Wacom tablets track every app you open

On Linux you&#x27;d be using the community-maintained drivers[0], so I assume this wouldn&#x27;t be a problem (correct me if I&#x27;m wrong).<p>But as far as I can tell, there&#x27;s not equivalent Open Wacom drivers for Windows. People with more Windows knowledge than me: any thoughts on why? Is it just that someone using Windows probably doesn&#x27;t care about Open drivers, so the demand isn&#x27;t there? Or is there something about Windows that makes substituting drivers harder?<p>Wacom doesn&#x27;t provide their own Linux drivers, but looking at the state of drivers around GPUs, printers, I vaguely suspect that somebody in Linux would be working on Open alternatives even if they did. I&#x27;m trying to think off the top of my head what Windows-compatible hardware has 3rd-party driver options. Maybe some printers?<p>[0]: <a href="https:&#x2F;&#x2F;linuxwacom.github.io&#x2F;" rel="nofollow">https:&#x2F;&#x2F;linuxwacom.github.io&#x2F;</a>

The sad bit is that (some reasonable) telemetric data is really, really useful for software engineering. If you have a large enough program, of course it&#x27;ll have way more bugs than you could ever fix. Crash tracking and usage analytics is how you make a data driven decision on what to fix, and what to ignore. This enables a data driven approach to software quality that&#x27;s a huge improvement.<p>Having worked on projects that did and did not have telemetrics, working without them feels absurd - it seems like you&#x27;re just randomly fixing the side mirror on a car without any idea what&#x27;s actually broken on it (independently of your overall testing posture).<p>Vendors tracking excessive information without proper disclosure destroy this information source for those developers that try to collect reasonable information (with consent, disclosure, in context, etc).

Really great article. But I wonder, why the author did not cover if&#x2F;what the driver publishes, If I do:<p>- open &quot;Wacom Desktop Center&quot;<p>- Top right (next to &quot;Login&quot;) is &quot;More&quot; (click!)<p>- &quot;Data Privacy Settings&quot; (click!)<p>- &quot;Participate In Wacom Experience Program&quot; =&gt; on =&gt; off!<p>My setting was &quot;On&quot; - and I swear: whenever a program&#x2F;website&#x2F;installer asks I go &quot;No thankx&quot;. So it must be dark UI patterns with evil defaults that this super-hidden thing was &quot;on&quot; for me. Shame on you, Wacom!

FWIW that isn’t a unique identifier for the author, it’s for Wacom’s GA account. I didn’t see any meaningful identifier being sent. Of course the set of most opened apps and your IP are probably enough to identify you.<p>That said, yep, it seems lame they don’t disclose this tracking. I can understand why they’d want to know what apps their device pairs most often with, but tracking all app opens seems aggressive, but maybe it’s the only way to identify what app is open when the device is used.<p>(I work for an analytics company)

This is just one of many reasons to use StevenBlack&#x27;s Hosts [1] list to block this type of behavior. While it doesn&#x27;t currently block link.wacom.com, it would have prevented the subsequent requests google analytics. It works even better when paired with a PiHole [2] to protect all devices on the network.<p>[1] <a href="https:&#x2F;&#x2F;github.com&#x2F;StevenBlack&#x2F;hosts" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;StevenBlack&#x2F;hosts</a><p>[2] <a href="https:&#x2F;&#x2F;pi-hole.net&#x2F;" rel="nofollow">https:&#x2F;&#x2F;pi-hole.net&#x2F;</a>

Bravo for a really well written article. I&#x27;m interested in this kind of thing but not familiar with techniques &amp; tools used, so it was really nice that the author included lots of detail, reasons for doing things, etc.

I work on UX, coming from an engineering background. It means that everyday I work close to product management and engineering.<p>The trend over the last 10 years is to collect tons of data to improve the product. Some PMs and UXrs believe that they’ll get a magic insight from the data, and the skeptics do it anyways because is another data point to have. For engineering, services like GA are cheap and easy to integrate.<p>Nobody has a bad intention. But, we are distracted by the next product release to see the long term consequences for the society.<p>The reality is that some data is useful, but most of it is BS. To measure adoption and engagement you can do a pilot and then deactivate data collection. Big app errors are reported soon after a release, and you don’t need to continue collecting that for a long time.<p>To improve the UX you can do research with less data points, and smaller groups. The irony: I wish to have data to prove it, my hypothesis is based on my experience. I got more actionable insights from qualitative research, self-reported metrics, or quantitative data focused in certain aspects (instead of collecting all just in case). Some times having nice reports based on tons of data is more useful as an argument for corporate politics rather than to improve the product, but users doesn’t need to pay the consequences of your company stupidity (I’m looking at you MS telemetry ;-) )<p>There is a simple thing that we can do to change this trend. Ask yourself: What is the goal of collecting the data? What product hypothesis you want to prove? Can you get insights from a small group? If you don’t know.... hold on your data collection desires.

