It’s worth pointing out that this goofball was hunted down by Allison Nixon.
There’s a very easy trick to defeat this: use Linux.
If your system uses systemd, it has an etc/machine-id, which is used for a lot of different things. And changing it will break a lot of stuff, probably until you reboot. I guess you could write something to randomly shuffle it every time you reboot? But it is the go-to way for lots of programs (including browsers) to identify themselves. Which means (unless you have done the work to scramble your machine ID) you can be tracked on Linux as well.
Where in the source does Firefox expose machine-id to websites?
With a quick grep I’m only seeing it around audio?
If that hacker only knew about tracking by Windows…
I wouldn’t call overhauling your entire operating system, including finding alternatives to software you use daily, making sure your hardware is compatible and relearning your entire work method as an “easy trick”.
I think you might actually be surprised…
So they’re saying that all these “secret” societies online, like the Peter Thiel psychopathy, are relatively easily identified and rounded up and prosecuted to the fullest extent of the law, and they’re just choosing not to do it? I’m shocked.
Why would they catch pedophiles? Their founder is one
The level of naivete to think it’s a good idea using a microsoft account on a microsoft product for your illegal activity is astounding. Especially when you consider the amount of technical knowledge required to do such a thing.
I legitimately cannot make that connection, Microsoft has never been shy about tracking you or their tight relationship with 3 letter agencies. It doesn’t take a genius to know they are going to snitch, I figured that was a foregone conclusion.
Kids need to learn about OPSEC.
Agreed, using the same device for illegal and personal activity is dumb.
Yeah. What a moron.
Then why haven’t we heard about all the criminals (pedophiles, terrorists,…) being caught by Microsoft surveillance? Because they don’t care about the crimes you do. Their tracking is for money making only.
If I were a criminal I would not bank on it - they might use it for blackmail, too - but for the most part they are not in danger.
The current federal government is pedophiles, they aren’t going to arrest themselves.
Because you aren’t looking they take down people and groups all the time, it’s not their job to prosecute
I was gonna comment something about Linux distro also having a machine ID, but then I remembered that it’s not in a big database, and it’s so well enforced I routinely have multiple machines with the same ID pop up :D
Linux users will probably tell you their id if you ask them nicely and seem interested in their distro of choice.
Microsoft fucked their customers for the #69514026th time, will it be enough to make people switch to Linux, or do they just like being fucked? Who knows.
I downloaded this program called “Driver Easy,” which scans my hardware, searches automatically for driver updates, downloads and installs them for me. If I could download a wizard that got rid of windows, installed a nice user-friendly version of linux, while keeping my old programs, files and junk… I’d do it in a heartbeat. All I want to do is play my video games from Steam, download shit to watch, browse the internet, write in Libreoffice… Can I do all those things with Linux? Can I download some install wizard to switch?
If that wizard existed, a shit ton of people would switch. It’s just the idea of deleting my current OS and putting in a new one makes me thing I’m gonna brick my machine.
It’s always a good idea to back up your important files before a big change like switching operating systems, and your old software won’t work. But drivers haven’t been an issue for me in years. Mint is probably a super easy distribution for the switch. You can load it on a USB and give it a try before committing to the full install.
Steam works on Linux BTW. Actually a lot of my games run better on Linux than windows
Don’t delete your OS then. Just buy a small SSD to put Linux on and go from there.
I switched recently because they fucked me in a way I couldn’t deal with. To be fair, I’ve been experimenting with Linux on and off for 10+ years. But this was my kick to fully transition. Microsoft no longer serves convenience.
My laptop came with Win11, I’ve removed that drive a few months ago and replaced it with Mint.
Does this mean MS has my motherboard, WiFi, other hardware identifiers that would still tie that laptop to their database?
Yup!
Motherboard, CPU, GPU models and serial numbers. Ram size and speed. Those were used during Windows activation as old as windows 95. But likely yes, a full list of every component connected.
Your Android phone collects every WiFi network it has ever seen and sends it to Google, so we should assume Microsoft does the same (Android can locate you without GPS by using your neighbors’ WiFi signals as position identifiers, and can triangulate you to a few feet using the relative networks’ signal strengths)
GrapheneOS babyyyyy
Cannot wait for the Motorola/GrapheneOS collab phones.
Um… You’re aware that your pixel was known to google before you graphened it?
Never knew a google account, so it was known to Google but not to me. … but while on the topic, know of a better option?
