GDID Windows – Cut the tracker that follows you even under VPN

> Microsoft provided the FBI with the history of IP addresses tied to that specific GDID.

This article, and most articles about this, doesn't explain where FBI got that GDID from. Ok, Microsoft has a list of IP addresses that has been used by a computer with a certain GDID, but FBI needs to get the GDID in the first place, and then try to bind that to a person.

I found another article that explains the process a bit better:

> Stokes got caught because he used the same Windows device for everything, and the GDID stitched all of it back together after the fact.

> Scattered Spider members phoned the jewelry retailer’s IT help desk from Google Voice numbers, posed as locked out employees, and talked support staff into resetting three accounts, two with administrator privileges. From there they installed a tunneling tool called ngrok to get past the retailer’s network defenses, moved roughly 77 gigabytes of data to Amazon cloud storage using ngrok [...]

> Investigators later subpoenaed ngrok and found the account used in the attack had been created on May 12, 2025, at 19:21 UTC from a VPN proxy IP address run by Tzulo, a hosting provider. The IP was a dead end. VPN proxies do that. But the GDID is built different.

> Microsoft’s records showed that at that exact same minute, a Windows device carrying GDID g:6755467234350028 had visited the ngrok signup page. Three hours later, the same GDID visited the retailer’s own website, through the same Tzulo proxy address used to set up the ngrok account. It gave the FBI a device, that don’t rotate the way VPN exit nodes do.

https://www.windowslatest.com/2026/07/10/you-cant-fully-disa...

Although this doesn't explain where Microsoft got that traffic data from. How do Microsoft know which sites a computer visit?

I cannot believe people tolerate this kind of behavior from such a large company with a huge market.

It does make me wonder if people would react differently if Linux or Apple did the same thing.

Interesting, generally Microsoft bypasses the hosts file name resolution for various MSFT domains. Curious that these were not included (if it works, which I assume the mitigation does).

https://petri.com/windows-10-ignoring-hosts-file-specific-na...

I agree, tracking data via unique identifiers is evil incarnate, unless it's Google or VC-backed adtech doing it, because how else will they make money having architected their entire businesses around it.

I think it's likely that Microsoft is running a process to correlate "new" GDIDs to old ones, ex:

"Oh look, this one has almost all the serial numbers of components and attached-devices as that other one, it's probably the same computer with a fresh install, let's make a note of that..."

I have a sneaking suspicion that that ID can be deleted either with a specific service not running or with Windows powered off.

>Every finding here was reproduced on a real Windows 11 Pro VM (build 26200). Nothing is theoretical. See docs/technical-writeup.md for the evidence, tagged by confidence level.

That's sounds nice and all, but everything about it, from "Nothing is theoretical" to "evidence, tagged by confidence level" goes out the window when you find claude as one of the commit authors, and the content is clearly copy pasted output from claude with very little editing. Worse yet, one of the sources he cites is also clearly AI output.

I'm not even against the use of AI here. I would rather see it clearly say either "this is what claude found after I told it to investigate" or "yes this is generated by claude, but I independently verified each of the points myself".

Windows 10 LTSC IOT will be the last Windows I ever use.

As I grow older, I simply do not have the patience or the will to do all these workarounds and tweaks to my OS to turn it from a piece of barely-working corporate spyware into something that I can call a productive tool.

It also seems like interacting with the OS is on its way out anyway, as most people essentially interact with computers via the browser (essentially a different sandboxed OS altogether), whether on desktop or mobile device.

If you care about privacy, you simply cannot use Windows. Microsoft has made it clear over the last decade (if not longer) that they have a vested interest in compromising your ability to use software without exploiting and monetizing data about your usage.

Microsoft is a post-privacy corporation. Eventually, we really have to stop acting so shocked about this sort of thing from them.

Or just use Linux.

So, uhh, fuck windows and use Linux if you value your security and privacy?

this is a Windows 11 thing only?

when LTSC exists why are people using W11 ?

wow.. How is this not a bigger deal

Obvious workaround to get off windows and use Linux…

But do any popular linux distributions use an identifier? Ubuntu, Kali, Mint, Arch, etc?

It seems an attractive way for devs to work out telemetry. Awful in reality; but I imagine attractive.

[dead]

The performative outrage about the GDID is quite comical in the context that everyone continues to be mum about Google Chrome, a browser explicitly designed to hoover up as much data as possible about you, even having been caught doing it in Incognito Mode [1], all while touting "privacy" features; which means no one besides Google is allowed to do it.

[1] https://www.intego.com/mac-security-blog/google-forced-to-de...