Something this article glosses over is the fact that Microsoft knew all of the web URLs he was visiting. I don't know if that's because he was dumb enough to sign into Edge with his Microsoft account or if they were collecting that a different way, but the GDID wouldn't have been nearly as useful without that info.
And able to identify the specific accounts he was logging into. How are they able to do that?
Edge can save passwords and creds, much like any credential manager.
IDK either. But so much is now like, ppl wanting privacy have to be right every time. The co's wanting our data, only once! A single hidden backdoor siphon to our data and we didn't protect ourself from it. A single telemetry that encodes every URL we visit. A single statistical way to fingerprint us.
That Sisyphus dude knows our pain.
Which is why open source is important. Holes can be found and software telemetry can be avoided.
A lot of the telemetry is sold to people as being in their benefit. Monitor installed software for updates, location data for weather etc.
If the companies had to document the amount they collected in cash for each user based on ads and send it as a mk though report, it might be eye opening. The source if the cash would also be good. So did companies pay directly or dodgy intermediaries and data brokers.
I know people in real life that prefer targeted advertising because it's "more relevant to their interests". I think they drank the kool-aid
IIRC that's been a known function of Edge ever since its redesign around 5-6 years ago, regardless of whether you're signed in all URLs go to Microsoft in plaintext
I don’t think Microsoft recorded the URLs, just activity from a GDID and IP address at particular timestamps. The authorities would also have subpoenaed records from other accounts they knew were his e.g. Snapchat and Facebook. The GDID was just a way of assigning activity from his device to particular VPN endpoints at particular times. The point of the story is essentially that the GDID allowed them to track his device across multiple IP addresses. But this wouldn’t have been possible without at least some other pieces of the puzzle such as knowing which was his Microsoft account, or Facebook account etc. in the first place.
Hacker
Uses windows
He got what he fucking deserved
Okay, buy the thing to take note here is what tech companies can hide.
You know they're tracking users but there are still things we'll never find out unless they reveal it themselves or are made to reveal in indirectly.
On the other hand, open source software has everything revealed by default. It has no dirty secrets to hide
Not only he uses windows, but a ms online account as well!!!
My company is moving to Windows 11, I had one of my service desk teammates tell me that for an IT support person I'm very critical of change
Before Windows 11 I was critical of change because every change came with no new training for my team and a giant email to the company explaining very lazily about the changes and with the same text at the end of every email.. "Any problems call the service desk".
Now we've lost active directory.. Now I'm in a position where an incredibly incompetent IT security have restricted our access to intune and Entra and then the business wants me to still perform my daily duties as normal.
Upside is that same IT security is getting removed in the next few weeks.
Probably to be replaced by someone else even worse.
I just want to learn how to use Entra and Intune.. Everything Microsoft touches turns to shit.
Active directory just worked.. It was built when people at Microsoft actually knew how the operating system worked.. None of those people are still at Microsoft..
If you enjoyed how AD worked, you'll love how I tune and AAD don't.
And the workarounds for them... Like local management... Only get harder.
Good luck.
Year of the Linux desktop anyone?
The same user posted a thread in this comm about the Linux equivalent, device-id, which is possibly more problematic.
Seems like the answer is never. The masses are too addicted to PC games to give it up.
It's not the PC games keeping people so much. Proton solved a lot of that problem. It's inertia.
Most people don't care about things. They just don't. Their brains just don't have the juice.
A lot is professional software. Many people have one or two pieces of software they use a lot which doesn't run on Linux.
Linux is PC...
Also you can play almost all games on linux
And in some cases they run better then on windows.
the fucked up thing is this GDID thing apparently also show up for VM. So that would mean any VM and even a Quebe?
Fuck microsoft
Don't forget the unique identifier of Edge and Chrome.
The complaint quotes a Microsoft representative describing the GDID as “a persistent, device-level identifier designed to uniquely identify an installation of a Windows operating system on a device, either a physical device (e.g., a mobile phone or laptop) or virtual machine, across certain Microsoft services and scenarios”
A Global Device ID (GDID) is a permanent, unique digital fingerprint that Microsoft automatically assigns to your computer when you install Windows or sign into a Microsoft account.
ELI5?
Imagine your computer has a secret ID number that Microsoft gives it when you sign in with your Microsoft account. This number is like a permanent nametag that your computer wears. Even if you use a VPN to hide your location, that nametag stays the same.
A hacker used a VPN to hide while breaking into a jewelry store's computer system. But Microsoft helped the FBI find him because his computer's secret nametag kept showing up everywhere he went online. They matched that nametag to his social media accounts and other stuff he did, and that's how they caught him. Most people didn't even know this secret nametag existed, and you can't turn it off without breaking your computer.
how dumb can you be to use unhardened windows to hack valuable shit omg.
even if you didn't know of this system (i didn't) it's well known windows scans for even the color of your underwear.
also to login with edge on top of that
I think we are too exposed to the movie-villains-geniuses. The reality is that most criminals are dumb.
the average lemmy user is much more tech literate than an average person
people really don't know that kind of stuff. to many a computer is a computer, it has internet, and plays games... what's an operating system?
damn, but even hackers capable of breaking into jewelery store systems?
like at this point the problem is extreme ignorance.
They were logged in while using it for crime? That's like posting about it on facebook.
basically
Thanks! He should have used Linux
unfortunately https://lemmy.ml/post/49710604
Calling him a hacker is pretty generous if he let them catch him like this
why would a hacker use windows?
Enhance!!!!
Goym Device ID
Does MS track what you do in Edge and Windows, yes. Does Google track you in Crome and any app of theirs, yes. Does Apple track everything you do on their devices, yes. Does meta, twitter, all social media sites track the fuck out of you, also yes.
Does Linux track you? Does LibreWolf track you? Does GrapheneOS track you? Does Vanadium track you? Does SimpleX or Signal track you? Does...
Never mind, I think you get my point.
tracking is a core function of pretty much all commercial software at this point
Then there’s activation. Massgrave, the group behind Microsoft Activation Scripts, notes that Windows setup sends hardware info to Microsoft and gets identifiers back, the same tokens later used for Store access and licensing: “It’s impossible to prevent Windows from getting a GDID without breaking activation and UWP app[s].” Anyone who lost a license after swapping a motherboard has already met a smaller version of this.
I guess this is why people always said it was impossible to remove the watermark that appears when you are not activated, when it was rolled out many years ago.
Defeating the reasons for activation might've lead the more tech-savvy to figuring out the nature of the identifiers being sent for activation and seeing where else they are sent.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
much thanks to @gary_host_laptop for the logo design :)