Jolla Phone is just starting to ship
Promising…
so it was known to Google but not to me
Right, but you can assume google knows the imei and other hardware details, so they can probably link you to your identity on other platforms.
There is also the baseband issue. It is currently assumed that manufacturers could have access to snoop your LTE/5g and WiFi traffic, because the software running most phone baseband units is closed and not audited.
So you are probably private, but if you really want a phone with no Big Brother, you should get one from Pine64 or Jolla.
I’d love to. I bought an early pinephone and after about a day of trying to make it do basic functions I gave up. I’d LOVE to have a real Linux option but in my experiences so far we’re not there yet. I don’t see a better option than Graphene at the moment- it’s that solid.
Yes, I agree. We might not have rock-solid solutions, but less google is better.
I keep a oneplus 6t just to test Linux phone options.
Wait, what is the solution then? Genz are not going to settle on 10 yo laptop. They are going to buy new expensive AI-ready windows machine, replacing with Linux will do nothing privacywise? The only viable alt is to buy some obscure Linux laptop or old device? How old should it be anyway?
Oh, so to clear up confusion - switching to Linux destroys the local storage of the GDID, and Linux has generally much better privacy (to the degree the OS is involved - browser privacy is a related subject). However, it doesn’t undo the past - if you previously signed in with your MS account on that system, Microsoft will have that record in perpetuity.
Best solution would be to wipe any system you acquire without ever signing in to Microsoft. While switching to Linux will not change any of the components serial numbers that Microsoft has, you will at least not be actively associating most of your web activity with your M$ account.
Tangent - if you’re gonna do shady stuff, use VMs or TailsOS.
Android phone collects every WiFi network it has ever seen and sends it to Google
Possibly, but how often do you use WiFi on a phone?
Possibly, but how often do you use WiFi on a phone?
Basically whenever I’m at home or a relative’s house?
But why? Mobile networks are very fast nowadays. And how many homes still have routers?
fast ≠ widespread or consistent. mobile data tends to have excruciatingly low upload speeds (at least in my region)
Ah, then it makes sense.
…are you joking?
I would have used WiFi on my phone perhaps two or three times in the last year. My home does have a router, because we’re dinos, but most new houses don’t since everyone has a smartphone anyway.
Please note: I didn’t say you had to connect to these networks. This happens as a background process unless you do a ritual to shut off location services and actively work to keep it off. Most people do not know/care to do this. And even if it’s off in settings, some apps have the permission to temporarily override this (and will ask you once to grant it such permission and then have that permission for the lifetime of the app). And regardless of which app overrides said setting, Google gets a copy of whatever the background scan finds (for all Android phones that have the Play store installed, which is most of them).
Am I the only person who switches off the WiFi after use? I thought that was common advice to save battery.
I use WiFi at home and friends. I use cellular for work and travel (usually between home and friends). I’m glad you have a simple enough arrangement that it’s worthwhile to manage it by hand.
Further, in recent versions of Android, factory settings are set to automatically turn WiFi back on if turned off - plus there’s several methods to indirectly turn WiFi back on (https://thedroidguy.com/stop-android-turning-wifi-on-automatically-1261625). This is that dark patterns thing. Getting people to do what you want by being frictionless with your preferred options and ‘polite’ but obstinate about options you wish to steer people away from.
I use WiFi at home and friends.
This is the part I don’t understand. Mobile data would work in your houses too, right?
Further, in recent versions of Android, factory settings are set to automatically turn WiFi back on if turned off
I haven’t seen this happen, but I use MIUI (Xiaomi’s Android ROM) which tends to be aggressive in limiting battery use. It will actually cut hotspot if unused for a few minutes.
This is the part I don’t understand. Mobile data would work in your houses too, right?
Actually, first - ironically mobile coverage is terrible right at my new home since I moved. Great about 200 yards from home and most everywhere I go, but there’s a weird blind spot at my address specifically.
Second, Most mobile data plans are 30-80 Mbps†, most home WiFi plans are 300 Mbps-1Gbps†. WiFi isn’t just faster, it’s a lot faster. † your milage may vary, these are based on my experience
Finally, again this is another case of maybe I’m weird, but my friends and I are into retro gaming, and self-hosting and both of those have LAN-specific options that only work within the WiFi and home network.
If it was registered, probably. They use a mixture of that to allow re-enabling the same license on the same hardware.
