this is why Microsoft is pushing so hard for Microsoft accounts at install
An MS account is not required for a GDID to be issued.
Full Writeup of the Windows GDID
11–20 of 57 posts
Re: Full Writeup of the Windows GDID
#12For those like me who were not abreast of this issue: the FBI was able to arrest some kid who hacked/is alleged to have hacked a jewellery retailer through a VPN. They were able to track the hacker via the user's GDID, which is a stable identifier unaffected by VPN usage. This surveillance is certainly going to expand in scope as age verification comes into widespread usage. Personally I see little legitimate use cas…
Well, it's a darn good thing there is nothing like that over here on the Linux side. I'm pretty sure that if e.g. systemd attempted to generate a unique, persistent machine identifier during the installation process, it'd be shot down and patched off extremely quickly.
Re: Full Writeup of the Windows GDID
#13For those like me who were not abreast of this issue: the FBI was able to arrest some kid who hacked/is alleged to have hacked a jewellery retailer through a VPN. They were able to track the hacker via the user's GDID, which is a stable identifier unaffected by VPN usage. This surveillance is certainly going to expand in scope as age verification comes into widespread usage. Personally I see little legitimate use cas…
Well, it's a darn good thing there is nothing like that over here on the Linux side. I'm pretty sure that if e.g. systemd attempted to generate a unique, persistent machine identifier during the installation process, it'd be shot down and patched off extremely quickly.
Linux does though?
cat /etc/machine-idRe: Full Writeup of the Windows GDID
#14For those like me who were not abreast of this issue: the FBI was able to arrest some kid who hacked/is alleged to have hacked a jewellery retailer through a VPN. They were able to track the hacker via the user's GDID, which is a stable identifier unaffected by VPN usage. This surveillance is certainly going to expand in scope as age verification comes into widespread usage. Personally I see little legitimate use cas…
Well, it's a darn good thing there is nothing like that over here on the Linux side. I'm pretty sure that if e.g. systemd attempted to generate a unique, persistent machine identifier during the installation process, it'd be shot down and patched off extremely quickly.
Re: Full Writeup of the Windows GDID
#15How a Windows device's global ID is generated may be new info in the public sphere, but the fact that the global ID exists is not a secret. This format of device ID has been in Windows since the initial release of Windows 10 in 2015, when it was introduced as part of Windows' current telemetry subsystem. To see your device's global ID, open Windows Feedback Hub, then go to Feedback Hub Settings and look under Device…
What I'm more interested in is how/where the GDID is used. Imagine if e.g. Edge started sending your GDID as a header in every single web request.
Re: Full Writeup of the Windows GDID
#16How a Windows device's global ID is generated may be new info in the public sphere, but the fact that the global ID exists is not a secret. This format of device ID has been in Windows since the initial release of Windows 10 in 2015, when it was introduced as part of Windows' current telemetry subsystem. To see your device's global ID, open Windows Feedback Hub, then go to Feedback Hub Settings and look under Device…
What I'm more interested in is how/where the GDID is used . Imagine if e.g. Edge started sending your GDID as a header in every single web request.
I always assumed Chrome and Edge already did this — but sent the data to their respective masters.
Isn't every Chrome download unique?
It used to be even though the package contained an Authenticode signature, each installer stub download had a unique hash, because Windows' digital signatures allow a non-executable data area in the trailer which is not computed as part of the signed data.
There is zero technical reason to do this (generating unique binaries) aside from tracking purposes.
Re: Full Writeup of the Windows GDID
#17> The court record itself says a reinstall produces a new GDID
That's a half truth if I ever saw one. Telemetry also includes the hardware hash (which does use SMBIOS serial number, CPUID, TPM identifiers, etc.) and that one survives OS reinstalls and even hardware swaps. It is the underlying id used for things like Autopilot (the equivalent to Apple's remote MDM lock).
Re: Full Writeup of the Windows GDID
#18one thing this doesn't touch on that I am curious about is how was browsing history, etc, correlated to the GDID?
Ya. The FBI report to the court said that Microsoft showed the GDID visited the ngrok.com/signip page while using a VPN. I would have figured at that level the OS would not know domains but likely IP addresses. So it must be browser telemetry right?
Re: Full Writeup of the Windows GDID
#19Can promise you a re-install does nothing for your privacy. Plenty of IDs are embedded in the hardware.
Re: Full Writeup of the Windows GDID
#20For those like me who were not abreast of this issue: the FBI was able to arrest some kid who hacked/is alleged to have hacked a jewellery retailer through a VPN. They were able to track the hacker via the user's GDID, which is a stable identifier unaffected by VPN usage. This surveillance is certainly going to expand in scope as age verification comes into widespread usage. Personally I see little legitimate use cas…
Well, it's a darn good thing there is nothing like that over here on the Linux side. I'm pretty sure that if e.g. systemd attempted to generate a unique, persistent machine identifier during the installation process, it'd be shot down and patched off extremely quickly.
Is this sarcasm?