I wonder what the comfortable medium between privacy and letting developers get feedback about how well their code works is. It seems to me like Wacom just wants to know if their drivers work, so they can focus engineering efforts around fixing the issues that are affecting their users. &quot;Oh hey, the new beta of Photoshop breaks our drivers!&quot; They don&#x27;t make a &quot;cloud product&quot; and they have an obligation to make their hardware work with any software the user might want to use, so they are kind of painted into a weird corner here. If they collect data to drive their engineering, they&#x27;re spyware. If they collect no data, they&#x27;re a bug-ridden disaster area whose product you would never buy.<p>I am guessing that the answer will be &quot;they should test everything in house and tell users to complain via email when shit is broken&quot;... but we all know that synthetic QA is never going to be as good as &quot;ground truth&quot;, and that 99% of users will just silently be unhappy. So I wonder what the privacy balance is here.

&gt; Why does a device that is essentially a mouse need a privacy policy<p>I mean, crash logs, but yes -- defining question for our time<p>drivers shouldn&#x27;t connect to the internet unless that&#x27;s what they&#x27;re for. crash logs should be managed by a third party thing that the user can configure

While this implementation obviously has privacy issues, the anonymized aggregate data would be quite interesting, e.g. how many people use photoshop, illustrator, etc. with their wacom tablets.<p>The problem then seems to be more about the false positives. If you use &quot;Half Life 3 Test Build&quot; that is useless info for wacom because it (presumably) doesn&#x27;t care about pen input. Q: If the data were filtered to just art&#x2F;graphics apps using the pen, would that still be problematic?

No wonder everything is slowing down to a crawl when every mouse driver and their dog is doing full surveillance on every move the user makes.

They have all the data from the uninformed, ambivalent or defeated already. We develop things to crush the remaining resistance. Walled garden devices, cert pinning, signed applications, DNS over HTTPS, yes they are all more secure, but not for you. If well implemented, these serve as tools to make sure the privacy policy is the only thing informing you of collection.

Saw this two nights ago installing the driver on Windows 10. Read the UELA. Did not consent, closed the window. Is that good enough?<p>By the way, My tablet works MUCH BETTER on Ubuntu and Mint than on Windows 10. Krita and MyPaint are cross platform so I might just do my art on a *nix box instead.

&gt; as far as I can tell anyone with the presence of mind to decline it could do so with no adverse consequences<p>Makes me think one should try declining these kinds of agreements to see what happens, before accepting. As someone who also has an &quot;anti-privacy-policy-policy,&quot; I wonder how many of these kinds of things I&#x27;ve agreed to when it was unnecessary.

One thing the article doesn&#x27;t talk about is when this tracking happens.<p>Does it only happen if the pen is touching the tablet, or does it happen all the time even if the pen isn&#x27;t touching the tablet?<p>Because there&#x27;s a huge difference between the 2. Normally you would keep your tablet plugged into a USB port but the pen isn&#x27;t actively being used.

&quot;In some ways it feels unfair to single out Wacom.&quot; - Uh no, it is completely fair to single them out and put them in the spotlight for doing this kind of tracking.

It looks like everything in tech got poisoned, smart TVs taking screenshots, web apps tracking and matching user clicks, smartphones tracking locations realtime and who knows what else, desktop apps monitoring other apps and peripherals, creepy companies building profiles on everyone, health institutions selling data of their users... I want out, I didn&#x27;t get into this field, keeping myself up-to-date and super capable via top universities, to be just another cog in building a toxic monstrosity this industry is becoming just to make somebody with a limited lifespan feel powerful and rich.

I, for one, want to know Rick&#x27;s story...<p>How was the day he got famous internally in Wacom, just because some XML that no one was meant to see..

The best part is where the author admits to using google analytics himself to track who visits his blog. At some point we all have to say enough is enough.

These days I assume that if something is possible, profitable, and legal, it&#x27;s being done. Sometimes I question whether there&#x27;s a company executive on earth who doesn&#x27;t deserve to get stood up against a wall.

This is a fantastic read. It makes the process very straightforward - almost like a how-to for snooping the snoopers who use GA.<p>Well done &amp; great work.

