Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Can Track Users via a Windows Device ID

pcmag.com

Post reply on HN
Print view View original

81–90 of 170 posts

Re: Microsoft Can Track Users via a Windows Device ID

#81

Post by everdrive »

tremon wrote: post #15
cheschire wrote: post #12

Well they can’t use that to track users of Linux. I was a big fan of Microsoft ten to fifteen years ago. I’ve since transitioned my whole family off Microsoft products now over to Linux, Apple, and proton. Edit: and Brave. I really thought their corporate culture would’ve changed after the late 90’s but I guess this is a good lesson for founders. The culture you build into your company will likely outlast your tenure…

Both systemd and dbus have a similar device id for Linux, which e.g. Chrome reads at startup: https://manpages.debian.org/trixie/systemd/machine-id.5.en.h... https://manpages.debian.org/trixie/dbus-bin/dbus-uuidgen.1.e...

That's good to know, thank you. I'm been considering moving away from systemd, and certainly don't use Chrome.

The number of things you need to try to keep track of merely _improve_ your privacy is maddening. The whole world seems to be against you.

Re: Microsoft Can Track Users via a Windows Device ID

#82

Post by tremon »

inigyou wrote: post #38
gcr wrote: post #33

Earlier quoted context omitted.

The supported method to get a new one each boot is to truncate the file to 0 bytes and disable systemd-machine-id-commit.service Double-check that this method actually works though. Machine ID is used for things like dhcp leases, log rotation, etc. IPV6 addresses or transient MAC addresses are derived from it

I thought the kernel generated SLAAC addresses based on MAC and privacy addresses based on random numbers.

It does, but DHCPv6 prescribes a persistent device identifier (DUID): https://www.rfc-editor.org/info/rfc9915/#RFC3315-9

The DUID is designed to be unique across all DHCP clients and servers, and stable for any specific client or server. That is, the DUID used by a client or server SHOULD NOT change over time if at all possible; for example, a device's DUID should not change as a result of a change in the device's network hardware or changes to virtual interfaces

Re: Microsoft Can Track Users via a Windows Device ID

#84

Post by teaearlgraycold »

tremon wrote: post #15
cheschire wrote: post #12

Well they can’t use that to track users of Linux. I was a big fan of Microsoft ten to fifteen years ago. I’ve since transitioned my whole family off Microsoft products now over to Linux, Apple, and proton. Edit: and Brave. I really thought their corporate culture would’ve changed after the late 90’s but I guess this is a good lesson for founders. The culture you build into your company will likely outlast your tenure…

Both systemd and dbus have a similar device id for Linux, which e.g. Chrome reads at startup: https://manpages.debian.org/trixie/systemd/machine-id.5.en.h... https://manpages.debian.org/trixie/dbus-bin/dbus-uuidgen.1.e...

Trying to imagine a world where I use Chrome unironically.

Re: Microsoft Can Track Users via a Windows Device ID

#85

Post by MisterTea »

tremon wrote: post #15
cheschire wrote: post #12

Well they can’t use that to track users of Linux. I was a big fan of Microsoft ten to fifteen years ago. I’ve since transitioned my whole family off Microsoft products now over to Linux, Apple, and proton. Edit: and Brave. I really thought their corporate culture would’ve changed after the late 90’s but I guess this is a good lesson for founders. The culture you build into your company will likely outlast your tenure…

Both systemd and dbus have a similar device id for Linux, which e.g. Chrome reads at startup: https://manpages.debian.org/trixie/systemd/machine-id.5.en.h... https://manpages.debian.org/trixie/dbus-bin/dbus-uuidgen.1.e...

Sounds like chrome is the problem.

Re: Microsoft Can Track Users via a Windows Device ID

#86

Post by LtWorf »

everdrive wrote: post #81
tremon wrote: post #15

Earlier quoted context omitted.

Both systemd and dbus have a similar device id for Linux, which e.g. Chrome reads at startup: https://manpages.debian.org/trixie/systemd/machine-id.5.en.h... https://manpages.debian.org/trixie/dbus-bin/dbus-uuidgen.1.e...

That's good to know, thank you. I'm been considering moving away from systemd, and certainly don't use Chrome. The number of things you need to try to keep track of merely _improve_ your privacy is maddening. The whole world seems to be against you.

firejail has a setting to generate a random machine id at every run.

And you should be running the browser inside firejail at all times.

Re: Microsoft Can Track Users via a Windows Device ID

#87

Post by materialpoint »

istoleabread wrote: post #73
materialpoint wrote: post #66

This goes a long way to prove that Microsoft does NOT care about your privacy, even if the header of their cookie consent claims so. They absolutely do not care, and this should be said about every big-tech vendor, not matter how lame it seems to say so. It is long overdue that we all say what needs to be said: they do not care about your privacy, your independence, or your well being. They DO NOT CARE.

Big news: Fork found in kitchen

Since you did not understand the point at all: There are regulations in place to force sites to "ask" for permissions to use cookies and track you. The point is that the regulations completely fail to force the sites to not blatantly lie, and wrap the "consent" with "we care".

Re: Microsoft Can Track Users via a Windows Device ID

#88

Post by ralferoo »

Someone wrote: post #43

I guess we’ll see a Windows tool that sets your identifier to this suspect’s “g:6755467234350028” very soon (weird ID, by the way. 16-digits makes sense, but I would have expected it to be hexadecimal) Also, can anybody tell how “Microsoft had records showing that on May 12, 2025, at 19:21 UTC, the GDID associated with Stokes’ computer “accessed, among other ngrok pages, ' https://dashboard[.]ngrok.com/signup ,'” wor…

Converting that ID to hex gives 18,000F,C8CB,93CC which rather looks like 32 bits of random data plus the prefix 0x18000f or possibly 40-48 bits of time in ms granularity from some epoch.

Re: Microsoft Can Track Users via a Windows Device ID

#89

Post by LtWorf »

alimbada wrote: post #42
tremon wrote: post #15

Earlier quoted context omitted.

Both systemd and dbus have a similar device id for Linux, which e.g. Chrome reads at startup: https://manpages.debian.org/trixie/systemd/machine-id.5.en.h... https://manpages.debian.org/trixie/dbus-bin/dbus-uuidgen.1.e...

I went to check if Flatpak would protect against this but it seems although it's a wanted feature it's not so straightforward to implement: https://github.com/flatpak/flatpak/issues/4311

firejail has a setting to protect against it.

Re: Microsoft Can Track Users via a Windows Device ID

#90

Post by vel0city »

xeyownt wrote: post #35
heikkilevanto wrote: post #19

Earlier quoted context omitted.

I don't like the idea of a persistent id for my machine. Would there be any harm in rewriting the machine-id at every boot? Or just deleting it as part of the shutdown sequence?

Whatever you do there will always be uniquely identifiable information (if not an id, a fingerprint) on your machine. If you want to escape that, you have to use dedicated privacy-enhancing tools / browsers, but even then, it's very likely that you can still be identified by motivated adversaries. It doesn't mean you have to give up, but, if such id is necessary for technical reasons in systemd (I guess it is), I wou…

When you go really hard with the privacy-enhancing tools, you can potentially just make yourself even more visible. When you're so far outside the normal way a user looks you're making yourself even more unique than if you had normal-ish looking identifiers.

It can take a lot of effort to make yourself truly just blend in and disappear.

Post reply on HN