This article, and most articles about this, doesn't explain where FBI got that GDID from. Ok, Microsoft has a list of IP addresses that has been used by a computer with a certain GDID, but FBI needs to get the GDID in the first place, and then try to bind that to a person.
I found another article that explains the process a bit better:
> Stokes got caught because he used the same Windows device for everything, and the GDID stitched all of it back together after the fact.
> Scattered Spider members phoned the jewelry retailer’s IT help desk from Google Voice numbers, posed as locked out employees, and talked support staff into resetting three accounts, two with administrator privileges. From there they installed a tunneling tool called ngrok to get past the retailer’s network defenses, moved roughly 77 gigabytes of data to Amazon cloud storage using ngrok [...]
> Investigators later subpoenaed ngrok and found the account used in the attack had been created on May 12, 2025, at 19:21 UTC from a VPN proxy IP address run by Tzulo, a hosting provider. The IP was a dead end. VPN proxies do that. But the GDID is built different.
> Microsoft’s records showed that at that exact same minute, a Windows device carrying GDID g:6755467234350028 had visited the ngrok signup page. Three hours later, the same GDID visited the retailer’s own website, through the same Tzulo proxy address used to set up the ngrok account. It gave the FBI a device, that don’t rotate the way VPN exit nodes do.
https://www.windowslatest.com/2026/07/10/you-cant-fully-disa...
Although this doesn't explain where Microsoft got that traffic data from. How do Microsoft know which sites a computer visit?
"required" spyware: https://learn.microsoft.com/en-us/windows/privacy/required-d...
"optional" (but on by default) spyware: https://learn.microsoft.com/en-us/windows/privacy/optional-d...
This is my favorite:
Data Description for Browsing History data type
Microsoft browser data subtype: Information about Address bar and Search box performance on the device
* Text typed in Address bar and Search box
* Service response time
* Autocompleted text, if there was an autocomplete
* Navigation suggestions provided based on local history and favorites
* Browser ID
* URLs (may include search terms)
* Page title and notification text> Three hours later, the same GDID visited the retailer’s own website, through the same Tzulo proxy address used to set up the ngrok account.
"Oh look, this one has almost all the serial numbers of components and attached-devices as that other one, it's probably the same computer with a fresh install, let's make a note of that..."
https://petri.com/windows-10-ignoring-hosts-file-specific-na...
As I grow older, I simply do not have the patience or the will to do all these workarounds and tweaks to my OS to turn it from a piece of barely-working corporate spyware into something that I can call a productive tool.
It also seems like interacting with the OS is on its way out anyway, as most people essentially interact with computers via the browser (essentially a different sandboxed OS altogether), whether on desktop or mobile device.
when LTSC exists why are people using W11 ?
Microsoft is a post-privacy corporation. Eventually, we really have to stop acting so shocked about this sort of thing from them.
But do any popular linux distributions use an identifier? Ubuntu, Kali, Mint, Arch, etc?
It seems an attractive way for devs to work out telemetry. Awful in reality; but I imagine attractive.
But given there's no cloud accounts on linux I would imagine it's trivially changed just like a NIC's MAC
Also, seems unlikely it would be used for any single-signon with cloud services.
But it would be very foolish for a blackhat to turn on browser sync...
Using the school news paper shared account, I copied the bullies coursework in to the public share, made changes to the coursework on my own user account and then copied it back to their work folder using the school news papers account.
MS Office keeps an "Last edited by" field so I got caught. If I had used the school newspaper account to make the edit I wouldn't of been caught, rookie error. I too discovered a DCOM in the Windows 98 help file that revealed all the hidden shares on the network which scared the school. This was 2004 and I was 15.
Oh and the time, I bought a BB gun off someone at school. I was a librarian in the schools library and showed it off someone of the older grade year. The head librarian confiscated it and reported it to the headmaster. The guy then gave me a copy of Q3A and I stuck with violence the video-game way.
Ultimately there's no informed consent here: The average consumer is going to be surprised when they find out that Microsoft has a dossier of all their website visits, or that it can guess two people are in a relationship because their computers reported seeing one-another, or a dozen other surveillance-state things.
[0] It seems wrong to use the verb "leaks" when it's so obviously intentional.