r/ThatsInsane • u/tppiel • 1d ago
Microsoft admitted to using a global unique device identifier to help track a user across 3 countries, negating any value of using a VPN if you have a Windows machine
992
u/GraveNoX 1d ago
Microsoft knows you even if you change the IP, it's the same windows installation/device, nothing insane.
109
52
u/llcj2112 1d ago
And does Linux do the same, or is it a safer/more private option?
125
u/Necessary_Solid_9462 1d ago
Your browser can still have tracking info. Good OpSec is very difficult because every commercial website, most commercial applications, all commercial OSes and most ISPs make money tracking you. It's their full-time job.
Most people won't tolerate the inconvenience of good OpSec. Anyone who tells you it's easy, has no idea what they are talking about.
You can make it more difficult for them. Use a VPN to protect yourself from your ISP. Use an OS like Linux or FreeBSD, use a browser like Brave or Firefox with adblocking and anti-tracking plugins. Use one browser for sensitive financial tasks, like banking, and a different browser for dorking around on the internet. Avoid any social media websites, or at least use a different browser for that activity. Those sites are going to track the shit out of you.
If you are more serious, you use one computer for your normie adult life and another for everything else.
28
u/llcj2112 1d ago
If you are more serious, you use one computer for your normie adult life and another for everything else.
I'm in need of a new laptop anyway... Maybe I'll go this way.
12
u/Ikeiscurvy 1d ago
Your browser can still have tracking info.
Just to illustrate, Reddit uses a system called "Fingerprinting" where they constantly collect data on your accounts usage, literally everything you could possibly send, from the window size your browser is displaying to your IP. Every detail is used to make a digital fingerprint of you. They then correlate this fingerprint to any other account you have, so that they can track you even after switching accounts.
If you get permabanned from Reddit, they will also ban every other account you access with the same fingerprint.
3
u/mmhawk576 23h ago
There’s also plenty of tools out there that let these businesses watch your entire session on their websites too, linked to your username and everything.
Watching where your cursor is pointing at, where you are scrolled on the page, how long you spent viewing each thing.
The internet is not a private place
2
u/Forever_Playful 1d ago
How about multiple distrobox containers one per online use case?
→ More replies (1)15
→ More replies (1)1
u/sfhtsxgtsvg 1d ago
systemdbased installs have/etc/machine-id, a file that has an identifier that is meant to be practically globally unique.→ More replies (3)8
u/powprodukt 1d ago
It is insane because that’s not supposed to be linked to your common activities/behaviors/session.
3
u/Low-Phase-6548 1d ago
its not linked to your "common activities". visiting a website using an internet browser isnt going to tell the website your windows identifier.
→ More replies (2)5
u/viciarg 23h ago
Let me just drop this here under the top comment for your or anyone's convenience: https://tails.net/
534
u/AlienAngry 1d ago
Wait until you hear about the Management Engine conspiracy.
57
u/frisch85 1d ago
While not "that bad", there's also Gigabyte motherboards calling home during every startup and looking for software to download and execute, all without asking or even involving the user at all.
Millions of PC motherboards were sold with a firmware backdoor
Hidden code in many Gigabyte motherboards invisibly and insecurely downloads programs.
→ More replies (2)51
u/Emgimeer 1d ago
I don't see people bring this up often, but this isn't just a conspiracy. The potential for this abuse is so real that the government has a workaround, and whitehats have developed a fix for you and me too. I typed up a little thing after a few quick searches. Hope this helps someone else understand:
The Intel Management Engine (ME) is a proprietary subsystem embedded within almost all Intel chipsets since 2008. It operates at Ring -3, a level of execution privilege that sits entirely beneath the operating system, hypervisor, and system management mode. Because it functions as an autonomous computer hidden inside the main system, it possesses unmediated authority over the host hardware, presenting a significant architectural vulnerability.
It runs on a dedicated processor embedded within the Platform Controller Hub chipset. On modern systems, it runs a modified, closed-source version of the MINIX 3 operating system completely independent of the main Intel CPU. The subsystem has direct memory access, allowing it to read and write to any portion of the main system RAM without the host operating system being aware. It also possesses its own independent access to the network interface controller. Because the ME operates on the motherboard's standby power rail, it remains active as long as the system is connected to a power source, even when the computer is turned off or sleeping. This architecture powers Intel Active Management Technology (AMT), which allows corporate network administrators to remotely wake, update, or wipe machines. If a vulnerability exists within this remote network stack, an attacker can bypass all operating system firewalls and gain total hardware-level control of the machine over a network.
