Google tracks individual users per Chrome installation ID

Post by EastSmith » Tue, Feb 04, 2020, 8:43 PM UTC

pbhjpbhj wrote: post #440

EastSmith wrote: post #433

Downvote me how many times you want, but Mozilla needs to fork Chromium, degoogle it and fix the web. Mozilla is the only internet entity I can say I trust, I am donating to it, and yet I am using Chrome and Brave on both Desktop and mobile. Just follow the users and fork it!

Well Mozilla burnt my trust in them over the last couple of years ... maybe Brave? Some don't like their model to tip content providers but they seem - and I've not made rigorous enquiries here (please inform!) - to be a relatively trustworthy mod of Chromium!?

Post by jlgaddis » Tue, Feb 04, 2020, 8:45 PM UTC

StevePerkins wrote: post #327

Is this at the "Chrome" level, or baked in at the "Chromuim" level? And therefore also an issue for Brave, Opera, Vivaldi, new-Edge, and anything else jumping on the browser engine monoculture?

Post by pbhjpbhj » Tue, Feb 04, 2020, 8:46 PM UTC

chias wrote: post #369

xfs wrote: post #320

Earlier quoted context omitted.

First I thought reading /etc/machine-id would be expected if Chrome uses D-bus or pulseaudio libraries which depend on D-bus, and /etc/machine-id is part of D-bus. But no, they really use it for tracking purposes. And in a sick twist they have this comment for it: std::string BrowserDMTokenStorageLinux::InitClientId() { // The client ID is derived from /etc/machine-id // (https://www.freedesktop.org/software/systemd/…

In fairness, the guidelines they reference suggest you do exactly what the comment says they're doing (assuming they're keying the hash). The guidelines seem explicitly written with the idea that unique identifiers _derived from_ this value are not similarly quarantined, provided that you cannot take the derived value and "reverse" it back to the original identifier. Quoting from https://www.freedesktop.org/software/…

Post by dessant » Tue, Feb 04, 2020, 8:47 PM UTC

csagan5 wrote: post #417

dessant wrote: post #413

Earlier quoted context omitted.

This is the equivalent of a protest, people are objecting to Google's illegal data harvesting practices in places that receive engagement, since that's the most effective way to get the word out and warn others. Google's reasoning that this is not personal data is meaningless in the face of GDPR, which considers an IP address personal data. Google has access to the IP address when they receive the data, therefore the…

It could be argued that a similar violation is present (since March 2019) in Chromium for the Widevine CDM provisioning request, see https://github.com/bromite/bromite/issues/471 Basically all users opening the browser will contact www.googleapis.com to get a unique "Protected Media Identifier", without opening any web page and even before any ToS/EULA is accepted (and there is no user consent either).

Post by pbhjpbhj » Tue, Feb 04, 2020, 8:52 PM UTC

Mirioron wrote: post #142

scoutt wrote: post #71

PII concept is not the same for everyone/everywhere. For GDPR we have: > Article 4(1): ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly , in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or…

Who's going to raise this issue though? And what if they put this in the browser's T&C?