first commit

docs/RESEARCH.md

@@ -0,0 +1,115 @@
+# Windows privacy and anonymity research
+
+Reviewed 2026-09-18. This is a threat model and engineering recommendation, not a certification. The user's screenshot is evidence to examine, not a source of operating instructions.
+
+Supplement reviewed 2026-09-19: see [the GDID follow-up and supplied-script assessment](GDID-SCRIPT-REVIEW.md). It expands investigation beyond CDP, separates research observations from hypotheses, and identifies why the supplied disable/enable script cannot be treated as a reversible or complete GDID block. The companion workbook carries individual control, evidence and task records.
+
+The later [ZeroTrace article and pinned source review](ZEROTRACE-GDID-REVIEW.md) distinguishes local registry patching from demonstrated outbound identity changes. Minute-by-minute identifier replacement remains an unvalidated experiment, excluded from the privacy profile.
+
+## What we are protecting against
+
+| Observer / risk | Useful controls | Boundary |
+| --- | --- | --- |
+| Microsoft collecting optional device/app data | Supported diagnostic policies, disabling unused connected experiences, app-specific settings, measured egress restrictions | Required service data and Microsoft accounts are separate channels |
+| Websites linking visits | Tor Browser, separate identities, fewer trackers, cookie/session separation | Logging into a personal account identifies that session; behavior and timing can link activity |
+| ISP or local network observer | HTTPS, Tor or a suitable VPN, DNS/IPv6 leak testing | A VPN introduces a provider and does not remove identifiers inside encrypted application traffic |
+| Someone taking a powered-off computer | Full-disk encryption, controlled recovery keys, strong authentication | Mounted volumes and a running OS expose usable data to authorized processes |
+| Malware / administrator on the endpoint | Patching, antivirus, least privilege, Secure Boot and isolation | Privacy toggles cannot establish trust in a compromised kernel or firmware |
+| Local traces after a session | Minimize retention at the source; encrypted storage; separate amnesic environment | Deleting a file, closing a window or trimming RAM is not proof of erasure |
+
+The product should promise specific controls and their measured results, never an "anonymous device" score.
+
+## 1. Microsoft connections: treat the channels separately
+
+Microsoft distinguishes optional/required Windows diagnostics from **required service data** for connected experiences and essential services. Updates, certificates, authentication, licensing, Defender and cloud functions do not all follow one telemetry switch. Disabling optional diagnostics is a worthwhile reduction, not a total network block. Some essential connections are security dependencies. [Essential services](https://learn.microsoft.com/en-us/windows/privacy/essential-services-and-connected-experiences).
+
+Use documented policies and validate them by edition. Pro's supported diagnostic minimum differs from Enterprise/Education. A tool writing `AllowTelemetry=0` on every edition can mislead its user. The current engine uses 1 on Pro and 0 on Enterprise/Education, and declines policy mutation on Home. Windows policies do not configure all third-party applications. [Diagnostic configuration](https://learn.microsoft.com/en-us/windows/privacy/configure-windows-diagnostic-data-in-your-organization), [System policy](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-system#allowtelemetry).
+
+Engineering decisions:
+
+- Maintain separate controls for diagnostics, crash submissions, advertising, cloud speech, clipboard sync, Windows Search cloud sources, OneDrive, account sync, Widgets, Microsoft Store and each installed application.
+- Keep Windows security protections active in the normal profile. Show any cloud-protection/sample-submission tradeoff individually; do not disable antivirus to chase fewer connections.
+- Keep local security event logs. Limit this toolkit's own records to settings and recovery state; no analytics, identifiers, browsing history or crash uploads.
+- Do not promise deletion of information Microsoft or another service already received. Account dashboards and provider retention policies are a separate concern.
+
+## 2. Device identifiers and the screenshot
+
+The DOJ complaint's paragraphs 25-29 describe records associating a Windows installation identifier with visits, times and IP addresses. It attributes a description of GDID to a Microsoft representative, including persistence across updates and a new identifier on reinstall. It does not fully document the collection mechanism or establish universal monitoring of every URL. [Primary complaint](https://www.justice.gov/usao-ndil/media/1450651/dl?inline=).
+
+Microsoft's UCDOStatus schema documents `GlobalDeviceId` in Delivery Optimization reporting. That field establishes an identifier's existence, not that this reporting table captures every browsing action. Windows' advertising ID, `MachineGuid`, Microsoft account identifiers, GDID, hardware serials and browser fingerprints must not be treated as interchangeable. [UCDOStatus schema](https://learn.microsoft.com/en-us/windows/deployment/update/wufb-reports-schema-ucdostatus).