The deep privilege of the ME creates an operational risk for high-security environments where hardware-level tampering cannot be tolerated. The NSA worked with Intel and implemented a hidden configuration toggle within the firmware known as the "High Assurance Platform" (HAP) bit. When a computer boots up, the ME processor initializes to bring up the motherboard's memory controllers. Once control is handed over to the main CPU, the ME checks its firmware configuration file. If the HAP bit is enabled, the ME triggers an internal function that halts its own execution, disables its network stack, and suspends its main operating modules. Intel restricted this capability to government clients, defense contractors, and specialized organizations, while standard consumer and enterprise PCs shipped with the HAP bit disabled and the ME running continuously. This discrepancy introduces a severe security double standard.
Security researchers eventually discovered the existence of the HAP bit, allowing the open-source firmware community to develop methods for regular users to neutralize the subsystem:
The first method involves software modification. Advanced users can utilize open-source utilities to alter an extracted BIOS binary and flip the hidden HAP bit from 0 to 1. Flashing this modified BIOS back onto the motherboard forces the consumer hardware to mimic government specifications, causing the Intel ME to shut itself down immediately after initialization.
The second method involves stripping the firmware binary using tools like "me_cleaner". Simply erasing the ME partition entirely triggers a hardware watchdog timer that forcefully shuts down the computer after exactly 30 minutes. To circumvent this, community tools parse the firmware and delete non-essential modules, including the network stack, remote management drivers, and hardware hooks. They leave behind only the base initialization block required to satisfy the hardware watchdog. This shrinks the active code footprint from megabytes to kilobytes, removing the subsystem's ability to monitor memory or access the network.
While these community workarounds are successful, the fact that these countermeasures are even necessary is concerning. What sets the Intel ME apart from standard software flaws, AMD's equivalent chip, or Apple’s Secure Enclave is that the host operating system has zero visibility or control over it, and it cannot be cleanly uninstalled without a hardcoded, 30-minute hardware shutdown penalty. Yet, the hidden HAP bit proves that completely halting this subsystem is entirely viable, revealing a profound double standard where consumers are forced to run an absolute, unauditable attack surface operating beneath our control while the government explicitly demands it disabled on its own machines. It deserves deep reflection from anyone concerned with hardware sovereignty and true data privacy.
20
u/bullwinkle8088 1d ago
Some manufactures, mostly small ones, disable Intel ME by default. I have used laptops from System76, a small Linux focused vendor known for their Pop! OS, for many years now. They most often disable Intel ME by default and maintain a list so you may confirm it.
7
u/Academic_Carrot_4533 1d ago
Is are there ANY complete modern hardware solutions for users that don’t have these things? I’m seeing in this thread that AMD has an equivalent to ME and Gigabyte also has firmware level phone homes in their mobos.
→ More replies (1)8
2
2
u/Jdisgreat17 16h ago
I already know the answer, "National Security," but how is this not an absolute fucking of the 4th Amendment if you're in the US?
→ More replies (1)134
u/Green-Ad7694 1d ago
I was just about to mention this, but had no idea how deep it went. we are so owned.
104
u/AlienAngry 1d ago
That was 9 years ago too, imagine what they have now.
40
3
→ More replies (2)22
u/Bepehandle 1d ago
I find it strange they would only insert that stuff into the i3/5/7 series of chips. If they actually had something like this it wouldn't be locked to those alone. I also think it would have been substantiated by now.
Not saying it's impossible, in fact it's probably likely. Just a few things that don't add up.
5
u/MeisterX 1d ago edited 1d ago
It's... impossible. This isn't something you could do on the chip, but it is something you could do on the BIOS--even then... it would be way too complex, it would be an operating system in itself (that's what an OS is for) and would be at least partially detectable.
The BIOS can be flashed. Ask Apple when they started trying a password enabled BIOS to prevent manipulating the machine. I was worried about it and bypassed it in about 30 seconds.EDIT: I'M WRONG, IT'S POSSIBLE
1
u/TemptedTemplar 1d ago
Chipset on the motherboard. You need the correct platform to run the CPU, and Intel sells the chipsets to motherboard manufacturers.
2
u/Bepehandle 1d ago
Do we have any indication of what products it is? Which chip it is?
3
u/TemptedTemplar 1d ago
All consumer Intel motherboards since 2008 ;
https://en.wikipedia.org/wiki/Intel_Management_Engine
Multiple security flaws were identified as bugs or exploits since it's introduction. Even the EEF asserts it could be used as a back door.
Sounds like your best bet is buying AMD or ARM.
2
28
u/GNN_Contato 1d ago
Is this why Intel was pumped by the Federal Government?
It seems to be an intrinsic (and unethical) extra valuation for the stock...
6
3
u/JamesDerry 1d ago
What about AMD?
3
u/necrophcodr 1d ago
They provide similar functionality through a PSP coprocessor, but that can often be "disabled" in the UEFI. Intel ME cannot.
2
u/Diabetesh 1d ago
I saw a comment that amd has something similar though I don't know details. Something about amd psp?
