8 ms·
Microsoft Can Track Users via a Windows Device ID
- Terr_ 3mo agoTLDR: Microsoft can (at least) correlate your Windows installation to all website domains you visit while using Windows. It's unclear what the mechanism is, but I'd wager their "telemetry" is constantly revealing your installation ID, your current IP, and domains that were recently resolved.
- pogue 3mo agoThe article links to this page, which was shared on HN yesterday. [1] I feel like using wireshark to look at what's being sent back and forth from Windows telemetry, when using Edge, Chrome & etc should reveal what's being sent and recieved. Using MITM SSL spoofing should be able to intercept the packets. [1] https://github.com/SmtimesIWndr/gdid-reversal https://github.com/SmtimesIWndr/gdid-reversal
- Terr_ 3mo agoI would be shocked if Microsoft was not using their own layer of certificate-pinning to stop people from doing that, and/or using another layer of encryption separate from the networking layer.
- cromka 3mo agoBut you'd still see some encrypted traffic and it wouldn't fly under a radar
- pogue 3mo agoOnly way to see what's going on is testing to see what's going on. Hopefully, someone who knows more about it than me can take a look at the packets and see what they contain.
- Terr_ 3mo agoI found this talk [0] and some of the slides suggest that Windows is, at least in some circumstances, packaging web-browsing data into telemetry. To lift examples from the slides, that includes page titles: "CorrelationGuid": "7da62b73-082f-4eb2-a370-135d0113e1dd", "EventInfo.Level": 2, "PageTitle": "SiSyPHuS AFUNKT - Search", "TabId": 830425073, "client_id": -7497793556371901000, "pop_sample": 100, "utc_flags": 140737488355328 The transitions between pages: "IsSameDocumentNavigation": 0, "client_id": -7497793556371901000, "navigationUrl": "https://www.bsi.bund.de/DE/Service- Navi/Publikationen/Studien/SiSyPHuS_Win10/AFUNKT/SiSyPHuS_AFUNKT_node.html", "referUrl": "https://www.bing.com/", "HttpStatusCode": 200, And even which link you clicked in the page: "DOMElementPath": "A|1||c-link%20c-link--download%20FTpdf;P|5[…]gsb%20lang-de%20fixed%20js-on;HTML|1||", "DOMAnchorHrefUrl": "https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Cyber-Sicherheit/SiSyPHus/AFUNKT.pdf?__blob=publicationFile&v=6", [0] https://troopers.de/troopers23/talks/bsabut/ https://troopers.de/troopers23/talks/bsabut/
- pogue 3mo agoWhat application is doing the sending and where is it being sent?
- echelon_musk 3mo agoWorse than just domains as TFA shows full URLs are recorded. Reminds me of Google Safebrowsing.
- ale42 3mo agoPossibly the same but done by Edge?
- red_admiral 3mo ago"all" would be troubling indeed. I hope that someone can discover the mechanism, and whether it's depending on any settings like "Share browsing data with other Windows features" or any other settings.
- 8cvor6j844qw_d6 3mo agoI was under the impression Windows is unreliable for these kind of activities as they are "leakish". I imagine it's not too difficult to narrow down the potential suspects with how much data points you'd get from ISP, Windows telemetry, and whatever.
- boopig 3mo agoIt's Microsoft Defender SmartScreen in Edge. You can also use the Windows Diagnostic Viewer to check the telemetry data being shipped to Microsoft. I'd be willing to bet that you could use Edge (with defaults) and see the URLs being sent to Microsoft but nothing would come from Brave, Firefox, Chrome etc.
- protocolture 3mo agoProbably a capability demanded through a TCN or TAN as part of a mechanism like Australias Access and Assistance bill.
- midtake 3mo agoTo me this indicates that Microsoft has some sort of traffic analysis performed on endpoints, then linked to GDID. I'd guess this is part of Defender's real time protection or MAPS. Fun fact, Microsoft Defender MAPS was previously named SpyNet. https://en.wikipedia.org/wiki/Microsoft_Active_Protection_Service https://en.wikipedia.org/wiki/Microsoft_Active_Protection_Se... The GDID identifier seems software in nature though. They could be more aggressive and tie it to the baseboard's serial number the way some games do. Then the hardware is tracked throughout its entire lifecycle, not just per instance of Windows install.
