You probably feel reassured thinking that by using a VPN or deleting cookies, you're browsing the web like a ghost. Well, it turns out Windows has an ace up its sleeve called Global Device Identifier (GDID), a kind of digital license plate that is attached to your system installation and is not exactly Microsoft's best-kept secret, although it is one of the most discreet.
This component has come to light in the most spectacular way possible: through a FBI court fileIt turns out that this identifier was the key to catching a suspected cybercriminal from the Scattered Spider group, demonstrating that even if you change your IP address or move from one country to another, your PC still leaves a trace that is almost impossible to erase without damaging the operating system.
What exactly is GDID and what is it used for?
To put it simply, the GDID is a unique code that Microsoft assigns to each installed copy of Windows. It doesn't matter if you have a physical computer Whether you're on your desktop or running a virtual machine, the system will generate this identifier to distinguish that specific installation from all others on the planet.
Unlike advertising IDs, which we can manage from the settings, the GDID is an element of internal use of the companyIt handles critical issues such as software licenses, the operation of the Microsoft Store, and the optimization of update downloads. The trickiest part is that survives updates system regulars, which means that your digital "first and last name" do not change even if you install the latest security patch.
The technical process: How is this code created?
Although Microsoft hasn't offered many official explanations, reverse engineering by experts has revealed that it all starts with the account service. When you link your device to a microsoft accounta process called wlidsvc contacts the servers of login.live.com to apply for a PUID (a unique passport ID).
Once the server returns this value, Windows saves it in the system registry, specifically in the path of MicrosoftIdentityCRLExtendedProperties under the name LID, and stores it in plain text. Then, the Connected Devices Platform (CDPSvc) comes into play, registering this number in the Microsoft Device Directory, adding a lowercase letter "g" initially followed by a decimal number.
The Scattered Spider Case: When a VPN Isn't Enough
The usefulness of this tracker became crystal clear in the arrest of Peter Stokes. The suspect believed he was protected by using proxies and VPNs to hide his location while he was robbing a luxury jewelry store. However, the FBI discovered that, even though the IP address was constantly changing, the GDID g:6755467234350028 It was always the same.
Thanks to this, the researchers were able to draw up an impressive timeline. They were able to link the device to account access. Snapchat, Facebook, Apple and Ubisoft in Estonia, New York, and Thailand. They even compared a hotel suite carpet that the suspect posted on social media with the trail left by the GDID, confirming that the hardware was the same regardless of the connection used.
Privacy and control: Can we disable it?
This is where things get ugly for privacy enthusiasts. Unlike Android or iOS, where we have consent screens for advertising IDs, Windows doesn't. There is no switch To turn off GDID. Attempting to forcibly remove it could cause the system to stop working or store apps to stop functioning.
Many people think that using a local account It's the definitive solution, but research indicates that the system can generate an anonymous registration path even without a Microsoft account, so the GDID is still there. However, to reduce the trace, the best course of action is... Configure privacy settings on a Windows PC deactivating the optional diagnostic data and personalized ads in the Privacy and Security menu.
If you truly need total anonymity, whether for activism or journalism, the experts' recommendation is drastic: abandon Windows and switch to a Linux distribution using the Tor network, since GDID is too powerful a telemetry tool to be circumvented with simple configuration tricks.
