jayshozie's personal blog

They have a Global Device Identifier (GDID) Tracker that functions as a fingerprint for your PC that can surpass VPNs, proxy servers and countries. Although it can't survive a clean reinstall of Windows (it can survive updates), because Microsoft forces you to go to the internet and log in into a Microsoft account, they will be able to get to you.

Microsoft kept it secret and it was only found out when the FBI tracked a hacker thanks to the information Microsoft gave them.

You should be paying attention to this, and possibly consider moving away from Windows. If a government, especially the US government, doesn't like you for some reason, this could be seriously concerning.

This article specifically notes:

For journalism, activism, or domestic abuse situations, skip Windows and use Linux routed through Tor instead of a commercial VPN. A GDID doesn’t care which VPN you use, only that it’s still the same Windows installation.

Other important quotes:

What has researchers uneasy is everything else the case reveals. Costin Raiu, a well-known malware researcher, asked on the Three Buddy Problem podcast how much of this exists on other platforms, and whether it is linked more permanently to hardware. Matthew Hickey, another security researcher, called Windows “surveillance software”.

Two things back that up:

There’s no consent screen. A GDID gets assigned when you sign into a Microsoft Account. Apple’s advertising identifier needs an App Tracking Transparency prompt and a visible reset; Android’s works the same way. GDID has neither, and a Windows reinstall only gets you a new number Microsoft can still get back to the same account.

Then there’s activation. Massgrave, the group behind Microsoft Activation Scripts, notes that Windows setup sends hardware info to Microsoft and gets identifiers back, the same tokens later used for Store access and licensing: “It’s impossible to prevent Windows from getting a GDID without breaking activation and UWP app[s].” Anyone who lost a license after swapping a motherboard has already met a smaller version of this.

Here's the complaint filed to the court, the primary source for the case mentioned in the article. You can find mentions of GDID on page 30 of the document or 34 of the PDF.

15 years old: i was so cringe when i was twelve, i'm super mature now though. i'm a totally different person. i'm basically an adult

18 years old: i was so. (trying to be nicer to myself) fifteen. when i was fifteen. i wasn't an adult even a little back then. i'm an adult now though of course

21 years old: i was so newborn fawn taking its first steps when i was 18. i wasn't an adult at 18 i'm barely even an adult now tbh

23 years old: i was so. hey wait the others have all gone up in increments of three why'd it change

23 years old: because i'm still 23 so i can't speak to that experience yet

23 years old: do you think anything will magically change in the next few months to the point where you can't possibly imagine how you'll feel at 24

23 years old: i mean you never know. anything can happen. they're letting people born in 2002 turn 24, for instance

Source

This month people have been tearing Flock cameras off their poles. Perched above public streets, they are birdlike things, weatherproof, and they photograph every passing car and file it in a searchable national database. Somebody cut two of them in half at Washington Avenue and Westcott in Houston, spray-painted the wreckage, and left an American flag on one of them. Police were notified on the morning of the Fourth of July. Somebody severed a camera in Rutherfordton, North Carolina. The police department posted the photograph itself and collected more than twenty thousand comments. “Not all heroes wear capes.” “Give them a medal.” Here is what the cameras do when nobody cuts them down. Cops use them to hunt immigrants and to follow ICE targets across state lines and to find women who ended pregnancies in states where that is a crime and to watch exes and to watch women they want, without a warrant and without a judge. A cop types a reason in a box and the box does not check. A man in Burleson, Texas, told deputies his girlfriend had taken abortion pills. He showed them the photographs, the FedEx envelope, the instructions. Deputies opened a death investigation into a non-viable fetus, and the district attorney told them the state could not charge her, and they searched anyway: 83,345 cameras across 6,809 networks, a month of everywhere she had been. The reason they typed was had an abortion, search for female. The search reached Illinois and Washington, where what she did was legal. They found her in Dallas. She came into the sheriff’s office a week later, and they thought she had come to explain the fetus, and she had come to report that the man who called them had put a gun to her head. A sheriff in Jerome County, Idaho ran his wife’s plate more than seven hundred times in three months. He typed the same reason every time. Test. The attorney general found nothing to charge him with. He retired in April. The Institute for Justice counts at least twenty-two officers who used the system to track people they were romantically interested in, and calls that almost certainly an undercount. And the cameras keep falling.