I just encountered a new Microsoft Edge pop-up... 

Microsoft’s default position has always been to ignore its intrusive corporate surveillance (aka “telemetry”) because it is all about "improving the user experience" rather than selling customer-targeted advertising.

This default position is troubling because browsers are increasingly able to access device sensors, including cameras, microphones, accelerometers, GPS location, and applications that can gather biometric samples. Not only is it possible to locate your position, but confirm it is, indeed, you.

Enabled by default…

It should not surprise anyone that Edge sends unique hardware identifiers to Microsoft which cannot be easily changed or deleted, and all trackers are enabled by default in all Edge installations to share details of every webpage you visit with their services. All these browsers use autocomplete feature to send web addresses to their services in real-time.

According to a browser analysis, from Douglas Leith with the School of Computer Science and Statistics at Trinity College in Ireland, Edge sends privacy-invasive telemetry to Microsoft’s back-end servers — including “persistent” device identifiers and URLs typed into browsing pages. <Source>

• Edge sends the hardware UUID [Universally Unique IDentifier] of the device to Microsoft, a strong and enduring identifier than cannot be easily changed or deleted.
• Edge connects to edge.microsoft.com roughly every 30 mins and to config.edge.skype.com and smartscreen-prod.microsoft.com roughly every hour.
• Requests to config.edge.skype.com seem to be checking for updates to Edge itself. SmartScreen is Microsoft’s malware/anti-phishing service and so presumably the requests to smartscreen-prod.microsoft.com relate to that.
• Edge sends text to www.bing.com (a Microsoft search service) as it is typed. A request is sent for almost every letter typed.
• Once the typed URL has been navigated to, Edge then makes two additional requests: one to web.vortex.data.microsoft.com and one to nav.smartscreen.microsoft.com. The request to nav.smartscreen.microsoft.com includes the URL entered and forms part of Microsoft’s phishing/malware protection service, while the request to web.vortex.data.microsoft.com transmits two cookies.

From a privacy perspective, Microsoft Edge and Yandex [A browser linked to Russia] are qualitatively different from the other browsers studied. Both send persistent identifiers than can be used to link requests (and associated IP  address/location) to back-end servers.

Edge also sends the hardware UUID of the device to Microsoft and Yandex similarly transmits a hashed hardware identifier to back-end servers.

As far as we can tell this behavior cannot be disabled by users. In addition to the search autocomplete functionality that shares details of web pages visited, both transmit web page information to servers that appear unrelated to search autocomplete.

Choose one: convenience or privacy!

Bottom line…

Before accepting any default, please read the fine print carefully and be sure what the terms, conditions, and weasel words imply and how they impact your personal privacy. And, like Bill Clinton questioning what the meaning of the word ‘is’ is, make sure you understand the meaning of yes/no and on/off options. Yes – you want the option “off” and inactive or “yes,” you agree the option should be “on” and active.

We are so screwed.

-- steve