Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google tracks individual users per Chrome installation ID

github.com

Post reply on HN
Print view View original

401–410 of 642 posts

Re: Google tracks individual users per Chrome installation ID

#401

Post by dmtroyer »

dessant wrote: post #389
throwawaylolx wrote: post #381

Earlier quoted context omitted.

I just tried it now on google.com, and it sent it in 6 requests. You can ctrl+f in developer tools in Chrome.

I think extensions can filter out the x-client-data header, though Google should definitely make this data collection opt-in. GDPR is very clear about this data being personal information [1], since Google has access to the IP address on the receiving end, which has been repeatedly tested in courts as being personal data. Google is engaging in personal data harvesting without user consent and control, and no amount o…

Oh interesting, it must be an extension that is filtering it out for me (Ghostery, DDG Privacy Essentials or Adblock Plus in my case)

Re: Google tracks individual users per Chrome installation ID

#402

Post by dmtroyer »

outworlder wrote: post #396
dmtroyer wrote: post #312

I must be dense but I never see the `x-client-data` header in the request headers of the network tab in developer tools.

Try a packet capture. You wouldn't trust the browser to let you know all shady emails it is sending, right? :)

This did come to mind, hah.

Re: Google tracks individual users per Chrome installation ID

#403

Post by coldpie »

eitland wrote: post #366
coldpie wrote: post #246

Earlier quoted context omitted.

I guess we'll have to agree to disagree (which is fine!). I'd rather continue donating to them to show there are funding sources outside of advertising, which is a business model I despise.

I thought like you. There seems to be a huge problem though: for some reason it seems they aren't allowed to use donated funds for what I thought was the main reason for Mozillas existence: development of the Firefox web browser. Instead donated funds seems to go to outreach etc. I have nothing against outreach but if this is the case I'd rather donate to such organizations directly (or rather increase my monthly don…

Sure. I guess to me that feels like an implementation detail. I like Mozilla and I want them to exist so I give them money. If they stopped making Firefox, I would probably stop giving them money. But whether my money goes to Firefox development is up to them, they know their financial arrangements better than I do. I understand if you don't agree with that policy.

Re: Google tracks individual users per Chrome installation ID

#404

Post by rvnx »

x0x0 wrote: post #54
rvnx wrote: post #45

Earlier quoted context omitted.

13b, if usage statistics are disabled (not the default). Otherwise, unspecified amount of entropy.

thanks. and ugh.

Just referred as High Entropy: https://cs.chromium.org/chromium/src/components/metrics/entr...

Re: Google tracks individual users per Chrome installation ID

#405

Post by outworlder »

shadowgovt wrote: post #355
fmajid wrote: post #267

Earlier quoted context omitted.

IP addresses are considered PII under both GDPR and CCPA.

... which is crazy unrealistic, since it's "PII" that can only stay "private" by collective agreement of every node in the network, but no accounting for the reality of network architecture in passing law, I guess. Maybe a deep expectation of anonymity while accessing a worldwide network of cooperative machines is something people should stop telling the public they should expect?

Or they can stay 'private' by not being stored or correlated with other user data. GDPR doesn't apply to the network itself, it applies to whoever is using it.

Re: Google tracks individual users per Chrome installation ID

#406

Post by shadowgovt »

outworlder wrote: post #405
shadowgovt wrote: post #355

Earlier quoted context omitted.

... which is crazy unrealistic, since it's "PII" that can only stay "private" by collective agreement of every node in the network, but no accounting for the reality of network architecture in passing law, I guess. Maybe a deep expectation of anonymity while accessing a worldwide network of cooperative machines is something people should stop telling the public they should expect?

Or they can stay 'private' by not being stored or correlated with other user data. GDPR doesn't apply to the network itself, it applies to whoever is using it.

"Stored" is definitely the purpose of a router. "Correlated" can be necessary for debugging routing issues (or client-server connection issues that are tied to the intermediary fabric near the client doing something weird; hard to determine if an entire subnet is acting up if you aren't allowed to maintain state on errors correlated to IP address).

Re: Google tracks individual users per Chrome installation ID

#408

Post by [deleted] »

meowface wrote: post #245
sildur wrote: post #181

Earlier quoted context omitted.

I care. I care that I even if I log off, even if I use a vpn, even if I go into incognito mode, they still can associate my requests with the account I initially logged in.

The problem is any website can do that. Incognito-bypassing fingerprinting is difficult to prevent, unless you use something like uMatrix to disallow JavaScript from everything but a few select domains. This is a collection of random-ish unique-ish attributes. Any collection of such things can be used to track you, like installed fonts, installed extensions, etc. If this were just a set of meaningless encoded random…

[deleted]

Re: Google tracks individual users per Chrome installation ID

#409

Post by asdfasgasdgasdg »

calibas wrote: post #394
asdfasgasdgasdg wrote: post #190

Earlier quoted context omitted.

> > Experiments may be further limited by country (determined by your IP address) > They even admit to inspecting the IP address... I don't think that sentence admits what you say? Chrome could be determining which experiments to run client-side. Of course, when you visit a Google property, they needs must inspect your IP address to send a response to you, at a minimum. That goes for any site you might choose to visi…

Yeah, it's not a "state secret" but it's not common knowledge either. Their privacy policy says that specific header can't be used to identify you, but fails to mention it can be combined with other information to make browser fingerprinting trivial. If you don't know how all this works, which is true for most human beings, their privacy policy might give you the wrong impression.

> says that specific header can't be used to identify you

That's not what it says. It says the header won't contain PII, which is true. It can be linked to PII, but so can literally every bit of information you send to Google while logged into or otherwise using their services. A disclaimer to this effect would not have any purpose.

Post reply on HN