OEM systems come with the license key stored in the firmware (ACPI tables specifically), you can read them from *nix easily enough.
sudo strings /sys/firmware/acpi/tables/MSDMIf you boot the system and login an account then yeah they’ll be able to link that, but the install itself can “self activate”.
It is truly god damn unfortunate that Microsoft has spent decades fostering a level of technical ineptitude among the average person that they cannot even consider getting off their fucking shit ass platform that “just works”. Because that is the real problem. So many people on here will say “just use Linux!” But the vast majority of people cannot fathom where to even start with that and won’t even consider it because Windows “just works” and it has done so for so long that people just can’t be bothered.
It’s easier than ever to use Linux these days and Lemmy certainly doesn’t lack for penguin faithful that’ll proselytize and condemn you to computer-hell if you don’t adopt their religion.
But the “”“problem”“” is that Windows works okay for the vast majority of users. Most of the annoying parts of W11 can be changed or disabled within the OS itself, without needing special tools or knowledge. And I think that the vast majority of users don’t even care enough to do that. We use stock W11 at work and while the “new” style right menus and shit are annoying, they still function fine.
Windows likely won’t lose serious market share until prebuilt PCs come with Linux instead of Windows installed. Especially the non-gaming prebuilts.
Windows “just works”
Honestly, I cannot understand, who can tolerate Windows 11. It does not even work! Constant bugs, eats memory like a hog, have to uninstall programs when updates itself (so constantly), because automatic re-installs. Every time you reboot, you have to kill several unnecessary background processes it automatically starts, or everything works even more like in tar. On my Surface Pro (Microslop made! Their own product!) the task bar never worked properly, every time there was an update to fix something, something else stopped working. Even the damn desktop broke few times, with random updates. It is a vibe coded piece of garbage.
I have everything I cannot switch to Linux, on Windows 10 - at least that still works. Windows 11 cannot even fill that bare minimum.
I have to use windows for work and its painful.
It does the opposite of just working.
The only part of “just works” that’s still “just” working is that windows comes installed by default on the vast majority of laptops. I dread having to use windows each time I have to, not because linux is that much better, but because windows is really just that much worse.
The average user was incompetent WAY before Microsoft ever entered the scene.
Knowing anything about computers is a lot more niche than you think.
Cant wait for someone to make or reveal they already have a GDID spoofer and can now make grandma look like the worlds number 1 hacker.
Also 10. And 8. Maybe since Vista actually…
Its doesn’t have a off switch but you can generate a new one.
Elaborate, Please…
I don’t remember the command but it was easy to find. There are a couple of ways to do it. I used a scheduled power shell script for the persons computer I did it for. They used it to avoid a annoying set of trackers that kept her from getting the lowest price on some equipment website. That was in 2020 or 2021.
Edit: I was mistaken about what generated ID I was talking about. You can however change GDID but it will force microsoft to reregister the installation so I don’t know how many times you could do it before microsoft refuses to do it again
Identifier. Not tracker. They’re not phoning home, thank god.
Ugh… How do you think they correlated the GDID to his social media?
It mentions this GDID is sent in telemetry. So this guy kept using a hosted proxy, meaning his egress IP was always changing accessing different services, but everytime his Windows 11 machine was sending back telemetry (which included his GDID) they were logging the IP address he was appearing from (the proxy) - so they were able to track and identify him.
If you use your Microsoft account to login, they have to be able to identify you somehow when you try to authenticate. It is basic usage. Not Telemetry. That is what caught him.
This is where I’m really fuzzy on the mechanics.
Any authentication is to establish an identity. At what point does that involve getting a unique id associated with an OS installation instance?
My original question is how the hardware id and ngrok get associated at all.
So, after getting frustrated and just going to sign up for an account myself, it looks like ngrok has options to sign is as a Google account, or sign in as a github account.
I’m guessing they picked github, and that’s why Microsoft had any visibility at all on the fact that they accessed a site that isn’t owned by Microsoft.
It still doesn’t answer the question of how the browser knows this id which is set at the os level. It still begs the question of what github authentication looks like differently between operating systems. Obviously a osx or Linux machine wouldn’t have that id at all. Is it part of the initial authentication request? Is there some kind of challenge and response?
Ctrl-f NSAKEY (sees nothing) — it seems the internet has forgotten the NSAKEY debacle https://en.wikipedia.org/wiki/NSAKEY
He’ so stupid for sending ransomware and logging into snapchat/facebook from the same laptop without even using VMs
arguably more stupid for using windows and assuming there was any level of privacy
