Re:Windows 10 has an undocumented certificate pinning feature
by TazeTSchnitzel on Sunday September 25, 2016 @08:13AM
(#12574989)
I recall seeing a list of telemetry domains, and it's quite different.
This is a list of user-facing sites.
Re:Windows 10 has an undocumented certificate pinning feature
by dirtbox on Sunday September 25, 2016 @09:45AM
(#12575278)
Correct. I made a quick dump of the telemetry hosts here: https://cl.ly/hZ3q
If you have win10, you can add this to your hosts file. The optional portion of the list will block store items, the email client and even things like the Groove media player, so use it as you will.
Re:Windows 10 has an undocumented certificate pinning feature
by lightedman on Sunday September 25, 2016 @10:09AM
(#12575370)
Given the OS is known to be able to ignore its own HOSTs file, you're better off doing this directly in your router, if that is a possible option.
Most likely this feature is a response to incidents such as this: https://www.wired.com/2011/03/comodo-compromise/ (in which certs for login.skype.com and login.live.com were misissued by Comodo).
Blocking the domains in this list to prevent telemetry, as suggested in other comments, would prevent access to most of Microsoft's online services. This includes third-party websites hosted on Azure that aren't using their own custom domain (.azurewebsites.net), and all software updates, including critical security patches.