- reactordev 3mo agothat's the idea behind SecureBoot and the TPM chip is to provide the GDID based on hardware fingerprint. Some games already do this as "anti-cheat" measurements (tracking you) and Microsoft has been doing it since Windows 7 days. It's just that the TPM now gives you that hardware authority.
- gruez 3mo ago>that's the idea behind SecureBoot and the TPM chip is to provide the GDID based on hardware fingerprint hard drive and motherboard serials have been around far longer than TPMs. Not to mention TPMs are far cheaper to replace than hard drives.
- midtake 3mo agoPoster might mean that the TPM gives you some degree of non-repudiation since the TPM can cryptographically sign stuff.
- egamirorrim 3mo agoTruly terrifying. But also shocking that a 'hacker' is using windows
- efilife 3mo agoSome hackers want to spend their time doing cool stuff rather than constantly fixing their system
- gcr 3mo agowhen it comes to video gaming I’ve found Bazzite to be generally far less fiddly than windows 11, surprisingly
- nehal3m 3mo agoYeah, that’s why they install Linux
- redsocksfan45 3mo ago[dead]
- drw85 3mo agoI switched to linux a year ago and in that year had less problems than on Windows. I had some minor problems after updates once or twice. On Windows i had to boot into restore mode multiple times due to Windows Update screwing something up. The MS Store also constantly had trouble updating apps and games and i had to manage packages manually and uninstall and reinstall them so it would work again until the next update. The times were Windows is easy to use and fire and forget are long gone. The decline in quality is noticeable.
- dizhn 3mo agoThis is basically FUD and has been for at least 20 years. Please refrain from it. I am not fixing nothing daily.
- anthk 3mo agoActual hackers don't need to run debloating tools each boot getting tired of all the adware and bundled crap eating GB's of storage. Actual hackers would use Guix System and actually hack really cool stuff and, yes, Guix (the package manager) would be eating GB's because of reproducibility... but at least you could restore your system from Grub anytime.
- zelphirkalt 3mo agoMy surprise level is at approximately... zero. Next we will see some news, that MS was compelled to share that info with some three letters. - Oh wait, that is exactly what has already happened, according to the article. MS is just like that person, who drives a dagger into your back.
- thewebguyd 3mo agoMy thoughts exactly. Weren't they just caught recently handing over bitlocker keys (that get uploaded to MS by default when you sign in with a microsoft account) to the feds?[1] Windows is malware. [1] https://www.forbes.com/sites/thomasbrewster/2026/01/22/microsoft-gave-fbi-keys-to-unlock-bitlocker-encrypted-data/ https://www.forbes.com/sites/thomasbrewster/2026/01/22/micro...
- cheschire 3mo agoWell they can’t use that to track users of Linux. I was a big fan of Microsoft ten to fifteen years ago. I’ve since transitioned my whole family off Microsoft products now over to Linux, Apple, and proton. Edit: and Brave. I really thought their corporate culture would’ve changed after the late 90’s but I guess this is a good lesson for founders. The culture you build into your company will likely outlast your tenure.
- merb 3mo agoWell Enterprises can also enroll Linux machines in intune
- tremon 3mo agoBoth systemd and dbus have a similar device id for Linux, which e.g. Chrome reads at startup: https://manpages.debian.org/trixie/systemd/machine-id.5.en.html https://manpages.debian.org/trixie/systemd/machine-id.5.en.h... https://manpages.debian.org/trixie/dbus-bin/dbus-uuidgen.1.en.html https://manpages.debian.org/trixie/dbus-bin/dbus-uuidgen.1.e...
- givinguflac 3mo agoIs this specific to Debian?
- tremon 3mo agohttps://www.freedesktop.org/software/systemd/man/latest/machine-id.html https://www.freedesktop.org/software/systemd/man/latest/mach... https://dbus.freedesktop.org/doc/dbus-uuidgen.1.html https://dbus.freedesktop.org/doc/dbus-uuidgen.1.html
- cryo32 3mo agoFreeBSD has it as well.
