> The ID is generated when Windows is set up with a Microsoft Account
So not only was this “hacker” using Windows and Edge, they singed in to windows with a Microsoft account. And then used that same computer for their social media. Nice.
I'm not a "hacker" by any means, but I would probably use a Qubes based system with a dedicated "hacking" VM, only use anonymous VPNs connected from public WiFi access points (having left my mobile at home) while wearing a fake beard and STILL be paranoid that I somehow somewhere make a mistake.
Qubes is probably the best option but, the last time I checked, it didn't have certain deniability features that someone with the feds in their threat model might prefer.
Personally I'd say use Qubes because it might be better at preventing you from getting raided in the first place.
That's what hackers do in popular stories, right? In reality, most cybercriminsls just don't care that much (they usually use Tor browser, though). I mean they mostly use discord and telegram (both unencrypted).
Serious "hackers" are usually state sponsored now, or members of mature groups.
Edge has a feature where it will periodically pull the bookmarks and browsing history from any other browsers you have installed, so they'll then get sent to Microsoft and associated with your Microsoft account. This was initially enabled by default without the user's consent, although I believe now you may have to opt into it if you do a fresh Windows install. I only realized this was a thing because one time my work PC rebooted to install an update, then Edge came up instead of Firefox, but with all my Firefox tabs. I guess this was part of some effort to try to trick old people who wouldn't notice the difference into switching to Edge. Here's a news article about someone else running into this when it started happening: https://www.theverge.com/24054329/microsoft-edge-automatic-c...
"Old" people? How about the vast majority of the public, which is not represented on HN?
Not to mention that one of the many major UI regressions in Windows is the removal of title bars from application windows, which is fundamental to this "trick." Try opening a PDF in Edge and also in Acrobat. Neither window has a title bar, and they are otherwise almost identical. You have to scrutinize the very few controls around the window to determine which app you're looking at.
>"Massgrave, the group behind Microsoft Activation Scripts, has noted that Windows setup sends hardware info to Microsoft and receives identifiers back that are later used for Store access and licensing. Blocking GDID assignment breaks both activation and UWP apps."
I think probably it sends the gdid back to Microsoft as part of telemetry/updates/MS account periodic re-auth, which lets them know the current IP address, and then once the government has Microsoft's logs and the various target websites' logs, they can correlate based on IP address. I don't think it's actually sending the gdid to the web sites. Maybe.
This serves to further illustrate that nobody should be using Windows for anything that involves the need for privacy. And doubly, triply, and morefold so, nobody should ever sign a Windows machine into a MS account for any reason.
>Send optional diagnostic data to improve Microsoft products [Includes how you use the browser, websites you visit, and enhanced error reporting. Determined by your Windows diagnostic data setting]
>Allow Microsoft to save your browsing activity including history, usage, favourites, web content, and other browsing data to personalise and improve Microsoft Edge and Microsoft services like ads, search, shopping, news, and Copilot [Includes your history, usage, favourites, web content and other browsing data]
i wont even dual boot windows on my linux machine, dont trust them not to vacuum up my linux drive data when i boot into windows. also just recently discovered their attempt to hijack the entire pc industry with secure boot, they are consistent gotta give them that. why do i have microsoft keys installed on my motherboard when im not even using windows.
> The ID is generated when Windows is set up with a Microsoft Account
So not only was this “hacker” using Windows and Edge, they singed in to windows with a Microsoft account. And then used that same computer for their social media. Nice.
It's fascinating, right?
I'm not a "hacker" by any means, but I would probably use a Qubes based system with a dedicated "hacking" VM, only use anonymous VPNs connected from public WiFi access points (having left my mobile at home) while wearing a fake beard and STILL be paranoid that I somehow somewhere make a mistake.
Qubes is probably the best option but, the last time I checked, it didn't have certain deniability features that someone with the feds in their threat model might prefer.
Personally I'd say use Qubes because it might be better at preventing you from getting raided in the first place.
Decisions decisions.
That's what hackers do in popular stories, right? In reality, most cybercriminsls just don't care that much (they usually use Tor browser, though). I mean they mostly use discord and telegram (both unencrypted).
Serious "hackers" are usually state sponsored now, or members of mature groups.
They don't care, I would say they don't know.
I saw an article where they analyzed the leaked IP addresses from a breach forum, and some of the top ten were Surfshark and iCloud Private relay.
The ID is generated even if you only create a local user account. I don't know to what extent that affects tracking/telemetry though.
