@nyanbinary I mean, clearly doing more than licensing. But just the most well known use.

@sharkfie the big question I have here (and which I couldnt find docs on during a cursory search) which none of this reporting mentions is how/when/where the device ID is collected?

Like, sure, a device ID is a thing, who cares. Where the fuck is the Activity<->ID link collected??

@nyanbinary https://www.justice.gov/usao-ndil/media/1450651/dl?inline [pdf] pages 8 and 38

I only skimmed it, but seems like a name for several identifiers meant to identify a machine across reinstalls (like for activation). Some sort of HWID?

@sharkfie ok, but like, the question still is: Who/how is this linkage connected.

Lets take 26. as an example:

According to Microsoft records, on or about May 12, 2025, at 19:21 UTC—when, according to ngrok records, the ngrok account was created—the device with the GDID accessed, among other ngrok pages, “https://dashboard.ngrok.com/signup,” the ngrok page to set up an ngrok account.

ngrok isn't MS & afaik isn't even Azure-hosted. I'm trying to look for a way that MS still would be able to know about the page visit for the device ID without just pulling non-anonymized browsing data from device, lmao.

@nyanbinary I read it as "the device identified by this ID" that was known to use "this proxy server", connected to ngrok dashboard.

And they probably had logs of that IP with that ID connecting for updates or just telemetry.

Reminds me of the indictment (wrong word?) RaidForums admin a few years back, with the log collection. It's fucked up either way.