- nickjj 3mo agoNope, but Debian does use systemd by default so it's there. I'm running Arch Linux and /etc/machine-id is present. There's also an optional /etc/machine-info file that could exist. It's not a part of systemd and won't be created by default. It's more of an informal way to have details about the system in 1 spot. It was more popular when provisioning bare metal servers but still has value in the cloud. You can have key / value pairs on who to contact, where it's located, what type of machine it is, etc..
- surcap526 3mo ago[dead]
- xnx 3mo agoVague article. No evidence that Microsoft can see what web pages you are visiting in Chrome or Firefox (for example).
- crtasm 3mo agoOr even Edge with these options turned off: >Send optional diagnostic data to improve Microsoft products [Includes how you use the browser, websites you visit, and enhanced error reporting. Determined by your Windows diagnostic data setting] >Allow Microsoft to save your browsing activity including history, usage, favourites, web content, and other browsing data to personalise and improve Microsoft Edge and Microsoft services like ads, search, shopping, news, and Copilot [Includes your history, usage, favourites, web content and other browsing data]
- x______________ 3mo agoFrom the reply you're replying to: > 27. Microsoft records also indicate: <...> a little more than three hours after the ngrok account was created, the user visited “[Company F].com” from the .168 proxy server.
- crtasm 3mo agoThis tells us nothing about whether non-Microsoft browsers are involved
- x______________ 3mo agoScary huh? What else aren't they telling us..
- pluc 3mo agoUS Tech is fast becoming like Russia's and China's.
- d5lt5 3mo agoHave you heard of a website called facebook?
- inigyou 3mo agoIt was originally called LifeLog and sponsored by the military as a data collection system to help them identify terrorists.
- pluc 3mo agoThere was a time where the default assumption was functionality created tracking opportunities. Nowadays, it's more the opposite. Social media have always been on the forefront of monetizing data, but the same data in the hands of governments is used differently. My point is that the way you/we feel towards Facebook, the entire world is increasingly feeling about most, if not all, US tech. I know people who won't use Israeli or Chinese-made tech for fears of sabotage. US tech is quickly making its brand in that market.
- herbst 3mo agoI know people who avoid US tech and happily use Chinese or Russian tech here in central Europe. Not trusting US tech isn't new, it just gets a lot worse
- BiteCode_dev 3mo agoI actually opened a yandex mail account 15 years ago because, since I was going to be tracked, at least it would be from people who have no friendly contact with most gov entities and companies in my society. Sad.
- herbst 3mo ago
- m132 3mo agoDuplicate? https://news.ycombinator.com/item?id=48807767 https://news.ycombinator.com/item?id=48807767
- contubernio 3mo agoDoes this not violate European privacy laws?
- tosti 3mo agoProbably yes it does. Not that it matters when you hack a website to have some expensive jewelry sent to your home address.
- deleted 3mo ago[deleted]
- Kipters 3mo agoGDPR only covers PII, this is a randomly generated ID that changes on every install on the OS. You can mix it with other info to track a user, but it's not enough to de-anonymize someone on its own.
- weberer 3mo agoSo what if it does? They'll get hit with a fine that will be the equivalent of 6 hours of revenue as they continue to be bastards.
- Someone 3mo agoI guess we’ll see a Windows tool that sets your identifier to this suspect’s “g:6755467234350028” very soon (weird ID, by the way. 16-digits makes sense, but I would have expected it to be hexadecimal) Also, can anybody tell how “Microsoft had records showing that on May 12, 2025, at 19:21 UTC, the GDID associated with Stokes’ computer “accessed, among other ngrok pages, 'https://dashboard[.]ngrok.com/signup https://dashboard[.]ngrok.com/signup,'” works? If it’s the browser sending that info to Microsoft, wouldn’t somebody have noticed that their PC contacts Microsoft for every web page they open? Or do they batch that data and send it at some later time? Also, would that mean this ‘only’ affects those using Microsoft’s browser (or does Chrome do the same, sending data to Google?) Alternatively, is this happening lower in the stack? I can think of a place where a system component has access to the domain name, but not of one where it has the full URL.
