Ya. The FBI report to the court said that Microsoft showed the GDID visited the ngrok.com/signip page while using a VPN. I would have figured at that level the OS would not know domains but likely IP addresses. So it must be browser telemetry right?
No relation. GUID is just a format for a 128-bit unique number, used throughout the software industry. This is a specific 64-bit number assigned to your Windows device.
For those like me who were not abreast of this issue: the FBI was able to arrest some kid who hacked/is alleged to have hacked a jewellery retailer through a VPN. They were able to track the hacker via the user's GDID, which is a stable identifier unaffected by VPN usage.
This surveillance is certainly going to expand in scope as age verification comes into widespread usage. Personally I see little legitimate use case for this telemetry. It seems only useful for the purposes of tracking users for law enforcement or targeted advertising purposes.
Well, it's a darn good thing there is nothing like that over here on the Linux side. I'm pretty sure that if e.g. systemd attempted to generate a unique, persistent machine identifier during the installation process, it'd be shot down and patched off extremely quickly.
How did they query his GDID/PUID to make the arrest though? Does the browser have access to it during some requests? Also, if it’s stored as plaintext, what’s stopping anyone from randomizing it on machine startup?
I'm guessing Ngrok gets subpoena'd, hands over the IP who created the account, page access timestamp, etc - FBI hands over to Microsoft, finds which Windows PCs were active with a certain IP on that time period, tries to correlate other characteristics such as OS version or anything to get a single hit, and then return other IPs used by that machine and everything else they have, like SmartDefender / Edge telemetry.
This isn't "tracking", this is attribution in a court. The defence can't stand there and say "That's not him/this device" when the forensics point exactly at it.
To be fair, the courts in USA apparently have a different definition of tracking than all normal people do. Speaking of car movements, Flock claims this isn't tracking people based on some legalese mumbojumbo. Obviously, this and GPs claims are absolutely ridiculous if you speak English, but are apparently true in american legalese doublespeak.
How a Windows device's global ID is generated may be new info in the public sphere, but the fact that the global ID exists is not a secret. This format of ID has been in Windows since the initial release of Windows 10 in 2015, when it was introduced as part of Windows' current telemetry subsystem. You can see your PC's global ID very easily by opening Windows Feedback Hub and checking the Settings page under Device Information.
In a sense it doesn't matter how the global ID is used now. The fact that it exists allows it to be used in ways like what you describe, either by a malicious (?) Microsoft itself or by a malicious third-party attacker.
I'm familiar with these global IDs because I routinely used the Windows telemetry system as part of my work on the Windows core at Microsoft. We had strong policies on how and when we could access or use data for a single device as identified by global ID.
But ultimately, these policies will have a "government or court order" exception in reality even if not in theory, just like in most other consumer software observability systems. Windows is different only because it is the OS and so it controls everything else.
There are, unfortunately, a lot of abuses people will tolerate in the name of convenience, especially if those abuses aren't readily apparent and affecting them directly at the time they learn about them.
The alternative is not running any proprietary tech. This would require people to give up a lot of convenience, build their own tech stack, make tools where none exist, etc. Doable for most on this forum I'd suspect, not really feasible for the population at large so the choice is even worse for them: be spied on, or abstain from using technology all together.
Its a captive audience, and why advocating for privacy is such a difficult, losing battle. People aren't going to stop using Windows because of this, so Microsoft has no incentive to do anything differently. Same goes for Meta, Google, Apple, etc.
Even for myself, I've gotten really lazy over the years and have traded quite a bit of my computing freedoms for the Apple device ecosystem's convenience factors. And that's the trap. When even the people who understand exactly what they're giving up still choose the golden handcuffs, the market has no incentive to change.
> The court record itself says a reinstall produces a new GDID
That's a half truth if I ever saw one. Telemetry also includes the hardware hash (which does use SMBIOS serial number, CPUID, TPM identifiers, etc.) and that one survives OS reinstalls and even hardware swaps. It is the underlying id used for things like Autopilot (the equivalent to Apple's remote MDM lock).
As someone pointed out in the X argument comments, this is UNCONFIRMED and most likely not how the actual GDID being sent to microsofts servers looks like.
1. The GDID that most closely resembles the one mentioned in the DOJ indictment of Stokes is found inside the registry key Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\IrisService\IrisActionCreatives, which starts with the "g:" prefix and is explicitly called GLOBALDEVICEID.
2. According to the research, a Microsoft account is required. No, it's not necessary. Whether or whether you are logged into your Microsoft device, GDID is being filled in.
I also verified the value computed as suggested by the repository's creator and it differs from the value discovered inside the Iris registry key that begins with g:
Some users have been deleting the entire IrisService in the registry, it appears to also be related to the systray icons on the taskbar.
