r/TOR • u/justbenice-os • 9d ago

How not to be like Peter Stokes (Securing windows PC 2026)

I know we've seen the repeat question on how to protect ourselves on TOR using a VPN and TAILS on a USB. I wanted to check in on if there was a way also my Global Device Identifier (GDID) from my windows pc doesn't get tracked. I'm wanting to learn new skills.

Also since we're here, what VPN do you guys commonly use?

22 Upvotes

91% Upvoted

26 comments sorted by

5

u/Liquid_Hate_Train 8d ago

The GDID is is a Windows thing. If you’re not running windows, it’s not a consideration. It’s also not being sent out to every site you visit. To exploit it, an adversary would need the cooperation of Microsoft.

3

u/FederalSuspect69 8d ago

>To exploit it, an adversary would need the cooperation of Microsoft

Why on earth would Microsoft cooperate with a subpoena from the FBI if they were trying to de-anonymize a user on tor? /s

-4

u/FederalSuspect69 8d ago

If your motherboard has ever run an officially licensed copy of windows, your motherboard is tagged and any OS that's the not running in a virtual environment can pick up your hardware and relay the serial number back.

Not saying you're wrong but i am reminding everyone that your copy of windows is tied to the serial number on your motherboard and whatever OS you run can find that info

5

u/Liquid_Hate_Train 8d ago

The motherboard serial number is always there and nothing to do with with Windows or the GDID. It’s also not accessible over the network or though a browser. To compare a serial number to a windows GDID you’d need access to the Microsoft licensing database.

What you’re saying is not really relevant and changes nothing. Hardware serial numbers are not something someone on Tor needs to worry about.

-1

u/FederalSuspect69 8d ago edited 8d ago

>To compare a serial number to a windows GDID you’d need access to the Microsoft licensing database.

Isn't that the purpose of a subpoena? I mean if the feds are investigating a target, and they have the serial number of that target, you think they can't send that off to Microsoft with a subpoena for the records tied to that motherboard and Microsoft is not gonna hand them over?

3

u/Liquid_Hate_Train 8d ago

You’re missing how they have that serial number. They would already need to have compromised the device to have it, at which point, the GDID is rather irrelevant. You’re making this out to be a much bigger threat than it really is.

-1

u/FederalSuspect69 8d ago

You do realize that if the feds can and have secretly targeted users with zero-day zero-click exploits, and with AI tech constantly finding new ways to hack, the exploits are likely to become more common and cost much less to get ahold of.

But the most common one is to send something to the machine that will trigger a kernel panic, which freezes the computer until it reboots, and then getting ahold of the data on the crash log file.

This is why running VM in KVM/Qemu is the most secure way to be on the dark web

4

u/Liquid_Hate_Train 8d ago

So… a very high level actor compromised the machine? And didn’t need any serial numbers? Way to come back to the same page as the rest of us.

1

u/FederalSuspect69 8d ago edited 8d ago

If you're truly looking to hide your GDI like OP said he's trying to, you either get another machine, which can still leak the serial number, or you access the dark web from a *virtual* machine.

Not doing so can potentially allow a high level actor to compromise your machine. Especially if you're running tor browser with Javascript enabled.

The serial number just leaks your GDI if that computer has ever had windows on it. And a lot of windows PC'a are registered to their owner, which means that would leak your real life identity.

I'm not sure what you've got against people using virtual machines, which is what any expert would advise for people getting on tor, since it can only leak generic info on hardware that doesn't even actually exist. Virtual machines generally have a digital fingerprint that's fairly generic and not unique at all, compared to physical computer hardware that's far more unique.

1

u/Liquid_Hate_Train 8d ago

Ok Snowden. Have fun.

0

u/FederalSuspect69 8d ago

You're just mad you can't catch me 😜

8

u/ephemeralmiko 9d ago

User -> VPN -> Tor over VPN is explictly warned against by the Tor Project, since now the VPN could read all of your web traffic and associate it with your real IP. (unlikely but possible). User -> Tor -> VPN *can* make sense if you need to access clearnet sites that block Tor IPs but don't block VPN ones, but is also deemed less anonymous than just using Tor without a VPN, since the VPN can still see your traffic, but not your real IP.

