Unfortunately for privacy advocates, Windows 10 privacy controls don't appear to be sufficient to completely prevent the operating system from going online and communicating with Microsoft's servers. For example, even with Cortana and searching the Web from the Start menu disabled, opening Start and typing will send a request to www.bing.com to request a file called threshold.appcache which appears to contain some Cortana information, even though Cortana is disabled. The request for this file appears to contain a random machine ID that persists across reboots.

MS Sniffing Key points:

-It sends all text you type anywhere (not just into search) every 30 minutes to MS. If you type about a holiday to your blog, next day youll see holiday ads.

- every 30 minutes it sends your geolocation and network info

-if you type a telephone number into Edge it sends it to MS after 5 min

-if you type anywhere in windows a name of some movie, windows will start indexing all your media files after a while and will send it to MS after 30 minutes of your inactivity

-after installing W10, it will send about 35MB of data once

-after turning on your webcam for the first time it sends data to microsoft once. Probably your photo.

-everything you say is transferred to MS, it works even if you disable and remove and uninstall Cortana. Parts of Cortana are needed for the core of the OS to run. Confirmed by MS helpdesk. You can be identified by your voice anywhere near a microphone after they get enough data from you.

-Voice to text is transferred instantly

-voice is transferred every 15 min, 80MB of data

-after 15 minutes of your inactivity or when screensaver is on, network activity ramps up and everything else is being sent to MS

-blocking in hosts doesnt work, some IPs are hardcoded into their code and DLLs

Some of the traffic is obviously harmless. On connecting to a new network, Windows machines try to request two URLs (www.msftncsi.com/ncsi.txt and ipv6.msftncsi.com/ncsi.txt, the former over IPv4, the latter over IPv6) to ascertain whether a given network is routed to the Internet and if there is a captive portal in the way (NCSI stands for "Network Connection Status Indicator"). These requests are very bare, with no machine IDs or other data sent. If you want to turn even these off there is a way to do so, but the privacy impact is minimal. Some of the traffic looks harmless but feels like it shouldn't be happening. For example, even with no Live tiles pinned to Start (and hence no obvious need to poll for new tile data), Windows 10 seems to download new tile info from MSN's network from time to time, using unencrypted HTTP to do so. While again the requests contain no identifying information, it's not clear why they're occurring at all, given that they have no corresponding tile. Other traffic looks a little more troublesome. Windows 10 will periodically send data to a Microsoft server named ssw.live.com. This server seems to be used for OneDrive and some other Microsoft services. Windows 10 seems to transmit information to the server even when OneDrive is disabled and logins are using a local account that isn't connected to a Microsoft Account. The exact nature of the information being sent isn't clear—it appears to be referencing telemetry settings—and again, it's not clear why any data is being sent at all. We disabled telemetry on our test machine using group policies.

And finally, some traffic seems quite impenetrable. We configured our test virtual machine to use an HTTP and HTTPS proxy (both as a user-level proxy and a system-wide proxy) so that we could more easily monitor its traffic, but Windows 10 seems to make requests to a content delivery network that bypass the proxy.