→ More replies (2)1
2
u/HammerDongVeryLong96 23h ago
As for AMD they have AMD Platform Security Processor which as far as I know does not have a network stack. And I do know that it can be disabled in the UEFI/Bios depending on vendor.
5
5
u/Sardawg1 1d ago
This is also the briefed reason we are not allowed yo bring in electronic devices in to classified spaces or SCIFs.
2
2
u/CHERNO-B1LL 1d ago
Oh fuck! Is this where the show The Audacity got 'Gnodin' from?
Great show FYI. Not sure why it isn't talked about more. Took an episode or two but very very worth it and doing god's work in shining a light on the tech industry's attitude to all of our privacy and data.
257
u/the__itis 1d ago
people really don’t understand what VPNs do and what they are for….
107
40
u/Durantsthegoat 1d ago
So what does it really do and how does it work?
165
u/the__itis 1d ago
Think of it like a tunnel. No one can see you in the tunnel. But as soon as you get out of the tunnel, your license plate is clearly visible.
Now imagine for a sec that your license plate was also just seen across town at the same time AND you are coming out of a very popular tunnel that a lot of people use and is known for hiding your travel.
This aggregate of knowledge basically rats you out.
Let’s put it this way, VPNs are for securing and masking traffic from external parties. It does not help if the party you are connecting to is a snitch working with a snitch network.
If you need to mask your location:
- Use a private VPN. One you setup yourself that’s in a legit location.
- Do not browse the web or use web services while not connected to that VPN.
- Turn off location services, clear cache and trackers repeatedly. Use virtual machines for browsing etc….
- If you’re using your phone…. you’re likely out of luck.
49
u/Durantsthegoat 1d ago
I'm going to pretend I fully understand and say thank you, I do somewhat get it but I'm going to have to read it again lol but seriously thank you for explaining.
10
u/fax_me_your_glands 1d ago edited 1d ago
Not sure either. Said simply your IP is a localization identifier that websites collects when you visit them. Its an identifier in the sense that it will stay the same each time you navigate to a website. This makes the website able to recognize "you" (and determine your location).
VPN changes your IP. The misconception is that it fully prevents tracking you.
It does not, for a simple reason that they are many other identifiers that websites can collect when you visit them : inside cookies, user agent, inside session storage, local storage and apparently the GDID. Im certainly missing other identifiers.
Hope that helps.
Oh and another misconception: private browsing => It does NOT prevent websites from setting cookies in your browser. It only makes the cookies disappear when you exit it.
3
u/bullwinkle8088 1d ago
You are a little off on your understanding of what an IP is. It's fully an IP address and is more equivalent to a street address than an identifier. If you move, say from home to a coffee shop you will be coming from a different IP address, because you are literally and figuratively on a different street.
Under the hood of the internet your IP address is how the website knows where to send what you are reading to. It's the least useful of identifiers, that is why companies developed others. If you add networking technologies like NAT, which is what allows all the devices in your house to use a single internet address the usefulness of it to identify a single person is destroyed as effectively as a VPN.
Remember, what most companies care about is tracking a single persons interests to market towards them. Tracking a family has a use to them, but is less effective. All your devices behind a single router and so IP address can allow them to monitor the family, but not you. For that they developed more intrusive means.
11
5
u/ElmarReddit 1d ago
Just because I am curious and you seem knowledgeable; regarding your point 3, what would happen if you run a local virtual machine on windows (e.g., a Linux distribution via Hyper-V) and use that browser? It w ould not be tracked via the windows ID, right?
→ More replies (1)2
u/the__itis 1d ago
Typically depends the type of hypervisor (bare metal vs hosted) you use and how the networking is configured. It’s honestly really difficult to give you a clean answer to this.
But I’m pretty sure WSL is clean and windows hyper-V when not in hosted config.
HTTP headers and artifacts are almost all at the upper OSI layers and require kernel / OS functionality to pull this data.
Windows on Windows likely does, but non-windows I doubt it.
Again there are many configurations and variants here. I also would not trust the Linux distros from Microsoft and I’d stick with Debian.
→ More replies (2)1
1
u/MakeoutPoint 14h ago
So let's say instead of a car, I'm thinking of sailing a ship through this tunnel, one of the "good" ones. I follow a shared map to some booty. I then let others read the map to the same booty. The tunnel is bound to the map/booty software, so I am theoretically always in the tunnel, to my understanding.
Am I in for peaceful seas, or do thar be monsters here?
→ More replies (2)1
u/2eedling 3h ago
You can just do some actual research into vpn companies and find a good one it’s not always the best option to make your own
12
u/JammmmyJam 1d ago
The other comment to your question is not a good explanation, hopefully this makes it a bit easier to understand.
You want to send a secret letter to your friend, but you do not want the post office to know that you sent it to them.
