AI-generated "research" once more. How can anyone call it full writeup?
As someone pointed out in the X argument comments, this is unconfirmed and most likely NOT how the actual GDID being sent to microsofts servers looks like.
1. The GDID that most closely resembles the one mentioned in the DOJ indictment of Stokes is found inside the registry key Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\IrisService\IrisActionCreatives, which starts with the "g:" prefix and is explicitly called GLOBALDEVICEID. This keys holds cached response from microsoft servers and this is value microsoft servers consider a "GDID"
2. According to the research, a Microsoft account is required. No, it's not necessary. Whether or whether you are not logged into your Microsoft device, GDID is being filled in. Did AI forget to check that?
3. How can author claim this is full writeup of GDID, when you did not verify whether the value your AI found, is the one being sent along with telemetry network requests? Author did not even verify whether he found the right thing
I also verified the value computed as suggested by the repository's creator and it is different from the value discovered inside the Iris registry key that begins with "g:".
Summary: The value author of repo claims is a GDID, is not the same as saved on microsoft servers as GLOBALDEVICEID.
How a Windows device's global ID is generated may be new info in the public sphere, but the fact that the global ID exists is not a secret. This format of device ID has been in Windows since the initial release of Windows 10 in 2015, when it was introduced as part of Windows' current telemetry subsystem. To see your device's global ID, open Windows Feedback Hub, then go to Feedback Hub Settings and look under Device Information.
In a sense it doesn't matter how the global ID is used now. The fact that it exists allows it to be used in ways like what you describe, either by a malicious (?) Microsoft itself or by a malicious third-party attacker.
I'm familiar with these global IDs because I routinely used the Windows telemetry system as part of my work on the Windows core at Microsoft. We had strong policies on how and when we could access or use data for a single device as identified by global ID.
But ultimately, these policies will have a "government or court order" exception in reality even if not in theory, just like in most other consumer software observability systems. The Windows difference is simply the breadth of data that is intentionally collected by Microsoft or can be identified by any Microsoft-controlled IDs. That difference is huge in potential impact but very small conceptually.
I always assumed Chrome and Edge already did this — but sent the data to their respective masters.
Isn't every Chrome download unique?
It used to be even though the package contained an Authenticode signature, each installer stub download had a unique hash, because Windows' digital signatures allow a non-executable data area in the trailer which is not computed as part of the signed data.
There is zero technical reason to do this (generating unique binaries) aside from tracking purposes.
Ya. The FBI report to the court said that Microsoft showed the GDID visited the ngrok.com/signip page while using a VPN. I would have figured at that level the OS would not know domains but likely IP addresses. So it must be browser telemetry right?
For those like me who were not abreast of this issue: the FBI was able to arrest some kid who hacked/is alleged to have hacked a jewellery retailer through a VPN. They were able to track the hacker via the user's GDID, which is a stable identifier unaffected by VPN usage.
This surveillance is certainly going to expand in scope as age verification comes into widespread usage. Personally I see little legitimate use case for this telemetry. It seems only useful for the purposes of tracking users for law enforcement or targeted advertising purposes.
Well, it's a darn good thing there is nothing like that over here on the Linux side. I'm pretty sure that if e.g. systemd attempted to generate a unique, persistent machine identifier during the installation process, it'd be shot down and patched off extremely quickly.
How did they query his GDID/PUID to make the arrest though? Does the browser have access to it during some requests? Also, if it’s stored as plaintext, what’s stopping anyone from randomizing it on machine startup?
I'm guessing Ngrok gets subpoena'd, hands over the IP who created the account, page access timestamp, etc - FBI hands over to Microsoft, finds which Windows PCs were active with a certain IP on that time period, tries to correlate other characteristics such as OS version or anything to get a single hit, and then return other IPs used by that machine and everything else they have, like SmartDefender / Edge telemetry.
No relation. GUID is just a format for a 128-bit unique number, used throughout the software industry. This is a specific 64-bit number assigned to your Windows device.
> The court record itself says a reinstall produces a new GDID
That's a half truth if I ever saw one. Telemetry also includes the hardware hash (which does use SMBIOS serial number, CPUID, TPM identifiers, etc.) and that one survives OS reinstalls and even hardware swaps. It is the underlying id used for things like Autopilot (the equivalent to Apple's remote MDM lock).
Every little bit of hardware off an apple line is serialised out the wazoo, and the device's serial number is associated with every apple ID ever used to sign in to the device. I doubt it ever gets deleted. So yeah.
AI-generated "research" once more. How can anyone call it full writeup?
As someone pointed out in the X argument comments, this is unconfirmed and most likely NOT how the actual GDID being sent to microsofts servers looks like.
1. The GDID that most closely resembles the one mentioned in the DOJ indictment of Stokes is found inside the registry key Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\IrisService\IrisActionCreatives, which starts with the "g:" prefix and is explicitly called GLOBALDEVICEID. This keys holds cached response from microsoft servers and this is value microsoft servers consider a "GDID"
2. According to the research, a Microsoft account is required. No, it's not necessary. Whether or whether you are not logged into your Microsoft device, GDID is being filled in. Did AI forget to check that?
