Another chap did some preliminary tests on Origin, here's what he found, It's not mine so, any questions I will be of only limited help with. Some of the other tech savy chaps on here may be of more help than me. Have a look, what do you chaps think? I still remain unsure if it can send information at a later date etc. So I honestly unsure of what the program actually gets up to.After installing Origin I started it up with Process Monitor running as well. It recorded origin accessing various EA folders on the C drive and registry keys relating to EA and system stuff.
I did a search on its registry access and I noticed that it did NOT access the following keys (commonly used by the system to list the programs installed on the computer):
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstall
SOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData
HKUUSER-SID-HERESoftwareMicrosoftInstallerProducts
HKLMSoftwareMicrosoftWindowsCurrentVersionInstallerUserData
HKLMSoftware****sInstallerProducts
HKEY_LOCAL_MACHINESOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionUninstall
HKLMSoftwareWow6432NodeMicrosoftWindowsCurrentVersionUninstall
HKCUSoftware
I also searched and found that Origin did not access any keys at all containing the word "Uninstall".
Folder and file access showed Origin accessing mostly EA and system related stuff although it did access ALL of the folders and most if not all files in the ProgramData folder. Within these folders it even accessed icon files, Robosoft search dump files and some other miscellanous stuff which seemed a bit strange.
Origin also opened Xfire.ini which does contain a list of detected installed games as well as xfire_games.ini which contains a list of all games that XFire can detect.
I searched all the logs and couldn't find anything about Origin accessing folders or registry keys relating to my legitimate Battlefield 2 installation, and the game itself worked fine afterwards so it doesn't seem to interfere with other EA games (unless they are perhaps part of origin itself).
I searched the file and registry logs and found that Origin did not access any values containing the word "browser", "Internet Explorer", "Steam", "Valve" or "Firefox" (my default browser) except for a couple of HTTPshellopencommand(Default) registry entries that indicate what is the default browser for the system. It also queried the registry entries Internet ExplorerSecuritySafety Warning Level and Internet ExplorerSecurity which seem to indicate what security level IE is running on.
The Wireshark network log showed Origin communicating with several EA servers, though from what I could tell it was mostly sending HTTP GET requests and sending some sort of encrypted information to them.
While Origin was starting up & checking files it utilized 0% of the Internet connection. There was a tiny spike of internet utilization when I logged into my Origin account but after leaving it for a few minutes there was no more Internet activity. This would indicate that although it did check/open everything in the ProgramData folder there's no way it could have provided all that detailed information to the EA servers without a massive spike in Internet usage.
Origin did not appear to install or activate any additional services when it was installed or when it started up.
Conclusion:
From what I can see Origin does act a bit suspiciously as it checks everything in the ProgramData folder and I can't tell for certain what data it sends to the EA servers, however it does appear to be mostly benign. Given its tiny amount of Internet utilization when logging in (barely half a megabit per second for a couple of seconds) it would appear to not send that much information to EA, especially since my ProgramData folder is 4.25GB and contains 211000 files in 655 folders. From looking at it's activities Origin seems sloppily programmed and badly implemented more so than anything else.
It doesn't appear to use steam or common registry keys to get a list of other programs on the computer however it does access XFire files which show what games XFire detected on your computer. It doesn't appear to access the game folders or registry keys of the games themselves though. It does however check to see what's in the ProgramData folder
I suppose you could remove the detected game info in Xfire.ini before starting Origin and hide or move the other stuff in the ProgramData folder to stop that stuff from being accessed.
It also doesn't appear to go through your browsing history or check much of your browser stuff except for checking what the default browser is and Internet Explorer's security level.
Modifié par billy the squid, 14 octobre 2011 - 08:38 .