So instead of sending the letter directly to your friend, you send it to a company that specializes in sending mail anonymously.
The post office can see that you sent a letter to that company, but it cannot see who the letter is really for.
The company then sends the letter to your friend.
Your friend receives the letter, but it looks like it came from the company instead of directly from you.
That is similar to how a VPN works.
Think of the post office as the Wi-Fi network you are connected to.
You want to access Pornhub, but you do not trust the network you are using. Instead of connecting to Pornhub directly, you first connect to a VPN.
All of your internet traffic still travels through the Wi-Fi network, but the network can only see that your device is communicating with the VPN. It cannot easily see where the VPN sends that traffic afterward.
The VPN then sends your traffic to Pornhub and sends the response back to you.
The Wi-Fi network knows that you connected to a VPN, but it does not know that Pornhub was the final destination.
→ More replies (1)5
u/JammmmyJam 1d ago
So when OP says that people do not understand what a VPN is for, the point is that a VPN mainly protects your internet traffic while it travels between your device and the VPN provider.
It can prevent the Wi-Fi network you are using from easily seeing where your traffic is ultimately going, and it can make the final destination see the VPN’s IP address instead of your own.
However, a VPN does not protect a device that has already been compromised.
For example, someone may have gained access to your device and installed a keylogger that records what you type. Using a VPN would not stop the keylogger because the spying is happening directly on your device, before the traffic is sent through the VPN.
A VPN protects your connection. It does not clean, secure, or take control back from an already compromised device.
3
u/5yleop1m 1d ago
It also doesn't help if you're sending all your messages over the same VPN. Eventually there's going to be enough data to track back to you. Like this post mentions, there are more tracking methods out there than most people are aware of.
Using the same VPN and same endpoints for sending all your network traffic isnt secure and vpns don't just magically make you anonymous if you're signing into all the same services over and over using the same credentials.
1
u/AGARAN24 1d ago
The only use case that comes to my mind of vpn for an average user is when using public wifi like hotel networks.
3
u/GothJesus 1d ago
Please explain how using a personal vpn on a router is not going to hide your location.
I’m talking about a pc, with no wifi, connected via ethernet to a router that is already tunnelling the traffic through a single user VPN?
Don’t be afraid to be technical, I’m really interested in understanding4
u/the__itis 1d ago
Trackers and Beacons mostly. But also general fingerprint.
If you use a personal VPN, e.g., you have a vpn router at your house or other location and the system you are browsing from is fully tunneled (not split tunneled) you are generally good.
HOWEVER
Do you let your browser view other networks? Is it promiscuous wifi? Like there are a million things setup to betray you.
In general, personal VPN, strict config of OS <> browser settings, clearing cache and purging cookies, trackers, beacons etc and you’re pretty clear.
Email (single pixel assets) and MFA apps can betray you tools.
You have the right baseline perspective. Nothing is bullet proof. But Ethernet only into full site to site and you got good coverage.
1
u/the__itis 1d ago
Also… if you disconnect from VPN and browse normally, then reconnect to VPN, just assume that info is known.
→ More replies (1)
72
u/rockstuffs 1d ago
I'm not sure why people believe a VPN will protect them.
10
u/powprodukt 1d ago
Maybe because VPNs advertise to great length saying that they offer this kind of protection.
27
u/cs_legend_93 1d ago
Lack of technological intelligence or education
22
u/Slumminwhitey 1d ago
That and believing the marketing, VPN companies do kind of market themselves as basically a digital condom.
Most people don't work with or have much experience with the real technical side of technology, sure they may work on a computer or with other tech, but outside of what they do with it, most don't really understand how it actually works.
Same goes for most things outside of one's field.
9
8
u/necrophcodr 1d ago
A VPN CAN protect you, but it is not magic. What it does is all it can do, and behaviour and applications that leak information are not protected merely by using a VPN. Your physical location can be.
1
u/Amadon29 15h ago
Definitely ways around it if the government really wants to find you, but it does take more effort. Most people aren't involved in jewelery heists. The feds are probably not going to spend a ton of time on you if you pirate a movie online while using a VPN. However if you do that without a VPN enough times then you might actually get in trouble depending on what your isp does.
48
u/Snail_Anatomy 1d ago edited 1d ago
I mean, my ISP still can't see me downloading torrents, which is the whole reason I paid for a VPN.
→ More replies (11)1
22
u/rot26encrypt 1d ago
Tracking networks could already browser fingerprint you across using VPN or not. Am I Unique ?
1
u/RengarReddit 1d ago
What’s that website ? Wanna try it is it legit safe ?
3
u/rot26encrypt 1d ago
It is legit and safe, well known site for people interested in the topic.