- Kipters 3mo ago> (weird ID, by the way. 16-digits makes sense, but I would have expected it to be hexadecimal) it's the decimal representation of a 64 bit integer
- embedding-shape 3mo ago> Also, can anybody tell how “Microsoft had records showing that on May 12, 2025, at 19:21 UTC, the GDID associated with Stokes’ computer “accessed, among other ngrok pages, 'https://dashboard[.]ngrok.com/signup https://dashboard[.]ngrok.com/signup,'” works? That URL shows 16 blocked requests, it tries to load (at the very least) datadog and googletagmanager, I'm guessing the police simply reached out to all the analytics companies Ngrok ends up indirectly/directly sending data to, which ends up saving everything they get their hands on. What surprises me the most is that the guy was using a Windows installation to do all of this. But then again, you only hear about the dumbest criminals who get caught, so I guess it does make sense after all.
- advisedwang 3mo ago> I'm guessing the police simply reached out to all the analytics companies Ngrok ends up indirectly/directly sending data to, which ends up saving everything they get their hands on. But those companies would have no way of knowing the GDID. It's not sent in a header, I assume.
- Alien1Being 3mo agoThe most surprising part of this is a "hacker" using Windows ...
- materialpoint 3mo agoThis goes a long way to prove that Microsoft does NOT care about your privacy, even if the header of their cookie consent claims so. They absolutely do not care, and this should be said about every big-tech vendor, not matter how lame it seems to say so. It is long overdue that we all say what needs to be said: they do not care about your privacy, your independence, or your well being. They DO NOT CARE.
- istoleabread 3mo agoBig news: Fork found in kitchen
- materialpoint 3mo agoSince you did not understand the point at all: There are regulations in place to force sites to "ask" for permissions to use cookies and track you. The point is that the regulations completely fail to force the sites to not blatantly lie, and wrap the "consent" with "we care".
- kevin_thibedeau 3mo agoNo site is forced to implement cookie consent. They all have the option to only use strictly necessary cookies without notification.
- materialpoint 3mo agoThat's just pedantic, because you know it is not the reality they choose. Most sites don't want to not track you. So they pretend they care about your privacy, and then proceed to collect and share data on you anyways.
- failbuffer 3mo agoYeah, but it's galling we accept these big obvious lies in our society. A legitimate government would impose appropriately stern consequences for misleading and false advertising.
- ChrisArchitect 3mo ago[dupe] Full Writeup of the Windows GDID https://news.ycombinator.com/item?id=48811081 https://news.ycombinator.com/item?id=48811081
- lorislab 3mo agoThe interesting part is not really the existence of a machine identifier. Almost every modern OS has some equivalent. The bigger question is the boundary: which components can access it, and when does a local identifier become a remote tracking identifier? A machine-id sitting on disk is very different from an OS vendor correlating it with network activity.
- llm_nerd 3mo agoThis is the part that isn't clear and is by far the most interesting. At what stage and what point did the GDID get correlated with a tool/web request. As is it almost sounds like Microsoft "telemetry" gathers everything and they did a bulk search for certain activity, pulling the GDID and correlating it with a user.
- mysteria 3mo agoFrom reading the official criminal complaint [1] it looks like Microsoft literally logs all web requests along with the GDID and sends it over as "telemetry". It basically associates the URL, the client's IP, and the GDID together. Or I suppose it's possible that it only sends the domain and not the full URL, but that's enough for the police to go to the hoster and demand logs containing the full URL for said IP. 1. https://www.justice.gov/usao-ndil/media/1450651/dl?inline https://www.justice.gov/usao-ndil/media/1450651/dl?inline
- nubinetwork 3mo agoAndroid has one too. If you don't link your google account to an app, they can use your device id as your profile.
- fumeux_fume 3mo ago[dead]
- diogenescynic 3mo agoI assume this likely true for nearly all device manufactures. I assume all devices have some kind of unique ID that they use for tracking, whether they said so or not.
