Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google tracks individual users per Chrome installation ID

github.com

Post reply on HN
Print view View original

511–520 of 642 posts

Re: Google tracks individual users per Chrome installation ID

#511

Post by 0xfffafaCrash »

joshuamorton wrote: post #478
dessant wrote: post #477

Earlier quoted context omitted.

GDPR treats an IP address as personal data. The data is not transmitted through an anonymizing network, so Google has access to the user's IP address when they receive the data. Anything that is associated with personal data also becomes personal information, therefore Google is transmitting personal data without user consent, which is illegal. Asking for consent is not required under GDPR when the data collection is…

> GDPR treats an IP address as personal data. No it doesn't. GDPR only treats IP address as personal data if it is associated with actual identifying information (like name or address). Collecting IP address alone, and not associating it with anything else, is completely fine (otherwise nginx and apache's default configs would violate GDPR), and through them basically every website would violate GDPR. Edit: and furth…

There has been an EU court ruling on this exact question of whether dynamic IP addresses count as personal data even in contexts where the website operator in question does not have the means to associate it with an individual but another party (such as an ISP) does. The Court of Justice of the European Union has ruled on this and it does count as personal data. [1]

Furthermore, GDPR itself specifically refers to online identifiers in Article 4 as falling under the definition of personal data[2] and then clarifies in Recital 30[3] that IP addresses count as online identifiers in this context. There seems to be no legal ambiguity in the EU on this topic at this point, but I would be not surprised to see parties who are not GDPR compliant pretend otherwise indefinitely.

[1] https://curia.europa.eu/jcms/upload/docs/application/pdf/201...

[2] https://gdpr-info.eu/art-4-gdpr/

[3] https://gdpr-info.eu/recitals/no-30/

Re: Google tracks individual users per Chrome installation ID

#512

Post by pests »

make3 wrote: post #185
clSTophEjUdRanu wrote: post #175

Earlier quoted context omitted.

>Linking that browser ID to a personal account is trivial as soon as someone logs in to any Google service. Wat? You mean to tell me they can identify you if you log into their service? Am I missing something here? Who cares?

he means they can continue to identify you after you log off

I think the argument is they have other methods like cookies they could also use. The fact you trust them not to use those methods extends to this form of tracking.

Re: Google tracks individual users per Chrome installation ID

#513

Post by heavyset_go »

kokey wrote: post #431
bsharitt wrote: post #198

Everybody imagine going back 15 years and tell yourself that you're using a web browser made by the parent company of DoubleClick. Your 15 year ago self would think you're a moron (assuming that 15 years ago you were old enough to know what DoubleClick was).

My 15 year ago self would have taken a double helping of DoubleClick if my only choices were that or Internet Explorer 6.

Firefox and Opera existed at the time.

Re: Google tracks individual users per Chrome installation ID

#514

Post by jariel »

aidos wrote: post #481
mabbo wrote: post #461

Earlier quoted context omitted.

I think the concern is that this disarms Google's competitors while keeping them fully-armed. Ads are a business, and they are Google's business. They are how they make money. And like all businesses, they are competitive. Tracking is a way to make more money off online advertising. By removing tracking from their competitors while keeping it for themselves, Google stand to make a lot of money off this change. Their…

While I agree with some of your comment, I feel like it’s harsh to paint the whole chrome enterprise with that brush. Chrome was about freeing the world of a truly terrible web browser and a lot of devoted devs have spent a lot of time working on it. There’s an advertising aspect that it’s right to call out, but I think on the whole it was done to make the internet better, because the internet is google’s business to…

"Chrome was about freeing the world of a truly terrible web browser "

Chrome is about establishing more control over the web to further the business objectives of Google and Alphabet.

The problem with this belief of Google as some kind of 'benevolent actor' is a function of the new kind of branding they helped introduce, something that an entire generation of particularly young people are being duped by.

'Brand' used to be the image that companies presented - it was a decision, a marketing tactic, usually invented by agencies. Google was one of the first to change that, to effectively 'internalize' the brand so that they (staff, even leaders) really kind of believed their own kool-aid. There's an incredible aura of 'authenticity' to this; when leaders really believe their own schtick, it rings more powerfully. (This is an issue for another thread.)

But Google has proven that in the long run, they're just a regular company. I don't think they are bad actors, and in the big picture, they're better than most. But, they're just a self-interested entity: they will do whatever is in their power and which is also legal, to leverage their incumbency and stymie competition.

Re: Google tracks individual users per Chrome installation ID

#515

Post by sequoia »

euske wrote: post #506
mabbo wrote: post #461

Earlier quoted context omitted.

I think the concern is that this disarms Google's competitors while keeping them fully-armed. Ads are a business, and they are Google's business. They are how they make money. And like all businesses, they are competitive. Tracking is a way to make more money off online advertising. By removing tracking from their competitors while keeping it for themselves, Google stand to make a lot of money off this change. Their…

I think this is a common strategy of big players at any industry. First, they do some dirty thing to gain a competitive edge when the industry is still new and unregulated. Later they develop an alternative way to achieve the same competitive edge, and then criticize other players for doing an old way, saying they should be "mature and responsible".