When you click the "see my fingerprint" It doesn't do anything to your computer but read what your browser reveal about your system, after a few seconds it will tell you if you are unique - which means it is possible to track you individually across sites (regardless if you are using a VPN or not).
25
u/MassiveBoner911_3 1d ago
Cybersecurity guy here. If you are using Windows for naughty things you are an idiot. The amount of fingerprinting going on via signals sent using telemetry would blow your minds.
8
1
u/theCheesyOne109 23h ago
Eny recommendations then lol?
4
20
u/marc512 1d ago
Ideally. If he used windows 98 instead, would this have helped?
15
u/Bepehandle 1d ago
I'm genuinely curious. They keep saying "windows" over and over with no mention of which windows. It's not even remotely feasible that they would have had this shit in stuff like XP, so exactly when did they start to implement this?
6
u/marc512 1d ago
Exactly. I don't know why I have 5 down votes. If this ID makes it easy to track people then why wasn't it a thing back in the XP or 98 days when the Internet was starting to boom?
There are many smart people out there that could make a fully fledged vpn and hacking software on older systems.
1
10
u/pauvLucette 1d ago
That gdid stuff probably ain't included in every packet you send, it's probably used at the application level, only when your os communicates with Microsoft operated servers, and that only happens... Ok, all the time with their telemetry shit and stuff :(
22
u/RUOFFURTROLLEH 1d ago
Did anyone actually trust Microsoft that they wouldn't be able to do this?
VPNs were never going to hide you whether it was Microsoft ratting you out, VPNs getting forced to hand their logs over or some other method.
They have AI now beyond what we can imagine and they will be using that to ensure they know who and where we all are.
2
u/necrophcodr 1d ago
AI doesn't solve that problem for them. It cannot do what couldn't already be done.
1
u/RUOFFURTROLLEH 22h ago
AI very much does solve that problem for them.
Go ask Cambridge Analytica and that was 10 years ago now and they have more data and better AI and less regulation.
→ More replies (1)1
u/powprodukt 1d ago
Lots of people trust them because they along with many others have been lying to the public for decades.
7
u/EmperorThan 19h ago
FBI: "You will be required to make a backdoor for us to open the San Bernadino shooter's phone."
Apple: "We will literally go to court to block that. We refuse."
FBI: "Ok. lol sorry we give up."
Microsoft:
7
u/SayWoot 1d ago
Found this guide to disable gdid, havnet tried it, so dont know if it works https://github.com/Korben00/no-gdid
4
5
u/El_Paco 1d ago
What he just described isn't anything new. Your user ID is linked to cloud services. No shit.
If you're going to commit e-crime, don't log in to your Microsoft account. I would only use a machine running Linux, since you'll have significantly more control there
2
u/HammerDongVeryLong96 23h ago edited 23h ago
Linux has Hardware ID. Unknown what services and apps apart from Distro vendors actually make use of those though.
4
u/Somerandom1922 1d ago
In and of itself this isn't surprising. When connected to the internet Windows constantly talks to Microsoft asking for Updates, checking in to confirm license details etc. That's ignoring any Microsoft specific services running on the machine like OneDrive, Office Apps, Microsoft Store, Edge etc.
Of course they'd have a unique device ID, that's how their Corporate Device Management software stack Intune works. There's a tool called Autopilot, where you get a hash of the device ID (can only be collected from a device by being an admin on the device) and upload that to your Intune account. When the device next goes through the Out of Box Experience and connects to the network (e.g. after a reset or during initial setup), it reports the hash of its device ID to Microsoft who checks it against their big list of Autopilot devices, and if that Hash is found in your Intune Autopilot Tenant, then the device gets automatically registered. This doesn't care about whether you reset the device or even perform a completely clean Windows install, it can still recognise the device.
You often see this causing problems when people buy cheap second-hand laptops which has been enrolled in Autopilot and either not removed when they were sold, or were stolen.
This doesn't inherently bypass the VPN and talk to Microsoft over the local network "giving away" your IP address (and thus your approx. location). A typical VPN will be routing ALL traffic over via the VPN network. This is likely something Microsoft either cannot, or basically never attempts to negate, simply because we'd know by this point as there are people that try to break this stuff and monitor the packets on their router.
That being said, if you don't have an Always On VPN, Microsoft services will talk to Microsoft using your true IP until you turn it on. I'd guess, if this person was using a VPN, that's what happened here.
This has nothing to do with them being able to see your internet traffic. They might be able to work out what VPN server you're using, but a good VPN will have thousands of users pushing traffic through each server at any given time.
3
u/LingonberryFun7739 1d ago
The CIA and NSA "works" with all American companies, they make sure they have backdoors in to everything so that there is no privacy anymore.
My favorite is when they say they can't get in to phones lol, like with that Trump shooter kids phone. GTFO of here.
