I've agreed to when it was unnecessary.
  • egypturnash 7y ago
    As far as I can tell the only consequence of declining it is that it pops up the “hey please let us have all this info” dialogue whenever you reboot. I’ve been doing this on my own machine for most of a year. Might be different with the latest update, I haven’t bothered with that.
    • pbhjpbhj 7y ago
      Is there an accessible way to prevent an application drawing a specific window to the screen? I can see an app like autohotkey could click the "no" button and automatically remove it, but could you (assuming it's not modal; which it probably is) tell Windows not to show it?
      • egypturnash 7y ago
        The "Wacom Desktop Center" app mostly just sits there looking for updates and bugging you to enable tracking anyway; the Mac version has a menu setting that theoretically stops it from ever running, and thus bugging you to sign up to share your analytics. I just turned it off (since I just noticed it for the first time) but don't feel like rebooting to check if it actually works. (Though I did just run the little script I keep around to restart the driver, which normally brings up the WDC, and it did not show up this time. Huzzah!) No idea about Windows, I never use that.
• codezero 7y ago
  FWIW that isn’t a unique identifier for the author, it’s for Wacom’s GA account. I didn’t see any meaningful identifier being sent. Of course the set of most opened apps and your IP are probably enough to identify you. That said, yep, it seems lame they don’t disclose this tracking. I can understand why they’d want to know what apps their device pairs most often with, but tracking all app opens seems aggressive, but maybe it’s the only way to identify what app is open when the device is used. (I work for an analytics company)
  • penagwin 7y ago
    Tracking the currently open application software side is perfectly within scope for a drawing tablet - they often have buttons that can be bound to keyboard shortcuts, etc. It makes sense that it should know when you're focused on Photoshop vs Google Chrome. But why are they sending this data to a server? My best guess is that this helps them focus on what software people are using. This allows them access to the popularity of graphic applications. They get to see what percentage of users use say Photoshop vs [Other program here] - so they know where to prioritize integrations and testing. But I'm not sure how much "integrations" or work with third parties Wacom does - the drawing tablets are following an api standard after all. But maybe wacom does work directly with application devs, I don't really know. I doubt they're doing this to try to track individual users - even if there are ways to do it. That said I really wish they approached this with a more friendly "Would you like to enable some basic Telemetry to improve Wacom products - Yes, No" instead of a very unfriendly user agreement where they try to force it.
    • Joe-Z 7y ago
      IMO the more simple explanation is they want this data to sell to data aggregators, who can in turn enrich the profile they have on you. There's a similar thing going on with smart TVs, right?
      • hkmurakami 7y ago
        That seems pretty unlikely for a mid sized, independently operated/capitalized Japanese company tbh.
• moron4hire 7y ago
  "their device, which - remember - is essentially a mouse" ... that has per-application configuration settings that change how the tablet can be used. They aren't just wantonly collecting unrelated data. They have features tied to this. I read the whole article to see if there was any mention of app-specific config. Doesn't come up once.
  • luckydata 7y ago
    It also has quite a few quirks depending on the app so it’s logical they want to know which compatibility work is most pressing. Not that they have done much lately, but that’s a different subject. Wacom is an extremely frustrating company to deal with.
  • betageek 7y ago
    Unless I'm very much mistaken, there are no application specific configs set on default install of Wacom drivers, just a generic 'All' profile. If, and only if, I had set up an app-specific config, then maybe Wacom would be vaguely justified in tracking when I open that specific app. 'wantonly collecting unrelated data' is exactly what they're doing.
    • moron4hire 7y ago
      We aren't talking about Facebook or Amazon or Google here. I think we can walk back the apocalypsism. Most companies aren't well-oiled, gigantic machines of user-data-manipulation. I'm sure there is a better way for Wacom to do things. I'm also pretty sure their staff are doing the best they can.
      • JohnFen 7y ago
        It doesn't matter if this is done by Facebook, Amazon, Google, or Joe's Basement Software Company, nor what the data is actually being used for. Doing this without obtaining the user's informed consent is unacceptable.
      • mixmastamyk 7y ago
• diffeomorphism 7y ago
  While this implementation obviously has privacy issues, the anonymized aggregate data would be quite interesting, e.g. how many people use photoshop, illustrator, etc. with their wacom tablets. The problem then seems to be more about the false positives. If you use "Half Life 3 Test Build" that is useless info for wacom because it (presumably) doesn't care about pen input. Q: If the data were filtered to just art/graphics apps using the pen, would that still be problematic?
  • deleted 7y ago
    [deleted]
  • _jal 7y ago
    > would that still be problematic? Yes. When thinking about data, you need to think about orthogonal uses. Can you imagine reasons why someone might subpoena data to determine whether Photoshop was being used on my home desktop machines at a particular time? They might not care that it was Photoshop at all.
    • diffeomorphism 7y ago
      Any data collection of course has a privacy cost and should of course be opt in. What about aggregate data limited to art apps? For example if it only sends a monthly summary: used photoshop with a wacom tablet for 15 hours this month, illustrator for 3 hours this month?
      • harikb 7y ago
        In that fictitious scenario, would they have checked with Adobe if they wouldn't mind their users spied up on. What if this information is indirectly used for trading on ADBE stock? Would that be considered OK ?