>The Global Device Identifier (GDID) is a permanent ID assigned when Windows provisions against a Microsoft Account.
So again, the "make an account" is the part you ALWAYS skip. Local accounts or it technically isn't even a PC anymore.
The article is misleading... the GDID is created even if you don't use a Microsoft account.
How exactly does Microsoft link their gdid to a hotel booking?
Hotels last I saw don't collect an obscure gdid...
Did this victim use edge and sync their browser history or something perhaps?
Edge has a feature where it will periodically pull the bookmarks and browsing history from any other browsers you have installed, so they'll then get sent to Microsoft and associated with your Microsoft account. This was initially enabled by default without the user's consent, although I believe now you may have to opt into it if you do a fresh Windows install. I only realized this was a thing because one time my work PC rebooted to install an update, then Edge came up instead of Firefox, but with all my Firefox tabs. I guess this was part of some effort to try to trick old people who wouldn't notice the difference into switching to Edge. Here's a news article about someone else running into this when it started happening: https://www.theverge.com/24054329/microsoft-edge-automatic-c...
"Old" people? How about the vast majority of the public, which is not represented on HN?
Not to mention that one of the many major UI regressions in Windows is the removal of title bars from application windows, which is fundamental to this "trick." Try opening a PDF in Edge and also in Acrobat. Neither window has a title bar, and they are otherwise almost identical. You have to scrutinize the very few controls around the window to determine which app you're looking at.
Microsoft and its software are trash now.
Edge has less browser market share than Firefox right now, it's not the "vast majority."
Adobe provides PDF viewer that is embedded in Edge...
There's a blurb in the article:
>"Massgrave, the group behind Microsoft Activation Scripts, has noted that Windows setup sends hardware info to Microsoft and receives identifiers back that are later used for Store access and licensing. Blocking GDID assignment breaks both activation and UWP apps."
I think probably it sends the gdid back to Microsoft as part of telemetry/updates/MS account periodic re-auth, which lets them know the current IP address, and then once the government has Microsoft's logs and the various target websites' logs, they can correlate based on IP address. I don't think it's actually sending the gdid to the web sites. Maybe.
This serves to further illustrate that nobody should be using Windows for anything that involves the need for privacy. And doubly, triply, and morefold so, nobody should ever sign a Windows machine into a MS account for any reason.
Edge seems likely. Its settings include:
>Send optional diagnostic data to improve Microsoft products [Includes how you use the browser, websites you visit, and enhanced error reporting. Determined by your Windows diagnostic data setting]
>Allow Microsoft to save your browsing activity including history, usage, favourites, web content, and other browsing data to personalise and improve Microsoft Edge and Microsoft services like ads, search, shopping, news, and Copilot [Includes your history, usage, favourites, web content and other browsing data]
Probably had his laptop with him and they simply traced the gdid to a specific IP address that they determined belonged to the hotel
Discussions:
Microsoft admits Windows 11 has a GDID tracker with no off switch
https://news.ycombinator.com/item?id=48872561
Full Writeup of the Windows GDID
https://news.ycombinator.com/item?id=48811081
Microsoft Can Track Users via a Windows Device ID
https://news.ycombinator.com/item?id=48815196
How does the GDID compare to the UDID (Unique Device Identifier) and serial number in iOS; and the Apple Hardware UUID and serial number of Macs?
well, mostly the name. And the fact MS gave away GDID - IP mapping to the govt.
i wont even dual boot windows on my linux machine, dont trust them not to vacuum up my linux drive data when i boot into windows. also just recently discovered their attempt to hijack the entire pc industry with secure boot, they are consistent gotta give them that. why do i have microsoft keys installed on my motherboard when im not even using windows.
They caught a 19 year old hacker that uses Edge, and all it took was the privacy of 1.4 billion Windows users.
At it again!
How is this not a the mother of all GDPR violations?
One more proof that Windows is malware.
Linux has the same kind of identifier at /etc/machine-id... readable by default by basically any application on the system.
Which is also well documented and trivially rotatable by anyone with root on the machine. How do you rotate the MS identifier?
https://github.com/gd03gd031/Windows-GDID-Changer
> well documented and trivially rotatable
Yes, but almost nobody does that or complains about it at all, even though applications may have been silently phoning it home for many years now.
...and that can be changed at-will.
same for the windows GDID
[dupe] https://news.ycombinator.com/item?id=48872561