Privacy problems with Windows GDID

[ABCbits]

99% of Linux users are using machines that had Windows previously installed at some point. I mean what computer does not come with Windows pre-installed?

It's not that rare. Some people build their own computer from parts either to lower the cost, have specific need or it's just their hobby. Some company also offer device with one of linux distro pre-installed.

Perhaps a few years ago, more PC were sold without an operating system, even Lenovo sold PC without Windows.

Few years? from what i've seen, major brand have stopped selling device with DOS or without OS since more than a decade. I recall it's because either windows give much lower price to the device-maker or prioritize company who sell windows laptop by default.

[Satofan44]

WARNING: Uninstalling Windows does not eliminate the persistence of the GDID system. Microsoft states that the GDID system ceases to function upon uninstallation, however, specialists have demonstrated that even after formatting a system and installing another OS, traces of the GDID system remain amongst the remnants of Windows and can potentially still communicate with the servers. Worse still, if any Windows system were to be reinstalled at a later date, this would "officially" bring GDID back to life, and it would send historical data and timestamps to Microsoft servers.

I don't understand this part.

99% of Linux users are using machines that had Windows previously installed at some point. I mean what computer does not come with Windows pre-installed?
Most Linux users tend to use laptops such as Thinkpads, and all of these came with Windows preinstalled. However, the old ones did not come with Windows 10, so that may be a solution, using older computers. However things like Ordinals are not helping since they are making running Bitcoin in older machines more difficult.

So what are you suggesting to get around this? Because I don't know any computers that are built from scratch and sold without Windows installed at some point. Even these "linux laptops" tend to be repurposes regular laptops that had Windows installed.

This is mostly an exaggerated claim and completely false by "specialists" who don't know how computers work at all. It completely confuses 2 concepts that have nothing to do with each other:
1) A GDID that is stored server side by Microsoft.
2) A GDID that is functional after Windows has been removed (false claim).

The first point is completely irrelevant to everything that happens after Windows has been erased. Just because someone has once stored your fingerprints somewhere, that does not mean that they have access to or are able to access everything that you have done and where you have been since the fingerprint was taken (don't watch too many movies for your own sake). Even if the same GDID could be reconstructed on a laptop after a Linux install, Microsoft does not in any way know what you have been doing while you have had Linux. A complete format and encryption will wipe away all significant traces of this identifier. The way that this scam misinformation is being shared online implies that GDID sometimes stays active and is tracking the user even while they are using Linux, it is completely false. It is not even technologically possible.

Here is a source on some GDID work: https://github.com/SmtimesIWndr/gdid-reversal.

The claims are wrong. It is not "128 bit" and not "generated from serial numbers." The court record itself says a reinstall produces a new GDID, which rules out it being derived from hardware serials like your GPU.

Whether the laptop had Windows before or not does not matter, stop overreacting and spreading misinformation.

[Italian Panic]

This is mostly an exaggerated claim and completely false by "specialists" who don't know how computers work at all. It completely confuses 2 concepts that have nothing to do with each other:
1) A GDID that is stored server side by Microsoft.
2) A GDID that is functional after Windows has been removed (false claim).

The first point is completely irrelevant to everything that happens after Windows has been erased. Just because someone has once stored your fingerprints somewhere, that does not mean that they have access to or are able to access everything that you have done and where you have been since the fingerprint was taken (don't watch too many movies for your own sake). Even if the same GDID could be reconstructed on a laptop after a Linux install, Microsoft does not in any way know what you have been doing while you have had Linux. A complete format and encryption will wipe away all significant traces of this identifier. The way that this scam misinformation is being shared online implies that GDID sometimes stays active and is tracking the user even while they are using Linux, it is completely false. It is not even technologically possible.

Here is a source on some GDID work: https://github.com/SmtimesIWndr/gdid-reversal.

Take it easy, mate, there’s no need to get angry. As mentioned in the posts preceding yours, these were just suggestions, as the issue had only just come to light following the arrest of several Scattered Spider hackers, due to the mistakes they would made, the fact that they were unaware of the GDID, and also the fact that a hacker using Windows is really quite poor.

As for the rest, I have been working in IT for several years now, and my grey hairs don’t lie. I have seen it all and heard the most far-fetched statements imaginable to reassure users, whilst the companies did exactly as they pleased.

