Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google tracks individual users per Chrome installation ID

github.com

Post reply on HN
Print view View original

481–490 of 642 posts

Re: Google tracks individual users per Chrome installation ID

#481

Post by aidos »

mabbo wrote: post #461
d1zzy wrote: post #362

TL;DR I think whoever posted that is trying to bury the UA anonymizing feature by derailing the discussion. What I'm seeing is an RFC for anonymizing parts of User-Agent in order to reduce UA based fingerprinting, which improves everyone's privacy, that's a good thing! Then I see someone comments how that could negatively impact existing websites or Chromium-derived browsers, comments which are totally fair and make…

I think the concern is that this disarms Google's competitors while keeping them fully-armed. Ads are a business, and they are Google's business. They are how they make money. And like all businesses, they are competitive. Tracking is a way to make more money off online advertising. By removing tracking from their competitors while keeping it for themselves, Google stand to make a lot of money off this change. Their…

While I agree with some of your comment, I feel like it’s harsh to paint the whole chrome enterprise with that brush. Chrome was about freeing the world of a truly terrible web browser and a lot of devoted devs have spent a lot of time working on it. There’s an advertising aspect that it’s right to call out, but I think on the whole it was done to make the internet better, because the internet is google’s business too.

EDIT I just wanted to point out that a load of people have poured their lives into making Google Chrome the amazing bit of software that it is and suggesting that the end-goal has been entirely about supplying ads does a great disservice to their personal contributions.

Re: Google tracks individual users per Chrome installation ID

#482

Post by munificent »

reaperducer wrote: post #387
munificent wrote: post #314

Earlier quoted context omitted.

Bias up front: I work at Google but am not speaking for Google. > involuntary, unpaid guinea pigs. I don't see how this is involuntary. You are choosing to use the product. If you choose to use the product, yes, you may be exposed to features that the product has. If you don't want to be exposed to those features, the way to opt out is to not use the product. > What's the motivation? It lets the company incrementally…

I don't see how this is involuntary. You are choosing to use the product It's involuntary because it's not informed consent. Google doesn't tell people up front or in any meaningful way that this is happening. That's like saying "Oh, that steak was covered in the chef's experimental hot sauce that we didn't list on the menu? Well, too bad, you chose to come to this restaurant."

> It's involuntary because it's not informed consent.

I think you're making an analogy that doesn't logically apply. "Informed consent" is a property of healthcare administration. When you're putting drugs into someone's blood stream or cutting them open while anaesthetized, yeah, you need to make damn sure you're doing the right thing for them.

> the chef's experimental hot sauce that we didn't list on the menu?

Likewise, when you're serving food that someone will ingest and which may cause allergic reactions or food poisoning, again the bar is pretty high to make sure you are treating people safely.

But we're talking about using a free piece of software. If Chrome changes the color of their tab bar, no one is going into anaphylactic shock. When Facebook adds a new button on the sidebar, there is little risk of that inadvertently severing someone's carotid artery.

Re: Google tracks individual users per Chrome installation ID

#483

Post by dessant »

joshuamorton wrote: post #478
dessant wrote: post #477

Earlier quoted context omitted.

GDPR treats an IP address as personal data. The data is not transmitted through an anonymizing network, so Google has access to the user's IP address when they receive the data. Anything that is associated with personal data also becomes personal information, therefore Google is transmitting personal data without user consent, which is illegal. Asking for consent is not required under GDPR when the data collection is…

> GDPR treats an IP address as personal data. No it doesn't. GDPR only treats IP address as personal data if it is associated with actual identifying information (like name or address). Collecting IP address alone, and not associating it with anything else, is completely fine (otherwise nginx and apache's default configs would violate GDPR), and through them basically every website would violate GDPR. Edit: and furth…

An IP address is itself personal data, it does not have to be associated with other personal data.

https://ec.europa.eu/info/law/law-topic/data-protection/refo...

> Collecting IP address alone, and not associating it with anything else, is completely fine (otherwise nginx and apache's default configs would violate GDPR), and through them basically every website would violate GDPR.

See my comment about consent not being required when the data is needed to provide a service. Logging is reasonably required to provide a service.

> and furthermore, even if it did (I see conflicting reports), if you collect IP Address and another pseudonymous ID and don't join them, the ID isn't personal data.

The transmission of data is already covered by GDPR, you don't have to store the data to be bound by the law.

Re: Google tracks individual users per Chrome installation ID

#484

Post by TeMPOraL »

aidos wrote: post #481
mabbo wrote: post #461

Earlier quoted context omitted.

I think the concern is that this disarms Google's competitors while keeping them fully-armed. Ads are a business, and they are Google's business. They are how they make money. And like all businesses, they are competitive. Tracking is a way to make more money off online advertising. By removing tracking from their competitors while keeping it for themselves, Google stand to make a lot of money off this change. Their…

While I agree with some of your comment, I feel like it’s harsh to paint the whole chrome enterprise with that brush. Chrome was about freeing the world of a truly terrible web browser and a lot of devoted devs have spent a lot of time working on it. There’s an advertising aspect that it’s right to call out, but I think on the whole it was done to make the internet better, because the internet is google’s business to…

The way I see it, both of these can be (and most likely are) true. Intentions of the company aren't usually the same as intentions of individual contributors (or even whole teams). The Web is Google's business - the more stuff happens on the Web, the more money they can eventually make of it. Advertising is how they make most of that money, so this is what they're protecting. But beyond that, Chrome answered a real need and a lot of hard-working people made it into a best-in-class browser.

