Privacy problems with Windows GDID

[NotATether]

First point: my co_dev and I are interested in understanding whether GDID could potentially track Bitcoin wallet or crypto wallets on connected systems or via a temporary connection to a cold wallet. This is for legitimate purposes, as already described at the start.

Unless Microsoft is sending an index of every single file hash on your system to their servers, I don't think this is possible. For a hardware wallet specifically, probably the device ID of some sort is going to be sent to Microsoft as well, but this is for driver quality purposes, not GDID.

Second point: someone has reported me to the admins, I don’t know why. I find these topics absolutely fascinating and wanted to share them with you to gather the insights you have already provided, for which I thank you all. The fact that I have been reported saddens me.

Maybe it was for a consecutive post? What was the exact message?

[nc50lc]

Second point: someone has reported me to the admins, I don’t know why. I find these topics absolutely fascinating and wanted to share them with you to gather the insights you have already provided, for which I thank you all. The fact that I have been reported saddens me.

Don't worry, your post is interesting.
Although quite off-topic for this board since most replies barely touch "Bitcoin" aspect of the topic, it's about its impact on Bitcoin's privacy nonetheless.

Now, I've checked the forum's "mod.log" and it seem to be the second part of this merged replies.
Obviously, the original post must be deleted or it'll just be duplicated.

[Italian Panic]

Thank you, @nc50lc. I will be more careful. On our board, we aren’t that strict, even though the moderators do a great job in this regard, and I will certainly be more careful from now on.

Yes, it’s true we have gone a bit off topic, but I want to clarify that what concerns me most, beyond personal data and privacy, is precisely the privacy risk associated with Bitcoin. As I wrote at the beginning of the thread, if there were any reports in these logs about btc wallet or other crypto related data, some countries, such as those in Europe that are very eager for money, —could pressure Microsoft to search their servers and obtain data to uncover capital held in crypto.

Thank you guys

[vapourminer]

As I wrote at the beginning of the thread, if there were any reports in these logs about btc wallet or other crypto related data, some countries, such as those in Europe that are very eager for money, —could pressure Microsoft to search their servers and obtain data to uncover capital held in crypto.

doesnt even have to even be microsoft itself, just a rouge employee selling data, or a data breach.

fortunately that stuff never happens /s

[Synchronice]

Is it better to use Qubes os VS Tails with its built-in Persistent Storage feature

It depends Tails isn't really meant to be used as a daily driver. You use it (only) when you want to be anonymous. Qubes is designed to isolate vulnerabilities by virtualizing everything. So it depends on what you're using it for.

Interesting thing is, what happens when they arrest you and as a proof, they find out that you have installed Tails on Flash Drive? Can this evidence be used against you?

In any case, NEVER INSTALL Linux on a machine that previously had Windows 10 or Windows 11 installed, because the GDID remains as a fragment even after formatting, and it is still unclear whether it is truly inactive or retains some level of activity. Microsoft says it remains 100% inactive, which is why I don’t trust it, and we’re working to understand this.

If things are that f-ed, then why don't we assume that spyware is integrated in a hardware level? Maybe motherboards already have a spyware and GDID is not really the biggest challenge here. We will never know, will we? There are open source hardwares too but building a computer with them isn't really nice.

Did i miss something? the GDID string probably still exist if you only quick format the SSD/HDD. But based on this thread, GDID string seems to exist only on Windows registry and Windows server.

Let's say that there is an erase option in BIOS. If I format my SSD from BIOS, is it still possibly a threat that I had previously installed windows? What's the best way to wipe data on SSD to basically return it to factory reset? Or we should buy a new SSD all the way? Or what about tools like Blancco?

[LoyceV]

Interesting thing is, what happens when they arrest you and as a proof, they find out that you have installed Tails on Flash Drive? Can this evidence be used against you?

Evidence of what? There's innocent until proven guilty and no ex post facto law:

No one shall be held guilty of any criminal offence on account of any act or omission which did not constitute a criminal offence under national or international law at the time when it was committed.

I'm allowed to have Tails on a Flash Drive. I'm also allowed to give it away or even sell it.

[ABCbits]

Did i miss something? the GDID string probably still exist if you only quick format the SSD/HDD. But based on this thread, GDID string seems to exist only on Windows registry and Windows server.

Let's say that there is an erase option in BIOS. If I format my SSD from BIOS, is it still possibly a threat that I had previously installed windows? What's the best way to wipe data on SSD to basically return it to factory reset? Or we should buy a new SSD all the way? Or what about tools like Blancco?

I'm not sure why you ask these question. But i believe GDID string on your HDD/SSD alone isn't enough to harm you in any way. Formatting your drive in any way doesn't really imporve your privacy, because GDID string (along with other data) already uploaded to microsoft server.

Interesting thing is, what happens when they arrest you and as a proof, they find out that you have installed Tails on Flash Drive? Can this evidence be used against you?

Evidence of what? There's innocent until proven guilty and no ex post facto law:

No one shall be held guilty of any criminal offence on account of any act or omission which did not constitute a criminal offence under national or international law at the time when it was committed.

I'm allowed to have Tails on a Flash Drive. I'm also allowed to give it away or even sell it.

Note if you refuse to give the password (Tails have encrypted persistent storage feature), some government may jail you for that reason alone. For example,
https://www.techdirt.com/2017/06/19/man-to-spend-180-days-jail-turning-over-non-working-password/
https://www.bbc.com/news/technology-36159146

[LoyceV]

Note if you refuse to give the password (Tails have encrypted persistent storage feature), some government may jail you for that reason alone.

Sounds like fun: give a politician a Tails USB stick with encrypted partition, and he'll spend 6 months in prison! That should give him enough time think about what's wrong with this law.

[Italian Panic]

Note if you refuse to give the password (Tails have encrypted persistent storage feature), some government may jail you for that reason alone.

Sounds like fun: give a politician a Tails USB stick with encrypted partition, and he'll spend 6 months in prison! That should give him enough time think about what's wrong with this law.

Only in the United States can you serve months in prison on the basis of a presumed sentence rather than a definite one. In recent years, I helped an organisation that supported death row inmates and long term prisoners in America, and bear in mind that 7% of those on death row are not entirely guilty or have been convicted solely on the sworn testimony of a co-defendant. I have witnessed some truly absurd things. If you are not familiar with it, read the story of Rocco Barnabei, who was executed in Virginia some 20 years ago without conclusive evidence.