17 lines
2.5 KiB
Markdown
17 lines
2.5 KiB
Markdown
# ZeroTrace GDID source review
|
|
|
|
Reviewed 2026-09-19. Static source review only; no upstream program executed, local identifiers collected, registry changed or network enforcement applied. The workbook's existing implementation counts are unchanged.
|
|
|
|
## Evidence and limits
|
|
|
|
- **Registry patch, demonstrated by source:** `write_lid` writes HKCU's LID and `main` reads it back. No request capture, delayed persistence check, certificate validation or remote unlinkability test appears in this program. [Pinned patcher source, commit 2c9bceacbdd20a814b5c800a7a23a3706996664c](https://github.com/5mukx/GDID-Extractor/blob/2c9bceacbdd20a814b5c800a7a23a3706996664c/patch-poc/src/main.rs).
|
|
- **Local enumeration, demonstrated by source:** the Rust extractor reads registry, firmware, disk, adapter and TPM public-key information. Its printed hardware report does not demonstrate that these fields were transmitted in a Windows identity request. [Pinned extractor source](https://github.com/5mukx/GDID-Extractor/blob/2c9bceacbdd20a814b5c800a7a23a3706996664c/rust/src/main.rs).
|
|
- **Article assertions needing reproduction:** automatic LID restoration; universal hardware relinking; GDID on every Microsoft request. The certificate-import discussion uses tentative language before presenting a definite outcome. Treat these as unresolved, not established backend behavior. [ZeroTrace article](https://www.zerotracelab.com/blog/gdid-windows-tracking).
|
|
- **Case evidence:** paragraphs 25-30 describe a persistent installation identifier, URL records and corroborating account/IP evidence. They do not identify Edge or a specific collection mechanism. The complaint describes a new GDID after reinstall; that does not establish whether other signals can link installations. [DOJ complaint](https://www.justice.gov/usao-ndil/media/1450651/dl?inline=).
|
|
|
|
## Project decision
|
|
|
|
Minute-by-minute LID replacement remains an unvalidated experiment, excluded from the privacy profile. A changed registry value is not our success criterion. Independent research would need versioned, repeatable observations of actual outbound identifiers before and after a change, including reboot and service restart, plus security/update compatibility checks. Even changed outbound identifiers would not prove the provider cannot correlate sessions.
|
|
|
|
Prioritize measurable reductions in unnecessary data transmission. Keep credential stores, TPM state and security protections intact while evaluating supported controls. No claim that blocking one identity endpoint eliminates all Microsoft collection is justified by this review.
|