See also first world countries industrializing/modernizing & becoming rich/lifting people out of poverty using industrial techniques that pollute heavily, then "going green" and criticizing other players (India, China) for doing the same thing, saying they should be "mature and responsible".

Re: Google tracks individual users per Chrome installation ID

#516

Post by shadowgovt »

labawi wrote: post #508
shadowgovt wrote: post #490

Earlier quoted context omitted.

Hard to say, but not necessarily a great example; exploits on software are a function both of attack surface / complexity and installed userbase (i.e. nobody bothers to see if lynx is pwnable because a zero-day against that browser will be worth, what, twenty bucks to gain access to the five people who use it?).

Perhaps. Perhaps not. As a thought experiment: How long would it be safe to go without browser updates with a browser of complexity/capabilies of links, if 50% of people used it? With many people combing through it, would it become effectively unexploitable?

Probably not very long. Even with a small attack surface, if half the world uses it, the zero-days are valuable. Links is still vulnerable to

* application-layer attacks (it is still an HTTP client and HTML parser, and the protocols themselves are complicated to implement soundly, even if the newest features aren't included)

* protocol attacks (is links immune to buffer-overruns triggered by intentionally-malformed queries? Probably not, since it has no total-soundness verification. And the source code isn't open-source so )

* dependency attacks (it uses svgalib [https://www.cvedetails.com/vulnerability-list/vendor_id-84/p...], and every third-party library is a potential attack vector)

* good old-fashioned UI spoofing (is links' UI design immune to allowing web pages to show an image that tricks the user into thinking they're looking at the links UI itself?)

In this thought experiment, any successful attack has massive value so we can expect bad actors to be hammering on the system and finding most such exploits available on the application.

Re: Google tracks individual users per Chrome installation ID

#517

Post by joshuamorton »

0xfffafaCrash wrote: post #511
joshuamorton wrote: post #478

Earlier quoted context omitted.

> GDPR treats an IP address as personal data. No it doesn't. GDPR only treats IP address as personal data if it is associated with actual identifying information (like name or address). Collecting IP address alone, and not associating it with anything else, is completely fine (otherwise nginx and apache's default configs would violate GDPR), and through them basically every website would violate GDPR. Edit: and furth…

There has been an EU court ruling on this exact question of whether dynamic IP addresses count as personal data even in contexts where the website operator in question does not have the means to associate it with an individual but another party (such as an ISP) does. The Court of Justice of the European Union has ruled on this and it does count as personal data. [1] Furthermore, GDPR itself specifically refers to onl…

Interesting, TIL. That doesn't change the major point I was making though, which is that an anonymized identifier (such as the 13-bit ID under discussion) isn't personal info, even if it might have originally been collected along side data which is personal info. If I give you said 13 bit ID, you need other info to back out a single person, the anonymous ID corresponds to multiple IPs.

Re: Google tracks individual users per Chrome installation ID

#518

Post by meowface »

rvnx wrote: post #269
meowface wrote: post #245

Earlier quoted context omitted.

The problem is any website can do that. Incognito-bypassing fingerprinting is difficult to prevent, unless you use something like uMatrix to disallow JavaScript from everything but a few select domains. This is a collection of random-ish unique-ish attributes. Any collection of such things can be used to track you, like installed fonts, installed extensions, etc. If this were just a set of meaningless encoded random…

Maybe one actually useful non-advertising usage could be reCAPTCHA ? If you read carefully, it says nowhere than there is the limit to 8000. There is this limit of 8000 only if you disable usage statistics / crash reports.

Sorry about that, too late to edit it now. That is an important detail. If there are 32 or more different feature flags, then that's 4 billion unique states, which would be an effective fingerprint.

I still think it's pretty unlikely they're using it in that way or would in the future, and I think Google fuzzing this for those who opt out of telemetry is probably a signal of good faith in this instance. They realize the privacy implications and provide a way to disengage, even if they don't intend to abuse the information.

But of course the potential for abuse always remains. And the potential for (arguably) non-abusive tracking, like the possibility of it being used for bot detection by reCAPTCHA, as you say.

Re: Google tracks individual users per Chrome installation ID

#519

Post by chatmasta »

arh68 wrote: post #442
chatmasta wrote: post #270

Earlier quoted context omitted.

Safari on iOS is great. Safari on Mac is underwhelming and sucks. My biggest gripe is I can’t update it without updating the entire OS. Also, dev tooling is really bad. God help you if you ever need to unregister a service worker.

Have you tried Safari Developer Previews? It's been a while since I've used them myself. [0] https://developer.apple.com/safari/download/

I have not. I don’t think they have any extra dev tools though; it’s just the later version of the browser (which, granted, may include improved dev tools). And you still need to be on latest macOS to run it.

But thanks for the tip on the preview releases; I’d forgotten about those. I’ll check them out.

Re: Google tracks individual users per Chrome installation ID

#520

Post by pier25 »

sergiotapia wrote: post #150

I dropped chrome a long time ago and switched to Brave. Does Brave have these same issues, considering it uses webkit for it's rendering engine? Am I just being paranoid? What a tumor google has become.

Brave uses Chromium not Webkit.
Post reply on HN