So, over the years, I have learnt to check things out for myself first and then see where the truth lies, simply reading about it isn’t enough for me.

As for the GDID, it certainly records the PC hardware and firmware static data (UEFI and TMP, only for example) and links these static values to the GDID. You uninstall Windows and install Linux, but the static UEFI and TMP data doesn’t change; Linux doesn’t report it. However, if you mess something up and the data is forcibly extracted, or worse still, if for some reason you need to reboot Windows on that machine, the authorities have hit the jackpot.

Do you think it’s science fiction? Grab a PC and have a go yourself, it’s not that complicated.

I know how they work, and I only feel safe if I take the hard drive with Windows on it, chuck it in the bin, and install Linux on a brand new HDD or SSD.

[Satofan44]

As for the GDID, it certainly records the PC hardware and firmware static data (UEFI and TMP, only for example) and links these static values to the GDID. You uninstall Windows and install Linux, but the static UEFI and TMP data doesn’t change; Linux doesn’t report it. However, if you mess something up and the data is forcibly extracted, or worse still, if for some reason you need to reboot Windows on that machine, the authorities have hit the jackpot.

Do you think it’s science fiction? Grab a PC and have a go yourself, it’s not that complicated.

That only confirms that it is the same machine, it does not provide any data on the activities while the machine was using Linux. I can recognize the "same machine" without GDID information -- it is just a more systematized, comprehensive and automated way to do it. Again, all of this is a completely exaggerated narrative that comes from watching too many movies. GDID is nothing special, and neither is this case.  Any machine that had Windows previously is quite fine to use, and you can't be actively tracked using GDID once Windows is deleted and Linux is being used -- GDID is not functional in that setup. The story ends there, stop freaking out normal users over nothing. This is completely different from what is being claimed and communicated, the impression that somehow people can be tracked using GDID while they are on Linux which is not correct.

I know how they work, and I only feel safe if I take the hard drive with Windows on it, chuck it in the bin, and install Linux on a brand new HDD or SSD.

If you do things that are not scientifically necessary, that shows dogmatism and not an "understanding" of how computers work. This action is completely unnecessary. Feelings are not compatible with the objective reality of how these systems work. A complete cryptographic erasure followed with an encryption (which should be default for users by now were they smarter) removes any kind of data on storage media. Storage media is not even related to what we are talking about, throwing them away doesn't change that static data. Among many other things to read, learn it.

https://uefi.org/specs/PI/1.8A/V3_Design_Discussion.html
https://learn.microsoft.com/en-us/windows-hardware/drivers/bringup/smbios

If you really wanted to go through the unnecessary replacement of hardware for this, then it would be better to replace the motherboard instead of the storage media.

[Italian Panic]

If you’re happy reading the EULAs and official blogs of those who carry out these acts of mass surveillance, you’re perfectly free to do so.

What I’ve seen from the Assange, Manning, Snowden and Schulte cases I know the research of privacy it's never enough. The Schulte/Vault 7 case is the most recent, and what he exposed is hair-raising because it seems that every device is fitted with a backdoor. These aren’t films; they’re real life. So I will quite happily never feel that I’m being too excessive when it comes to privacy.

Perhaps you haven’t read what I wrote in my previous posts; I said that switching to Linux disables the GDID, but restarting Windows reactivates it with a new GDID that is linked back to the previous one precisely because of the matching fingerprint. On some points, you’re saying exactly what I maintain and what I’ve corrected in my previous statements. I’ve never had any problem admitting when I’m wrong because I believe in the scientific method.

Am I being too cautious and overly vigilant? Of course, everyone knows what their privacy is for, and everyone knows what they need to defend and who they need to defend themselves against, and so they apply different levels of security.

[Satofan44]

If you’re happy reading the EULAs and official blogs of those who carry out these acts of mass surveillance, you’re perfectly free to do so.

What I’ve seen from the Assange, Manning, Snowden and Schulte cases I know the research of privacy it's never enough. The Schulte/Vault 7 case is the most recent, and what he exposed is hair-raising because it seems that every device is fitted with a backdoor. These aren’t films; they’re real life. So I will quite happily never feel that I’m being too excessive when it comes to privacy.

