Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google tracks individual users per Chrome installation ID

github.com

Post reply on HN
Print view View original

601–610 of 642 posts

Re: Google tracks individual users per Chrome installation ID

#601

Post by Yizahi »

koheripbal wrote: post #562
userbinator wrote: post #546

As long as web developers continue to create (app-)sites that only work in the latest versions of Chrome(and Chromium-ish) browsers, giving users little effective choice over what browsers they can use, this sort of abusive behaviour will continue. The sort of "feature-racing" that Google engages in is ultimately harmful for the open web. Mozilla struggles to keep up, Opera surrendered a while ago, and more recently,…

Are there really that many popular extensions not available on Firefox? I may be just one anecdote, but I think I'm pretty typical, and I've found the transition to Firefox to be quite pleasant, and uneventful.

Popular - no. Essential - yes. Case in point - my bank (top 5 in my country) which uses Chrome plugin for security purposes, you need it to create digital signature. So once a year I HAVE to install Chrome (key expires every year) and then delete it. I've also found at least one payment processor not working in Firefox, my city portal for public transport and several small sites. The worrying thing is the trend - with Firefox share dropping below 10% recently it will be abandoned more and more.

Re: Google tracks individual users per Chrome installation ID

#602

Post by GrayShade »

_trampeltier wrote: post #578
GrayShade wrote: post #414

Earlier quoted context omitted.

If I log in to my Google account once, they can associate that browser id with my account. Even if I log out, clear my cookies (and probably use the incognito mode), Google will be able to identify and follow me all over the Web. I don't know about your PII thing, but it's personal data under the GDPR.

You can't even login into gmail, at least from firefox in incognito mode.

It works for me, at least with 2FA enabled.

Re: Google tracks individual users per Chrome installation ID

#603

Post by paulintrognon »

koheripbal wrote: post #562
userbinator wrote: post #546

As long as web developers continue to create (app-)sites that only work in the latest versions of Chrome(and Chromium-ish) browsers, giving users little effective choice over what browsers they can use, this sort of abusive behaviour will continue. The sort of "feature-racing" that Google engages in is ultimately harmful for the open web. Mozilla struggles to keep up, Opera surrendered a while ago, and more recently,…

Are there really that many popular extensions not available on Firefox? I may be just one anecdote, but I think I'm pretty typical, and I've found the transition to Firefox to be quite pleasant, and uneventful.

It doesn't happen often but sometimes, when a website doesn't work, I switch to chrome and it works there.

Re: Google tracks individual users per Chrome installation ID

#604

Post by JdeBP »

carlsborg wrote: post #82

If you strace chrome on linux it also picks up /etc/machine-id (or it did back when I looked), which is a 32 byte randomly generated string which uniquely identifies you and on some systems is used as the DHCP ID across reboots.

That's not a correct description.

* http://jdebp.uk./Softwares/nosh/guide/commands/machine-id.xm...

Re: Google tracks individual users per Chrome installation ID

#605

Post by JdeBP »

chias wrote: post #369
xfs wrote: post #320

Earlier quoted context omitted.

First I thought reading /etc/machine-id would be expected if Chrome uses D-bus or pulseaudio libraries which depend on D-bus, and /etc/machine-id is part of D-bus. But no, they really use it for tracking purposes. And in a sick twist they have this comment for it: std::string BrowserDMTokenStorageLinux::InitClientId() { // The client ID is derived from /etc/machine-id // (https://www.freedesktop.org/software/systemd/…

In fairness, the guidelines they reference suggest you do exactly what the comment says they're doing (assuming they're keying the hash). The guidelines seem explicitly written with the idea that unique identifiers _derived from_ this value are not similarly quarantined, provided that you cannot take the derived value and "reverse" it back to the original identifier. Quoting from https://www.freedesktop.org/software/…

Now go and read http://jdebp.uk./Softwares/nosh/guide/commands/machine-id.xm... and RFCs 3041 and 4941.

Re: Google tracks individual users per Chrome installation ID

#606

Post by hyperbovine »

sequoia wrote: post #515
euske wrote: post #506

Earlier quoted context omitted.

