GDID is the persistent Windows ID that helped FBI trace a Scattered Spider hacker despite VPNs. Here's how it works and how to limit it.
    • whatiswrongwithyou@lemmy.ml
      121·
      11 days ago

      The same user posted a thread in this comm about the Linux equivalent, device-id, which is possibly more problematic.

    • const_void@lemmy.ml
      105·
      11 days ago

      Seems like the answer is never. The masses are too addicted to PC games to give it up.

      • FineCoatMummy@sh.itjust.worksEnglish
        3·
        11 days ago

        I agree. But I think more to the other side of it. I worry that a vast influx, who don’t care about privacy and computing freedom, would make for huge market pressure to lock down Linux. Same way we see Windows, IOS, Android locked.

        Game co’s, big tech, and others will demand it, if the masses flee to Linux. Today, most Linux users go nah, we want freedom more than your AAA game. If that changes, we could lose the very culture that resists locked down corporate controlled computing.

        • mic_check_one_two@lemmy.dbzer0.comEnglish
          3·
          10 days ago

          There are certain games that refuse to enable anticheat on Linux. So if you play one of those games, you’re forced to use Windows. But that isn’t Linux’s fault. It’s simply the game makers refusing to enable Linux support. Multiple game devs have even stated that it’s basically an “enable on Linux” checkbox on their end, but the publishers want that sweet kernel-level access on Windows.

    • iamtherealwalrus@lemmy.world
      44·
      10 days ago

      I have tried over and over for 30 years now and every time I discover something is missing, something I’m not willing to give up. Today it was Google Drive. There are multiple solutions for Linux to mount Google Drive as a folder in the local filtersystem, none of them offer decent performance compared to the windows client. Every time I try Linux something like this comes up.

      • shneancy@lemmy.world
        3·
        10 days ago

        could you elaborate on what you mean by “performance” of cloud storage? the speed of upload, download?

        • iamtherealwalrus@lemmy.world
          2·
          10 days ago

          The time it takes to open and list a directory using Nautilus in GNOME desktop. It can take 5-10 seconds with a directory of 5 files, a lot longer if there are 50 files in a directory. And all the “solutions” I find on the web involve some kind of guesswork and tweaking settings left and right, hoping to somehow hit a magic combination that works.

    • 0_o7@lemmy.dbzer0.comEnglish
      10·
      10 days ago

      Okay, buy the thing to take note here is what tech companies can hide.

      You know they’re tracking users but there are still things we’ll never find out unless they reveal it themselves or are made to reveal in indirectly.

      • BlackLaZoR@lemmy.world
        8·
        10 days ago

        On the other hand, open source software has everything revealed by default. It has no dirty secrets to hide

    • ☆ Yσɠƚԋσʂ ☆@lemmy.mlOP
      33·
      11 days ago

      Imagine your computer has a secret ID number that Microsoft gives it when you sign in with your Microsoft account. This number is like a permanent nametag that your computer wears. Even if you use a VPN to hide your location, that nametag stays the same.

      A hacker used a VPN to hide while breaking into a jewelry store’s computer system. But Microsoft helped the FBI find him because his computer’s secret nametag kept showing up everywhere he went online. They matched that nametag to his social media accounts and other stuff he did, and that’s how they caught him. Most people didn’t even know this secret nametag existed, and you can’t turn it off without breaking your computer.

  • BigBoyShuanzee@aussie.zone
    7·
    9 days ago

    My company is moving to Windows 11, I had one of my service desk teammates tell me that for an IT support person I’m very critical of change

    Before Windows 11 I was critical of change because every change came with no new training for my team and a giant email to the company explaining very lazily about the changes and with the same text at the end of every email… “Any problems call the service desk”.

    Now we’ve lost active directory… Now I’m in a position where an incredibly incompetent IT security have restricted our access to intune and Entra and then the business wants me to still perform my daily duties as normal.

    Upside is that same IT security is getting removed in the next few weeks.

    Probably to be replaced by someone else even worse.

    I just want to learn how to use Entra and Intune… Everything Microsoft touches turns to shit.

