Discussion summary
Microsoft can track users via a Windows Device ID, correlating browsing data with system activity. The extent of data collection and mechanisms remain unclear.
What the discussion says
- Some believe Windows telemetry is extensive and potentially intrusive.
- Others suggest it is similar to tracking mechanisms used by other device manufacturers.
- Users can check telemetry data via Windows tools like Diagnostic Viewer.
- There is concern about the transparency and control over what data is shared.
“Microsoft can correlate your Windows install to visited websites.”
“It's possible that Windows shares browsing data through telemetry.”
Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- Android has one too. If you don't link your google account to an app, they can use your device id as your profile.by nubinetwork
- I'm probably going to called a lunatic but I'm convinced this kind of telemetry is somehow linked to and behind the huge coordinated advertising push for VPNs in the last few years. More and more, the "invisible hand of the market" seems like literally the hands of a few very large conglomerations of power and capital that shape the economics of the entire market to effectively control it - they shape the gradient and make sure companies optimize loss. VPNs are either directly spyware that increases tracking capability, or are being offered now because they don't need your IP to track you anymore so they might as well make money off your fears while still tracking you. More broadly, I don't see much of a free market or democracy left anymore, now every government is doing a coordinated push to eliminate privacy as well.
- The most surprising part of this is a "hacker" using Windows ...by Alien1Being
- US Tech is fast becoming like Russia's and China's.by pluc
- Why when Americans do something do we feel like we have to mention the Russians and the Chinese?
Maybe I'm just bad at PR, though. If we call this "Chinese" behavior, maybe it will appeal a particular demographic who would normally support it in order to protect them from "Black Crime."
by pessimizer - Have you heard of a website called facebook?by d5lt5
- [dupe] Full Writeup of the Windows GDID
- Vague article. No evidence that Microsoft can see what web pages you are visiting in Chrome or Firefox (for example).by xnx
- Or even Edge with these options turned off:
>Send optional diagnostic data to improve Microsoft products [Includes how you use the browser, websites you visit, and enhanced error reporting. Determined by your Windows diagnostic data setting]
>Allow Microsoft to save your browsing activity including history, usage, favourites, web content, and other browsing data to personalise and improve Microsoft Edge and Microsoft services like ads, search, shopping, news, and Copilot [Includes your history, usage, favourites, web content and other browsing data]
by crtasm - From the reply you're replying to:
> 27. Microsoft records also indicate: <...> a little more than three hours after the ngrok account was created, the user visited “[Company F].com” from the .168 proxy server.
- Does this not violate European privacy laws?by contubernio
- GDPR only covers PII, this is a randomly generated ID that changes on every install on the OS.
You can mix it with other info to track a user, but it's not enough to de-anonymize someone on its own.
by Kipters - So what if it does? They'll get hit with a fine that will be the equivalent of 6 hours of revenue as they continue to be bastards.by weberer
- Probably yes it does. Not that it matters when you hack a website to have some expensive jewelry sent to your home address.by tosti
- So this kid uses his home computer at his home, and they trace him down with the IP address, and the IP address also makes a request for Windows Updates. And that narrows down the Device ID. The device id is now traced to this kid.
This is the kind of stuff privacy advocates have been raising the alarms about. This is the kind of capability that de facto erased all privacy assertions. And further led companies like Google to take advantage of this and erase assumptions of privacy all together.
by nashashmi - This goes a long way to prove that Microsoft does NOT care about your privacy, even if the header of their cookie consent claims so. They absolutely do not care, and this should be said about every big-tech vendor, not matter how lame it seems to say so. It is long overdue that we all say what needs to be said: they do not care about your privacy, your independence, or your well being. They DO NOT CARE.
- Big news: Fork found in kitchenby istoleabread
- I guess we’ll see a Windows tool that sets your identifier to this suspect’s “g:6755467234350028” very soon (weird ID, by the way. 16-digits makes sense, but I would have expected it to be hexadecimal)
Also, can anybody tell how “Microsoft had records showing that on May 12, 2025, at 19:21 UTC, the GDID associated with Stokes’ computer “accessed, among other ngrok pages, 'https://dashboard[.]ngrok.com/signup,'” works?
