Stopped using Windows in Windows 7 era, never regretted.
GDID Windows – Cut the tracker that follows you even under VPN
71–80 of 106 posts
Re: GDID Windows – Cut the tracker that follows you even under VPN
#72Earlier quoted context omitted.
They didn’t. They went to ngrok and asked for all the data at the point of signup. They then looked to find the any of that data at the second site. In this case they had two identical data points - the GDID and the IP address.
What do you mean? The FBI could know that this VPN ip visited ngrok and then the retailer website, but how would it know that that ip was associated with the specific GDID unless microsoft was tracking (timestamp,website,gdid) tuples?
Probably Windows constantly pings the MS server and they record those tuples.
Re: GDID Windows – Cut the tracker that follows you even under VPN
#73I think it's likely that Microsoft is running a process to correlate "new" GDIDs to old ones, ex: "Oh look, this one has almost all the serial numbers of components and attached-devices as that other one, it's probably the same computer with a fresh install, let's make a note of that..."
They do not need this, they require you to create a Microsoft account to use your own computer (currently without a phone number, passport and selfie but that will probably change in the future).
Re: GDID Windows – Cut the tracker that follows you even under VPN
#74Earlier quoted context omitted.
Yes I think privacy and security on the desktop has fallen way behind mobile and we need much stronger protection these days.
Mobile's came at the cost of composability between programs and the imposition of policy, which are against the Unix Philosophy. I wouldn't make that trade. Mobile's a sad state of affairs, inferior to desktop in many ways. You can most likely get better security than mobile's, you just need to e.g. learn to write your own SELinux policies, etc. Facilities are there; they just have a learning curve.
How do you write SELinux policies to allow reading only certain files in /proc, where process IDs are not known ahead? I ended up writing my own FUSE-based /proc emulation. The facilities are there, but it feels like writing your own OS.
Re: GDID Windows – Cut the tracker that follows you even under VPN
#75I have a sneaking suspicion that that ID can be deleted either with a specific service not running or with Windows powered off.
I won't be surprised if MS patches workarounds quickly and won't shed a word on the whole situation. Or worse, pulls the "this helps fighting evil hackers" reasoning.
Re: GDID Windows – Cut the tracker that follows you even under VPN
#76Earlier quoted context omitted.
Mobile's came at the cost of composability between programs and the imposition of policy, which are against the Unix Philosophy. I wouldn't make that trade. Mobile's a sad state of affairs, inferior to desktop in many ways. You can most likely get better security than mobile's, you just need to e.g. learn to write your own SELinux policies, etc. Facilities are there; they just have a learning curve.
How do you write SELinux policies to allow reading only certain files in /proc, where process IDs are not known ahead? I ended up writing my own FUSE-based /proc emulation. The facilities are there, but it feels like writing your own OS.
What kind of use-case do you have for that? I suppose whatever it is, you could also e.g. write a privileged service that checks those files with whatever security policy you need. Your client wouldn't have direct access to /proc.
Another option may be to set up a container or PID namespace and give your tool direct access to that /proc.
Regarding SELinux, looking at https://unix.stackexchange.com/questions/767564/selinux-deni...
> the entries under /proc// are running under the respective pid's domain
It also seems doable, since you can differentiate which PID directory belongs to what by the domain.
Re: GDID Windows – Cut the tracker that follows you even under VPN
#77Earlier quoted context omitted.
It should be noted that the "correct" usage of /etc/machine-id is that you use it in a way that doesn't allow cross-correlation between different applications by using a HMAC of the machine-id with an application-specific UUID instead of using it directly. systemd-id128 has a command line flag to do this for you. Whether everyone does that correctly, that's a different question. On the other hand, while developers sh…
Yes I think privacy and security on the desktop has fallen way behind mobile and we need much stronger protection these days.
Mobile has no privacy, devs slap in any old SDK that promises them money. Way worse than desktop. Spyware is the basis for mobile apps.
Re: GDID Windows – Cut the tracker that follows you even under VPN
#78I think it's likely that Microsoft is running a process to correlate "new" GDIDs to old ones, ex: "Oh look, this one has almost all the serial numbers of components and attached-devices as that other one, it's probably the same computer with a fresh install, let's make a note of that..."
But I've got nothing to hide
(Aware/assuming you're being sarcastic.) I've always felt that statement reveals a serious lack of imagination, or at least a failure to apply it to the question.
Re: GDID Windows – Cut the tracker that follows you even under VPN
#79> Microsoft provided the FBI with the history of IP addresses tied to that specific GDID. This article, and most articles about this, doesn't explain where FBI got that GDID from. Ok, Microsoft has a list of IP addresses that has been used by a computer with a certain GDID, but FBI needs to get the GDID in the first place, and then try to bind that to a person. I found another article that explains the process a bit…
Thanks, I've added that link to the toptext above.
Edit: actually there have been a few threads about this - the link you mentioned was submitted in the second of these:
Microsoft confirms Windows GDID device identifier that cannot be disabled - https://news.ycombinator.com/item?id=48920338 - July 2026 (60 comments)
Microsoft admits Windows 11 has a GDID tracker with no off switch - https://news.ycombinator.com/item?id=48872561 - July 2026 (15 comments)
Windows GDID Changer - https://news.ycombinator.com/item?id=48818707 - July 2026 (4 comments)
Full Writeup of the Windows GDID - https://news.ycombinator.com/item?id=48811081 - July 2026 (49 comments)
Microsoft GDID telemetry includes full browsing and gaming history - https://news.ycombinator.com/item?id=48787239 - July 2026 (6 comments)
Re: GDID Windows – Cut the tracker that follows you even under VPN
#80> Microsoft provided the FBI with the history of IP addresses tied to that specific GDID. This article, and most articles about this, doesn't explain where FBI got that GDID from. Ok, Microsoft has a list of IP addresses that has been used by a computer with a certain GDID, but FBI needs to get the GDID in the first place, and then try to bind that to a person. I found another article that explains the process a bit…
> Microsoft has a list of IP addresses that has been used by a computer with a certain GDID, but FBI needs to get the GDID in the first place What they did was the opposite: ask Microsoft for GDIDs used by attacker-associated IPs within several 24-hour time periods during which attack-related activity took place. Windows pings Microsoft regularly with the GDID, establishing links between your GDID and any IP addresse…
This is my understanding:
* Microsoft collects timestamped GDID - IP address combinations at some interval.
* Other Service (eg your website) collects timestamped IP address data.
Combine the above and you can tell which GDID visited the service without the service knowing anything about GDID.
Eg
At 9:47:00 Microsoft gets a ping from a computer at IP address "123" with a GDID of "abc".
At 9:48:07 mywebsite.com is visited by IP address "123".
You combine both sets of data and you can be reasonably sure that GDID "abc" visited mywebsite.com at 9:48:07.