    Active directory just worked… It was built when people at Microsoft actually knew how the operating system worked… None of those people are still at Microsoft…

    • BlackVenom@lemmy.worldEnglish
      3·
      9 days ago

      If you enjoyed how AD worked, you’ll love how I tune and AAD don’t.

      And the workarounds for them… Like local management… Only get harder.

      Good luck.

  • mazzilius_marsti@lemmy.world
    6·
    9 days ago

    the fucked up thing is this GDID thing apparently also show up for VM. So that would mean any VM and even a Quebe?

    Fuck microsoft

  • Michael@slrpnk.net
    5·
    11 days ago

    Then there’s activation. Massgrave, the group behind Microsoft Activation Scripts, notes that Windows setup sends hardware info to Microsoft and gets identifiers back, the same tokens later used for Store access and licensing: “It’s impossible to prevent Windows from getting a GDID without breaking activation and UWP app[s].” Anyone who lost a license after swapping a motherboard has already met a smaller version of this.

    I guess this is why people always said it was impossible to remove the watermark that appears when you are not activated, when it was rolled out many years ago.

    Defeating the reasons for activation might’ve lead the more tech-savvy to figuring out the nature of the identifiers being sent for activation and seeing where else they are sent.

  • Aria@lemmygrad.ml
    42·
    10 days ago

    Smug Reddit-level takes left and right in this thread. The kid successfully hacked a website, you can assume he knows what he’s doing better than you and followed all the best practices short of not using Windows. They didn’t get his account from his Edge credential store. He probably used some Firefox-derivative. Tor browser if he was stupid. He probably “hardened” Windows every way he could think of, again, short of disconnecting from the internet. Windows simply does a good job of spying on you, that’s all it is.

    There are even people in the thread recommending running Windows games on Linux as a way to avoid this surveillance. If you put Microsoft Flight Sim on your Linux computer, then that’s now a Windows computer. Microsoft owns that computer, same as the Windows one. If you install Nvidia drivers, Nvidia owns that computer, and the USA can ask Nvidia for your accounts and whereabouts instead of Microsoft. If you put Steam on your Linux computer, that’s now Steam’s computer and the USA can ask Steam.

    There is no “safe” amount of malware.

      • Aria@lemmygrad.ml
        3·
        10 days ago

        The security of Tor is built on the assumption that one actor owning a majority of the nodes is improbable to the point of being written off as a non-concern. The tool has always been run and maintained by the USA government. When they opened access to the public, they owned the majority of the nodes, and with the amount of compute available to the NSA (look up the size of their official data-centres, add in their hacked bot-farms), it’s almost certain they still do. If it wasn’t their plan to always have supremacy, they aren’t doing their job. The purpose of Tor is to hide traffic from USA’s enemies. A few tens of thousands of private users is just reducing their power bill and painting targets on their own backs, not successfully hiding from the NSA.

        • chinaski@lemmy.ml
          2·
          10 days ago

          I appreciate the explanation. If not Tor, for very obvious reasons you specified, what is the better alternative?

          • Aria@lemmygrad.ml
            2·
            9 days ago

            There isn’t a 1-step perfect solution as far as I know. You can use Tor in combination with other technologies, and it’ll likely help you avoid a lot of surveillance, just not specifically the NSA. (Also keep in mind anyone/commercial actors can run Tor nodes with the intention of spying on Tor users. You need a lot of nodes to catch anyone, but I wouldn’t assume it never happens).

            The main thing is to own your software and hardware, and disconnect what you don’t own from the internet. If you can’t meet those conditions, then it’s impossible no matter how vigilant and knowledgable you are.

            My recommendations is to play your computer games on an offline computer via GOG purchases, or if you want Steam games, then just give up on securing that device. Have two networks. Have your secure computers for your general online tasks and chatting, and have the unsecure computer for interacting with DRM and services that lose a lot of functionality if the surveillance vectors are blocked.

            Bad attempts at hardening often don’t work, and have the adverse effect of making you more unique for fingerprinting. It might be worth foregoing some hardening advice if you can think of workarounds the hostile actor might use, which you don’t know how to counter-act.