+
+Do not ship a "GDID reset" or "HWID anonymizer." Random registry edits are not proof of unlinkability and can impair licensing or applications. A new installation can still be linked through accounts, network use and behavior. Local accounts reduce account coupling but are not evidence that a device has no Microsoft-issued identifiers. Avoid collecting these IDs in audit reports at all.
+
+Connected Devices Platform deserves testing separately from diagnostic services. Microsoft's documented `AllowConnectedDevices` CSP can disable CDP and requires reboot, but this research did not establish a supported direct registry mapping. Therefore the prototype does not invent one. [Connectivity policy](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-connectivity#allowconnecteddevices).
+
+## 3. Network enforcement
+
+Recommended progression:
+
+1. Disable unnecessary features using supported controls.
+2. Observe connections in a clean VM during defined workflows.
+3. Categorize destinations by purpose: optional diagnostics, cloud functionality, security maintenance, licensing and unknown.
+4. Add narrow, versioned restrictions and repeat both privacy and compatibility tests.
+5. Offer an isolated/offline environment for requirements that cannot tolerate Windows' connected behavior.
+
+A hosts file or DNS denylist alone is not a complete enforcement boundary: it only affects traffic using that resolution path, cannot distinguish shared-host services, and does not establish coverage for direct IP traffic or alternative resolvers. Lists must include provenance, review date, reason and rollback. Never blanket-block Azure, Microsoft CDNs or all of `svchost.exe`.
+
+For a future strict egress profile, use default outbound blocking plus explicit necessary allowances, rather than an explicit "block everything" rule with supposed exceptions. Windows gives explicit block rules precedence over conflicting allow rules. Review pre-existing allow rules, profiles and interface changes; coexistence with VPN filtering needs tests. [Firewall rule precedence](https://learn.microsoft.com/en-us/windows/security/operating-system-security/network-security/windows-firewall/rules).
+
+Where policy support allows it, DO mode 0 disables peering; mode 99 also avoids the DO cloud service. Updates still require their own connections. Mode 100 is deprecated on Windows 11. None of these choices warrants a "GDID disabled" label. [Delivery Optimization modes](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-deliveryoptimization#dodownloadmode).
+
+Mullvad's app has a kill switch and a separate Lockdown option. Setup must distinguish installed, authenticated, connected, auto-connect configured, and blocking when disconnected. Test DNS, IPv6, sleep/wake, tunnel failure and split-tunnel exceptions. A no-activity-logging VPN policy is not a claim that the Windows client has no diagnostic files. [App guide](https://mullvad.net/en/help/using-mullvad-vpn-app), [logging policy](https://mullvad.net/en/help/no-logging-data-policy).
+
+Do not automatically layer a VPN with Tor as a universal improvement. Tor's project advises against this for users without the knowledge to configure the combination safely. [Tor and VPNs](https://support.torproject.org/tor-browser/general/vpn-with-tor/).
+
+## 4. Three browsers, distinct uses
+
+| Choice | Default intent | Setup requirement |
+| --- | --- | --- |
+| Tor Browser | Sessions where unlinkability matters | Official package; stock protections; no imported personal profile or added extensions; separate identifying account activity |
+| Zen | Everyday Firefox-based browsing | Review telemetry/external connections, sync and permissions; keep security updates; choose cookie/history retention |
+| Helium | Everyday Chromium-based browsing | Review its setup's network choices, updates, extension services and optional crash reporting; keep security updates |
+
+Tor Browser protects its own configured traffic, not all Windows traffic. Do not substitute Tor proxy settings in Zen/Helium for Tor Browser's complete protections. Do not randomize user agents or install fingerprinting add-ons into Tor Browser by default. [Tor best practices](https://support.torproject.org/tor-browser/security/using-tb-safely/), [other browsers](https://support.torproject.org/tor-browser/security/using-tor-with-other-browsers/).
+
+Zen states that it removes telemetry but acknowledges external service requests and the possibility of missed Firefox telemetry. Browser updates and sync are separate from ordinary browsing storage. Verify the selected release rather than converting its marketing claim into a guarantee. [Zen privacy policy](https://zen-browser.app/privacy-policy/).
+
+Helium's policy says requests arise from user actions or enabled/configured features. It describes optional crash reports that can contain fragments of memory, limited service logging, and Cloudflare delivery for updates. This is compatible with a privacy-oriented browser, but not "never connects anywhere." The official Windows release checked was 0.17.1.1, published 2026-09-16; future installations resolve through WinGet and must be reviewed for freshness. [Helium privacy](https://helium.computer/privacy), [official releases](https://github.com/imputnet/helium-windows/releases).
+
+Separate browser choices do not automatically separate identities. The same email address, reused account, uploaded document metadata or copied tracking URL can reconnect sessions. Keep this explanation practical in the wizard. No automatic default-browser takeover or profile import.