3. How can author claim this is full writeup of GDID, when you did not verify whether the value your AI found, is the one being sent along with telemetry network requests? Author did not even verify whether he found the right thing
I also verified the value computed as suggested by the repository's creator and it is different from the value discovered inside the Iris registry key that begins with "g:".
Summary: The value author of repo claims is a GDID, is not the same as saved on microsoft servers as GLOBALDEVICEID.
How a Windows device's global ID is generated may be new info in the public sphere, but the fact that the global ID exists is not a secret. This format of device ID has been in Windows since the initial release of Windows 10 in 2015, when it was introduced as part of Windows' current telemetry subsystem. To see your device's global ID, open Windows Feedback Hub, then go to Feedback Hub Settings and look under Device Information.
What I'm more interested in is how/where the GDID is used. Imagine if e.g. Edge started sending your GDID as a header in every single web request.
In a sense it doesn't matter how the global ID is used now. The fact that it exists allows it to be used in ways like what you describe, either by a malicious (?) Microsoft itself or by a malicious third-party attacker.
I'm familiar with these global IDs because I routinely used the Windows telemetry system as part of my work on the Windows core at Microsoft. We had strong policies on how and when we could access or use data for a single device as identified by global ID.
But ultimately, these policies will have a "government or court order" exception in reality even if not in theory, just like in most other consumer software observability systems. The Windows difference is simply the breadth of data that is intentionally collected by Microsoft or can be identified by any Microsoft-controlled IDs. That difference is huge in potential impact but very small conceptually.
When IE did this at the very beginning of the internet it was a real scandal.
then verizon did it for (to?) mobile phones.
I guess these things get normalized, people might say "those jerks" and then put it out of their mind.
I always assumed Chrome and Edge already did this — but sent the data to their respective masters.
Isn't every Chrome download unique?
It used to be even though the package contained an Authenticode signature, each installer stub download had a unique hash, because Windows' digital signatures allow a non-executable data area in the trailer which is not computed as part of the signed data.
There is zero technical reason to do this (generating unique binaries) aside from tracking purposes.
Can promise you a re-install does nothing for your privacy. Plenty of IDs are embedded in the hardware.
one thing this doesn't touch on that I am curious about is how was browsing history, etc, correlated to the GDID?
Edge history syncing, presumably.
Ya. The FBI report to the court said that Microsoft showed the GDID visited the ngrok.com/signip page while using a VPN. I would have figured at that level the OS would not know domains but likely IP addresses. So it must be browser telemetry right?
For those like me who were not abreast of this issue: the FBI was able to arrest some kid who hacked/is alleged to have hacked a jewellery retailer through a VPN. They were able to track the hacker via the user's GDID, which is a stable identifier unaffected by VPN usage.
This surveillance is certainly going to expand in scope as age verification comes into widespread usage. Personally I see little legitimate use case for this telemetry. It seems only useful for the purposes of tracking users for law enforcement or targeted advertising purposes.
Well, it's a darn good thing there is nothing like that over here on the Linux side. I'm pretty sure that if e.g. systemd attempted to generate a unique, persistent machine identifier during the installation process, it'd be shot down and patched off extremely quickly.
Linux does though?
https://www.linux.org/docs/man1/systemd-machine-id-setup.htm...
cool. we definitely needed this
Not wanting to be left out, FreeBSD has it too.
Is this sarcasm?
How did they query his GDID/PUID to make the arrest though? Does the browser have access to it during some requests? Also, if it’s stored as plaintext, what’s stopping anyone from randomizing it on machine startup?
I'm guessing Ngrok gets subpoena'd, hands over the IP who created the account, page access timestamp, etc - FBI hands over to Microsoft, finds which Windows PCs were active with a certain IP on that time period, tries to correlate other characteristics such as OS version or anything to get a single hit, and then return other IPs used by that machine and everything else they have, like SmartDefender / Edge telemetry.
So can you change/spoof your GDID easily?
Wasn't this the GUID (Globally Unique Identifier) of early 00s Windows? When did it change to GDID? Are they the same?
No relation. GUID is just a format for a 128-bit unique number, used throughout the software industry. This is a specific 64-bit number assigned to your Windows device.
Maybe try reading the writeup? GDID's are 64 bit for one thing, not 128 like GUIDs.
> The court record itself says a reinstall produces a new GDID
That's a half truth if I ever saw one. Telemetry also includes the hardware hash (which does use SMBIOS serial number, CPUID, TPM identifiers, etc.) and that one survives OS reinstalls and even hardware swaps. It is the underlying id used for things like Autopilot (the equivalent to Apple's remote MDM lock).
is there a mac equivalent to the windows GDID?
Every little bit of hardware off an apple line is serialised out the wazoo, and the device's serial number is associated with every apple ID ever used to sign in to the device. I doubt it ever gets deleted. So yeah.
Related background:
Windows telemetry used to track web activity, link VPN activity to source IP
https://news.ycombinator.com/item?id=48807767
U.S. v. Stokes https://www.justice.gov/usao-ndil/media/1450651/dl
this is why Microsoft is pushing so hard for Microsoft accounts at install
An MS account is not required for a GDID to be issued.
But without an MS accoutn it would not be connected to the browsing history