        • diffeomorphism 7y ago
          Could you elaborate? Why would I as a user need permission from Adobe to tell wacom that I am using their tablet in photoshop? > What if this information is indirectly used for trading on ADBE stock? Would that be considered OK ? Obviously yes? What is supposed to be the issue here?
• ipython 7y ago
  The best part is where the author admits to using google analytics himself to track who visits his blog. At some point we all have to say enough is enough.
  • gruez 7y ago
    I'm going to go on a limb and say that tracking people who visits your blog is a little better than tracking app launches for the entire computer.
    • andai 7y ago
      Certainly, although I would call it less bad, rather than better.
    • rhacker 7y ago
      I think what escapes most people is that they think Google Analytics is a free product to help you track your visitors. Yes it does do that, but the more valuable product to other google customers is you've linked your website to a global ad network even if you don't display ads.
  • leppr 7y ago
    Except that visiting a website is a known, expected information leak to the website owner, and for 70% of web users also automatically to Google. On the other hand leaking the list of apps on your local computer, and to a third-party to top it off, is unexpected and thus more harmful.
    • FireBeyond 7y ago
      I'd disagree with that. Given that the Wacom utility is full of app-specific references and "customize your tablet, per app", I'd say that this is on par. Ask random person, "Hey, do you know that when you visit John's blog, he sends your information to Google, too, not just himself?" and I guarantee you the answer is probably closer to 7% than 70%.
    • risyachka 7y ago
• danShumway 7y ago
  On Linux you'd be using the community-maintained drivers[0], so I assume this wouldn't be a problem (correct me if I'm wrong). But as far as I can tell, there's not equivalent Open Wacom drivers for Windows. People with more Windows knowledge than me: any thoughts on why? Is it just that someone using Windows probably doesn't care about Open drivers, so the demand isn't there? Or is there something about Windows that makes substituting drivers harder? Wacom doesn't provide their own Linux drivers, but looking at the state of drivers around GPUs, printers, I vaguely suspect that somebody in Linux would be working on Open alternatives even if they did. I'm trying to think off the top of my head what Windows-compatible hardware has 3rd-party driver options. Maybe some printers? [0]: https://linuxwacom.github.io/ https://linuxwacom.github.io/
  • leppr 7y ago
    Clearly this isn't a trivial or very fun job (last time I used them, the Linux drivers were buggy as hell). Who would have the motivation to do it on Windows, where you have a driver that works and users have little expectation of privacy to begin with?
    • jchw 7y ago
      The Linux drivers for Wacom tablets have never been buggy in the past decade in a half I’ve used them. Other parts of the stack (Xinput, libinput, GUI libraries) have been, but the actual driver provides good data to userspace. Even then, to me the drivers on Linux have been perpetually less buggy. On Windows I found myself needing to restart the usermode service and restart applications frequently, especially if the USB connection was unreliable. The Linux driver did not have similar issues. For example, you’ll never have to follow this guide on Linux: https://www.deviantart.com/kiiroikat/art/How-to-Fix-Wacom-Drivers-Without-Rebooting-602842865 https://www.deviantart.com/kiiroikat/art/How-to-Fix-Wacom-Dr... I don’t recall having issues with the Mac drivers either.
      • oehpr 7y ago
        Just because it would be better doesn't mean it will be made. So long as something is "good enough", it will strangle new projects in the crib.
• buddylw 7y ago
  Wacom has application specific settings for compatibility. You can't have that feature without tracking individual processes and that data would be important for any sort of troubleshooting. It should be anonymized and they should be clear about what they are collecting, but the data does have a legitimate and benign use at least.
  • cforrester 7y ago
    Does this tracking data really need to be transmitted outside of the local environment, though? The driver simply needs to download a list of the available application profiles and compare it to the process list locally. Then, if a specific profile is available, it can request it and Wacom doesn't learn about the other processes running on the system.
  • penagwin 7y ago
    Software side you're right, it makes sense for the driver to keep track of the current application for things like button binds, etc. But that doesn't mean they need to transmit that information off your computer. Although I agree, this is likely relatively benign, it's most likely useful as a market research tool to see what applications they should prioritize support/testing for.
  • move-on-by 7y ago
    > You can't have that feature without tracking individual processes and that data would be important for any sort of troubleshooting. There is a pretty big between crash/error reporting vs constantly throwing data into Google Analytics.
  • inetknght 7y ago
    > Wacom has application specific settings for compatibility. I say: better to be incompatible instead.
• durpleDrank 7y ago
  Saw this two nights ago installing the driver on Windows 10. Read the UELA. Did not consent, closed the window. Is that good enough? By the way, My tablet works MUCH BETTER on Ubuntu and Mint than on Windows 10. Krita and MyPaint are cross platform so I might just do my art on a *nix box instead.
  • danShumway 7y ago
    Off topic, but would you be willing to expand on your Linux experiences with this? I'm currently doing all of my digital drawing on an old SP3 tablet running Manjaro, via Krita. The driver support is... acceptable, I guess. Krita has more than a few annoying edges, but shows a lot of potential so I've been sticking with it. For a long time I've been considering springing for a dedicated setup with one of Wacom's larger devices, but I've held back because I need it to have completely solid Linux support and I can't figure out how to test that in advance. I'm always curious to get more info about what issues other people have seen. I wish I could find a physical store where I could just bring in a laptop, plug it into the actual device, and draw for maybe an hour to figure out if there are any dealbreaking problems.