If it’s the browser sending that info to Microsoft, wouldn’t somebody have noticed that their PC contacts Microsoft for every web page they open? Or do they batch that data and send it at some later time?
Also, would that mean this ‘only’ affects those using Microsoft’s browser (or does Chrome do the same, sending data to Google?)
Alternatively, is this happening lower in the stack? I can think of a place where a system component has access to the domain name, but not of one where it has the full URL.
by Someone - Converting that ID to hex gives 18,000F,C8CB,93CC which rather looks like 32 bits of random data plus the prefix 0x18000f or possibly 40-48 bits of time in ms granularity from some epoch.by ralferoo
- A non-Edge browser would give the OS the domain name from the HTTPS connection and the page title because that's what it sets the window title to. I think that would be enough to identify the URL in a lot of cases (i.e. the sign-up URL sets the title to "ngrok Sign Up".by ndiddy
- > Also, can anybody tell how “Microsoft had records showing that on May 12, 2025, at 19:21 UTC, the GDID associated with Stokes’ computer “accessed, among other ngrok pages, 'https://dashboard[.]ngrok.com/signup,'” works?
That URL shows 16 blocked requests, it tries to load (at the very least) datadog and googletagmanager, I'm guessing the police simply reached out to all the analytics companies Ngrok ends up indirectly/directly sending data to, which ends up saving everything they get their hands on.
What surprises me the most is that the guy was using a Windows installation to do all of this. But then again, you only hear about the dumbest criminals who get caught, so I guess it does make sense after all.
- It's all parallel construction.by ptidhomme
- > (weird ID, by the way. 16-digits makes sense, but I would have expected it to be hexadecimal)
it's the decimal representation of a 64 bit integer
by Kipters - It was Microsoft Defender SmartScreen in Edge I believe. The visited domain is submitted to Microsoft to check it against known malware and phishing sites. And, as we're learning here, it is associated with the GDID (and Microsoft Account) which can be accessed via law enforcement requests.by boopig
- To me this indicates that Microsoft has some sort of traffic analysis performed on endpoints, then linked to GDID. I'd guess this is part of Defender's real time protection or MAPS.
Fun fact, Microsoft Defender MAPS was previously named SpyNet.
https://en.wikipedia.org/wiki/Microsoft_Active_Protection_Se...
The GDID identifier seems software in nature though. They could be more aggressive and tie it to the baseboard's serial number the way some games do. Then the hardware is tracked throughout its entire lifecycle, not just per instance of Windows install.
by midtake - that's the idea behind SecureBoot and the TPM chip is to provide the GDID based on hardware fingerprint. Some games already do this as "anti-cheat" measurements (tracking you) and Microsoft has been doing it since Windows 7 days. It's just that the TPM now gives you that hardware authority.by reactordev
- The interesting part is not really the existence of a machine identifier. Almost every modern OS has some equivalent. The bigger question is the boundary: which components can access it, and when does a local identifier become a remote tracking identifier? A machine-id sitting on disk is very different from an OS vendor correlating it with network activity.by lorislab
- Adding another example of this is the NetworkID in about:networking#networkid in Firefox. There was a point in time that cause some controversy. Every AI has the wrong information about it's origin and use.by Bender
- This is the part that isn't clear and is by far the most interesting. At what stage and what point did the GDID get correlated with a tool/web request. As is it almost sounds like Microsoft "telemetry" gathers everything and they did a bulk search for certain activity, pulling the GDID and correlating it with a user.by llm_nerd
- Systemd (part of many major linux distributions) has for example machine-id[1], readable by anyone on the machine under /etc/machine-id.
[1]: https://www.freedesktop.org/software/systemd/man/latest/mach...
by J-Kuhn