the criminal complaint: https://www.justice.gov/usao-ndil/media/1450651/dl?inline
page 18 answers many of the questions in this thread.
Microsoft confirms Windows GDID device identifier that cannot be disabled
41–50 of 64 posts
Re: Microsoft confirms Windows GDID device identifier that cannot be disabled
#42>The Global Device Identifier (GDID) is a permanent ID assigned when Windows provisions against a Microsoft Account. So again, the "make an account" is the part you ALWAYS skip. Local accounts or it technically isn't even a PC anymore.
The article is misleading... the GDID is created even if you don't use a Microsoft account.
Sources state the opposite. It is driven my the MS account.
https://www.windowslatest.com/2026/07/10/you-cant-fully-disa...
Re: Microsoft confirms Windows GDID device identifier that cannot be disabled
#43Discussions: Microsoft admits Windows 11 has a GDID tracker with no off switch https://news.ycombinator.com/item?id=48872561 Full Writeup of the Windows GDID https://news.ycombinator.com/item?id=48811081 Microsoft Can Track Users via a Windows Device ID https://news.ycombinator.com/item?id=48815196
Yet another reason for Windows 10 users to not upgrade.
Re: Microsoft confirms Windows GDID device identifier that cannot be disabled
#44i wont even dual boot windows on my linux machine, dont trust them not to vacuum up my linux drive data when i boot into windows. also just recently discovered their attempt to hijack the entire pc industry with secure boot, they are consistent gotta give them that. why do i have microsoft keys installed on my motherboard when im not even using windows.
> dont trust them not to vacuum up my linux drive data when i boot into windows.
LUKS
Re: Microsoft confirms Windows GDID device identifier that cannot be disabled
#45Earlier quoted context omitted.
Edge has less browser market share than Firefox right now, it's not the "vast majority."
I don’t believe that, there’s probably some missing data. Outside the techno echo chamber that HNers live in, most people use the defaults. I see people using adware browsers that were installed without their knowledge. Computers are just too complex for most people to notice details like what web browser they use.
Until they inevitable use Google, and it shows a big popup saying something like "Hey there you should use Chrome its way better and faster, click this button to get it" and then they end up with Chrome. Its basically how Chrome got such a large share of the market despite default browsers like Safari and IE/Edge.
Re: Microsoft confirms Windows GDID device identifier that cannot be disabled
#46User nashashmi [1]: So this kid uses his home computer at his home, and they trace him down with the IP address, and the IP address also makes a request for Windows Updates. And that narrows down the Device ID. The device id is now traced to this kid. That seems more likely, I hope, than Edge/Windows secretly telemetering your GDID and every URL you visit to Redmond. It's a huge privacy hole still, but they can plaus…
That could be how they initially associated the hacker with his GDID, but the criminal filing explicitly mentions that they were able to use Microsoft records to determine that his computer visited specific webpages:
> According to Microsoft records, on or about May 12, 2025, at 19:21 UTC—when, according to ngrok records, the ngrok account was created—the device with the GDID accessed, among other ngrok pages, “https://dashboard.ngrok.com/signup,” the ngrok page to set up an ngrok account.
> Microsoft records also indicate: (1) the user of the device assigned the GDID accessed multiple sites from Tzulo servers in May 2025, including the .168 server (the IP address used to create the ngrok account) on May 12, 2025; and (2) the user of the device assigned the GDID, on May 12, 2025 at 22:47 UTC, a little more than three hours after the ngrok account was created, the user visited “[Company F].com” from the .168 proxy server.
Re: Microsoft confirms Windows GDID device identifier that cannot be disabled
#47Earlier quoted context omitted.
Edge has a feature where it will periodically pull the bookmarks and browsing history from any other browsers you have installed, so they'll then get sent to Microsoft and associated with your Microsoft account. This was initially enabled by default without the user's consent, although I believe now you may have to opt into it if you do a fresh Windows install. I only realized this was a thing because one time my wor…
> so they'll then get sent to Microsoft and associated with your Microsoft account. The import is entirely local, the "sent to Microsoft" bit is if you have Edge sync enabled. This is identical to Chrome importing your Firefox data and then syncing it back to Google. Except the Edge import was, by reports at the time, accidentally auto-enabled. But you'd still have to sign into Edge and enable sync.
It's been a while since I last used Windows 11, but as far as I'm aware using a Microsoft account will automatically sign you into Edge and Edge sync is enabled by default unless you go into the settings and disable it.
Re: Microsoft confirms Windows GDID device identifier that cannot be disabled
#48Earlier quoted context omitted.
> so they'll then get sent to Microsoft and associated with your Microsoft account. The import is entirely local, the "sent to Microsoft" bit is if you have Edge sync enabled. This is identical to Chrome importing your Firefox data and then syncing it back to Google. Except the Edge import was, by reports at the time, accidentally auto-enabled. But you'd still have to sign into Edge and enable sync.
It's been a while since I last used Windows 11, but as far as I'm aware using a Microsoft account will automatically sign you into Edge and Edge sync is enabled by default unless you go into the settings and disable it.
I think it defaults to showing the account in Edge but enabling sync still requires a button click. I'll see if I can verify this with a spare PC somewhere.
Re: Microsoft confirms Windows GDID device identifier that cannot be disabled
#49Earlier quoted context omitted.
I don’t believe that, there’s probably some missing data. Outside the techno echo chamber that HNers live in, most people use the defaults. I see people using adware browsers that were installed without their knowledge. Computers are just too complex for most people to notice details like what web browser they use.
Until they inevitable use Google, and it shows a big popup saying something like "Hey there you should use Chrome its way better and faster, click this button to get it" and then they end up with Chrome. Its basically how Chrome got such a large share of the market despite default browsers like Safari and IE/Edge.
Didn't Chrome also come bundled with other software like torrent clients? That is, unless you unchecked a checkbox in the installer for these software, you ended up with Chrome installed? Unless people were careful to pay attention to every checkbox on every installer, Chrome could end up installed without their knowledge.
Re: Microsoft confirms Windows GDID device identifier that cannot be disabled
#50Earlier quoted context omitted.
They don't care, I would say they don't know. I saw an article where they analyzed the leaked IP addresses from a breach forum, and some of the top ten were Surfshark and iCloud Private relay.
>and some of the top ten were Surfshark and iCloud Private relay. what's wrong with icloud private relay? It uses a 2-hop architecture so it's probably more private than any single-hop VPN.
It's good, but it's funny to think about cybercriminals running Safari and an iCloud+ Apple account.