Privacy problems with Windows GDID

[Italian Panic]

Code:

https://korben.info/en/gdid-windows-cut-tracker-vpn.html

This Korben track it's a golden nugget, thanks for sharing it.
I still have some doubts about possible system instability issues with proprietary software if the OS were to detect that telemetry has been disabled.

The svchost.exe system file is the generic container that, on Windows, hosts telemetry instances of files such as "diagTrack" or "UtcSvc".

By running the following command as an administrator in PowerShell

Code:

tasklist /svc /fi "imagename eq svchost.exe"

You will simultaneously see all instances currently running on your win pc in the svchost container (I tryed in win10, but the command it's a standard troubleshooting from win xp to 12)

You obtain a list with more than 10 active processes, the factors to be taken into account are as follows (or similar if you use another version of win):

Code:

Process	                   PID 		Service
========================= =====================

svchost.exe                   xxxx DispBrokerDesktopSvc

svchost.exe                   xxxx DiagTrack

svchost.exe                   xxxx DoSvc

I voluntarily deleted the Process ID (PID) because, even though they change every time the machine restarts, a tracking system might have logged them. Am I being too cautious? I'm always been that way, and it’s always paid off.

These are files of telemetry services:

- diagTrack: collects diagnostic data, user habits, and software and hardware information. It is Microsoft tracking and fingerprinting system.

- dispBrokerDesktopSvc: manages the monitor resolution, orientation, refresh rate, and layout (very important for fingerprinting, anyone who uses Tor knows this is critical data).

- DoSvc: is Windows P2P service designed to optimize the distribution of updates to other PC. It causes spikes in ram usage and constantly scans the disk.

Disabling these services may compromise the OS proper functioning in the long run. As soon as I have a reason to use Windows for a certain period of time, I will try disabling them and assessing the OS stability.

I tried to force access to the diagTrack file to see what data it contained, but the system categorically blocks access to this file. Even though it is our own data.

There’s an app in the Microsoft Store that’s supposed to read the telemetry and show what’s being sent. I have never trusted it because it’s proprietary software rather than open source, so it might have an interest in hiding certain data.

[Lucius]

Code:

https://korben.info/en/gdid-windows-cut-tracker-vpn.html

This Korben track it's a golden nugget, thanks for sharing it.
I still have some doubts about possible system instability issues with proprietary software if the OS were to detect that telemetry has been disabled.
~snip~

If what he claims is true, then the OS would still be functional after the GDID is disabled, but I also wonder if they on the other side will realize that the data is no longer coming in and do something about it.

By the way, I tried the command with which you can actually see the ID of that tracker on W10 and all I get is an error in PowerShell (of course started as administrator), so I wonder if there is something different between OS 10 and 11 versions?

Code:

$lid=(Get-ItemProperty 'HKCU:SOFTWAREMicrosoftIdentityCRLExtendedProperties').LID
"g:$([Convert]::ToUInt64($lid,16))"

[Italian Panic]

Code:

https://korben.info/en/gdid-windows-cut-tracker-vpn.html

This Korben track it's a golden nugget, thanks for sharing it.
I still have some doubts about possible system instability issues with proprietary software if the OS were to detect that telemetry has been disabled.
~snip~

If what he claims is true, then the OS would still be functional after the GDID is disabled, but I also wonder if they on the other side will realize that the data is no longer coming in and do something about it.

By the way, I tried the command with which you can actually see the ID of that tracker on W10 and all I get is an error in PowerShell (of course started as administrator), so I wonder if there is something different between OS 10 and 11 versions?

$lid=(Get-ItemProperty 'HKCU:SOFTWAREMicrosoftIdentityCRLExtendedProperties').LID
"g:$([Convert]::ToUInt64($lid,16))"

However, you miss some backslash, with this command you can see the local ID which is used to identify the local cache when the machine communicates with Microsoft servers, it is not the GDID.

There are no differences between Windows 10 and Windows 11, although some versions of Windows 10 may have a different path. The command for local ID is:

Code:

Test-Path "HKCU:\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties"

if the answer is "false" probably you never activate windows live or microsoft account related software. If the answer is "true" insert this commans and obtaid the local ID:

Code:

Get-ItemProperty "HKCU:\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties" -Name LID -ErrorAction SilentlyContinue   

there are no direct commands to retrieve the GDID; I found this script in another forum (but it work good):

Code:

$lid=(Get-ItemProperty 'HKCU:\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties' -Name LID -ErrorAction SilentlyContinue).LID; if($lid) { "g:$([Convert]::ToUInt64($lid,16))" } else { "Error: LID not found. Check if signed in with Microsoft Account." }   

[Lucius]

However, you miss some backslash, with this command you can see the local ID which is used to identify the local cache when the machine communicates with Microsoft servers, it is not the GDID.

There are no differences between Windows 10 and Windows 11, although some versions of Windows 10 may have a different path.
~snip~

You're right, I managed to get that info with what you posted. For now, I'll refrain from applying the "korben" tutorial in an attempt to disable GDID, but since I'm planning to buy a new computer and use Linux, I'll definitely deal with it later.

If GDID could really be disabled in this way, then it would be very useful for those who buy new computers and want to use the Windows OS.

[Synchronice]

Windows is my favorite OS too because I've been using it since my childhood

If you have kids, do them a favor and give them a Linux installation from the start

That's really a good advice, I'm not kidding. Let kids get good habits from the day one.
Personally, I was using windows for playing video games on my pc and I have a nostalgia for Windows XP and 7 too but it doesn't mean that I use windows today.

Not yet! The fact that this GDID case was a high-profile case shows it's not something that's very common yet. It feels like they went the extra mile to catch this hacker. But this might as well become a very common thing in the future.
I wonder how long it will take for hackers to start spoofing someone else's GDID, so authorities end up with a 96 year suspect who only uses Facebook to see her grandchildren.

Not yet is a good answer. Too many people and too many companies don't pay taxes or fake the amount they have to pay. Using GDID for catching these people feels like planting a nuclear bomb in our computers to explode it one day. I think that if they use GDID for this, they won't be able to arrest everyone. Maybe a few at first but this will immediately be a clear message for absolutely everyone to move from Windows OS. But maybe then they'll make it mandatory to use Windows, who knows...

By the way, is Windows the only problem or does motherboard or other part of the computer carries the risk too that we don't know yet?

[NotATether]

Windows is spyware. I recognize that it's installed on all the computers whose names don't begin with Mac, but you should never be using Windows for any sensitive task. That's just reckless behavior.

Furthermore, Windows is quite unreliable when it comes to uptime (random updates restarting your computer automatically, application freezes & crashes, etc) such that if you can get Linux to not crash on your hardware, that's probably what you should be using going forward.