Forget GDID: your PC has a hardware-baked permanent identifier that you cannot erase

You think GDID is scary? The controversy over Windows telemetry’s use to track down a hacker only scratches the surface. Your computer carries a permanent hardware identity that you can never reset: delete browser, wipe Windows, switch to Linux, flash BIOS, or even burn your old storage drive, but it will still be there in the TPM chip.

The arrest of Scattered Spider hacker Peter Stokes sparked widespread privacy concerns – Microsoft fingerprinted and tracked the villain using its GDID (Global Device Identifier), a telemetry feature.

Cyber pros quickly pointed out that the attacker himself was clumsy and failed at the basics of operational security by choosing to use a Windows environment.

However, the general public has only now appeared to realize the privacy impact of various telemetry features. Many Windows users are hearing about GDID for the first time.

But GDID, which was used to track down the hacker, pales in comparison to the deeper issue at hand. While GDID remains persistent on Windows, it’s just a software-generated identifier, one of the many – a string that can be deleted, if you really want to.

What’s often overlooked is that PCs now have a baked-in hardware identifier that users can never rotate or change, even after a complete system wipe.

“The EK can't be changed or removed,” Microsoft’s documentation reads.

The Trusted Platform Module (TPM) – a hardware security chip for storing cryptographic keys and performing cryptographic operations – exposes a public Endorsement Key (EK), which is injected at manufacturing time and remains constant as long as the silicon remains the same. The EK is unique for every TPM and can identify it.

Microsoft has been one of the strongest drivers of TPM adoption in consumer PCs, and now TPM is a Windows security requirement.

Windows relies on it and uses it in Device Health Attestation, which phones back to Microsoft, as well as Windows Hello, BitLocker, Entra, and other services.

Many apps already rely on it, and this chip is used for attestation – i.e., proving to a bank that it’s the same device connecting and not a hacker with stolen credentials. Your employer’s VPN might check it before letting you connect to the corporate network.

Users can verify their unique identifier with a single PowerShell command provided by Microsoft.

The conversation on this topic is live. Join in the discussion.

Migrated to Ubuntu? No problem retrieving the exact same code there.

If you can run a terminal command, guess what else can run it? Any software you use, given sufficient privileges.

Increased security at the cost of privacy

Privacy-focused tech YouTuber Rob Braxman flagged the privacy issues with TPM 2.0 a while back. While marketed as a security feature, TPM can be a tool enabling complete loss of control over your privacy.

“This security chip not only erases your privacy, but could also become an instrument of control,” Braxman warned.

Braxman explained that Microsoft uses a service called Platform Crypto Provider (PCP) to route TPM operations through its cloud attestation infrastructure, which enables the tech giant to track users’ keys, devices, and configurations.

Not only Microsoft, but any application can call the TPM and reveal the endorsement key.

“Microsoft provides an API for applications to interface with security functions of your TPM, but it is handled through the cloud through Microsoft, which means Microsoft knows every security interaction, including every interaction with Windows Hello, booting with BitLocker, or interacting with any application that uses these Microsoft security features like gaming apps,” the YouTuber said.

The expert fears that TPM is becoming a mechanism for access denial – Windows, banking, and other apps require TPM to work. Braxman speculated that this can be paired with local AI assistants to remotely analyze data without leaving obvious local traces.

Every TPM ships with a unique asymmetric key, called the Endorsement Key (EK), burned by the manufacturer. We refer to the public portion of this key as EKPub.

Microsoft

It’s unclear how widely TPM EK is used for tracking users across the industry.

However, if GDID can be used to correlate hackers’ activity across different IPs, VPNs, and tunnels while using the same Windows installation, the TPM EK public key survives any software changes on the same hardware.

Resetting/clearing TPM in BIOS achieves nothing, but can brick your system

After the GDID-linked arrest, some engagement-farming accounts on X suggest that users should clear or reset their TPM data in the BIOS. Don’t do that, warns Daniel Card, a technology and cybersecurity professional running PwnDefend, a cybersecurity consulting company.

This only wipes user-created keys, certificates, and other data stored on the TPM chip – not the permanent keys.

“This resets the TPM to a factory-like state,” the expert explained on X.

“It does not change the TPM’s core identity: The Endorsement Key (EK) remains exactly the same. The Endorsement Primary Seed (EPS) – the secret value the EK is derived from – is persistent and is not reset by a normal clear operation.”

Resetting the TPM is only useful when preparing a PC for sale, fixing TPM-related issues, or reinstalling Windows.

Clearing TPM invalidates BitLocker’s encryption keys, resulting in the complete loss of all data unless the user has saved a recovery key. It erases Windows Hello and other credentials, breaks fingerprint logins, face unlocks, device-bound passkeys, and other apps and services that rely on TPM, such as games with anti-cheat systems.

What can you actually do to protect your privacy? Unfortunately, there’s no easy solution.

Braxman suggested setting up a computer with a TPM completely disabled in the BIOS. But BitLocker will stop working, Windows 11 will complain, and apps that require attestation won’t work either.

If you leave TPM enabled, your identity might be exposed whenever you sign in to Windows with a Microsoft account, enable Windows Hello, or use apps that access TPM.

Another option is to use Windows in a VM that can’t access the TPM module, or not run Windows at all, completely bypassing Microsoft’s attestation pipeline. However, even on Linux, the public TPM Endorsement Key can still be retrieved.

Linux doesn’t route TPM data through cloud attestation services unless the user configures it to do so, but installed third-party software might still access the chip.

If you really need a complete TPM identity reset, swapping the CPU (or, in some cases, the motherboard, depending on whether TPM is soldered) brings a new embedded TPM chip and a new hardware identity.

Beware that signing in to the same Microsoft or other accounts, exposing old software-generated ID keys, can link your new identity to the old one.