toggldesktop icon indicating copy to clipboard operation
toggldesktop copied to clipboard

Published 20 hours ago • verified publisher icon toggl-open-source

GetForegroundWindow API is called even if "Record Activity" is disabled

Open vukitoso opened this issue 3 years ago • 7 comments

💻 Environment

Platform: Windows OS Version: 10 Toggl Version: 7.5.442

📒 Description

Hello. Thank you for such a good program for keeping track of work. It helps me a lot, it's very convenient.

  1. Auto Update. How can I disable updating to the latest version? Since the program itself downloads the update to the latest version and after closing and opening the program updates the exe file to the new one.

  2. Record activity I disabled the option "Record activity" but the program keeps monitoring the windows of the running applications, registry and logging. It also constantly connects to ip-addresses and sends something, although I did not click "synchronize". All this information I got through the program ProcessMonitor from sysinternals.com. I tried to decrypt https/tls connection, but I failed.

Please tell me why "Toggl Track" continues to monitor running applications and connects to servers. What is being sent to these servers? Thank you.

vukitoso avatar Mar 17 '21 12:03 vukitoso

Hi @vebmaster! Thanks for your report!

  1. We don't really support disabling the auto-updating for now. The issue with disabling it is that we may deprecate the APIs that we're using in the future, which means the non-updated apps would become unusable. We're considering having a special version with disabled auto-updates for some specific user scenarios like restricted environments. In this case, we'll need to be clear that the user or admin is responsible for updating the app manually. Can you please share your scenario and why would you need to disable the auto-update? Thanks.
  2. The app doesn't save or send any recorded activity data when "Record activity" is disabled. The process monitoring APIs are also used for the Autotracker feature. If the Autotracker feature is disabled as well, then the app doesn't need to use any process monitoring APIs. If it does right now, then it might have been done only for the sake of implementation convenience and it really doesn't need to do so. We'll rewrite this feature a bit later this year and we'll ensure that the app does not call any process monitoring APIs when the corresponding feature is disabled. To verify this claim, besides checking the source code, you can also monitor the traffic by going to Preferences->Proxy and checking the "Ignore SSL verification" setting. In this case, you'll be able to use Fiddler or any other web proxy app and look through all the traffic. The traffic that is being sent is just the periodic syncing of the time tracking data itself.

Thanks again for the report and please let us know if you have any more questions!

skel35 avatar Mar 17 '21 13:03 skel35

One more thing I forgot to mention - you can also use the Microsoft Store version of the app and control the auto-updates using MS Store settings.

skel35 avatar Mar 17 '21 14:03 skel35

Thank you.

  1. You can add the "Auto Update" option to the settings with ON/OFF options.

  2. Can you make the app not track app activity when I have tracking disabled?

  3. You can add "Manual Sync" switch in the settings with options ON/OFF. When enabled - data synchronization occurs only after pressing "Sync F5". In other cases, there should not be any tcp-connection.

Why I don't want auto update: I'm paranoid. I can use auto-update to inject an infected exe file to spy on my computer. If I build from source, then auto update will do me harm, because I do not know what is in that exe file.

vukitoso avatar Mar 17 '21 17:03 vukitoso

Hi!

I also came here looking for a way to disable the activity tracking feature (item 2 from @vebmaster). I remember having enabled it sometime ago, but now realize I do not need it. I did not find a way to disable it directly and Autotracker feature is already disabled.

vinismarques avatar Mar 26 '21 12:03 vinismarques

Thank you.

  1. You can add the "Auto Update" option to the settings with ON/OFF options.
  2. Can you make the app not track app activity when I have tracking disabled?
  3. You can add "Manual Sync" switch in the settings with options ON/OFF. When enabled - data synchronization occurs only after pressing "Sync F5". In other cases, there should not be any tcp-connection.

Why I don't want auto update: I'm paranoid. I can use auto-update to inject an infected exe file to spy on my computer. If I build from source, then auto update will do me harm, because I do not know what is in that exe file.

  1. I'll pass the feedback to the product management, thanks.
  2. We will make sure no APIs are called if it's disabled. It doesn't really "track activity" now as no data is saved anywhere if "Record Activity" is disabled, and you can check it in the source code.
  3. I'll pass the feedback to the product management, thanks.

skel35 avatar Mar 26 '21 12:03 skel35

Hi! I also came here looking for a way to disable the activity tracking feature (item 2 from @vebmaster). I remember having enabled it sometime ago, but now realize I do not need it. I did not find a way to disable it directly and Autotracker feature is already disabled.

Hi @vinismarques! If you disable "Record activity" then no data is being tracked.

skel35 avatar Mar 26 '21 12:03 skel35

Hi @skel35,

Thank you for the information! Indeed the option is there on the Timeline tab.

vinismarques avatar Mar 26 '21 18:03 vinismarques