    • comex 7y ago
      Well, that kind of thing is what the return policy is for, isn’t it?
    • durpleDrank 7y ago
      "Off topic, but would you be willing to expand on your Linux experiences with this?" I'm using a Wacom Intuos pen & touch M graphics tablet, connected to a Thinkpad 430. Over the years I was using Debian Stable, MINT, and finally Ubuntu. The experience is great. Like I mentioned, much better than windows. I only just started to use Krita (I prefer MyPaint, however I feel I should branch out). The work I do isn't special, just stupid doodles and cartoon type of stuff. The wacom I'm using is older, I think I bought it 5 years ago or so. I don't really have much to add besides that. I remember WAYYY back in the day having to compile the driver myself for an older wacom (Ubuntu 6 or 7 era). It's practically plug and play now, however, I think there is some other apt-get stuff that I did once for some reason that I forget (eraser wasn't working?). If you are having issues maybe try another tablet. I think the one I have can be bought for $50 on ebay. Maybe try a 30 day return place like best buy and sorry to say try the latest ubuntu or mint for compatibility (have a dedicated art machine?)
• lightswitch05 7y ago
  This is just one of many reasons to use StevenBlack's Hosts [1] list to block this type of behavior. While it doesn't currently block link.wacom.com, it would have prevented the subsequent requests google analytics. It works even better when paired with a PiHole [2] to protect all devices on the network. [1] https://github.com/StevenBlack/hosts https://github.com/StevenBlack/hosts [2] https://pi-hole.net/ https://pi-hole.net/
  • Spivak 7y ago
    I mean I put Pihole on all my networks but this is at best a solution to “nice malware” that doesn’t bother to hardcode addresses or perform lookups via an attacker controlled DNS server. You can catch slightly more aggressive malware by forcing all DNS traffic to your server at the network level but you’re now playing the role of malicious network operator. I would whitelist this to only devices you own.
    • egdod 7y ago
      And even if you go that far, DoH lets the device use whatever DNS server it wants.
    • lightswitch05 7y ago
      I don't think anyone would make the argument that a PiHole is a replacement for following best practices in terms of computer and network security. I'm just pointing out that a PiHole can block google analytics and other common violators of privacy. Its not a security tool and isn't advertised as such.
  • KajMagnus 7y ago
    Is there a way to create a whitelist instead of a blacklist? In some VMs / computers, I'd like to whitelist Internet domains instead of blacklisting, for security reasons. Edit: Seems PiHole supports whitelisting: "Manage White And Black Lists" https://pi-hole.net/ https://pi-hole.net/
  • philplckthun 7y ago
    Sadly, some of these list don't currently include google-analytics.com since some sites would otherwise break as a result. So when using one of these hosts files it's often a good idea to double check whether they include Google's domains first. (Also sad to say that GA is so big that a lot of websites/app rely on it)
• 0xff00ffee 7y ago
  Great article! I love how he MITM'd Wacom on his host machine. Slick! Also this: "I dug around in the driver’s logfile and found the following snippet that confirmed my suspicions..." Arms race time: this is an alert to shady developers to not put meaningful messages about data collection in their log files.
  • TheRealPomax 7y ago
    Real shady devs already don't do this. All signs here point to "salaried employees being asked to implement a feature, and just following the ticket to the letter".
• sillysaurusx 7y ago
  BURP SUITE! Burp suite is amazing and more people should use it. That is all.
  • burntwater 7y ago
    On their website, they list their plans Enterprise through Community, left to right. That's the opposite of what's standard and immediately makes me wary. They might be great, I don't know. But if something as non-standard as that is done, what other weirdness behavior does their software have?
    • sillysaurusx 7y ago
      Heh. Brace yourself; Burp is very weird. It's worth learning though. I haven't found a better intercepting proxy, and the community edition is pretty powerful.
• excerionsforte 7y ago
  I'm fine with Wacom collecting this kind of data as long as it doesn't open any security holes. There are certain classes of products where I would not care what they collected as long as it was relevant to improving the product. i.e. Wacom wants to know popular apps I use my tablet on, ok. If they wanted to know my approx location though then I'd be alarmed.
  • kovacs_x 7y ago
    Haven't you thought that they know this already by your ip address? ;)
    • excerionsforte 7y ago
      This is very basic information. Wacom makes drawing tablets which is usually in a static place for me.
  • CarelessExpert 7y ago
    Then they should be very open, up front, and explicit about asking for your consent, including describing what they will be collecting, and also making it very clear you can decline without negative consequences. I'm fairly comfortable with data collection if the user opts in, but the current trend--dark patterns where you put out a blanket "we will collect stuff" disclaimer that lacks any specifics, while not making it clear what the consequences are of declining--is deeply troubling and, I hope, becomes illegal thanks to things like GDPR and CCPA.
    • AJ007 7y ago
      It is illegal under GDPR. Under CCPA you request all of this information Wacom has, and also tell them to delete it.
  • criddell 7y ago
    Of course they want to know your approximate location. It will probably help them target ads for the next iteration of the tablet.
