By default, Windows listens to you, gathers your keystrokes, watches your browser history and purchases and sends them to Microsoft and its partners — but even if you turn off all the tickboxes in the hellishly complex privacy dashboard it still gathers and sprays your data.
Other traffic looks a little more troublesome. Windows 10 will periodically send data to a Microsoft server named ssw.live.com. This server seems to be used for OneDrive and some other Microsoft services. Windows 10 seems to transmit information to the server even when OneDrive is disabled and logins are using a local account that isn't connected to a Microsoft Account. The exact nature of the information being sent isn't clear—it appears to be referencing telemetry settings—and again, it's not clear why any data is being sent at all. We disabled telemetry on our test machine using group policies.And finally, some traffic seems quite impenetrable. We configured our test virtual machine to use an HTTP and HTTPS proxy (both as a user-level proxy and a system-wide proxy) so that we could more easily monitor its traffic, but Windows 10 seems to make requests to a content delivery network that bypass the proxy.
We've asked Microsoft if there is any way to disable this additional communication or information about what its purpose is. We were told "As part of delivering Windows 10 as a service, updates may be delivered to provide ongoing new features to Bing search, such as new visual layouts, styles and search code. No query or search usage data is sent to Microsoft, in accordance with the customer's chosen privacy settings. This also applies to searching offline for items such as apps, files and settings on the device." This is consistent with what we saw (there is no query or search data transmitted), but also likely to run counter to most people's expectations; if Web searching and Cortana are disabled, we suspect that the inference that most people would make is that searching the Start menu wouldn't hit the Internet at all. But it does. The traffic could be innocuous, but the inclusion of a machine ID gives it a suspicious appearance.
Even when told not to, Windows 10 just can't stop talking to Microsoft [Peter Bright/Ars Technica]
