Microsoft confirms Windows GDID device identifier that cannot be disabled • Hacker News Board

Re: Microsoft confirms Windows GDID device identifier that cannot be disabled

#51

Post by crtasm » Wed, Jul 15, 2026, 11:04 PM UTC

1970-01-01 wrote: post #42

ranger_danger wrote: post #22

Earlier quoted context omitted.

The article is misleading... the GDID is created even if you don't use a Microsoft account.

Sources state the opposite. It is driven my the MS account. https://www.windowslatest.com/2026/07/10/you-cant-fully-disa...

>A Global Device ID (GDID) is a permanent, unique digital fingerprint that Microsoft automatically assigns to your computer when you install Windows or sign into a Microsoft account.

Note the "or"

I own a Windows 10 machine which has never signed into a Microsoft account. It still has a GDID in the registry.

Re: Microsoft confirms Windows GDID device identifier that cannot be disabled

#52

Post by crtasm » Wed, Jul 15, 2026, 11:08 PM UTC

kmoser wrote: post #43

ChrisArchitect wrote: post #30

Discussions: Microsoft admits Windows 11 has a GDID tracker with no off switch https://news.ycombinator.com/item?id=48872561 Full Writeup of the Windows GDID https://news.ycombinator.com/item?id=48811081 Microsoft Can Track Users via a Windows Device ID https://news.ycombinator.com/item?id=48815196

Yet another reason for Windows 10 users to not upgrade.

Windows 10 also features the GDID, telemetry and Edge history syncing.

Re: Microsoft confirms Windows GDID device identifier that cannot be disabled

#53

Post by orev » Wed, Jul 15, 2026, 11:52 PM UTC

They say this is also sent with Windows Update checks, which happen frequently per day, and I think also when you initially connect to a network, so that’s a clear way they could tie the ID back to any IP address you’re using.

Re: Microsoft confirms Windows GDID device identifier that cannot be disabled

#54

Post by Terr_ » Thu, Jul 16, 2026, 12:52 AM UTC

WalterGR wrote: post #5

How does the GDID compare to the UDID (Unique Device Identifier) and serial number in iOS; and the Apple Hardware UUID and serial number of Macs?

On the subject of serial numbers, the ones for your hardware and peripherals are also being transmitted as "telemetry", which gives them even more options to spying on you, ex:

1. If your printer has tracking dots [0] then a printed flyer can be tracked back to your computer, IP, and MS/Apple account.

2. If a device is reported on two computers, MS/Apple know there is some kind of connection between the computers.

[0] https://www.eff.org/pages/list-printers-which-do-or-do-not-d...

Re: Microsoft confirms Windows GDID device identifier that cannot be disabled

#55

Post by wolvoleo » Thu, Jul 16, 2026, 2:30 AM UTC

ranger_danger wrote: post #23

drnick1 wrote: post #14

One more proof that Windows is malware.

Linux has the same kind of identifier at /etc/machine-id... readable by default by basically any application on the system.

You'd still need to have your system compromised by a malicious app to be tracked using that.

On windows, it does that all by itself, Microsoft tracks you with it. Because windows is the malicious app just like the GP said.

Re: Microsoft confirms Windows GDID device identifier that cannot be disabled

#56

Post by 1970-01-01 » Thu, Jul 16, 2026, 1:49 PM UTC

crtasm wrote: post #51

1970-01-01 wrote: post #42

Earlier quoted context omitted.

Sources state the opposite. It is driven my the MS account. https://www.windowslatest.com/2026/07/10/you-cant-fully-disa...

>A Global Device ID (GDID) is a permanent, unique digital fingerprint that Microsoft automatically assigns to your computer when you install Windows or sign into a Microsoft account. Note the "or" I own a Windows 10 machine which has never signed into a Microsoft account. It still has a GDID in the registry.

What's your point? There are thousands of GUIDs in the registry.

Re: Microsoft confirms Windows GDID device identifier that cannot be disabled

#57

Post by dormento » Thu, Jul 16, 2026, 1:58 PM UTC

hughw wrote: post #39

User nashashmi [1]: So this kid uses his home computer at his home, and they trace him down with the IP address, and the IP address also makes a request for Windows Updates. And that narrows down the Device ID. The device id is now traced to this kid. That seems more likely, I hope, than Edge/Windows secretly telemetering your GDID and every URL you visit to Redmond. It's a huge privacy hole still, but they can plaus…

> they can plausibly deny they set out to track you across the web using their OS

Only the first time this happens, before it becomes clear to everyone that such mechanism can be used for tracking. After that... well I have this bridge I've been meaning to sell.

Re: Microsoft confirms Windows GDID device identifier that cannot be disabled

#58

Post by ranger_danger » Sat, Jul 18, 2026, 4:36 PM UTC

gruez wrote: post #35

ranger_danger wrote: post #31

Earlier quoted context omitted.

https://github.com/gd03gd031/Windows-GDID-Changer > well documented and trivially rotatable Yes, but almost nobody does that or complains about it at all, even though applications may have been silently phoning it home for many years now.

> https://github.com/gd03gd031/Windows-GDID-Changer sounds like you can rotate it, but it doesn't really matter because the registration/rotation process sends a bunch of static information to microsoft, which means they can re-correlate the the old id back to the new id.

Surely the sending of the GDID to MS can be blocked?

Re: Microsoft confirms Windows GDID device identifier that cannot be disabled

#59

Post by ranger_danger » Sat, Jul 18, 2026, 5:13 PM UTC

drnick1 wrote: post #37

ranger_danger wrote: post #23

Earlier quoted context omitted.

Linux has the same kind of identifier at /etc/machine-id... readable by default by basically any application on the system.

This is a systemd identifier, not strictly speaking a "Linux" identifier. In any case, an executable allowed to run on a host can trivially fingerprint the machine it is running on using a combination of hardware identifiers. Removing or rotating machine-id does not buy you any privacy against a malicious app. What I find most surprising in this story is how careless these "hackers" were. You would think that people…

> Removing or rotating machine-id does not buy you any privacy against a malicious app.

It absolutely can if that's the only identifier an app is looking at.

> You would think that people engaged in this type of activities would use throwaway devices running free operating systems and VMs, not personal devices logged into Snapchat and Facebook.

Well, the smart ones do that, which is why they don't make the news as they don't get caught.

Re: Microsoft confirms Windows GDID device identifier that cannot be disabled

#60

Post by ranger_danger » Sat, Jul 18, 2026, 5:14 PM UTC

1970-01-01 wrote: post #56

crtasm wrote: post #51

Earlier quoted context omitted.

>A Global Device ID (GDID) is a permanent, unique digital fingerprint that Microsoft automatically assigns to your computer when you install Windows or sign into a Microsoft account. Note the "or" I own a Windows 10 machine which has never signed into a Microsoft account. It still has a GDID in the registry.

What's your point? There are thousands of GUIDs in the registry.

GUID != GDID