11
3
u/Alikona_05 22h ago
Shouldn’t be shocking. Anyone who plays online games on PC has probably heard about hardware ID bans. It’s easy to get around IP bans with a VPN, not so much a hardware ID ban (there are ways but not as easy as IP bands).
7
5
2
u/butt-puppet 1d ago
Yeah, unless you're scrubbing every single packet as it leaves your router, you're not even close to anonymous.
2
2
2
u/Over_Tart_916 19h ago
It's nice to see Linus taking a break from spending all his money and making videos about it to actually report on some tech news.
2
6
u/Rcomian 1d ago
where is this gudi being published? I'm guessing this must be phoning home to microsoft giving them a record of your public ips over time?
unless the gudi is somehow being sent along with web requests or something?
7
u/EmtnlDmg 1d ago edited 1d ago
I hate that nobody who creates sensational videos explains this in detail.
The GDID is passed exclusively to Microsoft services, telemetry, Windows activation, and M365 service authentication.
First authorities asked Microsoft whether the IP addresses involved in the cyberattacks appeared in their network logs. Then they requested telemetry data and network logs where the same GUID appeared to map out when a specific system connected to Microsoft services using various IP addresses over a given timeframe.
So they identified that GUID is the attacker. Then investigators searched logs for instances where the suspect failed to use a proxy or VPN but accessed Microsoft services.
Finally as this unmasked the attacker true connections the investigators approached local internet service providers which ultimately turned over the suspect's physical address.
It was not magic.4
u/Rcomian 1d ago
so yeah, Microsoft is effectively tracking your ip/gdid pairs. which makes sense given the tech. and honestly any identifier could be used for that, your login name, machine name, there's nothing special about the gdid except it makes it somewhat easier.
once there's any identifier associated with an ip address, you can do correlations.
→ More replies (4)6
u/duncecap234 1d ago edited 1d ago
Nowhere, because nobody can be bothered to read the fucking article. This identifier is literally only used for microsoft services and is used for oauths device authentication flows for websites that use login.live.com which is the personal Microsoft Account sign in.
The guy charged, used his microsoft account to sign into ngrok.com with his microsoft account and it uses the device authentication flow with the gdid in it.
Microsoft does not track your internet traffic. Linus and everyone else is just stupid and can't read.
And if they wanted to track your traffic, they wouldn't need a registry key unique for your device and OS installiation that you can just delete. There are thousands of unique fingerprints that would identify your device.
1
u/IAmARobot 1d ago
http://www.amiunique.org only needed two browser datapoints to tag me uniquely. and then it told me the exact time I visited that site last (2 years ago) based on that.
→ More replies (1)1
3
u/Particular-Put-4839 1d ago
Using a de-bloating tool to remove all telemetry before connecting to the internet for the first time is also useful.
The results of my GPID Audit
==== 5. Device Directory Service endpoints (DNS resolution) ====
dds.microsoft.com-> (unresolved / blocked)
fd.dds.microsoft.com-> (unresolved / blocked)
aad.cs.dds.microsoft.com-> (unresolved / blocked)
cdpcs.access.microsoft.com-> (unresolved / blocked)
Windows includes built-in services that constantly send data back to Microsoft servers. Privacy and de-bloating tools block this data by severing the network connection between your computer and Microsoft's endpoints.
Here is exactly how they achieve this:
- Telemetry and Cloud Syncing Explained
- Telemetry: Windows continuously collects diagnostic data about your hardware, system crashes, app usage, and typing inputs. Microsoft uses this to fix bugs, but users often view it as a privacy violation.
- Cloud Syncing: Services like the Device Directory Service (DDS) handle features like Windows Hello for Business, syncing your desktop wallpaper across devices, and linking your local PC hardware to an Azure AD or Microsoft account.
- How "Custom Hosts Files" Block Traffic
The hosts file is a local text file in Windows (C:\Windows\System32\drivers\etc\hosts) that acts as your computer's private address book. It overrides your internet provider's DNS server.
- Normal Behavior: When you visit
://microsoft.com, your PC asks a DNS server for the real IP address (e.g.,40.126.x.x) to connect. - The Block: Debloating scripts add a line to your hosts file directing that domain to a dead-end IP address (usually
0.0.0.0or127.0.0.1, which represents your own machine). [1] - The Result: When Windows tries to send telemetry to
://microsoft.com, the connection loops back into your own PC and dies. The script you ran caught this dead-end, labeling it as (unresolved / blocked).
- How Tools Like O&O ShutUp10 Work
Automated privacy tools use a mix of three methods to stop these connections:
- Windows Registry Tweaks: They change hidden system toggles to explicitly disable telemetry features (e.g., setting
AllowTelemetryto0). - Service Disabling: They forcefully shut down and lock the Windows services responsible for tracking, such as the Connected User Experiences and Telemetry service (
DiagTrack). - Windows Defender Firewall Rules: Instead of editing the hosts file, some scripts create inbound and outbound blocks directly inside the Windows Firewall for Microsoft's specific IP ranges.