• pvaldes 7y ago
  I received one as a gift but, to be honest, I never used it after seeing the obscure mandatory propietary format to save the files. If I can't open my files later in GNU and there is not a method at sight to save it as jpeg, png, etc... is useless. Just a cheap model probably. Collecting dust somewhere. My other wacom, and older model, was awesome as a mouse replacement; but it toke months to work in Linux and I don't feel too much inclined to repeat the experience.
  • andai 7y ago
    My wacom experiences on linux have been plug and play so far. Maybe I got lucky with the model numbers.
    • pvaldes 7y ago
      I was a species of "mid-early adopter", probably. All should be much easier now. In any case I eventually stopped to use the older model because it was just a little cumbersome to move it around with the laptop all day. It was a nice piece of hardware. Is a pity to hear that they are now tracking what users do with their computers. For me this is a no-way (It seems that I did the right thing dismissing the second model).
  • mkl 7y ago
    Wacom tablets work fine in Linux, Gimp, Krita, etc. in my experience (and haven't required significant setup for over a decade). Why are you trying to use obscure proprietary software instead?
    • pvaldes 7y ago
      > Why are you trying to use obscure proprietary software instead? I'm not trying. In fact, I rejected that Wacom tablet exactly for that. Some time ago when you unbox a product it was not uncommon to hear something like: "Sorry but as you are a Linux user we, the makers, will try to make your journey miserable not providing any support. Ha haa!. Maybe some volunteer working for free will fix this new model in six months. Maybe not". Sorry maker but as you don't provide drivers for users like me, I will not use it. Bye. Have a good day. They do not laught so much today
• tnorthcutt 7y ago
  Bravo for a really well written article. I'm interested in this kind of thing but not familiar with techniques & tools used, so it was really nice that the author included lots of detail, reasons for doing things, etc.
  • system2 7y ago
    Burp Suite and Wireshark come default in Kali. Give it a try: https://www.kali.org/downloads/ https://www.kali.org/downloads/ (Also make sure to check out Maltego, Metasploit Framework and Armitage.)
• Quai 7y ago
  I, for one, want to know Rick's story... How was the day he got famous internally in Wacom, just because some XML that no one was meant to see..
  • DonHopkins 7y ago
    They're probably teasing the poor fellow by using XML instead of JSON.
  • gvb 7y ago
    It's Rick Astley, y'know "Never Gonna Give You Up" (https://en.wikipedia.org/wiki/Rickrolling https://en.wikipedia.org/wiki/Rickrolling).
  • Plough_Jogger 7y ago
    https://www.linkedin.com/in/rickmpeterson/ https://www.linkedin.com/in/rickmpeterson/ > •Successfully activating insights to optimize value propositions, user experiences, and marketing
• robohoe 7y ago
  I'm surprised Wacom is still around with iPad and Apple Pencil being such a hit. I know I've migrated.
  • zzzcpan 7y ago
    iPad doesn't run professional software that tablets are mostly used with.
    • mikewhy 7y ago
      With Sidecar (+ a supported Mac), you can use your tablet as a second screen and apps can access the pencil. I can't comment on the experience.
      • egypturnash 7y ago
        Sidecar step 1: upgrade your Mac to Catalina, lose access to all your 32-bit apps. Including that treasured copy of the last version of Adobe's apps you paid good money for before they switched to a subscription-only model.
  • microcolonel 7y ago
    Not everyone who uses a Wacom tablet is a bedroom illustrator, even a professional bedroom illustrator. Many projects simply don't fit, and most professional applications do not have their full version available on the iPad, and that will likely continue to be the case indefinitely.
  • as1mov 7y ago
    They are still the really popular is both the professional (>$2000+) and the ultra cheap market segment (<$50). iPad doesn't really cater to either of those cases.
  • ghostbrainalpha 7y ago
    Is the pressure sensitivity equal on the apple pencil to high end Wacom?
• shmerl 7y ago
  You can use them on Linux and avoid the malware: https://linuxwacom.github.io https://linuxwacom.github.io
• rhacker 7y ago
  That's actually really good to know. I used to own a wacom (pronunciation war: It's Whack-om haha) about 10 years ago for drawing - I don't think I would buy one now until they walk this one back (and push it off the cliff to die).
• HenryBemis 7y ago
  Every time I see the words “XYZ Experience Program”, my alarms go off, it's synonym to "every move you make, I'll be watching you".
• jsilence 7y ago
  No wonder everything is slowing down to a crawl when every mouse driver and their dog is doing full surveillance on every move the user makes.
• awinter-py 7y ago
  > Why does a device that is essentially a mouse need a privacy policy I mean, crash logs, but yes -- defining question for our time drivers shouldn't connect to the internet unless that's what they're for. crash logs should be managed by a third party thing that the user can configure
• Causality1 7y ago
  These days I assume that if something is possible, profitable, and legal, it's being done. Sometimes I question whether there's a company executive on earth who doesn't deserve to get stood up against a wall.
• st3fan 7y ago
  "In some ways it feels unfair to single out Wacom." - Uh no, it is completely fair to single them out and put them in the spotlight for doing this kind of tracking.
  • rossdavidh 7y ago
    I think the statement was meant to indicate that this kind of behavior is well-nigh ubiquitous, so the only thing really different about Wacom is that they're the one we're talking about, when they are by no means the worst offender.
    • JohnFen 7y ago
      I'm sure that's exactly what it means -- but it's still fair to call out individual companies that engage in this misbehavior. That others are doing it as well isn't important.