Perhaps you haven’t read what I wrote in my previous posts; I said that switching to Linux disables the GDID, but restarting Windows reactivates it with a new GDID that is linked back to the previous one precisely because of the matching fingerprint. On some points, you’re saying exactly what I maintain and what I’ve corrected in my previous statements. I’ve never had any problem admitting when I’m wrong because I believe in the scientific method.

Am I being too cautious and overly vigilant? Of course, everyone knows what their privacy is for, and everyone knows what they need to defend and who they need to defend themselves against, and so they apply different levels of security.

Sure thing, yet your suggestion to replace the storage media does absolutely nothing to break the GDID connection. Therefore, use your head when you want to make overly cautious or overly paranoid suggestions. By the way, to believe that there is a secret function in UEFI or similar constructs that go beyond the specifications and which nobody has discovered is equal to tin foil thinking. It does not help any kind of user, keep it to yourself. Any claims become a pure reflection of paranoia if they are not backed up by objective proof for said claims.

If you really wanted to go through the unnecessary replacement of hardware for this, then it would be better to replace the motherboard instead of the storage media.

This is what you should be suggesting if you want to go this way, replacing the storage media does nothing at all. There is no super secret way to embed backdoors in storage media that can not be easily removed by other software, that is not how these things work.

[PrivacyG]

One thing I would say is that if you are extremely paranoid and your threat level is significantly high then the best technology you can own is no technology.  Have face to face conversations where no microphone is, close the curtains when using your computer, use burners, purchase cables hundreds of miles away from a shop no one would ever think you would visit and if you used Windows on a device, instead of 'cleaning' it up it is best to simply replace it.

But most of us are NOT at such a high threat level where we the level of stress is so high that you have to inspect even wall sockets and analyze our surroundings to make sure you are safe.  If you want to go overly paranoid about your Privacy trust me, you will end up not trusting ANY THING.  Including a brand new computer that has never seen Linux before.

In fact.  Open up any of the computers you have and tell me if you know how all of the components work.  If you do not, start from there.  Some can be replaced by Open Source alternatives.  Others can not.  There are Open Source computers you can buy, but most of these come from a small company or two that sell these things.  So you have to rely on them, and when there are so few and pretty easy to find you can start wondering why.  Could they be honey pots?

The other way around is building your own from zero.  Component by component.  But then you would have to trust who ever sells you the components so to make sure, you will have to purchase components separately from multiple sources.

Most of the components we run on a computer do have back doors.  Some of them have been found, others have been exposed, others have not even been found yet.  But this not mean all back doors are constantly used or will ever be used, and it does not mean they are constantly storing all that information in some kind of server.  Although I would argue I am personally skeptical about how little of it is stored and I do believe by the time we find out how much of that is actually already stored and used it will be too late as we have overly shared too much already, but that is my own paranoia and it is a feeling I would not like to spread around any way.

And this makes me return to my initial point, if this scares you then the best technology you can own is none.  The thing about being paranoid is knowing where to stop.

[Italian Panic]

You’re just fuelling unfounded concerns that have nothing to do with me and that you’re making up. I don’t have anything major to hide; I’m just very protective of my bitcoins and I don’t want the state to get involved with its rubbish because of some carelessness or thoughtlessness on my part.

Your privacy is the most important thing you have, just like your seed phrase, because privacy is like health: once lost, it cannot be regained.

If you don’t care about your privacy, ask yourself why you wouldn’t take a shower in a public square full of thousands of people. Exposing your personal data, your habits, your browsing history and everything else is exactly the same reason why you wouldn’t shower in public.

Find out about the Vault 7 and Vault 8 scandals; you will discover that Windows systems are the most compromised and feature in every single case of surveillance. This isn’t science fiction; it’s official documentation for which activists have been jailed for life.

https://en.wikipedia.org/wiki/Vault_7

https://wikileaks.org/vault7/#Dark%20Matter

From wikileaks release "Dark Matter" about UEFI Malware:
WikiLeaks releases Vault 7 "Dark Matter", which contains documentation for several CIA projects that infect Apple Mac firmware (meaning the infection persists even if the operating system is re-installed) developed by the CIA's Embedded Development Branch (EDB). These documents explain the techniques used by CIA to gain 'persistence' on Apple Mac devices, including Macs and iPhones and demonstrate their use of EFI/UEFI and firmware malware.


