Microsoft Confirms Windows GDID Device Identifier That Cannot Be Disabled

londons_explore

How exactly does Microsoft link their gdid to a hotel booking? Hotels last I saw don't collect an obscure gdid... Did this victim use edge and sync their browser history or something perhaps?

WalterGR

How does the GDID compare to the UDID (Unique Device Identifier) and serial number in iOS; and the Apple Hardware UUID and serial number of Macs?

14u2c

> The ID is generated when Windows is set up with a Microsoft Account So not only was this “hacker” using Windows and Edge, they singed in to windows with a Microsoft account. And then used that same computer for their social media. Nice.

ChrisArchitect

[dupe] https://news.ycombinator.com/item?id=48872561

drnick1

One more proof that Windows is malware.

1970-01-01

>The Global Device Identifier (GDID) is a permanent ID assigned when Windows provisions against a Microsoft Account. So again, the "make an account" is the part you ALWAYS skip. Local accounts or it technically isn't even a PC anymore.

AlienRobot

They caught a 19 year old hacker that uses Edge, and all it took was the privacy of 1.4 billion Windows users.

globalnode

i wont even dual boot windows on my linux machine, dont trust them not to vacuum up my linux drive data when i boot into windows. also just recently discovered their attempt to hijack the entire pc industry with secure boot, they are consistent gotta give them that. why do i have microsoft keys installed on my motherboard when im not even using windows.

yodon

How is this not a the mother of all GDPR violations?

aniwalunj

At it again!

ChrisArchitect

Discussions: Microsoft admits Windows 11 has a GDID tracker with no off switch https://news.ycombinator.com/item?id=48872561 Full Writeup of the Windows GDID https://news.ycombinator.com/item?id=48811081 Microsoft Can Track Users via a Windows Device ID https://news.ycombinator.com/item?id=48815196

hughw

User nashashmi [1]: So this kid uses his home computer at his home, and they trace him down with the IP address, and the IP address also makes a request for Windows Updates. And that narrows down the Device ID. The device id is now traced to this kid. That seems more likely, I hope, than Edge/Windows secretly telemetering your GDID and every URL you visit to Redmond. It's a huge privacy hole still, but they can plausibly deny they set out to track you across the web using their OS. [1] https://news.ycombinator.com/item?id=48815196#48818368

peter_stokes

the criminal complaint: https://www.justice.gov/usao-ndil/media/1450651/dl?inline page 18 answers many of the questions in this thread.

orev

They say this is also sent with Windows Update checks, which happen frequently per day, and I think also when you initially connect to a network, so that’s a clear way they could tie the ID back to any IP address you’re using.