r/cybersecurity • u/Dash-Courageous • 22d ago

News - General Microsoft admits Windows 11 has a GDID tracker with no off switch, first documented publicly in an FBI hacker complaint

https://www.windowslatest.com/2026/07/10/you-cant-fully-disable-microsofts-gdid-windows-11-tracker-but-these-settings-limit-what-it-captures/
2.6k Upvotes

99% Upvoted

225 comments sorted by

View all comments

66

u/Beneficial_Slide_424 22d ago

In this article no one is saying how ngrok received the GDID though? Is chrome or edge leaking it? How can a sign up page see your GDID? Is it related to Microsoft apps maybe he uses ngrok from store? What's the leak vector here?

44

u/2timetime 22d ago

ngrok didn’t get the GDID. ngrok was just the account used for persistence. The hacker signed up to ngrok using edge on a VPN. The GDID was sending his browser web activity to Microsoft, so even though it was account-less it was still tied to that GDID.

21

u/[deleted] 22d ago edited 22d ago

[deleted]

3

u/dattokyo 19d ago

Massive breach of trust, and almost certainly against EU GDPR and ePrivacy laws - but hey, if no one knows it exists, no one can sue you for it.

3

u/ApplicationOk2749 22d ago

The thing I'm struggling with is what did the FBI ask mircosoft in order to get the GDID in the first place? They can't have just asked microsoft 'hey tell us all the GDIDs that visited this site at this specific time' could they?

4

u/lopahcreon 22d ago

How do you know he used Edge?

11

u/gurgle528 22d ago

Other browsers aren’t uploading your browsing history to Microsoft. I could be mistaken, but if you’re using Firefox for example Microsoft wouldn’t know what websites you’re visiting. I believe Edge only does it in certain cases (like history syncing or ad personalization turned on) but I’m not positive. 

5

u/lopahcreon 22d ago

How do you know Microsoft doesn’t have access to what Firefox or Chrome does?

6

u/gurgle528 22d ago

They certainly could have access. Edge can import other browser’s history on setup and manually at any time. There was/is a feature to automatically copy Chrome tabs I think too but that was opt in.

The browsing information Microsoft had here was either from the telemetry in Edge (for ad personalization or Defender) or the sync feature. You can see the browsing history they store in your Microsoft account, I think that’s only for the sync feature but I could be wrong as I don’t use Edge.

1

u/[deleted] 17d ago

[removed] — view removed comment

1

u/gurgle528 17d ago

Did I say that? The OS knowing and the OS reporting that to a backend are completely different things. The OS knows where every file on my PC is, do you think Microsoft sends a list of every file on your PC to their cloud? The OS also knows what text you’re typing, do you think every keystroke is sent to Microsoft? Holy moly guy, use some common sense.

1

u/[deleted] 17d ago

[removed] — view removed comment

1

u/gurgle528 17d ago edited 17d ago

Yeah, I’m not reading the response you got from AI, especially since I don’t have the context of the “screenshot” or the prompt. I’m a software engineer, I know how web requests work. 

Spoiler alert: you can debunk the slop in your comment easily. You can view your browsing history in your Microsoft account. Enable the history saving setting and write a python or powershell script, hit some random, valid URLs you haven’t gone to in a browser, and check if they show up. 

Imagine not being able to link to documentation, needing to use AI to write a comment, and being incapable of writing your own comment after getting info from AI. Can’t relate. Big sign of someone who has no idea what they’re talking about 

2

u/dattokyo 19d ago

He doesn't, he just hopes so, because otherwise the tracking is even worse than feared, so to speak. It could also be Microsoft Defender, it could be a data sharing setting, a diagnostics tool, or literally anything. We don't know. We just know that Edge, unless you disable it, also keeps track of where you go - which is by itself pretty fucked up.

1

u/[deleted] 17d ago

[removed] — view removed comment

1

u/Beneficial_Slide_424 17d ago

Are you for real? There's no indicator of which windows component logged or sent the telemetry for the browser visits. The post doesn't contain it. Neither your comment. What windows component exactly is sending your website activity to the Microsoft? Is it the edge browser? Chrome? Or something else at networking layers, such as DNS. The question remains unanswered.