-2

I am surprised to find so little information about what I would consider a serious breach of privacy and security.

It appears ubuntu-report is sending very unique information about your system - like a fingerprint, if not stopped with shell commands. See here: https://www.howtogeek.com/349844/how-to-stop-ubuntu-from-collecting-data-about-your-pc/

update: answer below argues that permission is asked before actually sending this information.

But now, I also frown upon a fresh minimal Ubuntu image connecting to the internet upon login. When logging in to the console, a Message of the Day (MOTD) is displayed. Something like this:

ubuntu login: ubuntu
Password:
Last login: <date>
Welcome to Ubuntu 18.04.1 LTS (...)

 * Documentation: https://help.ubuntu.com
 * Management:    https://landscape.canonical.com
 * Support:       https://ubuntu.com/advantage

  System information as of <date>

  System load: 0.08  (..)
  Usage of /: 4.9%  (..)

  Get cloud support with Ubuntu Advantage Cloud Guest:
    http://www.ubuntu.com/business/services/cloud

0 packages can be updated.
0 updates are security updates.

Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. 
Check your Internet connection or proxy settings

Perhaps I am being paranoid, but I think it is unacceptable that a mere login would send anything to the internet. If you do a connection to 'changelogs.ubuntu.com' every time you login on the shell, that can lead to potential security and privacy concerns. Am I the only one who is surprised about this and finds this unacceptable?

My question is: how can I safely use Ubuntu without compromising security or privacy?

In particular, my concern is with sending anything to the internet without permission. I don't want things to automatically connect or check or update to the internet in any way, unless I give the command to do that, with sudo apt update for example.

I tried playing with /etc/update-motd.d scripts but I could not find the script that was the culprit. I am kind of annoyed that I wasted a good hour on this stuff and still don't trust my Ubuntu system with ethernet/internet until this issue is resolved properly.

  • 2
    A mere login does not send anything to anybody. The message of the day and the number of available updates are updated daily by automated services with no relationship with users logging or not logging in. You can easily disable those services. – AlexP Dec 17 '18 at 9:59
  • 1
    Your question seems to be related to Why does the ubuntu-server package depend on update-notifier-common? – steeldriver Dec 17 '18 at 12:46
5

Ok this question contains contains some inaccurate information.

  • The package Ubuntu Report does not get installed if users uncheck the option during installation.
  • Even after giving permission during installation, it again asks for permission before sending any data and let users see the data to be sent and provide with permanent deny option.
  • The data it collects is general hardware and OS configuration related data which helps the development of Ubuntu. It does not collect any sensitive data (like IP address or real location). See it's GitHub page for an example.
  • The data is completely anonymized (can't be used to identify a single machine) and one time only. It does not send data on every login.

If you do a connection to 'changelogs.ubuntu.com' every time you login on the shell, that can lead to potential security and privacy concerns. Am I the only one who is surprised about this and finds this unacceptable?

I don't know about Ubuntu Server, but I'm pretty sure you can stop checking for updates at shell login. Don't know about the second question, it's just an update check!

I don't want things to automatically connect or check or update to the internet in any way

Not an option on 21st century PC ecosystem. If you want something like that, better use a default-deny firewall or something like that.

  • Thanks for your answer! I updated the question to reflect your nuance regarding ubuntu-report. Still, I think an opt-in would be better than opt-out. I have had apport send an application crash report simply because I was typing in an application when apport popped op, and my continued typing gave permission to send; not really privacy friendly. Nothing should be sent or even collected, unless there was express permission. That would please privacy-conscious users better. – Sigrid Dec 17 '18 at 13:21
  • Can you please point me to any resources blocking the automatic checking for updates upon login? – Sigrid Dec 17 '18 at 13:21
  • 1
    Regarding to your 21st century ecosystem comment; I would think that after Snowden, people would think about data security and privacy as something very important to safeguard against governments and companies from having too much power and knowledge about citizens. Therefore, I would have expected open-source operating systems like Ubuntu to be more friendly to privacy out-of-the-box, such that no 'phoning home' would occur with Ubuntu, unless the user expressly enabled something in the preferences (opt-in) or gave a command to do so. – Sigrid Dec 17 '18 at 13:26
  • 2
    @Sigrid - Sorry that Ubuntu does not meet your expectations. Merely uninstall the update-manager and unattended-upgrade packages, and you will have a never-phone-home system. WARNING: Those packages provide Ubuntu's automatic security upgrades - you will need to start doing those manually and regularly lest your system become vulnerable to published exploits. – user535733 Dec 17 '18 at 13:55
  • Downvoted for your ridiculous "not an option" comment about OP's completely normal and reasonable expectation of privacy. Perhaps you work for an advertising company, or you get a kick out of giving random people access to information about you which a reasonable person would expect to remain private, but this is NOT the norm and your assertion is both malicious and completely false. – L0j1k Jul 25 at 11:43
1

Every ubuntu desktop installation I have done I noticed it sending data to IPs owned by Canonical by default. This traffic seems to be rather constant. I could swear during the installation I specifically tell it not to send any data back to canonical.

I am about to wipe the Ubuntu install (16.04->18.04) to track an issue not related to this one. for the sake of this thread I will document all the options I selected and then will look at the network traffic.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.