Security Compromise? NYM Windows APP requires TELEMETRY USING Microsoft "Edge WebView2"

General
1

Hi,

https://support.nym.com/hc/en-us/articles/29036510423697-Why-does-NymVPN-require-Edge-WebView2-a-Microsoft-product-upon-Windows-installation

So as you can see in the above link, the NYM Windows APP uses “Microsoft Edge WebView2“. This “Microsoft Edge WebView2“ collects and submits MICROSOFT TELEMETRY data back to Microsoft along with system telemetry.

Windows Enterprise and Education editions are the only editions of windows that allow you to change telemetry reporting to the most basic level of ZERO “0”, Home Pro edition only allow changing to level 1. Even when telemetry is set to the lowest level of 0, it still sends a lot of private software and hardware data like Motherboard device ID, system IDs, RAM.

“Microsoft Edge WebView2“ also sends this data along with the windows apps that use “Microsoft Edge WebView2“ including NYM Windows APP.

So that means Microsoft can connect the system telemetry System and Device ID and hardware software configuration data, with the “Microsoft Edge WebView2“ Nym Windows APP telemetry data like the following;

  1. “NYM VPN App”,
  2. Which Entry server did the app select,
  3. Which Exit server did the app select.

This is a massive security leak and hole.

Why can’t you make the windows app completely free of “Microsoft Edge WebView2“?

That would make it secure.

NYM VPN is probably the greatest DeVPN meshnet! How “Microsoft Edge WebView2“ compromises the entry point.

Can someone respond to this concern?

Thanks.

2

Hi there, thanks for the question. It is a legitimate concern, especially seeing the direction Microsoft (and Windows) has taken in recent years when it comes to telemetry, general user data collection, Recall, and the list goes on and on.

Tauri’s wry component has SmartScreen disabled since 2022. This prohibits telemetry in WebView2, so no telemetry data is collected specifically related to NymVPN - check this thread on GitHub for further information.

As for why we NymVPN has WebView2, it is because we use the cross-platform Tauri framework for our Linux and Windows apps. This allows us to release the same build across these operating systems. WebView2 is an integral part of Tauri, and therefore there is no way to remove it.