🌤️

They have a Global Device Identifier (GDID) Tracker that functions as a fingerprint for your PC that can surpass VPNs, proxy servers and countries. Although it can't survive a clean reinstall of Windows (it can survive updates), because Microsoft forces you to go to the internet and log in into a Microsoft account, they will be able to get to you.

Microsoft kept it secret and it was only found out when the FBI tracked a hacker thanks to the information Microsoft gave them.

You should be paying attention to this, and possibly consider moving away from Windows. If a government, especially the US government, doesn't like you for some reason, this could be seriously concerning.

This article specifically notes:

For journalism, activism, or domestic abuse situations, skip Windows and use Linux routed through Tor instead of a commercial VPN. A GDID doesn’t care which VPN you use, only that it’s still the same Windows installation.

Other important quotes:

What has researchers uneasy is everything else the case reveals. Costin Raiu, a well-known malware researcher, asked on the Three Buddy Problem podcast how much of this exists on other platforms, and whether it is linked more permanently to hardware. Matthew Hickey, another security researcher, called Windows “surveillance software”.

Two things back that up:

There’s no consent screen. A GDID gets assigned when you sign into a Microsoft Account. Apple’s advertising identifier needs an App Tracking Transparency prompt and a visible reset; Android’s works the same way. GDID has neither, and a Windows reinstall only gets you a new number Microsoft can still get back to the same account.

Then there’s activation. Massgrave, the group behind Microsoft Activation Scripts, notes that Windows setup sends hardware info to Microsoft and gets identifiers back, the same tokens later used for Store access and licensing: “It’s impossible to prevent Windows from getting a GDID without breaking activation and UWP app[s].” Anyone who lost a license after swapping a motherboard has already met a smaller version of this.

Here's the complaint filed to the court, the primary source for the case mentioned in the article. You can find mentions of GDID on page 30 of the document or 34 of the PDF.

I also made a PDF version!!