Live data from Hacker News

Google tracks individual users per Chrome installation ID

github.com

471–480 of 642 posts

Re: Google tracks individual users per Chrome installation ID

#471
post #215

Earlier quoted context omitted.

Instead of giving my privacy away, I prefer software like anything that you have installed from a CD-ROM back in the 90's and didn't needed a weekly update. Games, 3D-Studio, Autocad (to name a few) were more complex than a web-browser ( a today's web-browser ) and didn't needed a weekly update or the hunger for user-requested features, let alone dialing home because . The world worked relatively fine without the up-…

Holy Jesus. Those things were chock full of security holes. If you used a web browser that arrived on a CD ROM you'd be advertising massive pwnability. In fact, you could easily simulate this by using last year's Firefox.

Firefox, chrome, linux ... all are full of unnecessary complexity. The point being - we need daily patches to keep it from falling apart.

I have links (or lynx) on an old SuSE, maybe even a Mandriva CD. Would they be massively pwnable?

Re: Google tracks individual users per Chrome installation ID

#473
post #464

Earlier quoted context omitted.

> Except it does not affect Google, because Google has this install ID to use both for tracking and preventing ad-fraud. So when Apple releases a privacy feature, that doesn't affect them as a business, we praise the feature or we say "except it doesn't affect Apple" and somehow try to argue how the feature is less valuable because of that?

Apple is not engaged in illegal data harvesting to gain a competitive advantage over other services in the same space. Google's collection of personal data with the x-client-data header without user consent is illegal under GDPR.

This relies on the (unfounded) assumption that this pseudonymous ID is being used for tracking purposes and that Google is actively lying about it.

Re: Google tracks individual users per Chrome installation ID

#474

Earlier quoted context omitted.

When I moved into IT almost 10-15 years ago, Google was one of the companies that I adored (in a kind of naive way, but nevertheless..). Working at that company has always been a dream of mine. They had the reputation for hiring the best of the best engineers, with great benefits and work culture. Meanwhile I'd hate to apply for them. Everything they do in terms of tracking, etc. has become so vile and almost evil th…

Well, I'm an ex employee. Actually nothing has changed inside the company. "Tracking" as you put it isn't perceived as evil, it never has been, and for good reasons. The only thing that's changed is people's perception of the company and - very recent post 2016 political issues aside - that was mostly driven by a sustained campaign by an angry media industry that wanted money (see: link taxes). Firstly, if tracking u…

You have good points.

You have to be diligent in your efforts to show that Google is actually doing wrong before accusing them.

If you don't -- you're playing into the hands of their rivals, especially "old" media companies.

Re: Google tracks individual users per Chrome installation ID

#475

Earlier quoted context omitted.

That's the whole point. Using any Google service means they can easily personally identify you, that's what the privacy policy should explain. That's their policy towards privacy, you don't have any. For some reason I can't fathom, you claim mentioning this in their privacy policy "would not have any purpose". Instead of honesty, their privacy policy is a wonder of public relations where it seems like they care deepl…

We disagree about the purpose of privacy policies. I believe that privacy policies should describe how data will be used, not how it could be used. I just don't think a policy describing how data could be used is very useful, because it's going to be the same for all services. Under this formulation, Google's policy is (presumably, lacking any data to the contrary) honest with respect to this value.

This is a fair distinction, though it does not include the option of discussing how the data _won’t_ be used.

Re: Google tracks individual users per Chrome installation ID

#476
post #320

If you strace chrome on linux it also picks up /etc/machine-id (or it did back when I looked), which is a 32 byte randomly generated string which uniquely identifies you and on some systems is used as the DHCP ID across reboots.

First I thought reading /etc/machine-id would be expected if Chrome uses D-bus or pulseaudio libraries which depend on D-bus, and /etc/machine-id is part of D-bus. But no, they really use it for tracking purposes. And in a sick twist they have this comment for it: std::string BrowserDMTokenStorageLinux::InitClientId() { // The client ID is derived from /etc/machine-id // (https://www.freedesktop.org/software/systemd/…

That really is a cynical comment. It almost bothers me more than this header.

Re: Google tracks individual users per Chrome installation ID

#477

Earlier quoted context omitted.

Apple is not engaged in illegal data harvesting to gain a competitive advantage over other services in the same space. Google's collection of personal data with the x-client-data header without user consent is illegal under GDPR.

This relies on the (unfounded) assumption that this pseudonymous ID is being used for tracking purposes and that Google is actively lying about it.

GDPR treats an IP address as personal data. The data is not transmitted through an anonymizing network, so Google has access to the user's IP address when they receive the data.

Anything that is associated with personal data also becomes personal information, therefore Google is transmitting personal data without user consent, which is illegal.

Asking for consent is not required under GDPR when the data collection is needed for a service to function. This is not the case here, Google services function without receiving that header, the data is used by Google to gain a technical advantage over other web services.

Re: Google tracks individual users per Chrome installation ID

#478

Earlier quoted context omitted.

This relies on the (unfounded) assumption that this pseudonymous ID is being used for tracking purposes and that Google is actively lying about it.

GDPR treats an IP address as personal data. The data is not transmitted through an anonymizing network, so Google has access to the user's IP address when they receive the data. Anything that is associated with personal data also becomes personal information, therefore Google is transmitting personal data without user consent, which is illegal. Asking for consent is not required under GDPR when the data collection is…

> GDPR treats an IP address as personal data.

No it doesn't. GDPR only treats IP address as personal data if it is associated with actual identifying information (like name or address). Collecting IP address alone, and not associating it with anything else, is completely fine (otherwise nginx and apache's default configs would violate GDPR), and through them basically every website would violate GDPR.

Edit: and furthermore, even if it did (I see conflicting reports), if you collect IP Address and another pseudonymous ID and don't join them, the ID isn't personal data.

IOW, the theoretical capability to make changes to a system to use info in a non-GDPR compliant way doesn't make the information or system noncompliant. You actually have to do the noncompliant things.

Re: Google tracks individual users per Chrome installation ID

#479

Earlier quoted context omitted.

Apple is not engaged in illegal data harvesting to gain a competitive advantage over other services in the same space. Google's collection of personal data with the x-client-data header without user consent is illegal under GDPR.

This relies on the (unfounded) assumption that this pseudonymous ID is being used for tracking purposes and that Google is actively lying about it.

[deleted]

Re: Google tracks individual users per Chrome installation ID

#480
post #362

TL;DR I think whoever posted that is trying to bury the UA anonymizing feature by derailing the discussion. What I'm seeing is an RFC for anonymizing parts of User-Agent in order to reduce UA based fingerprinting, which improves everyone's privacy, that's a good thing! Then I see someone comments how that could negatively impact existing websites or Chromium-derived browsers, comments which are totally fair and make…

https://cs.chromium.org/chromium/src/components/google/core/...

Just thinking out loud.

What happens, let's say, if someone malicious buys youtube.vg and puts a SSL certificate on it ? Will they be able to collect the ID ?

I guess so ?

Post reply on HN