The first link is a couple years old but the second one is from a couple months ago. Apparently triggered now by the latest update kb5094126, so there may be some questionable new changes going on in this particular monkey-business department:
1. You install windows
2. Windows performs online device registration via call to live.com/ppsecure/deviceaddcredential.srf it submits hardware information about your computer
3. Microsoft SERVER generates Global Device ID also known as GDID
4. This GDID is persisted on your computer as part of the session permanently
How to change it?
Perhaps only way is to change hardware details and somehow invalidate the session to force device registration again
Install mitmproxy on your router and you can see the whole flow
50 comments
[ 38.2 ms ] story [ 276 ms ] threadThis surveillance is certainly going to expand in scope as age verification comes into widespread usage. Personally I see little legitimate use case for this telemetry. It seems only useful for the purposes of tracking users for law enforcement or targeted advertising purposes.
.. and how do they do that?
While we're on the subject of telemetry, has anyone got a GDPR orientated writeup of what's known?
I'm familiar with these global IDs because I routinely used the Windows telemetry system as part of my work on the Windows core at Microsoft. We had strong policies on how and when we could access or use data for a single device as identified by global ID.
But ultimately, these policies will have a "government or court order" exception in reality even if not in theory, just like in most other consumer software observability systems. Windows is different only because it is the OS and so it controls everything else.
then verizon did it for (to?) mobile phones.
I guess these things get normalized, people might say "those jerks" and then put it out of their mind.
The alternative is not running any proprietary tech. This would require people to give up a lot of convenience, build their own tech stack, make tools where none exist, etc. Doable for most on this forum I'd suspect, not really feasible for the population at large so the choice is even worse for them: be spied on, or abstain from using technology all together.
Its a captive audience, and why advocating for privacy is such a difficult, losing battle. People aren't going to stop using Windows because of this, so Microsoft has no incentive to do anything differently. Same goes for Meta, Google, Apple, etc.
Even for myself, I've gotten really lazy over the years and have traded quite a bit of my computing freedoms for the Apple device ecosystem's convenience factors. And that's the trap. When even the people who understand exactly what they're giving up still choose the golden handcuffs, the market has no incentive to change.
That's a half truth if I ever saw one. Telemetry also includes the hardware hash (which does use SMBIOS serial number, CPUID, TPM identifiers, etc.) and that one survives OS reinstalls and even hardware swaps. It is the underlying id used for things like Autopilot (the equivalent to Apple's remote MDM lock).
Windows telemetry used to track web activity, link VPN activity to source IP
https://news.ycombinator.com/item?id=48807767
U.S. v. Stokes https://www.justice.gov/usao-ndil/media/1450651/dl
https://github.com/gd03gd031/Windows-GDID-Changer
As someone pointed out in the X argument comments, this is UNCONFIRMED and most likely not how the actual GDID being sent to microsofts servers looks like.
1. The GDID that most closely resembles the one mentioned in the DOJ indictment of Stokes is found inside the registry key Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\IrisService\IrisActionCreatives, which starts with the "g:" prefix and is explicitly called GLOBALDEVICEID.
2. According to the research, a Microsoft account is required. No, it's not necessary. Whether or whether you are logged into your Microsoft device, GDID is being filled in.
I also verified the value computed as suggested by the repository's creator and it differs from the value discovered inside the Iris registry key that begins with g:
Some users have been deleting the entire IrisService in the registry, it appears to also be related to the systray icons on the taskbar.
The first link is a couple years old but the second one is from a couple months ago. Apparently triggered now by the latest update kb5094126, so there may be some questionable new changes going on in this particular monkey-business department:
https://gist.github.com/JMMBA/d56923502a74b6b7196dd800fad0a8...
https://thegeekpage.com/taskbar-missing-after-sign-in-6-fixe...
"Fix 3" is the one where the IrisService reg key is nuked.
1. You install windows 2. Windows performs online device registration via call to live.com/ppsecure/deviceaddcredential.srf it submits hardware information about your computer 3. Microsoft SERVER generates Global Device ID also known as GDID 4. This GDID is persisted on your computer as part of the session permanently
How to change it? Perhaps only way is to change hardware details and somehow invalidate the session to force device registration again
Install mitmproxy on your router and you can see the whole flow
https://github.com/gd03gd031/Windows-GDID-Changer
1) Do we think this is actually how the FBI found this kid or is this simply what they're saying in order to keep some other tool hidden?
2) Is there a way to block or manually change the GDID from being revealed. If it's the browser leaking it, do all browsers leak it?
https://github.com/gd03gd031/Windows-GDID-Changer