Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Can Track Users via a Windows Device ID

pcmag.com

Post reply on HN
Print view View original

141–150 of 170 posts

Re: Microsoft Can Track Users via a Windows Device ID

#141

Post by llm_nerd »

mysteria wrote: post #100
llm_nerd wrote: post #97

Earlier quoted context omitted.

This is the part that isn't clear and is by far the most interesting. At what stage and what point did the GDID get correlated with a tool/web request. As is it almost sounds like Microsoft "telemetry" gathers everything and they did a bulk search for certain activity, pulling the GDID and correlating it with a user.

From reading the official criminal complaint [1] it looks like Microsoft literally logs all web requests along with the GDID and sends it over as "telemetry". It basically associates the URL, the client's IP, and the GDID together. Or I suppose it's possible that it only sends the domain and not the full URL, but that's enough for the police to go to the hoster and demand logs containing the full URL for said IP. 1.…

Clearly a bunch of defensive Microsoft employees are hitting these threads. The official complaint directly cites Microsoft as the source of these logs. They refer to Microsoft as the source of the records for web requests, app usage, and so on.

Re: Microsoft Can Track Users via a Windows Device ID

#142

Post by zaptheimpaler »

I'm probably going to called a lunatic but I'm convinced this kind of telemetry is somehow linked to and behind the huge coordinated advertising push for VPNs in the last few years. More and more, the "invisible hand of the market" seems like literally the hands of a few very large conglomerations of power and capital that shape the economics of the entire market to effectively control it - they shape the gradient and make sure companies optimize loss. VPNs are either directly spyware that increases tracking capability, or are being offered now because they don't need your IP to track you anymore so they might as well make money off your fears while still tracking you. More broadly, I don't see much of a free market or democracy left anymore, now every government is doing a coordinated push to eliminate privacy as well.

Re: Microsoft Can Track Users via a Windows Device ID

#143

Post by specproc »

dlenski wrote: post #114
lorislab wrote: post #74

The interesting part is not really the existence of a machine identifier. Almost every modern OS has some equivalent. The bigger question is the boundary: which components can access it, and when does a local identifier become a remote tracking identifier? A machine-id sitting on disk is very different from an OS vendor correlating it with network activity.

Yeah, this is what's glaringly missing from the article. Exactly how does Microsoft's device identifier get associated with the ngrok session (normally initiated via its closed-source CLI)? I can't tell from the article whether Microsoft is doing something underhanded to inject its device identifiers into network traffic, or whether the ngrok client software (again, closed-source!) grabbed the device identifier… and…

I'm not even clear if it requires Windows. Say if one had a Surface running Arch, would that still be traceable?

Asking for a friend.

Re: Microsoft Can Track Users via a Windows Device ID

#144

Post by crtasm »

x______________ wrote: post #45
xnx wrote: post #21

Vague article. No evidence that Microsoft can see what web pages you are visiting in Chrome or Firefox (for example).

From the reply you're replying to: > 27. Microsoft records also indicate: a little more than three hours after the ngrok account was created, the user visited “[Company F].com” from the .168 proxy server.

This tells us nothing about whether non-Microsoft browsers are involved

Re: Microsoft Can Track Users via a Windows Device ID

#145

Post by mysteria »

nailer wrote: post #106
mysteria wrote: post #100

Earlier quoted context omitted.

From reading the official criminal complaint [1] it looks like Microsoft literally logs all web requests along with the GDID and sends it over as "telemetry". It basically associates the URL, the client's IP, and the GDID together. Or I suppose it's possible that it only sends the domain and not the full URL, but that's enough for the police to go to the hoster and demand logs containing the full URL for said IP. 1.…

> Microsoft literally logs all web requests Nope. That would be unbelievable but also very well known. It was a Windows software licensing matter, see my post above.

Are you talking about this post [1]? I don't see anything in the complaint alluding to a VPN license (for all we know he could have used an open source OpenVPN or Wireguard client to connect to the VPN), and the police seem to have gotten everything directly from Microsoft rather than from the VPN provider.

While this is Google and not Microsoft it's worth noting that Chrome literally has a telemetry option which sends URLs to Google [2].

1. https://news.ycombinator.com/item?id=48818984

2. https://ibb.co/k61WKSSB

Re: Microsoft Can Track Users via a Windows Device ID

#146

Post by zbentley »

mochapwns wrote: post #119
everdrive wrote: post #81

Earlier quoted context omitted.

That's good to know, thank you. I'm been considering moving away from systemd, and certainly don't use Chrome. The number of things you need to try to keep track of merely _improve_ your privacy is maddening. The whole world seems to be against you.

Would OpenBSD solve both of these issues or is there a device ID in there that I’m not aware of. I’ve seen that it uses a different init system and doesn’t rely on either dbus or systemd

OpenBSD’s equivalent is the hw.uuid sysctl: https://man.openbsd.org/sysctl.2#HW_UUID~2

Other BSDs don’t have that, but have equivalent PCI tree identifiers. “hostid”, too, is found on many systems but is much less unique as it’s often a function of local network address.

Re: Microsoft Can Track Users via a Windows Device ID

#147

Post by 9029 »

heikkilevanto wrote: post #19
tremon wrote: post #15

Earlier quoted context omitted.

Both systemd and dbus have a similar device id for Linux, which e.g. Chrome reads at startup: https://manpages.debian.org/trixie/systemd/machine-id.5.en.h... https://manpages.debian.org/trixie/dbus-bin/dbus-uuidgen.1.e...

I don't like the idea of a persistent id for my machine. Would there be any harm in rewriting the machine-id at every boot? Or just deleting it as part of the shutdown sequence?

You can replace it with a generic one to hopefully blend in https://madaidans-insecurities.github.io/guides/linux-harden...

Re: Microsoft Can Track Users via a Windows Device ID

#148

Post by RandyOrion »

The criminal complaint missing in this article: https://www.justice.gov/usao-ndil/media/1450651/dl

Basically, Microsoft logs things from windows users, including and not limiting to, the machine GDID, IPs that come with the GDID, and when and what exact URLs accessed. So for windows users, privacy, an important part of information security, is totally destroyed by these logs enforced on windows. Another important part of information security is bug fixing, and microsoft did make at least one security researcher angry [1].

And a simple solution to that problem is moving to linux. You save yourself a lot of time and energy for leaving the adversarial information security condition imposed by windows and microsoft.

P.S. You may consider debloating windows for a more information security friendly environment. However, that is nearly impossible, as long as you realize that windows is an OS composed of thousands of closed source softwares, and doing security audits on all of these will be costly.

[1] https://news.ycombinator.com/item?id=48315968

Post reply on HN