Researchers at the Graz University of Technology Austria demonstrated a new attack that can track you via file change events "on all systems," allowing for various data leaks.
The researchers say they responsibly disclosed the attacks to the vendors. In particular, Microsoft stated that the the private data leakage was actually there by design.
Excuse me wtf??
“Yeah we put in that vulnerability on purpose”
The paper’s footnote:
We responsibly disclosed our findings to the Windows Security team. In their response,
they stated that our findings were by-design. Furthermore, they state that it “only
reveals file names and paths within another user’s profile directory [and] does not
expose file contents or sensitive data”.
Yeah pretty baffling to me. Filenames can be very revealing, I would definitely classify that as sensitive data.