Windows logged the exact ngrok URL a suspect opened, down to the second
On May 12, 2025 at 19:21 UTC, a machine tagged g:6755467234350028 loaded dashboard.ngrok.com/signup. Microsoft had it on record, tied to an IP — and that log helped put a name to a hacker.
The arrest exposed that Microsoft keeps a Global Device Identifier for every Windows install and can correlate it with the IPs it used and the URLs it reached. What unsettled the thread is the scope, not the ID itself.
The sharpest question is which layer does this. A machine ID sitting on disk is normal; an OS vendor tying it to your live network activity is not. Nobody could say for sure whether it's Edge, Defender, or something lower in the stack.
What a hacker's arrest exposed about Windows
PCMag's report works backward from a court filing. A suspect running the tunneling tool ngrok was unmasked in part because the DOJ criminal complaint a reader surfaced shows Microsoft's logs placing his device at a specific ngrok signup page, at a specific second, matched to his IP address. What makes that possible is a persistent Windows machine identifier, the GDID, that the telemetry carries right alongside network activity.
That commenter's own summary is blunt: for Windows users, "privacy … is totally destroyed by these logs," and his fix is to move to Linux. A separate thread from Massgrave.dev developers is trying to reverse-engineer exactly how the GDID mechanism works.
Nobody in the thread can pin the mechanism
The uncomfortable part is that no one is sure how Microsoft ends up with this. A machine ID is mundane; a full URL is not.
"I can think of a place where a system component has access to the domain name, but not of one where it has the full URL." — a high-karma commenter tracing the data path
Guesses ran from Edge to generic telemetry to security tooling. One pointed at Defender's cloud service, MAPS, noting it was previously named SpyNet. The thread's TL;DR bet on ordinary telemetry quietly shipping the install ID, the current IP, and recently resolved domains.
"Every OS has a machine ID. That's not the point"
The reframe that landed hardest came from an iOS engineer:
"The interesting part is not really the existence of a machine identifier. Almost every modern OS has some equivalent. The bigger question is the boundary: which components can access it, and when does a local identifier become a remote tracking identifier?" — an iOS engineer who lists privacy among his interests
And not everyone accepted the article proved its claim:
"Vague article. No evidence that Microsoft can see what web pages you are visiting in Chrome or Firefox." — a skeptic in the thread
The arrest gets read two ways at once: a criminal caught, and a capability confirmed. The residue that unsettled the thread isn't that one hacker got traced. It's that the same chain, IP to install to URL, sits by default on a billion machines, and the room couldn't even agree which layer performs it. A correlation that reliable needs only a subpoena to point at anyone.
Get breakdowns like this every day
The top Hacker News stories, unpacked — by email, Telegram, or RSS.
Paid to delete AI code: is cleanup a real business or Sisyphus's labor?
The pitch is blunt. A client calls asking for a "small refactor" and hands over 100,000 lines of AI-generated spaghetti. To Slopfix, that isn't a headache. That's the whole business.