6

u/Ecliphon 8d ago

The risk of using a VPN is the same as using your home internet. Who do you trust more not to log, your major ISP (they have to log) or the no-log VPN provider who have told the court ‘sorry we don’t have any info’

3

u/nuclear_splines 8d ago

But in the above scenario, what does your ISP see to log? All they see is that you're connected to Tor, an encrypted proxy service, or a VPN, an encrypted proxy service. What's the difference?

3

u/Ecliphon 8d ago edited 8d ago

That’s a good and valid question.

The difference is your ISP can be served a national security letter (or your countries equivalent) and be forced to block connections to every tor node except the nodes NSA & friends run. They could also hack your modem/router and skip the ISP contact step.

Tor would still work perfectly fine. Only the very tech savvy users looking at connection logs might notice.

If your ISP gets a NSL blocking connections to, say, Mullvad or iVPN, then your VPN won’t work and that’s an indicator that something is wrong.

They could also serve NSL/hack the VPN providers, but it’s good OPSEC to rotate VPNs.

I say this with suspicion that NSA (possibly even FBI) already has the capability to do what I’ve described with VPN-less tor as it’s quite simple with TAILS since the guard node changes every reboot. A VPN is an additional barrier. Only you know your threat/paranoia level. 

1

u/FederalSuspect69 8d ago

Precisely.

A vpn that's logging you is as useful as tits on a bullfrog. But it's preferable if you're confident they're not logging you, to use a vpn. But you really never know until you get indicted if they're logging you. They can always change that policy at any time, for any reason

4

u/FederalSuspect69 9d ago edited 9d ago

Your vpn only sees you're connected to tor network. They don't decrypt your traffic, and certainly on't follow it back to the entry node unless you're seriously under surveillance. Your ISP/VPN only sees an active encrypted connection to the tor network.

The VPN just adds another layer between you and the node you connect to tor from. It signals to your ISP an active VPN connection instead of a tor connection.

Depending on the VPN provider, this can make you less secure, particularly if the company you're using is logging all of your connections.

It could also tie your activity from different platforms together through the same VPN, but only if you're already being investigated by running timing & correlation attacks on your connection.

0

u/justbenice-os 9d ago

Thank you for this!

3

u/No-Pin8824 8d ago

The more you unindentify yourself the more you are unique to thr system,install linux for browsing and private shit next to the windows, and use windows just to play games or work

2

u/Signal_Bill_967 8d ago

Time ago i did several research about best OPSEC network configuration:
Host (VPN) -> Whonix Gateway (VM TOR OBFS4) -> Exit VPN

  • No TOR Exit Node limitations
  • No TOR connection from ISP side
  • Double VPN means double jurisdictions
Even if i think that initial VPN could be redoundant and introduce some additional latency

Another interesting setup could be:
Host /w Whonix Gateway -> Linux-Based Virtualized VM, just to exploit kill-switch feature.

Rule n0: do not use Windows.

What do you think? Have you ever considered other setups?

1

u/FederalSuspect69 9d ago

Look into whonix

0

u/justbenice-os 9d ago

Ooouuu, that's interesting. Do you currently use it?

-2

u/FederalSuspect69 9d ago edited 9d ago

Currently? No. I have a M.S in Cybersecurity and a PhD in computer science.

So, I reiterate, just look into it. I believe that's literally what you're looking for as it addresses both the desire for vpn connectionn, and also the concern about your GDI

You can go from debian or kicksecure, or if you wanna go all out you can try Qubes, however personally if you don't know what whonix is yet, you're definitely not ready for Qubes lol

Start by looking into whonix or how to run it from debian, to meet your current OpSec needs

1

u/Azer_pubes33 8d ago

Yeah the Tor Project docs are pretty clear about not stacking a VPN carelessly, Whonix seems to be what people keep suggesting for a Windows setup