Re: Google tracks individual users per Chrome installation ID

#485

Post by joshuamorton »

dessant wrote: post #483
joshuamorton wrote: post #478

Earlier quoted context omitted.

> GDPR treats an IP address as personal data. No it doesn't. GDPR only treats IP address as personal data if it is associated with actual identifying information (like name or address). Collecting IP address alone, and not associating it with anything else, is completely fine (otherwise nginx and apache's default configs would violate GDPR), and through them basically every website would violate GDPR. Edit: and furth…

An IP address is itself personal data, it does not have to be associated with other personal data. https://ec.europa.eu/info/law/law-topic/data-protection/refo... > Collecting IP address alone, and not associating it with anything else, is completely fine (otherwise nginx and apache's default configs would violate GDPR), and through them basically every website would violate GDPR. See my comment about consent not bei…

See my edit. There's conflicting information on this. A dynamic IP, for example, isn't directly related to or relatable to a specific natural person without other context.

But even if that's the case, if you don't tie the pseudonymous ID to the IP, it isn't personal data. As far as I can tell, the transfer rules you reference are about transferring data out of the EU, and can be summarized as "you can't transfer data to a non-EU country and then process it in a way that violates the GDPR". Article 46 notes that transferring data is fine as long as appropriate safeguards are in place[1], and article 47[2] defines what constitutes those safeguards (in general, contractually/legally binding agreements with appropriate enforcement policies).

This goes back to what I said before: The theoretical capability to do noncompliant things doesn't make a system GDPR-noncompliant. You have to actually do noncompliant things to not comply.

[1]: https://gdpr-info.eu/art-46-gdpr/

[2]: https://gdpr-info.eu/art-47-gdpr/

Re: Google tracks individual users per Chrome installation ID

#486

Post by asdfasgasdgasdg »

shuckles wrote: post #475
asdfasgasdgasdg wrote: post #434

Earlier quoted context omitted.

We disagree about the purpose of privacy policies. I believe that privacy policies should describe how data will be used, not how it could be used. I just don't think a policy describing how data could be used is very useful, because it's going to be the same for all services. Under this formulation, Google's policy is (presumably, lacking any data to the contrary) honest with respect to this value.

This is a fair distinction, though it does not include the option of discussing how the data _won’t_ be used.

Per your observation, I would argue that the intent of the privacy policy as quoted above is pretty clear. When the policy says that the identifier doesn't contain PII, I believe that is meant to convey that it will not be used to identify you. But it's true that that use is not explicitly excluded. I'm not a lawyer so I couldn't tell you if being weasely in this way would count as fraud or not. Otoh, I suspect that Google is actually abiding by the spirit of the policy they wrote because honestly they have little to gain and much to lose by violating it.

Re: Google tracks individual users per Chrome installation ID

#487

Post by [deleted] »

rvnx wrote: post #395
gruez wrote: post #356

Earlier quoted context omitted.

>Now this is interesting. If without that 13 bits of entropy, what will Google lost? Is it because of this 13 bits then Google suddenly able to track what they were not? At the very least, having those 13 bits of entropy along with a /24 subnet allows you to have device-level granularity, whereas a /24 subnet may be shared by hundreds of households.

They have more than 13 bits of entropy https://cs.chromium.org/chromium/src/components/metrics/entr... Look how the function is called, high-entropy source :)

[deleted]

Re: Google tracks individual users per Chrome installation ID

#488

Post by c0restraint »

chatmasta wrote: post #279
tbodt wrote: post #209

Earlier quoted context omitted.

Actual list: https://cs.chromium.org/chromium/src/components/google/core/...

This seems like a cut-and-dry case of getting caught in monopolistic behavior. The code is right there. The Chrome codebase has special features for Google’s own web properties. I hope all these AGs suing google have some good tech advisors. It’s hard to keep track of all the nefarious things google has been up to over the past decade.

Perhaps you can send a summary to them, including the evidence?

Re: Google tracks individual users per Chrome installation ID

#489

Post by flukus »

janpot wrote: post #4

Not endorsing this, but according to https://www.google.com/chrome/privacy/whitepaper.html#variat... > We want to build features that users want, so a subset of users may get a sneak peek at new functionality being tested before it’s launched to the world at large. A list of field trials that are currently active on your installation of Chrome will be included in all requests sent to Google. This Chrome-Variations he…

So they're tracking people and using them as guinea pigs, the lack of respect for users is astounding.

Re: Google tracks individual users per Chrome installation ID

#490

Post by shadowgovt »

labawi wrote: post #471
scarejunba wrote: post #283

Earlier quoted context omitted.

Holy Jesus. Those things were chock full of security holes. If you used a web browser that arrived on a CD ROM you'd be advertising massive pwnability. In fact, you could easily simulate this by using last year's Firefox.

Firefox, chrome, linux ... all are full of unnecessary complexity. The point being - we need daily patches to keep it from falling apart. I have links (or lynx) on an old SuSE, maybe even a Mandriva CD. Would they be massively pwnable?

Hard to say, but not necessarily a great example; exploits on software are a function both of attack surface / complexity and installed userbase (i.e. nobody bothers to see if lynx is pwnable because a zero-day against that browser will be worth, what, twenty bucks to gain access to the five people who use it?).
Post reply on HN