I wonder if the extremely affordable tablets from Monoprice also have this problem. I don&#x27;t have a use for one but I know a few others who use them and claim they are fantastic in quality and not overpriced. If they don&#x27;t phone home, perhaps that could be another marketing point: respects your privacy.<p>For years I&#x27;ve avoided the software packaged with hardware whenever possible, e.g. printer drivers (a few MB of actual driver at most, and a few <i>hundred</i> MB of useless bloatware all installed together); now I guess there&#x27;s another reason to do that.

I received one as a gift but, to be honest, I never used it after seeing the obscure mandatory propietary format to save the files. If I can&#x27;t open my files later in GNU and there is not a method at sight to save it as jpeg, png, etc... is useless. Just a cheap model probably. Collecting dust somewhere.<p>My other wacom, and older model, was awesome as a mouse replacement; but it toke months to work in Linux and I don&#x27;t feel too much inclined to repeat the experience.

Every time I see the words “XYZ Experience Program”, my alarms go off, it&#x27;s synonym to &quot;every move you make, I&#x27;ll be watching you&quot;.

Hold on. This is a hardware device we are talking about here. You put it on your desk, physically interact with it, and plug it into your computer. Do you realize all the ways the manufacturer could harm you if they were malicious, cut corners, were coerced by a state to compromise the device, or failed to comply with regulations?<p>And you’re worried about their data handling policy?<p>A short and very incomplete list of the things a purchaser of a Wacom tablet is trusting to be true:<p>- That the tablet is safe to use - it will not fail in a way that exposes the user to electric shock hazards, sharp edges, dangerous chemicals, etc. - that the EM emissions used to communicate between the pen and tablet don’t interfere with other systems in ways that could compromise safety - that the device complies with usb standards and won’t damage electronics you interface it to - that there are no hidden surveillance devices in the tablet or pen - that, as an input device with access to your usb bus it doesn’t have the ability to be remotely induced to control your computer<p>Then you’re installing a piece of driver software, giving it sufficient permissions that it can read what application is currently running, and you are worried about it exfiltrating that information, rather than - say - the fact that as an input driver, again, it has complete control over your computer; it can record input - what if you use your Wacom to sign a pdf? Now it knows your signature. Or you tap out your banking password using an on screen keyboard. Who knows what else it can do - acting at the user input level presumably it can do anything you the user can do.<p>So sure, be concerned about what happens to the data it sends to Wacom, but if you don’t trust Wacom, your problems started much sooner than when you accepted the data sharing agreement.

Very enjoyable read, thank you.<p>I&#x27;d imagine simply turning off the &quot;User Experience Program&quot; opt-in is a flaky setting that probably gets reverted to &quot;on&quot; when you do updates etc<p>A better option is to install LittleSnitch and block the traffic.

Even my drawing tablet? Im starting to hate the present day philosophy of pervasive surveillance acceptability when I can&#x27;t even pay premium for a device and have it not track me constantly.

last wacom drivers I used on Windows ( I don&#x27;t know, 2013? ) would eat memory all day, every day, until self-destruction. I have a screenshot somewhere of the process taking ~28 gigs of memory.<p>It doesn&#x27;t at all surprise me that it&#x27;s sneaking around.<p>This might be some cargo-cult level religion of mine , but if a driver package has a lot of flashy UI stuff (Wacom, Logitech, Creative), it&#x27;s probably doing something suspect.<p>The more the apps look like key-gens, that&#x27;s when you have to start wiresharkin&#x27;.

Facebook Oculus Rift seems to log the title of every window of every app you open<p><a href="https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;virtualreality&#x2F;comments&#x2F;ezln7j&#x2F;facebook_oculus_rift_logs_desktop_activity&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;virtualreality&#x2F;comments&#x2F;ezln7j&#x2F;face...</a>

Until this kind of shit is legislated out of existence, every company that makes an installable program is going to be tempted to do it to generate more revenue. If it&#x27;s not forbidden, every company will think they have to do it to remain competitive, morality be damned.<p>Until that happens, use a piHole.

Can we just take a moment to appreciate how well-written this is? Super engaging and fun to read.

I haven’t seen this written anywhere (perhaps I haven’t looked hard enough) but I’m starting to think that perhaps Google and Facebook are reaching out to and paying companies like Wacom to capture these analytics.<p>It makes little real sense for Wacom, a manufacturer of tablets, to capture this amount of data, and doing so has a cost. But it makes heaps of sense for Google to do it since they can infer all sorts of stuff from the applications you install.<p>It also explains why this crap is so pervasive, why the privacy policy is so vague (Wacom may not even know the extent of the exfiltration - don’t ask don’t tell), and why the quality of the data collection is so good.<p>I mean I’m guessing there a google product called something like “Google Analytics for OSX Drivers” and google would want that in popular products.<p>These sort of back room deals and outreach programs are pretty common in general, but if I’m right, then Wacom, while certainly an accomplice, is not the root cause of this.