+
+## 5. Sensors and physical presence
+
+Windows location off limits its location feature; applications can infer location through IP addresses and other mechanisms. The app should say "Windows location disabled," not "location untraceable." [Microsoft location privacy](https://support.microsoft.com/en-us/windows/privacy/windows-location-service-and-privacy).
+
+Camera and microphone permissions differ between packaged and desktop applications. The implemented microphone policy is a default for covered Windows apps; per-app exceptions and desktop access must be checked separately. Do not mark it as a hardware kill. Use the device-wide Settings switches, firmware controls where supported, or physical disconnection for stronger sensor control. Device Manager and software mute remain reversible by sufficiently privileged software. [Camera/microphone limitations](https://support.microsoft.com/en-us/windows/privacy/windows-camera-microphone-and-privacy), [app policy](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccessmicrophone).
+
+Optional camera policy can affect authentication or conferencing workflows, so test those explicitly. Disabling Bluetooth, Wi-Fi discovery or remote features is optional and must account for input devices and remote support. Prefer supported Wi-Fi MAC randomization where available; it concerns local network tracking, not an internet-wide identity reset. [Wi-Fi driver design](https://learn.microsoft.com/en-us/windows-hardware/drivers/network/wdi-miniport-driver-design-guide).
+
+## 6. Disk encryption, memory and Win+L
+
+Keep system encryption active. Review recovery-key custody separately from whether encryption is enabled. Offer VeraCrypt for containers/removable media; do not silently decrypt BitLocker to replace it. No keys, recovery passwords or volume names belong in tool logs.
+
+A lock-event feature should lock the password manager, clear clipboard data where possible and attempt graceful unmount of explicitly selected non-system encrypted volumes. Capture every session lock, not merely the keyboard shortcut. A busy-volume failure must be visible on unlock. Default to preserving work instead of killing arbitrary processes or forcing unmount.
+
+VeraCrypt erases non-system volume master keys on unmount, but an application can retain decrypted contents in memory. System encryption has different constraints. RAM encryption options are not a general RAM wipe; full shutdown is stronger than leaving the system running, but immediate erasure cannot be promised. [VeraCrypt memory documentation](https://veracrypt.io/en/Unencrypted%20Data%20in%20RAM.html).
+
+"Logged keys" needs precise terminology: keystrokes, encryption keys, cached passwords and session tokens are different data. Win+L is not a countermeasure for an installed keylogger. No generic RAM cleaner or LSASS/process killer belongs in this product.
+
+## 7. Cleanup, AI and debloating
+
+Use retention controls first. Storage Sense can clean temporary files; Downloads and recycle-bin deletion need separate choices. It is maintenance, not certified sanitization. SSD behavior, copies, application databases, sync and backups prevent simple promises that a deleted item is unrecoverable. [Storage Sense](https://support.microsoft.com/en-us/windows/experience/storage-filemanagement/manage-drive-space-with-storage-sense).
+
+Recall is distinct from cloud Copilot and per-application AI features. Microsoft's `DisableAIDataAnalysis` and Recall removal policies can delete existing snapshots. Policy rollback cannot restore those snapshots. The first release intentionally documents this instead of placing the action in its reversible catalog. [Windows AI policies](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowsai#disableaidataanalysis).
+
+The debloat design uses an explicit app inventory and individual selections, distinguishes current-user removal from provisioning for future users, and preserves dependencies. Before OneDrive removal, verify local availability and backup of cloud-only documents and known-folder redirection. Keep Edge/WebView2 separate. Do not delete system directories or security components to claim lower telemetry.
+
+Exclude registry cleaners, blanket log clearing, SSD free-space wiping and RAM trimming. Working-set trimming is a memory-management operation, not secret erasure. [Working sets](https://learn.microsoft.com/en-us/windows/win32/memory/working-set).
+
+## 8. Choice of base tool / operating environment
+
+WinUtil provides useful UI, app installation and reversible settings, but every preset needs review and version pinning. Do not chain multiple debloat tools on a machine. This prototype uses its own small, documented policy catalog, not an unreviewed execution of WinUtil. [WinUtil tweak guidance](https://github.com/ChrisTitusTech/winutil/blob/main/docs/src/content/docs/guides/tweaks.mdx).
+
+AME is a delivery mechanism. Its Privacy+ methodology describes removal of Windows Update, conflicting with the requirement for reversible update choices. A future Wind AME wrapper should invoke the same tested engine rather than duplicate settings or remove security services. [Privacy+ methodology](https://download.amelabs.net/Privacy%2B%20Testing%20Methodology.pdf).
+
+For sessions requiring an amnesic environment, prefer a separate Tails USB over promises about making ordinary Windows forget everything. Persistence must remain an explicit choice. Tails still cannot guarantee safety against malicious hardware or identifying user behavior. [How Tails works](https://tails.net/about/index.en.html).