Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Can Track Users via a Windows Device ID

pcmag.com

Post reply on HN
Print view View original

131–140 of 170 posts

Re: Microsoft Can Track Users via a Windows Device ID

#131

Post by felooboolooomba »

J-Kuhn wrote: post #109
lorislab wrote: post #74

The interesting part is not really the existence of a machine identifier. Almost every modern OS has some equivalent. The bigger question is the boundary: which components can access it, and when does a local identifier become a remote tracking identifier? A machine-id sitting on disk is very different from an OS vendor correlating it with network activity.

Systemd (part of many major linux distributions) has for example machine-id[1], readable by anyone on the machine under /etc/machine-id. [1]: https://www.freedesktop.org/software/systemd/man/latest/mach...

Yep, and firefox ships it to it's servers.

Re: Microsoft Can Track Users via a Windows Device ID

#132

Post by felooboolooomba »

srichard16 wrote: post #128
dlenski wrote: post #114

Earlier quoted context omitted.

Yeah, this is what's glaringly missing from the article. Exactly how does Microsoft's device identifier get associated with the ngrok session (normally initiated via its closed-source CLI)? I can't tell from the article whether Microsoft is doing something underhanded to inject its device identifiers into network traffic, or whether the ngrok client software (again, closed-source!) grabbed the device identifier… and…

I work at ngrok, and this is not how our freemium plan works. Free plans limit based on usage alone, not on machine IDs.

I think the defendant might want to see this. Looks like an expert witness lied in court.

Re: Microsoft Can Track Users via a Windows Device ID

#133

Post by Terr_ »

pogue wrote: post #9
Terr_ wrote: post #4

Earlier quoted context omitted.

I would be shocked if Microsoft was not using their own layer of certificate-pinning to stop people from doing that, and/or using another layer of encryption separate from the networking layer.

Only way to see what's going on is testing to see what's going on. Hopefully, someone who knows more about it than me can take a look at the packets and see what they contain.

I found this talk [0] and some of the slides suggest that Windows is, at least in some circumstances, packaging web-browsing data into telemetry.

To lift examples from the slides, that includes page titles:

    "CorrelationGuid": "7da62b73-082f-4eb2-a370-135d0113e1dd",
    "EventInfo.Level": 2,
    "PageTitle": "SiSyPHuS AFUNKT - Search",
    "TabId": 830425073,
    "client_id": -7497793556371901000,
    "pop_sample": 100,
    "utc_flags": 140737488355328
The transitions between pages:

    "IsSameDocumentNavigation": 0,
    "client_id": -7497793556371901000,
    "navigationUrl": "https://www.bsi.bund.de/DE/Service-
    Navi/Publikationen/Studien/SiSyPHuS_Win10/AFUNKT/SiSyPHuS_AFUNKT_node.html",
    "referUrl": "https://www.bing.com/",
    "HttpStatusCode": 200,
And even which link you clicked in the page:

    "DOMElementPath": "A|1||c-link%20c-link--download%20FTpdf;P|5[…]gsb%20lang-de%20fixed%20js-on;HTML|1||",
    "DOMAnchorHrefUrl": "https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Cyber-Sicherheit/SiSyPHus/AFUNKT.pdf?__blob=publicationFile&v=6",
[0] https://troopers.de/troopers23/talks/bsabut/

Re: Microsoft Can Track Users via a Windows Device ID

#134

Post by dlenski »

srichard16 wrote: post #128
dlenski wrote: post #114

Earlier quoted context omitted.

Yeah, this is what's glaringly missing from the article. Exactly how does Microsoft's device identifier get associated with the ngrok session (normally initiated via its closed-source CLI)? I can't tell from the article whether Microsoft is doing something underhanded to inject its device identifiers into network traffic, or whether the ngrok client software (again, closed-source!) grabbed the device identifier… and…

I work at ngrok, and this is not how our freemium plan works. Free plans limit based on usage alone, not on machine IDs.

> I work at ngrok, and this is not how our freemium plan works. Free plans limit based on usage alone, not on machine IDs.

Thank you! This is not only good to know as an ngrok user myself, but it's also more informative than what's in the article.

Sounds like we can rule that out as the avenue of detection.

Re: Microsoft Can Track Users via a Windows Device ID

#135

Post by ankit_mishra »

dlenski wrote: post #126
nickphx wrote: post #122

Earlier quoted context omitted.

from the microsoft store. the ngrok app was downloaded via microsoft store...

