Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google can track surfing habits without need for HTTP cookies

youbroketheinternet.org

Post reply on HN
Print view View original

31–40 of 65 posts

Re: Google can track surfing habits without need for HTTP cookies

#31

Post by auslander »

asdfasgasdgasdg wrote: post #7

There are a lot of dark patterns Google could use to track you if it wanted to. Does it? Who can say besides those on the inside. If you think they're using this, then there are probably half a dozen other methods you also think they are using, so this shouldn't bother you (at least, not any more than you are already bothered). If you don't think they're using any of those half a dozen other methods, you probably sho…

> ... if it wanted to

Made me smile. Google needs to track you, its their core business model. Defeat is not an option, all methods should be found and blocked. Thankfully Chrome is not the only usable browser, and network requests are detectable.

Re: Google can track surfing habits without need for HTTP cookies

#32

Post by rayvy »

asdfasgasdgasdg wrote: post #7

There are a lot of dark patterns Google could use to track you if it wanted to. Does it? Who can say besides those on the inside. If you think they're using this, then there are probably half a dozen other methods you also think they are using, so this shouldn't bother you (at least, not any more than you are already bothered). If you don't think they're using any of those half a dozen other methods, you probably sho…

> There are a lot of dark patterns Google could use to track you if it wanted to

Could you elaborate here? I'm primarily only aware of cookies and javascript/pixels, but I'm sure there are much more elaborate ways.

Re: Google can track surfing habits without need for HTTP cookies

#33

Post by chrismorgan »

rayvy wrote: post #32
asdfasgasdgasdg wrote: post #7

There are a lot of dark patterns Google could use to track you if it wanted to. Does it? Who can say besides those on the inside. If you think they're using this, then there are probably half a dozen other methods you also think they are using, so this shouldn't bother you (at least, not any more than you are already bothered). If you don't think they're using any of those half a dozen other methods, you probably sho…

> There are a lot of dark patterns Google could use to track you if it wanted to Could you elaborate here? I'm primarily only aware of cookies and javascript/pixels, but I'm sure there are much more elaborate ways.

Here’s one way: https://en.wikipedia.org/wiki/HTTP_ETag#Tracking_using_ETags

Re: Google can track surfing habits without need for HTTP cookies

#34

Post by auslander »

rayvy wrote: post #32
asdfasgasdgasdg wrote: post #7

There are a lot of dark patterns Google could use to track you if it wanted to. Does it? Who can say besides those on the inside. If you think they're using this, then there are probably half a dozen other methods you also think they are using, so this shouldn't bother you (at least, not any more than you are already bothered). If you don't think they're using any of those half a dozen other methods, you probably sho…

> There are a lot of dark patterns Google could use to track you if it wanted to Could you elaborate here? I'm primarily only aware of cookies and javascript/pixels, but I'm sure there are much more elaborate ways.

blog.mozilla.org/security/2018/01/31/preventing-data-leaks-by-stripping-path-information-in-http-referrers/

Re: Google can track surfing habits without need for HTTP cookies

#35

Post by manicdee »

lixtra wrote: post #28
yjftsjthsd-h wrote: post #21

Earlier quoted context omitted.

So then it semi-randomly sends Google URLs you visit? That's better , but I wouldn't say patently wrong. Statistically usually wrong?

> So then it semi-randomly sends Google URLs you visit? No, it computes a 4 byte hash of the URL (domain?) and if this matches a local DB entry then it asks google for all malicious URLs with that hash (explained in the link of parent). Depending how many entries there are your browser contacts google fairly frequently and then google using techniques mentioned in the article can link your TLS-Cookie to your IP.

A four byte hash is unique to two billion sites. The collision space with non-mainstream sites you might visit is going to be tiny.

It’s as good as sending the actual URL, and possibly even the full path to the document you requested, if the browser has previously asked Google for another site and Google has seen a pattern of browsing from Site A to Site B in browsers not using this “security” feature.

Re: Google can track surfing habits without need for HTTP cookies

#37

Post by lixtra »

manicdee wrote: post #35
lixtra wrote: post #28

Earlier quoted context omitted.

> So then it semi-randomly sends Google URLs you visit? No, it computes a 4 byte hash of the URL (domain?) and if this matches a local DB entry then it asks google for all malicious URLs with that hash (explained in the link of parent). Depending how many entries there are your browser contacts google fairly frequently and then google using techniques mentioned in the article can link your TLS-Cookie to your IP.

A four byte hash is unique to two billion sites. The collision space with non-mainstream sites you might visit is going to be tiny. It’s as good as sending the actual URL, and possibly even the full path to the document you requested, if the browser has previously asked Google for another site and Google has seen a pattern of browsing from Site A to Site B in browsers not using this “security” feature.

> A four byte hash is unique to two billion sites

Due to the birthday paradox collisions happen much earlier.

Re: Google can track surfing habits without need for HTTP cookies

#38

Post by flukus »

yjftsjthsd-h wrote: post #21
aawc wrote: post #11

Did you turn on that 'Block dangerous and deceptive content' feature in Firefox' security tab? It works by consulting Google each time you visit a new website. You can imagine the rest. Patently wrong. Here's how the API works: The Update API lets your client applications download hashed versions of the Safe Browsing lists for storage in a local database. URLs can then be checked locally. Only if a match is found in…

So then it semi-randomly sends Google URLs you visit? That's better , but I wouldn't say patently wrong. Statistically usually wrong?

> That's better

Is it? Typically these shady sites would be the ones I'd most like to keep private.

Re: Google can track surfing habits without need for HTTP cookies

#40

Post by Dunedan »

tapirl wrote: post #39

The largest company which tracks surfing habits without need for HTTP cookies is Amazon. When you visit every website hosted on AWS, Amazon tracks you, without saving/reading any cookies. The same is for any server hosting provider companies.

> When you visit every website hosted on AWS, Amazon tracks you

Is that just an unsubstantial accusation or do you have a source for that?

Post reply on HN