• r00fus 7y ago
  This is a fantastic read. It makes the process very straightforward - almost like a how-to for snooping the snoopers who use GA. Well done & great work.
• ghostbrainalpha 7y ago
  I know privacy is a big deal, and this is not cool in general but I kind of don't mind Wacom doing this. If Wacom's users are starting to use a niche program outside of the Adobe suite, I'd like them to know about it so they can fully support it. And its not like I'm going to be using my Wacom tablet with very many programs. Its not like it can replace a mouse unless you are a crazy person...
  • JohnFen 7y ago
    I'm sure that most people feel as you do. So manufacturers should get informed consent before doing the data collection -- that way, you can give such consent and people who feel differently about such tracking can withhold it. It's win-win.
• thiagomgd 7y ago
  Good post. It would be nice to see a follow up with brands that don't track you.
• ogre_codes 7y ago
  Maybe Wacom isn't really aware of this and there is a guy named Rick who has set up an elaborate scheme to stalk his artist ex girlfriend. Edit: While this post was meant to be tongue in cheek, it is possible and I'm not sure which is worse.
• deleted 7y ago
  [deleted]
• ryanisnan 7y ago
  Wow, your writing is fantastic. Thanks for the writeup!
• The_mboga_real 7y ago
  Hacker 'News' is completely unfit for purpose
• droithomme 7y ago
  Great forensics work. > even if someone had read and understood Wacom’s privacy policy, and had knowingly consented to a reasonable interpretation of the words inside it, that person would still not have agreed to allow Wacom to log and track the name of every application that they opened on their personal laptop. I agree completely. Tracking every application one uses and reporting on that to third party Google is so contrary to their stated EULA that both a class action lawsuit, and prosecution in jurisdictions that protect privacy, are warranted.
• DerWOK 7y ago
  Really great article. But I wonder, why the author did not cover if/what the driver publishes, If I do: - open "Wacom Desktop Center" - Top right (next to "Login") is "More" (click!) - "Data Privacy Settings" (click!) - "Participate In Wacom Experience Program" => on => off! My setting was "On" - and I swear: whenever a program/website/installer asks I go "No thankx". So it must be dark UI patterns with evil defaults that this super-hidden thing was "on" for me. Shame on you, Wacom!
  • rsneekes 7y ago
    In my experience they turn it back on each driver update, I also believe they mentioned it somewhere during the setup but I’m not sure.
  • Moru 7y ago
    Or you could vote with your wallet and buy a Huion instead. They are just as good, if not better. And about half the price. It's all made in China any way.
    • Razengan 7y ago
      An iPad Pro with the Apple Pencil is actually a great alternative to traditional drawing tablets, even if you use Windows.
      • ngold 7y ago
        They make a top of the line art pad. And your in the apple eco system, so it's not super shady. Or at least you know what your getting.
      • cma 7y ago
        Windows art apps often need hover support since they assume a Wacom, and the general windows interface definitely does. I guess you can simulate hover by holding a hot key or something while touching though.
      • yoavm 7y ago
• LegitShady 7y ago
  Even my drawing tablet? Im starting to hate the present day philosophy of pervasive surveillance acceptability when I can't even pay premium for a device and have it not track me constantly.
• djhworld 7y ago
  Very enjoyable read, thank you. I'd imagine simply turning off the "User Experience Program" opt-in is a flaky setting that probably gets reverted to "on" when you do updates etc A better option is to install LittleSnitch and block the traffic.
• jrockway 7y ago
  I wonder what the comfortable medium between privacy and letting developers get feedback about how well their code works is. It seems to me like Wacom just wants to know if their drivers work, so they can focus engineering efforts around fixing the issues that are affecting their users. "Oh hey, the new beta of Photoshop breaks our drivers!" They don't make a "cloud product" and they have an obligation to make their hardware work with any software the user might want to use, so they are kind of painted into a weird corner here. If they collect data to drive their engineering, they're spyware. If they collect no data, they're a bug-ridden disaster area whose product you would never buy. I am guessing that the answer will be "they should test everything in house and tell users to complain via email when shit is broken"... but we all know that synthetic QA is never going to be as good as "ground truth", and that 99% of users will just silently be unhappy. So I wonder what the privacy balance is here.
  • JohnFen 7y ago
    > I wonder what the comfortable medium between privacy and letting developers get feedback about how well their code works is. I consider the nut of the problem to be informed consent. If you have user's informed consent to get the feedback, then there is no problem. If you don't, then the whole operation is unacceptable. And no, mentioning it in the privacy policy or terms of use don't count as "informed consent".
    • irq11 7y ago
      Thing that I know happens, from personal experience: you can put a giant modal alert, and write in blinking, all caps, 60pt bright-red font that you will do something unless the user presses a button, then draw a bright red arrow to the button. Users will still complain that they weren’t informed. Users are lazy and dumb, and the most ideological users are often the laziest and/or the dumbest, because they have an agenda. They will go out of their way not to give you the benefit of the doubt (”why was the font not 80pt? Clearly, you’re trying to hide something from users on high resolution screens!”) It never ends.
      • JohnFen 7y ago
• tinus_hn 7y ago
  It’s almost as if this is some sleazy attempt to get around malware checks by selectively disabling this behavior. Unacceptable.
