Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google can track surfing habits without need for HTTP cookies

youbroketheinternet.org

Post reply on HN
Print view View original

61–65 of 65 posts

Re: Google can track surfing habits without need for HTTP cookies

#61

Post by UncleMeat »

Avshalom wrote: post #25
aawc wrote: post #11

Did you turn on that 'Block dangerous and deceptive content' feature in Firefox' security tab? It works by consulting Google each time you visit a new website. You can imagine the rest. Patently wrong. Here's how the API works: The Update API lets your client applications download hashed versions of the Safe Browsing lists for storage in a local database. URLs can then be checked locally. Only if a match is found in…

any evidence that it doesn't match with the top ~1M websites? because that page says "hashed versions" which kind of implies "not inspect-able". also why does it collect client ID at all and also "should uniquely identify a client implementation, not an individual user" doesn't sound a lot like "can't identify an individual user" ... especially in a home user context.

Given that the system makes a network request when a hashed match is found, anybody could verify this. Surely the evidence would need to go in the other direction, especially since revealing the offending websites would signal to malicious parties exactly what they need to change.

Re: Google can track surfing habits without need for HTTP cookies

#62

Post by asdfasgasdgasdg »

rayvy wrote: post #32
asdfasgasdgasdg wrote: post #7

There are a lot of dark patterns Google could use to track you if it wanted to. Does it? Who can say besides those on the inside. If you think they're using this, then there are probably half a dozen other methods you also think they are using, so this shouldn't bother you (at least, not any more than you are already bothered). If you don't think they're using any of those half a dozen other methods, you probably sho…

> There are a lot of dark patterns Google could use to track you if it wanted to Could you elaborate here? I'm primarily only aware of cookies and javascript/pixels, but I'm sure there are much more elaborate ways.

There are a variety of them. Cookies are obvious, but even if you block those, there are a variety of techniques to enable server-side super cookies, where you are taking a fingerprint of the browser and storing the information on the server (e.g. https://amiunique.org/fp). And that's not even counting stuff you can do with no cooperation from the user-agent at all. You can do a lot of deanonymization using IP blocks, time of day, and behavior analysis. I'm not an expert. There's a lot of stuff here that you can read about if you dig in to it.

Personally, I don't believe that Google is doing much if any of this stuff, because I think they rightly believe that if it were discovered that they are, it would go poorly for them in the public sphere.

Re: Google can track surfing habits without need for HTTP cookies

#63

Post by lixtra »

Engineering-MD wrote: post #51
lixtra wrote: post #37

Earlier quoted context omitted.

> A four byte hash is unique to two billion sites Due to the birthday paradox collisions happen much earlier.

Yes, but that is (by the nature of the paradox) only true for a small subset of sites. It provides a huge amount of information, and for much the same reason, DoB is often used as part of an identifier.

Let’s assume that it is indeed the hash of the URL as they wrote. There are much more than 2B URLs on the net. Assume google flagged 2M as malicious (a 8MB db).

So on average you get a hit for 1 in thousands URLs. For each hit you query google for the malicious sites with the actual hash. It does feel like some information could leak but at the same time there are literally hundreds of possible URLs that map to each hash value. So there is plausible deniability as well.

Again, combined with more information this could be exploited. But probably there are easier attack vectors.

Re: Google can track surfing habits without need for HTTP cookies

#65

Post by manicdee »

lixtra wrote: post #37
manicdee wrote: post #35

Earlier quoted context omitted.

A four byte hash is unique to two billion sites. The collision space with non-mainstream sites you might visit is going to be tiny. It’s as good as sending the actual URL, and possibly even the full path to the document you requested, if the browser has previously asked Google for another site and Google has seen a pattern of browsing from Site A to Site B in browsers not using this “security” feature.

> A four byte hash is unique to two billion sites Due to the birthday paradox collisions happen much earlier.

Not the point.

You issue quest on hash A then hash B. Google guesses that because of other activity it has seen today, visits to a site marked by hash A followed by visits to site marked hash B means you are following a link from Alex Jones’ blog to a flat earth holocaust denial web site, and thus prepares to serve your IP address ads for tin foil hats and prepper magazines.

The chances of your traffic pattern of hash A then hash B colliding with, say, my browsing of the MLP fan club and following a link to cosplay photos from Dragon Con are pretty slim, even though the MLP fan club URL hash collided with the Alex Jones blog hash.

Google aren’t just looking at the one thing you viewed, they are following you everywhere.

Post reply on HN