- blaqq2 3mo agoI'm more surprised that this already isn't a known fact. I wonder exactly how far into each device activity is being tracked.
- diogenescynic 3mo agoIt's down to the component level in many cases...
- nashashmi 3mo agoSo this kid uses his home computer at his home, and they trace him down with the IP address, and the IP address also makes a request for Windows Updates. And that narrows down the Device ID. The device id is now traced to this kid. This is the kind of stuff privacy advocates have been raising the alarms about. This is the kind of capability that de facto erased all privacy assertions. And further led companies like Google to take advantage of this and erase assumptions of privacy all together.
- haussman 3mo agoCould this identification be through some alternate Windows service like Windows Update, Windows Time ntp server or Windows Defender?
- Pavel_Akimov 3mo ago[flagged]
- bigbuppo 3mo agoAnd remember, most of this telemetry is just marketing/ad tech, so anyone that works in the martech/adtech space, you're also part of this.
- materialpoint 3mo agoThe (not so) interesting part is how inefficient it is. Marketing by ads on the internet has less than 0.5% hit or click rate, and even then it is mostly accidental clicks due to the over-saturation of ads. It's not a real economy. It is just simply not actually worth it.
- bigbuppo 3mo agoAnd yet stupid amounts of money are spent collecting detailed dossiers on every person that touches the internet so that... I'm guessing someone's probably trying to sell mattresses or something... because that's always that weird last question in every marketing/advertising survey I've ever seen... do you plan on buying a mattress within the next six months?
- zaptheimpaler 3mo agoI'm probably going to called a lunatic but I'm convinced this kind of telemetry is somehow linked to and behind the huge coordinated advertising push for VPNs in the last few years. More and more, the "invisible hand of the market" seems like literally the hands of a few very large conglomerations of power and capital that shape the economics of the entire market to effectively control it - they shape the gradient and make sure companies optimize loss. VPNs are either directly spyware that increases tracking capability, or are being offered now because they don't need your IP to track you anymore so they might as well make money off your fears while still tracking you. More broadly, I don't see much of a free market or democracy left anymore, now every government is doing a coordinated push to eliminate privacy as well.
- RandyOrion 3mo agoThe criminal complaint missing in this article: https://www.justice.gov/usao-ndil/media/1450651/dl https://www.justice.gov/usao-ndil/media/1450651/dl Basically, Microsoft logs things from windows users, including and not limiting to, the machine GDID, IPs that come with the GDID, and when and what exact URLs accessed. So for windows users, privacy, an important part of information security, is totally destroyed by these logs enforced on windows. Another important part of information security is bug fixing, and microsoft did make at least one security researcher angry [1]. And a simple solution to that problem is moving to linux. You save yourself a lot of time and energy for leaving the adversarial information security condition imposed by windows and microsoft. P.S. You may consider debloating windows for a more information security friendly environment. However, that is nearly impossible, as long as you realize that windows is an OS composed of thousands of closed source softwares, and doing security audits on all of these will be costly. [1] https://news.ycombinator.com/item?id=48315968 https://news.ycombinator.com/item?id=48315968
- rroy676 3mo ago[dead]
- super256 3mo agoRelated thread by some Massgrave.dev devs explaining some GDID mechanisms: https://x.com/massgravel/status/2074304593303892354 https://x.com/massgravel/status/2074304593303892354
- Terr_ 3mo agoConvenience link for those who don't want to create a Twitter account to see more. https://xcancel.com/massgravel/status/2074304593303892354 https://xcancel.com/massgravel/status/2074304593303892354 The sites' anti-bot measures seem unhappy with my current computer/location at this time, but hopefully it works for everyone else.
- super256 3mo agoI can recommend the LibRedirect extension for doing this automatically: https://addons.mozilla.org/en-US/firefox/addon/libredirect/ https://addons.mozilla.org/en-US/firefox/addon/libredirect/ (I don't use it for Twitter, because I find the 5s xcancel redirect more annoying than logging into Twitter. But I use it for Imgur and Tiktok, as Imgur straight up denies serving many VPN IPs, and Tiktok serves a really annoying captcha.)