The CIA isn’t after me, and it isn’t after you, but a state hungry for money may well go after your bitcoins to rob you of them through taxation.

Guys, I’m not here to talk rubbish; I just want to find out if the GDID is the "Man in the Middle" of Windows systems. Nothing more.

[PrivacyG]

I believe you got my message wrong.  I did not mean it as an attack or as a disagreement but rather I was trying to simply add my thoughts on the subject to yours.  In fact.  I do not even know how you thought my message goes against yours!

GDID is not THE man in the middle.  It is A man in the middle in between many others.  Windows has been arguably the WORST Operating System for Privacy and whether one anti Privacy feature is exposed by others or announced by Microsoft them selves, it is clear that their anti Privacy model has multiple fail switches rather than relying on GDID.

I would argue Windows Recall is another man in the middle.  So was Cortana, so is diagnostic data, all the Software you can NOT disable or remove with out being an advanced user or at the very least running scripts et cetera.  My own opinion is that Windows has SO much telemetry and is SO bad Privacy wise that it is not even worth debating whether GDID is THE man in the middle or not.  Any body who wants to hold on to Bitcoin and live a peaceful life should disinfect all their devices of any Closed Source Operating Systems.

Over the years, ALL of these Operating Systems have become an absolute dystopian disaster.  They are all moving very close to the iOS jail.  See what Google is doing to Android phones, see what Windows has become.  Not that Windows has ever been great but any way.  You get it.

Hell.  I would go one step ahead and get a computer that can run LibreBoot or CoreBoot at the very least.  Then I would choose a preferred Linux distribution and start from there.  The other way around is what I do, which is pick up ANY computer and simply make it permanently offline for Bitcoin storage, using Tails on a separate online computer for online Bitcoin related operations such as broadcasting.  In my opinion, the safest way to go is that any file or information that should never leave my computer to the external world should never sit on an online device.

If some body is afraid of having their Bitcoin robbed or that the government is at some point in the future coming after them.  Whether it is for taxation or other purposes.  Simply run away from Windows and never look at it again, the news about GDID is simply adding on to the list of why we should never use Windows again.  It is pretty much like we find out Coldcard actually has ANOTHER 'tricky line of code' that has never been discovered before.  It is really bad but at this point simply move on, it is crap any way.  Returning to Windows in the future means they agree some things will be linked again.  There is a lot of information that can be re linked, but the first and biggest problem is moving back to Windows in the first place.

As for the HDD part.  I would tend to agree with Satofan44, an HDD can be erased and encrypted.  I do this pretty often but to be honest with you, I do get your feeling.  I would personally not feel safe having an HDD my Bitcoin was on, even if it was wiped properly.  That has more to do with my own paranoia however, rather than the reality of things.

[Synchronice]

Perhaps a few years ago, more PC were sold without an operating system, even Lenovo sold PC without Windows.

Few years? from what i've seen, major brand have stopped selling device with DOS or without OS since more than a decade. I recall it's because either windows give much lower price to the device-maker or prioritize company who sell windows laptop by default.

That's because PC and Laptop manufacturers buy a large quantity of OEM licenses at negotiated prices. Probably everyone has noticed that when they install windows on their Laptop, it no longer asks for an activation cause it's already activated, there is an OEM license in the laptop. Besides the fact that large quantity of Windows licenses are cheap for these companies, it's the most popular OS for desktop and laptop computers and on top of that, customers want a computer that works immediately and don't want to waste money and time on installing Windows and other necessary tools.

[Satofan44]

I believe you got my message wrong.  I did not mean it as an attack or as a disagreement but rather I was trying to simply add my thoughts on the subject to yours.  In fact.  I do not even know how you thought my message goes against yours!

There has been a lot of confusion in the intent here, whereas clarifications in regards to what GDID can and can not be done in order to produce accurate descriptions and avoid fearmongering is seen as an attack by others who have made or shared exaggerated claims. I've actually been asked by someone about this situation who does use Linux but is not tech savvy at all, and he got the exact impression that I was talking against: That GDID persists even if you switch to Linux and that you can actively be tracked this way. The precise way that things are communicated matter a lot, but many people tend to dismiss this or underplay its importance.

