Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google tracks individual users per Chrome installation ID

github.com

Post reply on HN
Print view View original

461–470 of 642 posts

Re: Google tracks individual users per Chrome installation ID

#461

Post by mabbo »

d1zzy wrote: post #362

TL;DR I think whoever posted that is trying to bury the UA anonymizing feature by derailing the discussion. What I'm seeing is an RFC for anonymizing parts of User-Agent in order to reduce UA based fingerprinting, which improves everyone's privacy, that's a good thing! Then I see someone comments how that could negatively impact existing websites or Chromium-derived browsers, comments which are totally fair and make…

I think the concern is that this disarms Google's competitors while keeping them fully-armed.

Ads are a business, and they are Google's business. They are how they make money. And like all businesses, they are competitive. Tracking is a way to make more money off online advertising. By removing tracking from their competitors while keeping it for themselves, Google stand to make a lot of money off this change.

Their motivations are not honest, but they're pushing them as if this is the high road. It isn't. It's the dirty low road of dominating the online ad business, made possible by their dominance in the browser market. And it's always been the end-goal of Chrome browser.

Re: Google tracks individual users per Chrome installation ID

#462

Post by Spooky23 »

Spooks wrote: post #86
driverdan wrote: post #58

Earlier quoted context omitted.

> their executive compensation rates are way too high Just because they're a non-profit doesn't mean execs should be paid far below market rates.

I agree, I never understood that argument. We have a fairly large and wonderful kids hospital that looks for donations and some of my friends said they wouldn't donate because their CEO makes 500k and he should donate his money instead. I had to explain you want to recruit great talent, and that 500k is less than he could make some place else.

You're assuming the $500k guy is great talent.

Our local YMCA pays the Executive Director $400k/year. The child care workers make $11.50/hr + free membership. (ie. minimum wage) The Y is great, but I'm not donating anything to them.

Re: Google tracks individual users per Chrome installation ID

#463

Post by shadowgovt »

JohnFen wrote: post #457
shadowgovt wrote: post #195

Earlier quoted context omitted.

> Programmers should stop pushing buggy or incomplete software as is, and start releasing software that works If you demand a perfection-of-function guarantee from something as complicated as a web browser, you'll never get a web browser with more features than the ones released in the '90s (and I'm not even sure we'd be that far along by now). If I'm given a forced choice between "more privacy" and "the software eve…

> you'll never get a web browser with more features than the ones released in the '90s I would actively prefer a web browser that lacks the features added since the '90s.

That's understandable, but it isn't what most people want---developers or users alike.

Browsers aren't just thin-clients to support HTTP protocol and HTML rendering. They've grown to adopt a new distributed computing paradigm, not unlike UNIX and its descendants grew to support a new multi-user-cum-multi-process paradigm. The things web development offers---location agnosticism, platform agnosticism, combined multimedia interaction, a workable security model for multi-source aggregate-component content---are eating software development, and the browser is becoming the OS of the modern era. We know users want this because users were willing to use Flash (even though Flash broke out of the security model of the old browser).

There'll always be a place for small text-based pages much as modern computing will always have a place for command-line tools, but the genie is out of the bottle and it won't be put back in.

Re: Google tracks individual users per Chrome installation ID

#464

Post by d1zzy »

lordlimecat wrote: post #459
d1zzy wrote: post #362

TL;DR I think whoever posted that is trying to bury the UA anonymizing feature by derailing the discussion. What I'm seeing is an RFC for anonymizing parts of User-Agent in order to reduce UA based fingerprinting, which improves everyone's privacy, that's a good thing! Then I see someone comments how that could negatively impact existing websites or Chromium-derived browsers, comments which are totally fair and make…

>which improves everyone's privacy, that's a good thing! Except it does not affect Google, because Google has this install ID to use both for tracking and preventing ad-fraud. Which means Google competitors are terribly disadvantaged, as they cannot use that. Which not only reduces market diversity (contrary to TAG philosophy) but represents a significant conflict of interest for an organization proposing a major web…

> Except it does not affect Google, because Google has this install ID to use both for tracking and preventing ad-fraud.

So when Apple releases a privacy feature, that doesn't affect them as a business, we praise the feature or we say "except it doesn't affect Apple" and somehow try to argue how the feature is less valuable because of that?

Re: Google tracks individual users per Chrome installation ID

#465

Post by emmelaich »

asdfasgasdgasdg wrote: post #434
calibas wrote: post #419

Earlier quoted context omitted.

That's the whole point. Using any Google service means they can easily personally identify you, that's what the privacy policy should explain. That's their policy towards privacy, you don't have any. For some reason I can't fathom, you claim mentioning this in their privacy policy "would not have any purpose". Instead of honesty, their privacy policy is a wonder of public relations where it seems like they care deepl…

We disagree about the purpose of privacy policies. I believe that privacy policies should describe how data will be used, not how it could be used. I just don't think a policy describing how data could be used is very useful, because it's going to be the same for all services. Under this formulation, Google's policy is (presumably, lacking any data to the contrary) honest with respect to this value.

