886
Microsoft admits Windows 11 has a GDID tracker with no off switch, first documented publicly in an FBI hacker complaint (www.windowslatest.com)
submitted 4 months ago by to c/technology@lemmy.world
201 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 3 months ago (11 children)

Another user said they think machine-id is readable by the browser. This is absolutely true, machine-id is working as described when it is read by any web browser.

So Linux isn’t sending your unique id to a central entity that can associate it with your ip, it’s sending your unique id to any entity you browse to that can then associate it with your ip.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 11 child comments
    •
  • [–] 1 point 3 months ago (3 children)

    If you're really worried about that, just change it every time you boot or something. There's a kernel parameter to change it.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 3 months ago (2 children)

    There is not a parameter to automatically change it every time the system boots, that solution doesn’t work for machines that don’t reboot often and it breaks stuff in systemd as volunteered by many people talking about it online and as verified by me two weeks ago when I tried that.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 3 months ago (1 child)

    I never said there was. There is however a kernel parameter to change the machine id, which I did say.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 3 months ago

    What you said was that if a person was actually worried about it there is a kernel parameter to change it.

    My reply was not intended to refute what you said but instead to illustrate how that approach doesn’t solve the problem of tracking and is not a workable solution for many systems and users.

    I made that reply to help you and any reader understand the depth and breadth of the problem, not to start a fight.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 3 months ago (6 children)

    It's intended to be read by applications on the system. That's like its whole purpose. If you know of any browsers sending it or otherwise making it available without hashing it with an application key first, that would be a problem.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 1 point 3 months ago (5 children)

    Yes as I said it’s working as intended. The point of machine id is to id a machine.

    A better solution would be to not rely on the various programs to hash the unique id and instead have the host read it, hash it and provide the hash to the program that asked.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 1 point 3 months ago (4 children)

    Yes as I said it’s working as intended. The point of machine id is to id a machine.

    Your claim was that Linux was "sending your unique id to any entity you browse" which is misleading at best. machine-id should never be transmitted and if it is, that software should be considered spyware.

    A better solution would be to not rely on the various programs to hash the unique id and instead have the host read it, hash it and provide the hash to the program that asked.

    That doesn't solve anything, really. There's plenty of ways to fingerprint a machine that doesn't involve the machine-id.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 3 months ago (3 children)

    Machine-id is read as plaintext by programs and transmitted as plaintext by programs.

    Hashing the unique id from the host side as opposed to trusting programs to read it and act in a way the user understands and deems appropriate is a much better method of handling calls to identify the equipment than just letting programs read your standardized unique id.

    And the above would literally solve something, it would keep programs from just walking directly across the mat tee posing to get a unique id and force them to do some kind of jetpack backflip routine that, when presented to a court, is much more tenuous.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 3 months ago (2 children)

    Machine-id is read as plaintext by programs and transmitted as plaintext by programs.

    [citation needed]

    Anything that does that is spyware and if you're aware of anything that does this you should be doing us all a public service and sharing.

    Hashing the unique id from the host side as opposed to trusting programs to read it and act in a way the user understands and deems appropriate is a much better method of handling calls to identify the equipment than just letting programs read your standardized unique id.

    I can build something in maybe 10 minutes that will fingerprint your machine to like 99.99% uniqueness. This solution solves nothing. But now we're just repeating ourselves.

    Go take it to the systemd folks yourself and see how they respond.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 0 points 3 months ago (1 child)

    here’s a fifteen year old stack overflow thread where someone asks where a unique system identifier can be read and someone suggests machine-id.

    Lest that be considered old and bad information, I just checked /etc/machine-id on a new install of Debian 13 and the permissions were 444, readable by owner, group and everyone else.

    So programs can read machine-id. If programs can read it they can transmit it. I hope someone capable of writing a program that can id my machine doesn’t need a proof of that.

    Further, programs reading machine-id don’t necessarily fall into the spyware category by default like you say. There are plenty of perfectly good reasons to request a machine specific identifier.

    Getting rid of the literal “papers please!” “Okay officer!” File literally makes investigation more difficult and puts a barrier up to tracking where there was none before. Presenting a unique hashed output based on the systems machine-id prevents a tracking method that is currently as easy as read file -> get identifier.

    The fact that other methods of tracking exist doesn’t make preventing this method not worthwhile and you should be ashamed for suggesting that.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 3 months ago

    So programs can read machine-id. If programs can read it they can transmit it.

    Never said things can't read it (in fact, that's very intentional). I even linked you the man page that lays all that out for you. I'm saying your claim that things are transmitting it is baseless. You stated your speculation as fact.

    Further, programs reading machine-id don’t necessarily fall into the spyware category by default like you say

    If anything is transmitting this ID it should be considered spyware.

    Whatever, I'm just repeating the same thing over and over again as if your reading comprehension will somehow get better.

  • permalink
  • fedilink
  • source
  • parent