• xg15 7y ago
  So, if the driver hadn't had the courtesy to use the OS cert store, respect the OS proxy settings and use unencrypted DNS, how would we go forward to find out the siohoned-off data then?
• doctor_eval 7y ago
  I haven’t seen this written anywhere (perhaps I haven’t looked hard enough) but I’m starting to think that perhaps Google and Facebook are reaching out to and paying companies like Wacom to capture these analytics. It makes little real sense for Wacom, a manufacturer of tablets, to capture this amount of data, and doing so has a cost. But it makes heaps of sense for Google to do it since they can infer all sorts of stuff from the applications you install. It also explains why this crap is so pervasive, why the privacy policy is so vague (Wacom may not even know the extent of the exfiltration - don’t ask don’t tell), and why the quality of the data collection is so good. I mean I’m guessing there a google product called something like “Google Analytics for OSX Drivers” and google would want that in popular products. These sort of back room deals and outreach programs are pretty common in general, but if I’m right, then Wacom, while certainly an accomplice, is not the root cause of this.
• killjoywashere 7y ago
  Who is Rick?
  • DrOctagon 7y ago
    It looks to me like a Rickroll.
• bitL 7y ago
  It looks like everything in tech got poisoned, smart TVs taking screenshots, web apps tracking and matching user clicks, smartphones tracking locations realtime and who knows what else, desktop apps monitoring other apps and peripherals, creepy companies building profiles on everyone, health institutions selling data of their users... I want out, I didn't get into this field, keeping myself up-to-date and super capable via top universities, to be just another cog in building a toxic monstrosity this industry is becoming just to make somebody with a limited lifespan feel powerful and rich.
  • sizzle 7y ago
    "just to make somebody with a limited lifespan feel powerful and rich." Wow that last sentence really puts things into perspective. How can be reverse course and throw a wrench in the system? We are the makers, we should be able to wrestle back control and do it democratically and get politicians on our side to legislate this ad industry into the ground.
    • bsanr2 7y ago
      Quickest thing you can do is quit your jobs en masse. At some index level of number of people * avg skill of people quitting, the industry becomes nonviable. Then you state your terms. Sounds like a union? Also sounds like Galt's Gulch. Weird dovetail, there. The kicker is that tech workers are in a FAR better position than the other groups that are pushing or considering a general strike. I suppose that makes the prospect more viable, but also more dangerous to the stability of the overall economy. I guess it's up to you if a shake-up now is worth stopping or forestalling the rising waters.
      • nerdponx 7y ago
        This. Tech workers need to organize. Unfortunately you have to convince tech workers that moral duty to society is better than their comfortable high-salary lifestyles, and good luck with that.
      • mdhardeman 7y ago
• djsumdog 7y ago
  How much of this is specifically Watcom sending that info to Google Analytics and how much of it is the stock Google Analytics SDK automatically slurping up that stuff by default?
• serf 7y ago
  last wacom drivers I used on Windows ( I don't know, 2013? ) would eat memory all day, every day, until self-destruction. I have a screenshot somewhere of the process taking ~28 gigs of memory. It doesn't at all surprise me that it's sneaking around. This might be some cargo-cult level religion of mine , but if a driver package has a lot of flashy UI stuff (Wacom, Logitech, Creative), it's probably doing something suspect. The more the apps look like key-gens, that's when you have to start wiresharkin'.
• Priem19 7y ago
  This is probably the best written article on tech I've ever read. It reads like a novel, and it's informative to boot.
• Pacers31Colts18 7y ago
  My Pixel 2 does the same. I assume all Android phones do. I can see everything ive opened in my Google profile
  • GrayShade 7y ago
    There used to be a "device activity" setting under https://myaccount.google.com/dashboard https://myaccount.google.com/dashboard. Does anyone know why it was removed? > Activity controls no longer include the Device Information setting
• Pacers31Colts18 7y ago
  I'm able to do the same on my Android phone. I can go into the Google settings and see everything I opened and when.
• musicale 7y ago
  More anti-privacy, security holes, and dark patterns in the name of "analytics." Is this really what tech customers want?
• dreamcompiler 7y ago
  Until this kind of shit is legislated out of existence, every company that makes an installable program is going to be tempted to do it to generate more revenue. If it's not forbidden, every company will think they have to do it to remain competitive, morality be damned. Until that happens, use a piHole.