And then what? Does the Microsoft store imprint an identifier into the network traffic of all the binaries downloaded from it? And if so, how? All of ngrok's traffic is TLS encrypted which means that only the client software and the server/peer should be able to decrypt or modify it.

They don't need the encrypted payload just domain is the basis here as far as I can tell.

Re: Microsoft Can Track Users via a Windows Device ID

#136

Post by floralhangnail »

heikkilevanto wrote: post #19
tremon wrote: post #15

Earlier quoted context omitted.

Both systemd and dbus have a similar device id for Linux, which e.g. Chrome reads at startup: https://manpages.debian.org/trixie/systemd/machine-id.5.en.h... https://manpages.debian.org/trixie/dbus-bin/dbus-uuidgen.1.e...

I don't like the idea of a persistent id for my machine. Would there be any harm in rewriting the machine-id at every boot? Or just deleting it as part of the shutdown sequence?

I do it with an hourly cronjob and haven't noticed any ill effects.

Re: Microsoft Can Track Users via a Windows Device ID

#137

Post by nostrademons »

drdexebtjl wrote: post #91
everdrive wrote: post #81

Earlier quoted context omitted.

That's good to know, thank you. I'm been considering moving away from systemd, and certainly don't use Chrome. The number of things you need to try to keep track of merely _improve_ your privacy is maddening. The whole world seems to be against you.

D-Bus is much harder to get rid of than systemd. It’s best to focus your efforts into rotating these IDs.

Not using Chrome is a better bet for privacy than not using systemd or D-Bus. If you sign into Chrome (which by default happens any time you sign into a Google product), your entire browsing history is logged on Google's servers, and tied to your email address, Android ID, and any other machine identifiers Chrome can read.

Anyone serious about privacy is using Firefox or Tor Browser, with various settings to harden it against tracking.

Re: Microsoft Can Track Users via a Windows Device ID

#138

Post by nostrademons »

nailer wrote: post #106
mysteria wrote: post #100

Earlier quoted context omitted.

From reading the official criminal complaint [1] it looks like Microsoft literally logs all web requests along with the GDID and sends it over as "telemetry". It basically associates the URL, the client's IP, and the GDID together. Or I suppose it's possible that it only sends the domain and not the full URL, but that's enough for the police to go to the hoster and demand logs containing the full URL for said IP. 1.…

> Microsoft literally logs all web requests Nope. That would be unbelievable but also very well known. It was a Windows software licensing matter, see my post above.

It's not unbelievable at all, and it is well-known. It's been publicized that Microsoft sends every URL you visit in Edge back to Microsoft servers, tied with all the IDs on the device:

https://www.itpro.com/security/privacy/355029/microsoft-edge...

Re: Microsoft Can Track Users via a Windows Device ID

#139

Post by srichard16 »

dlenski wrote: post #134
srichard16 wrote: post #128

Earlier quoted context omitted.

I work at ngrok, and this is not how our freemium plan works. Free plans limit based on usage alone, not on machine IDs.

> I work at ngrok, and this is not how our freemium plan works. Free plans limit based on usage alone, not on machine IDs. Thank you! This is not only good to know as an ngrok user myself, but it's also more informative than what's in the article. Sounds like we can rule that out as the avenue of detection.

For what its worth, this has been swiriling around on socials and i saw someone noted that the guy had been busted for something at age 17, maybe he was on some list?

Re: Microsoft Can Track Users via a Windows Device ID

#140

Post by drnick1 »

cheschire wrote: post #12

Well they can’t use that to track users of Linux. I was a big fan of Microsoft ten to fifteen years ago. I’ve since transitioned my whole family off Microsoft products now over to Linux, Apple, and proton. Edit: and Brave. I really thought their corporate culture would’ve changed after the late 90’s but I guess this is a good lesson for founders. The culture you build into your company will likely outlast your tenure…

> Edit: and Brave.

I would suggest staying away from Brave. I recently compiled the debloated Brave edition from source and was rather disappointed. Brave was slower on my machine than Firefox and Chromium according to Speedometer 3.1. The built-in adblocker does a worse job at cosmetic filtering than uBlock Origin on Firefox. On top of that, I had to build the browser from source because the only binaries I could find are Brave's own. Their builds aren't reproducible, and no Linux distro packages their own.

If you think I am being paranoid, you may also want to take a look at this:

https://www.pcmag.com/news/brave-browser-caught-redirecting-...

Post reply on HN