Microsoft Can Track Users via a Windows Device ID • Hacker News Board

Re: Microsoft Can Track Users via a Windows Device ID

#121

Post by Sophira » Tue, Jul 07, 2026, 4:41 PM UTC

nailer wrote: post #106

mysteria wrote: post #100

Earlier quoted context omitted.

From reading the official criminal complaint [1] it looks like Microsoft literally logs all web requests along with the GDID and sends it over as "telemetry". It basically associates the URL, the client's IP, and the GDID together. Or I suppose it's possible that it only sends the domain and not the full URL, but that's enough for the police to go to the hoster and demand logs containing the full URL for said IP. 1.…

> Microsoft literally logs all web requests Nope. That would be unbelievable but also very well known. It was a Windows software licensing matter, see my post above.

Can you link the specific post you're referring to? It's not "above" at this point in time.

Re: Microsoft Can Track Users via a Windows Device ID

#122

Post by nickphx » Tue, Jul 07, 2026, 4:46 PM UTC

dlenski wrote: post #114

lorislab wrote: post #74

The interesting part is not really the existence of a machine identifier. Almost every modern OS has some equivalent. The bigger question is the boundary: which components can access it, and when does a local identifier become a remote tracking identifier? A machine-id sitting on disk is very different from an OS vendor correlating it with network activity.

Yeah, this is what's glaringly missing from the article. Exactly how does Microsoft's device identifier get associated with the ngrok session (normally initiated via its closed-source CLI)? I can't tell from the article whether Microsoft is doing something underhanded to inject its device identifiers into network traffic, or whether the ngrok client software (again, closed-source!) grabbed the device identifier… and…

from the microsoft store. the ngrok app was downloaded via microsoft store...

Re: Microsoft Can Track Users via a Windows Device ID

#123

Post by materialpoint » Tue, Jul 07, 2026, 4:53 PM UTC

kevin_thibedeau wrote: post #94

materialpoint wrote: post #87

Earlier quoted context omitted.

Since you did not understand the point at all: There are regulations in place to force sites to "ask" for permissions to use cookies and track you. The point is that the regulations completely fail to force the sites to not blatantly lie, and wrap the "consent" with "we care".

No site is forced to implement cookie consent. They all have the option to only use strictly necessary cookies without notification.

That's just pedantic, because you know it is not the reality they choose. Most sites don't want to not track you. So they pretend they care about your privacy, and then proceed to collect and share data on you anyways.

Re: Microsoft Can Track Users via a Windows Device ID

#124

Post by midtake » Tue, Jul 07, 2026, 4:55 PM UTC

gruez wrote: post #92

reactordev wrote: post #32

Earlier quoted context omitted.

that's the idea behind SecureBoot and the TPM chip is to provide the GDID based on hardware fingerprint. Some games already do this as "anti-cheat" measurements (tracking you) and Microsoft has been doing it since Windows 7 days. It's just that the TPM now gives you that hardware authority.

>that's the idea behind SecureBoot and the TPM chip is to provide the GDID based on hardware fingerprint hard drive and motherboard serials have been around far longer than TPMs. Not to mention TPMs are far cheaper to replace than hard drives.

Poster might mean that the TPM gives you some degree of non-repudiation since the TPM can cryptographically sign stuff.

Re: Microsoft Can Track Users via a Windows Device ID

#125

Post by materialpoint » Tue, Jul 07, 2026, 4:56 PM UTC

bigbuppo wrote: post #120

And remember, most of this telemetry is just marketing/ad tech, so anyone that works in the martech/adtech space, you're also part of this.

The (not so) interesting part is how inefficient it is. Marketing by ads on the internet has less than 0.5% hit or click rate, and even then it is mostly accidental clicks due to the over-saturation of ads. It's not a real economy. It is just simply not actually worth it.

Re: Microsoft Can Track Users via a Windows Device ID

#126

Post by dlenski » Tue, Jul 07, 2026, 5:00 PM UTC

nickphx wrote: post #122

dlenski wrote: post #114

Earlier quoted context omitted.