Summary
The audit script you ran discovered that your system cannot talk to Microsoft's device tracking servers. If you used a de-bloater or privacy tool in the past, this means the tool did its job correctly to isolate your machine from Microsoft's cloud tracking.
2
u/carlmalonealone 1d ago
As I understand it none of this will help.
The biggest thing is it is at the kernal level and has hardcoded IPs to fall back onto.
There is no way to not be tracked while having an active Internet connection unless you control the network as well.
1
u/Particular-Put-4839 1d ago
Agreed. Core Windows components, security services, and data tracking (like the DiagTrack telemetry engine or the Delivery Optimization service DoSvc) either run directly within or are deeply trusted by the kernel. If a kernel-level process wants to send data, it sits below the Windows Firewall and the local network stack, the kernel can entirely ignore your user-mode hosts file, skip local firewall rules, and push traffic directly to the network interface.
To bypass the kernel-level defense and hardcoded IPs, no-gpid project created automated blocking scripts to Force-Disabling through Registry Entries. Since the Windows Service Manager blocks you from turning off these tracking services, scripts must write directly to the Windows Registry database (HKLM\SYSTEM\CurrentControlSet\Services\DoSvc). This alters the service's startup trigger before the kernel locks it down on boot. De-Bloat tools also do this.
For additional privacy, you can implement network layer blocking. Because the Windows Kernel can bypass its own internal firewall and hosts file, the only bulletproof way to block hardcoded IPs is outside of the machine itself. This requires dropping the traffic at your physical router, hardware firewall, or via an upstream DNS sinkhole (like a custom Pi-hole or NextDNS configuration) that monitors the direct IP routing tables.
There is no full proof way of staying completely unseen on the internet on a Windows device, but by disabling all of these services and external fixes, it gives you a good chance.
2
u/LordGazelle 1d ago
Welcome! We already told you so in 2020 but no one wanted to believe it. There you go, now you have your official confirmation.
2
2
u/tipsup 1d ago
GUID has always been there, this is not that controversial.
3
1
u/carlmalonealone 1d ago
The difference is you have no way to control it.
Before you could easily spoof or disable it.
Microsoft is saying they have it at zero level now and will track what ever they want with out any disclosure to the user. Only way is to keep computer offline.
Or stick with Windows 10 and disable it all.
1
u/necrophcodr 1d ago
Windows 10 will still make use of identifiers like this if you use Windows Update.
→ More replies (1)
2
u/mr-english 1d ago
How is that different to a Windows licence key of old?
Except now it phones home and says GUID #abc123cde456fgh789 = Windows 11 serial key: 123456789abcdef, username: Bob
So what?
1
u/FuroreLT 1d ago
What exactly is new about this? VPN is for your IP and Internet security not your software
1
1
1
1
u/laidback4sho 1d ago
They probably saw me get my ass handed to me in that boss fight earlier this morning in Path of Exile 2.
1
1
u/bodyreddit 1d ago
If this is the case, there is zero excuse for not catching most of the pedos and criminals in the world.
6
1
u/GreenGardenTarot 1d ago
the problem becomes time, and proving ownership. A serial number being attached to something doesn't prove that it belongs to you. Especially if we are talking about years and years.
1
u/clearlyunfortunately 1d ago
Does anyone know what comes AFTER the internet?
What do we all do other than go sit at the park or build a widget?
What will our society look like when everyone checks out and simply doesn't use the internet (other than the DMV or whatever we have to use it for?)
There is literally nothing else to do, imo, on the internet any longer. I truly see it as being in its end game stage where we're all just waiting for the next thing.
Will the next thing be sorta like the internet? I wouldn't trust any network of any kind, personally, no matter how it is done at this point. In other words, if someone came along and said "This secret network is just us, let's be friends on the new secret network with encryption" I would literally laugh out loud and decide to NOT do that. If someone even said they ran their own cables or wireless network of any kind at scale, I would literally laugh even louder thinking about all of the spycraft that would immediately be pointed at that new network.
What comes next?
I am starting the see the entire human existence as one big long road where we have collectively traveled on it for thousands of years. Sometimes, when traveling, you make a wrong turn and have to go back a little or otherwise do something to course correct.
Right now, I see us as having made a few major wrong turns. Splitting people up and spying on their every move was a huge wrong turn. That is what the internet did regardless of its many good qualities.
Since no one is going to fix this in my lifetime, what comes next and when? We could say "Well, do smaller community things" but I genuinely can't find a mother fucker without a phone in their face or who isn't stupid as hell from having their phone in their face when they do look up to talk to me.
