Full Writeup of the Windows GDID

Discussion (14 Comments)Read Original on HackerNews

hyperrail•about 1 hour ago

How a Windows device's global ID is generated may be new info in the public sphere, but the fact that the global ID exists is not a secret. This format of device ID has been in Windows since the initial release of Windows 10 in 2015, when it was introduced as part of Windows' current telemetry subsystem. To see your device's global ID, open Windows Feedback Hub, then go to Feedback Hub Settings and look under Device Information.

ranger_danger•14 minutes ago

What I'm more interested in is how/where the GDID is used. Imagine if e.g. Edge started sending your GDID as a header in every single web request.

naturalmovement•4 minutes ago

I always assumed Chrome and Edge already did this — but sent the data to their respective masters.

Isn't every Chrome download unique?

rrix2•about 2 hours ago

one thing this doesn't touch on that I am curious about is how was browsing history, etc, correlated to the GDID?

murderfs•about 1 hour ago

Edge history syncing, presumably.

ggerules•about 2 hours ago

Wasn't this the GUID (Globally Unique Identifier) of early 00s Windows? When did it change to GDID? Are they the same?

wrs•about 2 hours ago

No relation. GUID is just a format for a 128-bit unique number, used throughout the software industry. This is a specific 64-bit number assigned to your Windows device.

miffy900•about 2 hours ago

Maybe try reading the writeup? GDID's are 64 bit for one thing, not 128 like GUIDs.

stackghost•about 1 hour ago

For those like me who were not abreast of this issue: the FBI was able to arrest some kid who hacked/is alleged to have hacked a jewellery retailer through a VPN. They were able to track the hacker via the user's GDID, which is a stable identifier unaffected by VPN usage.

This surveillance is certainly going to expand in scope as age verification comes into widespread usage. Personally I see little legitimate use case for this telemetry. It seems only useful for the purposes of tracking users for law enforcement or targeted advertising purposes.

Joker_vD•29 minutes ago

Well, it's a darn good thing there is nothing like that over here on the Linux side. I'm pretty sure that if e.g. systemd attempted to generate a unique, persistent machine identifier during the installation process, it'd be shot down and patched off extremely quickly.

chocolatkey•20 minutes ago

Linux does though?

  cat /etc/machine-id

ranger_danger•15 minutes ago

https://www.linux.org/docs/man1/systemd-machine-id-setup.htm...

xyst•about 2 hours ago

this is why Microsoft is pushing so hard for Microsoft accounts at install

ranger_danger•40 minutes ago

An MS account is not required for a GDID to be issued.

Full Writeup of the Windows GDID

⚡ Community Insights

Discussion (14 Comments)Read Original on HackerNews