Stable host identifiers and privacy on Linux

[arvindautar]

I want to raise a privacy question around stable device identifiers.

I recently read about the Peter Stokes / Scattered Spider case. From what I understand, investigators used Microsoft Windows telemetry, including a persistent Global Device Identifier (GDID), together with IP logs and other records, to link online activity to a person.

This is not about defending illegal activity. My point is the privacy angle: stable device identifiers can become part of a tracking or attribution chain, even if they were originally created for legitimate system purposes.

That made me think about Linux and /etc/machine-id.

As I understand it, /etc/machine-id is the stable local machine identifier on most modern Linux systems. It has valid system uses, so I am not suggesting it should be randomized on every boot.

But Chrome/Chromium seems to use /etc/machine-id in some enterprise/cloud-management code paths to derive a stable client or device ID.

To be clear: I do not mean that websites can directly read /etc/machine-id. The concern is that software can use it as a seed to create another stable identifier. That derived ID can then be linked to activity over time, especially when combined with telemetry, accounts, IP addresses, or browser management data.

So the real question for me is:

Where should the boundary be between legitimate local system identity and privacy-invasive client identity?

I do not think the answer is “randomize everything.” That would probably break legitimate system behavior. But I also think there is a difference between a local system identifier existing and applications using it to create long-term client identities.

Maybe this is only a documentation issue. Maybe it belongs upstream. Maybe sandboxing or permissions could play a role in the future. I am not sure.

I am mainly interested in how people think about this boundary?

[znmeb]

Honestly, at this point in US history, I think I'd be OK with "randomize and quantum-secure encrypt everything," but I can't speak for folks with lesser privilege than a retired IT nerd.