That&#x27;s actually really good to know. I used to own a wacom (pronunciation war: It&#x27;s Whack-om haha) about 10 years ago for drawing - I don&#x27;t think I would buy one now until they walk this one back (and push it off the cliff to die).

Good post. It would be nice to see a follow up with brands that don&#x27;t track you.

So, if the driver hadn&#x27;t had the courtesy to use the OS cert store, respect the OS proxy settings and use unencrypted DNS, how would we go forward to find out the siohoned-off data then?

As the side note, the following sentence from the post &quot;I began my investigation with a strong presumption of chicanery&quot; is something I am going to steal and use from now on. :)

So they got list of apps, and did some analysis on the data. Should they disclose it upfront? Sure, it would be nice. If this a big deal? Doesn&#x27;t seem so.

BURP SUITE!<p>Burp suite is amazing and more people should use it. That is all.

You can use them on Linux and avoid the malware: <a href="https:&#x2F;&#x2F;linuxwacom.github.io" rel="nofollow">https:&#x2F;&#x2F;linuxwacom.github.io</a>

Pretty sure e-reader devices like Kindle, Kobo, Nook, etc. have baked-in Google Analytics too. Why isn&#x27;t there an outrage about that?

sigh... their tablets are quite good if you like to paint digitally. Time to look for non existent third party drivers for windows.<p>This is why a software firewall can be helpful. Since I use Windows I expect there are no alternative drivers.<p>You can use the tablets without drivers in a very restricted manner. I don&#x27;t know how to solve this besides strong regulations. Big firewall to China?

This is probably the best written article on tech I&#x27;ve ever read. It reads like a novel, and it&#x27;s informative to boot.

It’s almost as if this is some sleazy attempt to get around malware checks by selectively disabling this behavior. Unacceptable.

I&#x27;m able to do the same on my Android phone. I can go into the Google settings and see everything I opened and when.

More anti-privacy, security holes, and dark patterns in the name of &quot;analytics.&quot;<p>Is this really what tech customers want?

My Pixel 2 does the same. I assume all Android phones do. I can see everything ive opened in my Google profile

Wacom has application specific settings for compatibility. You can&#x27;t have that feature without tracking individual processes and that data would be important for any sort of troubleshooting. It should be anonymized and they should be clear about what they are collecting, but the data does have a legitimate and benign use at least.

Wow, your writing is fantastic. Thanks for the writeup!

Why is the blog author wasting his time? The privacy statement says WACOM collects data. He does research and proofs it. -_-