• 3xblah 7y ago
  "In Wacom's defense (that's the only time you're going to see that phrase today), the document was short and clear, although as we'll see it wasn't entirely open about its more dubious intentions (here's the full text)." The "document" is actually comprised of three documents. Lawyers call this "incorporation by reference." The link given by the author is therefore only a starting point. When we incorporate the other two^1 documents -- https://www.wacom.com/privacy https://www.wacom.com/privacy and https://www.wacom.com/cookie-notice https://www.wacom.com/cookie-notice, this is not a "short" document. 1. Actually it is comprised of four documents if we include the external list of companies -- www.wacom.com/about-wacom/our-passion/our-company that are also beneficiaries of the terms of these policies. Unless the user reads all three documents, she has not reviewed the entire contents of the "policy". "Wacom didn't say exactly what data they were going to send themselves." Looking at the privacy policy is there anything that could be in HTTP traffic from the tablet that would be outside the scope of what Wacom has stated they might collect. Excerpts 3. Scope of this Privacy Policy This privacy policy explains how we collect and use information that relates to you when you: - use our other software and products; or We refer to these uses and interactions as our "Services." |------------------------------------------------------------+----------------------------------------+------------------------------------------------------------| |Usage Information (e.g., indicators of engagement with our |(1) to improve our products and create |(a) with our service providers, including analytics | |website or usage of Services, IP address, device identifier,|new products |providers, to help us deliver and improve the Services, and | |etc.) | |to provide targeted advertising | | |(2) to provide targeted advertising | | | | |(b) our Affiliates | | |(3) to better understand how our | | | |customers' use our Services | | | | | | | |(4) for our internal accounting, | | | |security, and operational purposes | | | | | | | |(5) for purposes required by law | | |------------------------------------------------------------+----------------------------------------+------------------------------------------------------------| Usage Information. We collect information about your interactions with our services. This includes or can relate to your personal information. This information enables us to, among other things, improve our Services and your experience, see which areas and features of our Services are popular and count visits, provide you targeted advertising based upon your interests and to analyze trends, administer our websites, track how you engage with our websites and other Services, learn about the systems, browsers, and apps you use to interact with our Services, gather demographic information about our user base as a whole. We also use analysis tools and methods to allow us to better understand how our customers use our Services. This includes how often the Services are used, the events that occur within the application, aggregated usage, performance data, any exceptions that occur within the software and the source from which the application was downloaded. "Some of the events that Wacom were recording were arguably within their purview, such as "driver started" and "driver shutdown". I still don't want them to take this information because there's nothing in it for me, but their attempt to do so feels broadly justifiable. Assuming Wacom respects resolv.conf as it does system-wide HTTP proxy settings, why not run localhost or LAN DNS server, either authoritative or recursive, that does not return a Google IP address for queries like www.google-analytics.com originating from the tablet IP address The "broadly justifiable" reasoning does not account for the possibility Wacom may collect the data and then fail to improve the product, service or "user experience". Wacom is making no promises of any user benefits arising from collection of data. Even if there were "something in it" for the author, he has no way to hold Wacom to this promise. They get his data and he may or may not get something in return.
• deleted 7y ago
  [deleted]
• userbinator 7y ago
  I wonder if the extremely affordable tablets from Monoprice also have this problem. I don't have a use for one but I know a few others who use them and claim they are fantastic in quality and not overpriced. If they don't phone home, perhaps that could be another marketing point: respects your privacy. For years I've avoided the software packaged with hardware whenever possible, e.g. printer drivers (a few MB of actual driver at most, and a few hundred MB of useless bloatware all installed together); now I guess there's another reason to do that.
• viknod 7y ago
  They have all the data from the uninformed, ambivalent or defeated already. We develop things to crush the remaining resistance. Walled garden devices, cert pinning, signed applications, DNS over HTTPS, yes they are all more secure, but not for you. If well implemented, these serve as tools to make sure the privacy policy is the only thing informing you of collection.
  • aneutron 7y ago
    I'm not perfectly okay with what you are suggesting (and that's okay of course). But essentially, coming from a 3rd world country where censorship was the norm before Internet came along, and seeing how TLS and DoH is giving similar states like China a headache, I have to say that I am extremely happy, but concerned. I believe it is a regulatory problem. In essense, make collecting data punishable but personally (i.e. Person X signed on decision to collect data, person X gets jail time) I know that's probably not even remotely possible because employees "operate on behalf on the company" but removing that shield will effectively eliminate this. The same way dumping stock at a company means the FTC/SEC/FBI will have you ass on a platter, personally.
• vzaliva 7y ago
  As the side note, the following sentence from the post "I began my investigation with a strong presumption of chicanery" is something I am going to steal and use from now on. :)
• diegof79 7y ago
  I work on UX, coming from an engineering background. It means that everyday I work close to product management and engineering. The trend over the last 10 years is to collect tons of data to improve the product. Some PMs and UXrs believe that they’ll get a magic insight from the data, and the skeptics do it anyways because is another data point to have. For engineering, services like GA are cheap and easy to integrate. Nobody has a bad intention. But, we are distracted by the next product release to see the long term consequences for the society. The reality is that some data is useful, but most of it is BS. To measure adoption and engagement you can do a pilot and then deactivate data collection. Big app errors are reported soon after a release, and you don’t need to continue collecting that for a long time. To improve the UX you can do research with less data points, and smaller groups. The irony: I wish to have data to prove it, my hypothesis is based on my experience. I got more actionable insights from qualitative research, self-reported metrics, or quantitative data focused in certain aspects (instead of collecting all just in case). Some times having nice reports based on tons of data is more useful as an argument for corporate politics rather than to improve the product, but users doesn’t need to pay the consequences of your company stupidity (I’m looking at you MS telemetry ;-) ) There is a simple thing that we can do to change this trend. Ask yourself: What is the goal of collecting the data? What product hypothesis you want to prove? Can you get insights from a small group? If you don’t know.... hold on your data collection desires.
  • daemin 7y ago
    The one technical reason I see for doing this is to help in dealing with customer bugs and complaints. So strictly in a diagnostic capacity.
