A Hacker's Arrest Reveals Microsoft Can Track Users Via a Windows Device ID

Poor kid. Seems he was just starting out and didn’t get into the weeds of OpSec.

He used a personal laptop with his personal information stored on it tied to an identifier. Not great OpSec. A hardware ID spoofer or a partitioned disk with different OS would’ve made wonders.

Microslop’s Software is spyware? Impossible, they are such a trustworthy company!

How does Microsoft know which GDID is accessing which websites?

The document adds that Microsoft records also showed the GDID accessing “multiple sites” from servers at Tzulo, a web hosting provider, to help pull off the hack.

The GDID is one thing, but how is the connection to activities made? Is the GDID sent while making requests to a server (in this case Tzulo), which records it? But then it wouldn’t be microsoft records showing that. But if it isn‘t, how do you know which GDID visits a website? If Microsoft is collecting which website is visited on device and sending it off to their servers then the GDID is the smallest thing to worry about.

Maybe I’m missing something here but how is that not a logical conclusion for any service where you have a unique identifier? If it can get your IP it can get a general idea (CGNAT/VPN can screw with it a bit), if it’s allowed network access it can get nearby APs, which are pretty well mapped at this point, and if you allow it GPS, well that’s a no brainer.

Ditch windows whenever you can. MS is pure evil and hates its customers.

Kinda his fault for using Window$ tbh

@Moovau That isn't news, they have been able to since the release of Windows 10.

First of all, no shit.

Second of all, this is obviously not theoretical…

Microsoft can associate the GDID with third-party services and the timing as well, giving Redmond a way to theoretically track a user’s online activity.

This shouldn’t come as a surprise, Microsoft can track everything you do on there platform.

Y’all are probably tired of hearing it, but Linux has come a long way, especially for gaming; spin up a VM and try a few distros out.

Why is there never any more detail how the GDID is then used to collect information?

The complaint says Microsoft had records showing that on May 12, 2025, at 19:21 UTC, the GDID associated with Stokes’ computer “accessed, among other ngrok pages, ‘https\://dashboard[.]ngrok.com/signup,’ the ngrok page to set up an ngrok account.”

How do the records show a GDID in connection to the website?

That’s why all my devices running that piece of shit stay at work. Far away from my network.

Early iPhones all had unique UDIDs that were SDK accessible. It wasn’t long before it was used to connect location data to devices and devices with specific users. Apple’s solution was to yank it away from developers and go with an identifier the users could rescind and reset (the ADID). It still let apps track people, but there was always the risk users would reset it and break the chain of data gathering.

The real solution is to limit access to the information as-needed. Like for maintenance, or warranty repairs. Everybody else can go pound sand. In the desktop/laptop world, a lot of hardware vendors just blithely let anyone access unique hardware IDs, which leads to the same privacy outcome.

TBF nVidia and Intel components supposedly had the same sort of capability for many years now: unique device ids.

But yeh, fuck windowsm

Linux distros have the same kind of device ID mechanism (/etc/machine-id or /var/lib/dbus/machine-id)… the only difference is how applications use it.

Hardly surprising. Fuck Microslop!

Every time something like this comes out I’m reminded how much telemetry exists that most users never think about.

MS is part of the surveillance tech that leo uses.