61–70 of 106 posts
Earlier quoted context omitted.
This seems like something that should be easy to confirm, but I haven't seen anyone do it. Do they keep a database of every website visit all Edge users make?
The question you should be asking is: why would Microsoft not do this?
Earlier quoted context omitted.
But you don't have a service uploading it along with the URLs you visit, which is the creepy part. The ID itself can be useful for your own administration. And if such a service were to appear, it could easily be removed. Everything in Linux is optional, especially as long as you stick to open source.
How do we know? Does anyone check for things like this? Many, many apps read /etc/machine-id if you do a quick github search. Apps may have been silently correlating our activity for years without us knowing. We know DHCP, EFI, GNOME, popularity-contest and many other apps already use it. There are countless ways it could be used already that are hard to detect.
Whether everyone does that correctly, that's a different question. On the other hand, while developers should be more careful about how they use identifiers like this, if an application on your machine wants to track you they don't need /etc/machine-id.
> Microsoft provided the FBI with the history of IP addresses tied to that specific GDID. This article, and most articles about this, doesn't explain where FBI got that GDID from. Ok, Microsoft has a list of IP addresses that has been used by a computer with a certain GDID, but FBI needs to get the GDID in the first place, and then try to bind that to a person. I found another article that explains the process a bit…
> Microsoft has a list of IP addresses that has been used by a computer with a certain GDID, but FBI needs to get the GDID in the first place What they did was the opposite: ask Microsoft for GDIDs used by attacker-associated IPs within several 24-hour time periods during which attack-related activity took place. Windows pings Microsoft regularly with the GDID, establishing links between your GDID and any IP addresse…
Or just use Linux.
/etc/machine-id also exists
Indeed. One can regenerate it on each shutdown / reboot. The process is a little different depending on whether one has systemd or not. It's a dbus thing but systemd ingests it and there is a specific process around updating that in systemd.
There is also the NetworkID in Firefox about:networking#networkid
Another trackable piece of information on most systems is the creation time of / which just about any application can query unless it is properly isolated. This can be turned into a short unique hash. There are hacky ways to change the Birth time on unmounted filesystems using debugfs which may result in corruption. Some overlay filesystems do not support Birth time but that is not going to help most people unless the general populous expect all applications to be isolated in name spaces and overlay filesystems but this would have to be an expected pattern across all applications universally.
stat / | grep irth
Birth: 2023-04-17 20:27:01.000000000 +0000
stat / | grep irth | md5sum
8b5e849954373f8f3c2a625847e4e858Earlier quoted context omitted.
How do we know? Does anyone check for things like this? Many, many apps read /etc/machine-id if you do a quick github search. Apps may have been silently correlating our activity for years without us knowing. We know DHCP, EFI, GNOME, popularity-contest and many other apps already use it. There are countless ways it could be used already that are hard to detect.
It should be noted that the "correct" usage of /etc/machine-id is that you use it in a way that doesn't allow cross-correlation between different applications by using a HMAC of the machine-id with an application-specific UUID instead of using it directly. systemd-id128 has a command line flag to do this for you. Whether everyone does that correctly, that's a different question. On the other hand, while developers sh…
I think it's likely that Microsoft is running a process to correlate "new" GDIDs to old ones, ex: "Oh look, this one has almost all the serial numbers of components and attached-devices as that other one, it's probably the same computer with a fresh install, let's make a note of that..."
>Every finding here was reproduced on a real Windows 11 Pro VM (build 26200). Nothing is theoretical. See docs/technical-writeup.md for the evidence, tagged by confidence level. That's sounds nice and all, but everything about it, from "Nothing is theoretical" to "evidence, tagged by confidence level" goes out the window when you find claude as one of the commit authors, and the content is clearly copy pasted output…
Earlier quoted context omitted.
It should be noted that the "correct" usage of /etc/machine-id is that you use it in a way that doesn't allow cross-correlation between different applications by using a HMAC of the machine-id with an application-specific UUID instead of using it directly. systemd-id128 has a command line flag to do this for you. Whether everyone does that correctly, that's a different question. On the other hand, while developers sh…
Yes I think privacy and security on the desktop has fallen way behind mobile and we need much stronger protection these days.
You can most likely get better security than mobile's, you just need to e.g. learn to write your own SELinux policies, etc. Facilities are there; they just have a learning curve.
Earlier quoted context omitted.
And it’s easily altered.
It can still be correlated with past IDs by countless other methods in order to keep tracking you further.
Earlier quoted context omitted.
But you don't have a service uploading it along with the URLs you visit, which is the creepy part. The ID itself can be useful for your own administration. And if such a service were to appear, it could easily be removed. Everything in Linux is optional, especially as long as you stick to open source.
How do we know? Does anyone check for things like this? Many, many apps read /etc/machine-id if you do a quick github search. Apps may have been silently correlating our activity for years without us knowing. We know DHCP, EFI, GNOME, popularity-contest and many other apps already use it. There are countless ways it could be used already that are hard to detect.
It also helps that "Linux" isn't a monolith. One person's installation can be very different from another in terms of the software used. If one piece of software collects, that collection isn't as valuable as Microsoft's because the userbase is much smaller.
It's not perfect, but it's a hell of a lot better. A lot more resistant to abuse. Security in a lot of contexts tends to be relative like that. One's house isn't impenetrable; it's just better than another, in part because the neighborhood is better.