> I believe that privacy policies should describe how data will be used, not how it could be used.

This is key. If you subscribe to the "how it could be used" version, then even say possessing an android phone would be a violation of the privacy policy. Which is absurd.

Re: Google tracks individual users per Chrome installation ID

#466

Post by dessant »

d1zzy wrote: post #464
lordlimecat wrote: post #459

Earlier quoted context omitted.

>which improves everyone's privacy, that's a good thing! Except it does not affect Google, because Google has this install ID to use both for tracking and preventing ad-fraud. Which means Google competitors are terribly disadvantaged, as they cannot use that. Which not only reduces market diversity (contrary to TAG philosophy) but represents a significant conflict of interest for an organization proposing a major web…

> Except it does not affect Google, because Google has this install ID to use both for tracking and preventing ad-fraud. So when Apple releases a privacy feature, that doesn't affect them as a business, we praise the feature or we say "except it doesn't affect Apple" and somehow try to argue how the feature is less valuable because of that?

Apple is not engaged in illegal data harvesting to gain a competitive advantage over other services in the same space. Google's collection of personal data with the x-client-data header without user consent is illegal under GDPR.

Re: Google tracks individual users per Chrome installation ID

#467

Post by mc3 »

xfs wrote: post #320
carlsborg wrote: post #82

If you strace chrome on linux it also picks up /etc/machine-id (or it did back when I looked), which is a 32 byte randomly generated string which uniquely identifies you and on some systems is used as the DHCP ID across reboots.

First I thought reading /etc/machine-id would be expected if Chrome uses D-bus or pulseaudio libraries which depend on D-bus, and /etc/machine-id is part of D-bus. But no, they really use it for tracking purposes. And in a sick twist they have this comment for it: std::string BrowserDMTokenStorageLinux::InitClientId() { // The client ID is derived from /etc/machine-id // (https://www.freedesktop.org/software/systemd/…

> which is why we hash it first and then encode it in base64 before transmitting it.

This made me chuckle. "As per the rules, we'll put on a boxing glove before we punch your lights out". You wont get privacy, but at least there is some security!

Re: Google tracks individual users per Chrome installation ID

#468

Post by mc3 »

pbhjpbhj wrote: post #445
chias wrote: post #369

Earlier quoted context omitted.

In fairness, the guidelines they reference suggest you do exactly what the comment says they're doing (assuming they're keying the hash). The guidelines seem explicitly written with the idea that unique identifiers _derived from_ this value are not similarly quarantined, provided that you cannot take the derived value and "reverse" it back to the original identifier. Quoting from https://www.freedesktop.org/software/…

What else is going to break if one randomises that ID (per boot or per hour, say)?

What about running Chrome inside a container?

Re: Google tracks individual users per Chrome installation ID

#469

Post by mokus »

dessant wrote: post #447
csagan5 wrote: post #417

Earlier quoted context omitted.

It could be argued that a similar violation is present (since March 2019) in Chromium for the Widevine CDM provisioning request, see https://github.com/bromite/bromite/issues/471 Basically all users opening the browser will contact www.googleapis.com to get a unique "Protected Media Identifier", without opening any web page and even before any ToS/EULA is accepted (and there is no user consent either).

I think the Widevine CDM request is needed for the service to function, though they could certainly delay it until a website requires DRM. GDPR allows the use of personal data without consent when it is required to provide a service for the user. The personal data collected with the x-client-data header is not required for Google sites to function. Google uses the data to gain a technical advantage over other sites o…

Whether consent is legally required or not, as a user I want that service, whatever it is, to not work until I consent to the exposure of my personal data. Given that it apparently has something to do with DRM, I would be disabling the service anyway.

Re: Google tracks individual users per Chrome installation ID

#470

Post by zerocrates »

jmccorm wrote: post #428
gruez wrote: post #223

Earlier quoted context omitted.

It's a test case I wouldn't read too much into it. Maybe it's evidence of a massive anti-trust conspiracy at google, but it could very well be because it's the first domain that came to the programmer's mind at the time.

I wasn't aware of this, but it still seems like a thread worth pulling on. You're assuming, right? The reason I ask is that using any third-party company seems inappropriate. Even more so when Google has plenty of domains of its own to test against. Even more so when it is against a media/advertising company. And again, even more so against a company that changed from Google to Bing to power their search function. It…

The functionality is the functionality: it targets the header to Google sites. If there's a legal issue it really stands or falls there, not on the presence of another company's domain in the tests. There's nothing Yahoo-specific about what Chrome is actually doing.
Post reply on HN