As for the HDD part.  I would tend to agree with Satofan44, an HDD can be erased and encrypted.  I do this pretty often but to be honest with you, I do get your feeling.  I would personally not feel safe having an HDD my Bitcoin was on, even if it was wiped properly.  That has more to do with my own paranoia however, rather than the reality of things.

I am glad that we can agree on something for a change. If the issue is GDID related fingerprinting, changing the storage media does not do anything at all. If someone were to actually want to replace something to break the fingerprinting or at least to make it more difficult, which I am not suggesting that should be done, then the motherboard is the best target. However, the ability to do this is found with very few people and if we are talking about laptops as well then this excludes more than 99% of the population (and we are putting aside the costs completely as well in this consideration). We should provide to the masses accurate information with actionable steps and not: throw away everything, you have to replace everything or all is lost -- style of advice.

[takuma sato]

Perhaps a few years ago, more PC were sold without an operating system, even Lenovo sold PC without Windows. Anyway, it’s not a problem, the most common approach was to buy a PC with the specifications you wanted that had an HDD, then buy a blank SSD and, at the time of purchase, swap the hard drives, throwing away the one with Windows and installing Linux on the blank SSD.

You might say that opening it up voids the warranty, but I would never send my PC to a service centre where they spy everything; I would rather burn it in the fireplace and buy a new one.

I have never seen a Lenovo computer that did not come with Windows preinstalled. In fact all these famous "linux laptops" that are common in Linux communities like all the Thinkpads came with the infamous Windows sticker. There is a funny video of Richard Stallman saying he was offended by a Windows sticker on a laptop. He also says he gets his computer installed by experts. I have never seen him mention anything about this GDID issue and neither I have seen it mentioned in Libreboot and Coreboot enthusiasts so this thread was confusing. Im still reading new replies.

[LoyceV]

I have never seen a Lenovo computer that did not come with Windows preinstalled.

They're quite common on Amazon Germany. I bought one years ago (and had to replace the German keyboard).

[takuma sato]

I have never seen a Lenovo computer that did not come with Windows preinstalled.

They're quite common on Amazon Germany. I bought one years ago (and had to replace the German keyboard).

Im not sure im following as when I read your link I cannot really find something that says it doesn't come with Windows pre-installed. In fact as far as I can tell the Amazon link says that it comes with Windows 11 pre-installed.

Brand    Lenovo
Model name    83GW007YGE
Screen Size    15.6
Colour    unknown
Hard disk size    512 GB
CPU model    Intel Core 7
RAM memory installed size    8 GB
Operating system    Windows 11 Pro
Special feature    Numeric Keypad
Graphics card description    Integrated

Edit: Oh wait it says so on the title, FreeDOS, so Im assuming it comes with that and the Amazon details are not accurate. Well that's really cool but how common is it to find these? Never seen it before. Also most nice Thinkpads that you can install a free BIOS at are older models and from what I've seen all used models were originally pre-installed with Windows before the owner installed Linux and flashed the BIOS.

[LoyceV]

Edit: Oh wait it says so on the title, FreeDOS, so Im assuming it comes with that and the Amazon details are not accurate. Well that's really cool but how common is it to find these?

I specificially searched for "FreeDos" to find this. That's how I bought mine many years ago.

[PrivacyG]

most nice Thinkpads that you can install a free BIOS at are older models and from what I've seen all used models were originally pre-installed with Windows before the owner installed Linux and flashed the BIOS.

Depending on what you need to use it for, the used older ones are cheap as hell and still extremely fast considering their age.  I never had one I thought was not worth the price I paid.

[athanred]

I can tell the Amazon link says that it comes with Windows 11 pre-installed.

Obviously, nobody is making "windows-free" machines, coming like that out of production line. However, people buy these Windows machines, and then spend some time and effort, to install only Open Source BIOS, Operating System, and create a product, that you can buy. For example: https://minifree.org/

And of course, if you buy such product. then you can usually find a Windows sign on the keyboard. But well, you can buy stickers to cover it with Linux or whatever, if it bothers you that much.