&quot;In Wacom&#x27;s defense (that&#x27;s the only time you&#x27;re going to see that phrase today), the document was short and clear, although as we&#x27;ll see it wasn&#x27;t entirely open about its more dubious intentions (here&#x27;s the full text).&quot;<p>The &quot;document&quot; is actually comprised of three documents. Lawyers call this &quot;incorporation by reference.&quot; The link given by the author is therefore only a starting point. When we incorporate the other two^1 documents -- <a href="https:&#x2F;&#x2F;www.wacom.com&#x2F;privacy" rel="nofollow">https:&#x2F;&#x2F;www.wacom.com&#x2F;privacy</a> and <a href="https:&#x2F;&#x2F;www.wacom.com&#x2F;cookie-notice" rel="nofollow">https:&#x2F;&#x2F;www.wacom.com&#x2F;cookie-notice</a>, this is <i>not</i> a &quot;short&quot; document.<p>1. Actually it is comprised of four documents if we include the external list of companies -- www.wacom.com&#x2F;about-wacom&#x2F;our-passion&#x2F;our-company that are also beneficiaries of the terms of these policies. Unless the user reads all three documents, she has not reviewed the entire contents of the &quot;policy&quot;.<p>&quot;Wacom didn&#x27;t say exactly what data they were going to send themselves.&quot;<p>Looking at the privacy policy is there anything that could be in HTTP traffic from the tablet that would be outside the scope of what Wacom has stated they might collect.<p>Excerpts<p>3. Scope of this Privacy Policy<p>This privacy policy explains how we collect and use information that relates to you when you:<p>- use <i>our other software and products</i>; or<p>We refer to these uses and interactions as our &quot;Services.&quot;<p><pre><code> |------------------------------------------------------------+----------------------------------------+------------------------------------------------------------| |Usage Information (e.g., indicators of engagement with our |(1) to improve our products and create |(a) with our service providers, including analytics | |website or usage of Services, IP address, device identifier,|new products |providers, to help us deliver and improve the Services, and | |etc.) | |to provide targeted advertising | | |(2) to provide targeted advertising | | | | |(b) our Affiliates | | |(3) to better understand how our | | | |customers&#x27; use our Services | | | | | | | |(4) for our internal accounting, | | | |security, and operational purposes | | | | | | | |(5) for purposes required by law | | |------------------------------------------------------------+----------------------------------------+------------------------------------------------------------| </code></pre> Usage Information. We collect information about your interactions with our services. This includes or can relate to your personal information. This information enables us to, <i>among other things</i>, improve our Services and your experience, see which areas and features of our Services are popular and count visits, provide you targeted advertising based upon your interests and to analyze trends, administer our websites, track how you engage with our websites and other Services, learn about the systems, browsers, and apps you use to interact with our Services, gather demographic information about our user base as a whole. We also use analysis tools and methods to allow us to better understand how our customers use our Services. This includes how often the Services are used, the events that occur within the application, aggregated usage, performance data, any exceptions that occur within the software and the source from which the application was downloaded.<p>&quot;Some of the events that Wacom were recording were arguably within their purview, such as &quot;driver started&quot; and &quot;driver shutdown&quot;. <i>I still don&#x27;t want them to take this information because there&#x27;s nothing in it for me</i>, but their attempt to do so feels broadly justifiable.<p>Assuming Wacom respects resolv.conf as it does system-wide HTTP proxy settings, why not run localhost or LAN DNS server, either authoritative or recursive, that does not return a Google IP address for queries like www.google-analytics.com originating from the tablet IP address<p>The &quot;broadly justifiable&quot; reasoning does not account for the possibility Wacom may collect the data and then fail to improve the product, service or &quot;user experience&quot;. Wacom is making no promises of any <i>user benefits</i> arising from collection of data. Even if there were &quot;something in it&quot; for the author, he has no way to hold Wacom to this promise. They get his data and he <i>may or may not</i> get something in return.

Who is Rick?

Great article!<p>I love how he MITM&#x27;d Wacom on his host machine. Slick!<p>Also this: &quot;I dug around in the driver’s logfile and found the following snippet that confirmed my suspicions...&quot;<p>Arms race time: this is an alert to shady developers to not put meaningful messages about data collection in their log files.

How much of this is specifically Watcom sending that info to Google Analytics and how much of it is the stock Google Analytics SDK automatically slurping up that stuff by default?

Great forensics work.<p>&gt; <i>even if someone had read and understood Wacom’s privacy policy, and had knowingly consented to a reasonable interpretation of the words inside it, that person would still not have agreed to allow Wacom to log and track the name of every application that they opened on their personal laptop.</i><p>I agree completely. Tracking every application one uses and reporting on that to third party Google is so contrary to their stated EULA that both a class action lawsuit, and prosecution in jurisdictions that protect privacy, are warranted.

I&#x27;m surprised Wacom is still around with iPad and Apple Pencil being such a hit. I know I&#x27;ve migrated.

More importantly, don&#x27;t iOS and Android track every app you open also?

I know privacy is a big deal, and this is not cool in general but I kind of don&#x27;t mind Wacom doing this.<p>If Wacom&#x27;s users are starting to use a niche program outside of the Adobe suite, I&#x27;d like them to know about it so they can fully support it.<p>And its not like I&#x27;m going to be using my Wacom tablet with very many programs. Its not like it can replace a mouse unless you are a crazy person...

Maybe Wacom isn&#x27;t really aware of this and there is a guy named <i>Rick</i> who has set up an elaborate scheme to stalk his artist ex girlfriend.<p>Edit: While this post was meant to be tongue in cheek, it is possible and I&#x27;m not sure which is worse.

&quot;their device, which - remember - is essentially a mouse&quot;<p>... that has per-application configuration settings that change how the tablet can be used. They aren&#x27;t just wantonly collecting unrelated data. They have features tied to this.<p>I read the whole article to see if there was any mention of app-specific config. Doesn&#x27;t come up once.

I&#x27;m fine with Wacom collecting this kind of data as long as it doesn&#x27;t open any security holes. There are certain classes of products where I would not care what they collected as long as it was relevant to improving the product. i.e. Wacom wants to know popular apps I use my tablet on, ok. If they wanted to know my approx location though then I&#x27;d be alarmed.