Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Can Track Users via a Windows Device ID

pcmag.com

Post reply on HN
Print view View original

111–120 of 170 posts

Re: Microsoft Can Track Users via a Windows Device ID

#111

Post by gigel82 »

cheschire wrote: post #12

Well they can’t use that to track users of Linux. I was a big fan of Microsoft ten to fifteen years ago. I’ve since transitioned my whole family off Microsoft products now over to Linux, Apple, and proton. Edit: and Brave. I really thought their corporate culture would’ve changed after the late 90’s but I guess this is a good lesson for founders. The culture you build into your company will likely outlast your tenure…

Tangentially related to Device ID: Apple is significantly worse when it comes to machine identifiers; even with Autopilot enabled you can still install Linux on a Microsoft Surface device (or even Windows if you don't use a Microsoft Account). With MDM locks, Apple devices are literally bricks (especially since all ram and storage is soldered down and locked/paired to the secure enclave chip).

Re: Microsoft Can Track Users via a Windows Device ID

#112

Post by mmooss »

xeyownt wrote: post #35
heikkilevanto wrote: post #19

Earlier quoted context omitted.

I don't like the idea of a persistent id for my machine. Would there be any harm in rewriting the machine-id at every boot? Or just deleting it as part of the shutdown sequence?

Whatever you do there will always be uniquely identifiable information (if not an id, a fingerprint) on your machine. If you want to escape that, you have to use dedicated privacy-enhancing tools / browsers, but even then, it's very likely that you can still be identified by motivated adversaries. It doesn't mean you have to give up, but, if such id is necessary for technical reasons in systemd (I guess it is), I wou…

No security is perfect; there is always a way to bypass it. But security can be highly valuable.

Re: Microsoft Can Track Users via a Windows Device ID

#113

Post by advisedwang »

embedding-shape wrote: post #64
Someone wrote: post #43

I guess we’ll see a Windows tool that sets your identifier to this suspect’s “g:6755467234350028” very soon (weird ID, by the way. 16-digits makes sense, but I would have expected it to be hexadecimal) Also, can anybody tell how “Microsoft had records showing that on May 12, 2025, at 19:21 UTC, the GDID associated with Stokes’ computer “accessed, among other ngrok pages, ' https://dashboard[.]ngrok.com/signup ,'” wor…

> Also, can anybody tell how “Microsoft had records showing that on May 12, 2025, at 19:21 UTC, the GDID associated with Stokes’ computer “accessed, among other ngrok pages, ' https://dashboard[.]ngrok.com/signup ,'” works? That URL shows 16 blocked requests, it tries to load (at the very least) datadog and googletagmanager, I'm guessing the police simply reached out to all the analytics companies Ngrok ends up indir…

> I'm guessing the police simply reached out to all the analytics companies Ngrok ends up indirectly/directly sending data to, which ends up saving everything they get their hands on.

But those companies would have no way of knowing the GDID. It's not sent in a header, I assume.

Re: Microsoft Can Track Users via a Windows Device ID

#114

Post by dlenski »

lorislab wrote: post #74

The interesting part is not really the existence of a machine identifier. Almost every modern OS has some equivalent. The bigger question is the boundary: which components can access it, and when does a local identifier become a remote tracking identifier? A machine-id sitting on disk is very different from an OS vendor correlating it with network activity.

Yeah, this is what's glaringly missing from the article.

Exactly how does Microsoft's device identifier get associated with the ngrok session (normally initiated via its closed-source CLI)?

I can't tell from the article whether Microsoft is doing something underhanded to inject its device identifiers into network traffic, or whether the ngrok client software (again, closed-source!) grabbed the device identifier… and might well do the same on any other OS, using /etc/machine-id on Linux for example.

Since ngrok uses a "freemium" model, it wouldn't surprise me at all if its clients send machine IDs to try to catch users trying to get around its free limits.

Re: Microsoft Can Track Users via a Windows Device ID

#115

Post by thewebguyd »

zelphirkalt wrote: post #11

My surprise level is at approximately... zero. Next we will see some news, that MS was compelled to share that info with some three letters. - Oh wait, that is exactly what has already happened, according to the article. MS is just like that person, who drives a dagger into your back.

My thoughts exactly. Weren't they just caught recently handing over bitlocker keys (that get uploaded to MS by default when you sign in with a microsoft account) to the feds?[1]

Windows is malware.

[1] https://www.forbes.com/sites/thomasbrewster/2026/01/22/micro...

Re: Microsoft Can Track Users via a Windows Device ID

#116

Post by Bender »

lorislab wrote: post #74

The interesting part is not really the existence of a machine identifier. Almost every modern OS has some equivalent. The bigger question is the boundary: which components can access it, and when does a local identifier become a remote tracking identifier? A machine-id sitting on disk is very different from an OS vendor correlating it with network activity.

Adding another example of this is the NetworkID in about:networking#networkid in Firefox. There was a point in time that cause some controversy. Every AI has the wrong information about it's origin and use.

Re: Microsoft Can Track Users via a Windows Device ID

#117

Post by baranul »

llm_nerd wrote: post #108
nailer wrote: post #105

Earlier quoted context omitted.

Good question. My understand is that it was licensing: Hackers cloaked IP address -> VPN license -> Windows GDID -> Hacker's name.

From the reading of the document, I really don't think that's it. The suspects used phishing to get access to one company's servers, then used those servers to push software to other servers. It 100% reads that they enlisted Microsoft to correlate telemetry data with some known activities, backtracking from that. Barring specific additional data, this should be extraordinarily concerning. Repeatedly the documents cit…

But it has long been known that Microsoft actively collaborates with and provides user data to legal entities. It is more a matter of the general public not being aware of this, the kind of data collected, and to what extent will users continue to tolerate Microsoft's behavior.

Re: Microsoft Can Track Users via a Windows Device ID

#118

Post by boopig »

Terr_ wrote: post #2

TLDR: Microsoft can (at least) correlate your Windows installation to all website domains you visit while using Windows. It's unclear what the mechanism is, but I'd wager their "telemetry" is constantly revealing your installation ID, your current IP, and domains that were recently resolved.

It's Microsoft Defender SmartScreen in Edge.

You can also use the Windows Diagnostic Viewer to check the telemetry data being shipped to Microsoft. I'd be willing to bet that you could use Edge (with defaults) and see the URLs being sent to Microsoft but nothing would come from Brave, Firefox, Chrome etc.

Re: Microsoft Can Track Users via a Windows Device ID

#119

Post by mochapwns »

everdrive wrote: post #81
tremon wrote: post #15

Earlier quoted context omitted.

Both systemd and dbus have a similar device id for Linux, which e.g. Chrome reads at startup: https://manpages.debian.org/trixie/systemd/machine-id.5.en.h... https://manpages.debian.org/trixie/dbus-bin/dbus-uuidgen.1.e...

That's good to know, thank you. I'm been considering moving away from systemd, and certainly don't use Chrome. The number of things you need to try to keep track of merely _improve_ your privacy is maddening. The whole world seems to be against you.

Would OpenBSD solve both of these issues or is there a device ID in there that I’m not aware of.

I’ve seen that it uses a different init system and doesn’t rely on either dbus or systemd

Post reply on HN