Yeah, this is what's glaringly missing from the article. Exactly how does Microsoft's device identifier get associated with the ngrok session (normally initiated via its closed-source CLI)? I can't tell from the article whether Microsoft is doing something underhanded to inject its device identifiers into network traffic, or whether the ngrok client software (again, closed-source!) grabbed the device identifier… and…

from the microsoft store. the ngrok app was downloaded via microsoft store...

And then what?

Does the Microsoft store imprint an identifier into the network traffic of all the binaries downloaded from it?

And if so, how?

All of ngrok's traffic is TLS encrypted which means that only the client software and the server/peer should be able to decrypt or modify it.

Re: Microsoft Can Track Users via a Windows Device ID

#127

Post by drnick1 » Tue, Jul 07, 2026, 5:10 PM UTC

J-Kuhn wrote: post #109

lorislab wrote: post #74

The interesting part is not really the existence of a machine identifier. Almost every modern OS has some equivalent. The bigger question is the boundary: which components can access it, and when does a local identifier become a remote tracking identifier? A machine-id sitting on disk is very different from an OS vendor correlating it with network activity.

Systemd (part of many major linux distributions) has for example machine-id[1], readable by anyone on the machine under /etc/machine-id. [1]: https://www.freedesktop.org/software/systemd/man/latest/mach...

Unlike the Microsoft equivalent (?), nothing prevents you from scrambling it or outright chmodding to 700 to protect it from prying eyes.

I go further and bubblewrap software that I don't fully trust like Steam on my gaming machine. I simply don't expose /etc at all in most cases. The Linux security model is actually quite weak against potentially invasive software running in a main user account. For example /home is also completely exposed to programs such as games and anti-cheat software.

Re: Microsoft Can Track Users via a Windows Device ID

#128

Post by srichard16 » Tue, Jul 07, 2026, 5:15 PM UTC

dlenski wrote: post #114

lorislab wrote: post #74

The interesting part is not really the existence of a machine identifier. Almost every modern OS has some equivalent. The bigger question is the boundary: which components can access it, and when does a local identifier become a remote tracking identifier? A machine-id sitting on disk is very different from an OS vendor correlating it with network activity.

Yeah, this is what's glaringly missing from the article. Exactly how does Microsoft's device identifier get associated with the ngrok session (normally initiated via its closed-source CLI)? I can't tell from the article whether Microsoft is doing something underhanded to inject its device identifiers into network traffic, or whether the ngrok client software (again, closed-source!) grabbed the device identifier… and…

I work at ngrok, and this is not how our freemium plan works. Free plans limit based on usage alone, not on machine IDs.

Re: Microsoft Can Track Users via a Windows Device ID

#129

Post by bigbuppo » Tue, Jul 07, 2026, 5:27 PM UTC

materialpoint wrote: post #125

bigbuppo wrote: post #120

And remember, most of this telemetry is just marketing/ad tech, so anyone that works in the martech/adtech space, you're also part of this.

The (not so) interesting part is how inefficient it is. Marketing by ads on the internet has less than 0.5% hit or click rate, and even then it is mostly accidental clicks due to the over-saturation of ads. It's not a real economy. It is just simply not actually worth it.

And yet stupid amounts of money are spent collecting detailed dossiers on every person that touches the internet so that... I'm guessing someone's probably trying to sell mattresses or something... because that's always that weird last question in every marketing/advertising survey I've ever seen... do you plan on buying a mattress within the next six months?

Re: Microsoft Can Track Users via a Windows Device ID

#130

Post by close04 » Tue, Jul 07, 2026, 5:27 PM UTC

ygjb wrote: post #104

close04 wrote: post #78

Earlier quoted context omitted.

> Unless anonymization is provided by your browser, there is nothing you can do to prevent such identification technology The OS could treat certain apps as untrusted and spoof or limit the access to these unique identifiers.

That puts the OS in the position of attempting to profile or determine if an application is accessing OS, hardware, and user details to build a fingerprint, vs using those capabilities to do something the user intends, which puts the OS developer into a performance sucking, soul sucking arms race against big and little brother surveillance/advertising platforms. I absolutely support the intention, just know that it's…

The OS already does this for a living. A set of identifiers requested sporadically by an app can’t be what breaks its back. Isn’t iOS already doing something similar?