    • diegof79 7y ago
      For those cases the app can collect the exceptions only (as many apps and OS do). I worked on a desktop product with this type of data collection. Usually what happens is that after a new release you may see new errors coming up, and then they start to repeat. The data collection becomes a burden, new reports of the same error type doesn’t give you more information. It’s a good opportunity for a good UX, e.g point the user to the relevant support info to solve the problem. For support cases you may be able to ask for diagnostics on demand. The app can collect it internally without sharing and send part of it when an exception occurs and the user accepts to send it.
• yspeak 7y ago
  Can someone tell me why it matters ? They are just drawing apps.
• raxxorrax 7y ago
  sigh... their tablets are quite good if you like to paint digitally. Time to look for non existent third party drivers for windows. This is why a software firewall can be helpful. Since I use Windows I expect there are no alternative drivers. You can use the tablets without drivers in a very restricted manner. I don't know how to solve this besides strong regulations. Big firewall to China?
  • TrickyRick 7y ago
    I mean the author notes that you can decline and the software keeps working. I don't have a Wacom tablet so can't confirm, and it doesn't justify what they're doing but at least it's relatively easy to opt-out.
• risyachka 7y ago
  So they got list of apps, and did some analysis on the data. Should they disclose it upfront? Sure, it would be nice. If this a big deal? Doesn't seem so.
• greggman3 7y ago
  Facebook Oculus Rift seems to log the title of every window of every app you open https://www.reddit.com/r/virtualreality/comments/ezln7j/facebook_oculus_rift_logs_desktop_activity/ https://www.reddit.com/r/virtualreality/comments/ezln7j/face...
• nickjj 7y ago
  One thing the article doesn't talk about is when this tracking happens. Does it only happen if the pen is touching the tablet, or does it happen all the time even if the pen isn't touching the tablet? Because there's a huge difference between the 2. Normally you would keep your tablet plugged into a USB port but the pen isn't actively being used.
• lordleft 7y ago
  Can we just take a moment to appreciate how well-written this is? Super engaging and fun to read.
• jameshart 7y ago
  Hold on. This is a hardware device we are talking about here. You put it on your desk, physically interact with it, and plug it into your computer. Do you realize all the ways the manufacturer could harm you if they were malicious, cut corners, were coerced by a state to compromise the device, or failed to comply with regulations? And you’re worried about their data handling policy? A short and very incomplete list of the things a purchaser of a Wacom tablet is trusting to be true: - That the tablet is safe to use - it will not fail in a way that exposes the user to electric shock hazards, sharp edges, dangerous chemicals, etc. - that the EM emissions used to communicate between the pen and tablet don’t interfere with other systems in ways that could compromise safety - that the device complies with usb standards and won’t damage electronics you interface it to - that there are no hidden surveillance devices in the tablet or pen - that, as an input device with access to your usb bus it doesn’t have the ability to be remotely induced to control your computer Then you’re installing a piece of driver software, giving it sufficient permissions that it can read what application is currently running, and you are worried about it exfiltrating that information, rather than - say - the fact that as an input driver, again, it has complete control over your computer; it can record input - what if you use your Wacom to sign a pdf? Now it knows your signature. Or you tap out your banking password using an on screen keyboard. Who knows what else it can do - acting at the user input level presumably it can do anything you the user can do. So sure, be concerned about what happens to the data it sends to Wacom, but if you don’t trust Wacom, your problems started much sooner than when you accepted the data sharing agreement.
  • tedunangst 7y ago
    People were also upset about superfish.
    • jameshart 7y ago
      This is all just another example software devs' parochial belief that because software is eating the world, any problem in software is terrible, while ignoring the whole stack of hardware in meatspace that supports the software in the first place. Like the whole 'internet-connected-cars' panic that occasionally grips developers. You know what's more dangerous than putting a car on the internet? putting a car on the road. There are other drivers out there who could kill you. Thousands of people actually die in accidents. And you want to worry about the infotainment system containing a remote execution vulnerability?
• Nitramp 7y ago
  The sad bit is that (some reasonable) telemetric data is really, really useful for software engineering. If you have a large enough program, of course it'll have way more bugs than you could ever fix. Crash tracking and usage analytics is how you make a data driven decision on what to fix, and what to ignore. This enables a data driven approach to software quality that's a huge improvement. Having worked on projects that did and did not have telemetrics, working without them feels absurd - it seems like you're just randomly fixing the side mirror on a car without any idea what's actually broken on it (independently of your overall testing posture). Vendors tracking excessive information without proper disclosure destroy this information source for those developers that try to collect reasonable information (with consent, disclosure, in context, etc).
• wackget 7y ago
  Pretty sure e-reader devices like Kindle, Kobo, Nook, etc. have baked-in Google Analytics too. Why isn't there an outrage about that?
• persephonee 7y ago
  Why is the blog author wasting his time? The privacy statement says WACOM collects data. He does research and proofs it. -_-
  • danShumway 7y ago
    > Wacom didn’t say exactly what data they were going to send themselves. I resolved to find out. [...] > since Wacom’s privacy policy makes no mention of their intention to record the name of every application I open on my personal laptop, I’d argue that it doesn’t even give them the technical-fig-leaf-right to do so. In fact, I’d argue that even if someone had read and understood Wacom’s privacy policy, and had knowingly consented to a reasonable interpretation of the words inside it, that person would still not have agreed to allow Wacom to log and track the name of every application that they opened on their personal laptop.