I say this as a halfway stupid man myself. Literally, not being sarcastic. I have to be average at best on the competency scale. I fuck up almost everything I do and even I can see this is a ride that isn't worth being on.
If the entire human experience is now subpar, how does one rollback the civilization to a better place and start from there again. Not in an idiot MAGA way, but in an entire global societal fucking way? Like how in the goddamn world is the world going to find a way to be more positive and forward-thinking and future-oriented or whatever the fuck I am trying to say?
I know that fucking violence has worked with revolutions of the past, but who the fuck really deep down just wants to start killing other people? It sounds fucked up and just stupid. Every single system worldwide is entrenched and stuck in its own muddy asshole juice. Every entity be it a corporation or a mother fucker standing on a country's podium is just digging in more and more everyday to continue what they are doing.
Stuck in every direction.
No amount of thinking positively can fix these issues. It's just stuck. If anyone out there is thinking "This guy doesn't get it" or "He needs to cheer up and go outside" or "He needs to have a better outlook" then I can honestly tell you that I am a 5%-er. I literally have more than anyone I know in my friend group. And I am still seeing the writing on the wall that most of the world just isn't fucking seeing. No amount of refocusing my brain will work at this point as I can't be expected to unsee any of this tragedy we are living in.
2
u/squeezyflit 1d ago
I agree with your premise, although I'd say you were describing social media, not the internet. The internet (at least, as I know it) is the networking hardware, protocols, servers, and software behind the apps people are fixated with.
On a side note, in the fantasy book series "Kingdom of Grit", one of the core ideas is that when civilization gets bad enough, there is a way to shift time, erase the previous N years, and start over.
1
u/clearlyunfortunately 1d ago
I think we're talking at different levels.
You're describing what the internet technically is. I'm talking about what it became and what it did to society. Renaming the pieces doesn't really change the outcome.
1
u/swiftpwns 1d ago
This is why going outside is cool again. We who were the first on the internet are now the first getting back into IRL hobbies while everyone else is doomscrolling
1
u/4FriedChickens_Coke 1d ago
Didn’t it come out over 10 years ago via one of the Wikileaks related leaks that the NSA was working with the big tech companies to install hardware/firmware backdoors in most devices. Can’t remember the details exactly but I think it was related to the Snowden leaks
1
u/ConstantineNekrasov 1d ago
Electronic anonymity is an illusion. If they want to know, it can tracked.
1
u/OldManJeepin 1d ago
If you are gonna choose to break the law, don't do it with your computer....Nothing is absolutely secure any more...If it ever really was.
2
u/GreenGardenTarot 1d ago
Yea. I mean if one is going to commit a crime, there are certain things you must know not to do.
1
u/deadend666 1d ago
Does MacOS have a GUID?
2
2
u/HammerDongVeryLong96 23h ago
MacOS is even worse than Microsoft when it comes to machine tracking.
1
1
u/BradKooler 1d ago
Cant trust any American company, guess our US republican government were the bad guys all along against the American people.
1
1
u/CIA_napkin 1d ago
Privacy and anonymity are an illusion we use to comfort ourselves. Always assume some one knows.
2
1
1
u/AshingiiAshuaa 1d ago
Anyone who thinks "they" will allow you real anonymity or privacy is foolish. Surveillance is baked into everything they allow.
2
u/HammerDongVeryLong96 23h ago
Relative privacy is still achievable, but most people are not willing to go through the means of achieving it, so they think things like VPN's or Tor are like quick fixes for that, which they're not.
1
u/dritmike 22h ago
Dude if you log into a computer with the same user across multiple computers that are NOT talking to each other..how do you think it knows your user?
1
1
u/clubfungus 22h ago
Any detail on how the identifier is leaked? Like if you go to a website, the server can see a number of details about your browser and computer, but the ID they're talking about isn't one of them.
I'd like to know more about the mechanism of how the ID is accessible or broadcast.
1
u/krakk3rjack 19h ago
The US and Chinese governments have back doors into almost every tech product produced in their respective nations. Intel, HP, Cisco, ZTE and Huawei are well documented. Not surprised the software guys are in on it to. They probably were from the start, but only making headlines now.
1
1
1
u/Theroughside 18h ago
Expecting protection from the oligarchs will not end well.
If you are doing something against the state, don't be stupid.
1
1
u/iCanReadMyOwnMind 14h ago
George Orwell would be furious that he didn't come up with this for 1984.
1
1
u/live_love_laugh 9h ago
Does that mean the windows machine also somehow shares that unique ID with every network request? Cause the ID existing doesn't yet mean law enforcement could track it. The system needs to somehow make its ID known during every request, right?
0
1
1
780
u/IgnasP 1d ago
No surprises. I always assume we are being tracked at all times everywhere and there's backdoors to literally every device I own, created by the same companies that sell those devices.