GDID Windows – Cut the tracker that follows you even under VPN
Windows is tracking you with a persistent "GDID" identifier, a 64-bit PUID tied to your Microsoft account that sticks with you even under VPN. This story reveals how it was used to identify an alleged Scattered Spider member, sparking widespread privacy concerns among HN users about Microsoft's data collection practices. While the article offers mitigation scripts, the underlying message is a stark warning about the futility of true privacy on modern Windows.
The Lowdown
The article delves into the "GDID" (Global Device ID), a persistent 64-bit PUID that Windows assigns to a user's Microsoft account. This identifier is stored on Microsoft's servers and is re-downloaded by your PC, making it resilient to local deletion or VPN usage. Its real-world implications were highlighted when an alleged Scattered Spider member, despite using a VPN, was reportedly identified via his GDID, which Microsoft provided to the FBI.
- The GDID is not hardware-based but a persistent identifier linked to your Microsoft account, stored remotely, and re-downloaded if removed locally.
- Traditional privacy settings and disabling telemetry are ineffective, as the GDID is reported via specific services like Connected Devices Platform and Delivery Optimization.
- The author developed a set of scripts ("no-gdid") to mitigate this by disabling the reporting services (specifically DoSvc by modifying the registry) and blocking Microsoft's tracking endpoints via the hosts file.
- Crucially, these measures do not erase your past GDID data from Microsoft's servers, nor do they guarantee anonymity.
- The article concludes that for truly sensitive activities requiring privacy, using an alternative OS like a live Linux system is the only reliable solution, as Windows inherently makes such control difficult.
In essence, while you can take steps to curb future GDID reporting, Microsoft maintains a permanent record of your digital past associated with this identifier, emphasizing the uphill battle for privacy within the Windows ecosystem.
The Gossip
Deconstructing Data Disclosure
Commenters were intensely curious about how the FBI obtained GDID information and how Microsoft correlates browsing data to it. The initial story didn't fully explain this, leading users to cite external articles detailing how the GDID was linked to an ngrok account signup and subsequent visits to the target's website, even behind a VPN. There's significant debate on whether Microsoft actively tracks all browsing history or if data was correlated through other means (e.g., browser sync, app usage). Many expressed shock and outrage at the extent of Microsoft's data collection.
Linux Liberation and LTSC Limitations
A dominant theme was the suggestion to abandon Windows for Linux as the most effective privacy solution. Users expressed frustration with Microsoft's perceived corporate spyware tactics, stating they no longer have the patience for workarounds. Some discussed specific Windows versions like LTSC (Long-Term Servicing Channel) as a less intrusive alternative, though others noted GDID can still appear there. The general sentiment is that if privacy is a priority, Windows is no longer a viable option.
Skeptical Scripts and Systemic Struggles
While appreciative of the mitigation efforts, some commenters questioned the article's methodology, noting the explicit mention of AI generation without clear verification of findings. There was also discussion about the effectiveness of the hosts file block, with some pointing out that Microsoft often bypasses it for its own domains. Others debated whether the GDID is truly unchangeable, speculating that clearing specific registry keys offline might work, despite the article's claims.