I think this is a common strategy of big players at any industry. First, they do some dirty thing to gain a competitive edge when the industry is still new and unregulated. Later they develop an alternative way to achieve the same competitive edge, and then criticize other players for doing an old way, saying they should be "mature and responsible".

See also first world countries industrializing/modernizing & becoming rich/lifting people out of poverty using industrial techniques that pollute heavily, then "going green" and criticizing other players (India, China) for doing the same thing, saying they should be "mature and responsible".

Apples to oranges: unlike software ecosystems which come and go, we’ve only got a single real one!

Re: Google tracks individual users per Chrome installation ID

#607

Post by superlupo »

chias wrote: post #369
xfs wrote: post #320

Earlier quoted context omitted.

First I thought reading /etc/machine-id would be expected if Chrome uses D-bus or pulseaudio libraries which depend on D-bus, and /etc/machine-id is part of D-bus. But no, they really use it for tracking purposes. And in a sick twist they have this comment for it: std::string BrowserDMTokenStorageLinux::InitClientId() { // The client ID is derived from /etc/machine-id // (https://www.freedesktop.org/software/systemd/…

In fairness, the guidelines they reference suggest you do exactly what the comment says they're doing (assuming they're keying the hash). The guidelines seem explicitly written with the idea that unique identifiers _derived from_ this value are not similarly quarantined, provided that you cannot take the derived value and "reverse" it back to the original identifier. Quoting from https://www.freedesktop.org/software/…

> Instead the machine ID should be hashed with a cryptographic, keyed hash function, using a fixed, application-specific key.

Reading https://cs.chromium.org/chromium/src/chrome/browser/policy/b..., I do not not see it being hashed with a key, just unkeyed sha1.

Re: Google tracks individual users per Chrome installation ID

#608

Post by carlsborg »

JdeBP wrote: post #604
carlsborg wrote: post #82

If you strace chrome on linux it also picks up /etc/machine-id (or it did back when I looked), which is a 32 byte randomly generated string which uniquely identifies you and on some systems is used as the DHCP ID across reboots.

That's not a correct description. * http://jdebp.uk./Softwares/nosh/guide/commands/machine-id.xm...

True, more precisely - 16 bytes, 32 hex characters. Your link is in agreement "The machine ID is usually generated from a random source during system installation or first boot and stays constant for all subsequent boots." And See https://wiki.debian.org/MachineId at least one distro uses it for the DHCP ID.

Re: Google tracks individual users per Chrome installation ID

#609

Post by userbinator »

numlock86 wrote: post #591
userbinator wrote: post #546

As long as web developers continue to create (app-)sites that only work in the latest versions of Chrome(and Chromium-ish) browsers, giving users little effective choice over what browsers they can use, this sort of abusive behaviour will continue. The sort of "feature-racing" that Google engages in is ultimately harmful for the open web. Mozilla struggles to keep up, Opera surrendered a while ago, and more recently,…

> [...] this sort of abusive behaviour will continue. Can you elaborate what exactly is abusive behavior? > [...] reliance on hostile browsers, [...] What exactly is a hostile browser?

What is mentioned in the title of this article.

Re: Google tracks individual users per Chrome installation ID

#610

Post by imtringued »

meowface wrote: post #518
rvnx wrote: post #269

Earlier quoted context omitted.

Maybe one actually useful non-advertising usage could be reCAPTCHA ? If you read carefully, it says nowhere than there is the limit to 8000. There is this limit of 8000 only if you disable usage statistics / crash reports.

Sorry about that, too late to edit it now. That is an important detail. If there are 32 or more different feature flags, then that's 4 billion unique states, which would be an effective fingerprint. I still think it's pretty unlikely they're using it in that way or would in the future, and I think Google fuzzing this for those who opt out of telemetry is probably a signal of good faith in this instance. They realize…

reCAPTCHA is the most abusive type of tracking. Google simply denys you usage of captcha if you do not give them enough personal information. It doesn't matter if you enter the captcha correctly 20 times. It won't let you in.
Post reply on HN