Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google tracks individual users per Chrome installation ID

github.com

Post reply on HN
Print view View original

361–370 of 642 posts

Re: Google tracks individual users per Chrome installation ID

#361

Post by wayneftw »

eternalny1 wrote: post #339
wayneftw wrote: post #160

Earlier quoted context omitted.

The days of Firefox are over. Every site I work on has less than a few percent of Firefox users. We don't even test with Firefox, because fuck 'em - I never liked the way Mozilla did anything anyway and their painfully obviously false, preachy holier-than-thou brainwashing campaign that they're constantly running in order to keep getting daddy Google's money has always been annoying. I'd rather use MS Edge. It's actu…

> We don't even test with Firefox, because fuck 'em You are the types of people who are slowly destroying the internet, nice work.

Incorrect. Mozilla is responsible for their shitty market share, not me.

I don't test with the Opera, QQ, Yandex or Sogou Explorer browsers either - just to name a few other tiny niche browsers... Do you??

Re: Google tracks individual users per Chrome installation ID

#362

Post by d1zzy »

TL;DR I think whoever posted that is trying to bury the UA anonymizing feature by derailing the discussion.

What I'm seeing is an RFC for anonymizing parts of User-Agent in order to reduce UA based fingerprinting, which improves everyone's privacy, that's a good thing!

Then I see someone comments how that could negatively impact existing websites or Chromium-derived browsers, comments which are totally fair and make an argument that may not be a good idea doing this change because of that.

Then someone mentions the _existing_ x-client-data headers attached to requests that uniquely identify a Chrome installation. Then a lot of comments on that, including here on HN.

To me that's derailing the original issue. If we want to propose that Chrome remove those headers we should do so as a separate issue and have people comment/vote on that. By talking about it on the UA anonymizing proposal we are polluting that discussion and effectively stalling that proposal which, if approved, could improve privacy (especially since it will go into Chromium so then any non-Chrome builds can get the feature without having to worry about x-client-data that Chrome does).

Re: Google tracks individual users per Chrome installation ID

#365

Post by Andrex »

bsharitt wrote: post #198

Everybody imagine going back 15 years and tell yourself that you're using a web browser made by the parent company of DoubleClick. Your 15 year ago self would think you're a moron (assuming that 15 years ago you were old enough to know what DoubleClick was).

I can only speak for myself, but myself from 15 years ago would not have cared so strongly about the choice of browser. I believe I was using the newly-ad-less Opera at the time, and new/cared little about the company making it.

Re: Google tracks individual users per Chrome installation ID

#366

Post by eitland »

coldpie wrote: post #246
kick wrote: post #241

Earlier quoted context omitted.

They're already getting more than enough to fund development with the Google deal, which they've shown no willingness to let up on, despite it seriously compromising user privacy. Donating to Mozilla at this point is just encouraging organizational bloat.

I guess we'll have to agree to disagree (which is fine!). I'd rather continue donating to them to show there are funding sources outside of advertising, which is a business model I despise.

I thought like you.

There seems to be a huge problem though: for some reason it seems they aren't allowed to use donated funds for what I thought was the main reason for Mozillas existence: development of the Firefox web browser.

Instead donated funds seems to go to outreach etc.

I have nothing against outreach but if this is the case I'd rather donate to such organizations directly (or rather increase my monthly donation to Amnesty International).

Re: Google tracks individual users per Chrome installation ID

#367

Post by newspheasant »

Engineering-MD wrote: post #65
bamboozled wrote: post #20

You should also donate to Mozilla because it’s an insanely good piece o software for the price!

So I pay for Pocket Premium as it is wholly owned by Mozilla as a way of diversifying their income away from search and donations. I like and use pocket and get something in exchange for my money (which makes me more likely to keep a rolling payment going on). II know it’s not open source, but tbh that doesn’t hugely bother me given that Firefox itself is. Does anyone object to this indirect way of funding Firefox? D…

I've spent a lot of time considering Pocket Premium but the price point is just too high. Maybe if they roll in features from feedly and have a really nice RSS reader.

I also hate spending money on news that isn't going to journalists.

Re: Google tracks individual users per Chrome installation ID

#369

Post by chias »

xfs wrote: post #320
carlsborg wrote: post #82

If you strace chrome on linux it also picks up /etc/machine-id (or it did back when I looked), which is a 32 byte randomly generated string which uniquely identifies you and on some systems is used as the DHCP ID across reboots.

First I thought reading /etc/machine-id would be expected if Chrome uses D-bus or pulseaudio libraries which depend on D-bus, and /etc/machine-id is part of D-bus. But no, they really use it for tracking purposes. And in a sick twist they have this comment for it: std::string BrowserDMTokenStorageLinux::InitClientId() { // The client ID is derived from /etc/machine-id // (https://www.freedesktop.org/software/systemd/…

In fairness, the guidelines they reference suggest you do exactly what the comment says they're doing (assuming they're keying the hash). The guidelines seem explicitly written with the idea that unique identifiers _derived from_ this value are not similarly quarantined, provided that you cannot take the derived value and "reverse" it back to the original identifier.

Quoting from https://www.freedesktop.org/software/systemd/man/machine-id....:

This ID uniquely identifies the host. It should be considered "confidential", and must not be exposed in untrusted environments, in particular on the network. If a stable unique identifier that is tied to the machine is needed for some application, the machine ID or any part of it must not be used directly. Instead the machine ID should be hashed with a cryptographic, keyed hash function, using a fixed, application-specific key. That way the ID will be properly unique, and derived in a constant way from the machine ID but there will be no way to retrieve the original machine ID from the application-specific one.

Re: Google tracks individual users per Chrome installation ID

#370

Post by oarsinsync »

dontblink wrote: post #344
alleyshack wrote: post #300

Earlier quoted context omitted.

Yep. "I think this way, therefore everyone else thinks this way," is an incredibly common human fallacy.

Seems to equally apply here though. Many people are perfectly fine with targeted ads in exchange for free useful services. I would even propose the majority (otherwise these services wouldn't be popular in the first place!).

> > > Most users never really had the opportunity to provide informed consent.

> Many people are perfectly fine with targeted ads in exchange for free useful services. I would even propose the majority

I feel like these two remarks should be taken together, and not in isolation. My straw poll of a few non-technical folk in a highly-technical firm is that they're broadly unaware of these kinds of things (but everyone has anecdotes...)

Speaking for my own perspective, I was perfectly fine with Gmail when it first launched (1GB of free email storage in exchange for a computer scanning my mail and showing me text adverts on the side? DEAL!), mostly because in 2003 I had no idea what my data was worth (individually, very little. in aggregate along with eevryone else's? $GOOG indicates it's in the ~trillion range). Facebook? For sure! Have my favourite books, albums, movies, tv shows, all my photos, why not?

It took many years before the implications of that decision that we (collectively) made came through. Not everyone has the bandwidth to focus on this, and so it just becomes background noise.

Post reply on HN