Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google tracks individual users per Chrome installation ID

github.com

Post reply on HN
Print view View original

411–420 of 642 posts

Re: Google tracks individual users per Chrome installation ID

#411

Post by Kiro »

yohannparis wrote: post #358
ainar-g wrote: post #275

Earlier quoted context omitted.

Some of my front-end colleagues like to tell me that Safari is the new IE 6. Not in terms of the market domination (that's Crhome for you), but in terms of dragging the front-end back with unimplemented features, quirks, and bugs. The amount of hacks they have to add just to support Safari is uncomfortable.

No, they are confusing developing for Chomium first and not testing on all browsers. Safari is behind in terms of W3C features. But implementing unsupported features does not mean you are hacking to support Safari. They should look into the progressive enhancement principle and CSS @support feature.

I'm strictly talking about the canvas and audio implementations, forcing me to use all kind of different hacks just to get a reasonable FPS in Safari. Audio I've given up on long time ago and don't get me started on Mobile Safari.

Re: Google tracks individual users per Chrome installation ID

#412

Post by olliej »

Am I getting this right?

Irrespective of whether you use any other google products, if you use chrome google can now track you over any property that uses google ads, recaptcha, etc.

The header is inserted by the browser after any extensions run, and google pins google properties so you can have an intermediate proxy that strips the header, so they gain persistent tracking of all users across most of the web?

If it wasn’t a tracking vector why do they limit it to just google ads, etc? Why not other ad providers as well?

Re: Google tracks individual users per Chrome installation ID

#413

Post by dessant »

d1zzy wrote: post #362

TL;DR I think whoever posted that is trying to bury the UA anonymizing feature by derailing the discussion. What I'm seeing is an RFC for anonymizing parts of User-Agent in order to reduce UA based fingerprinting, which improves everyone's privacy, that's a good thing! Then I see someone comments how that could negatively impact existing websites or Chromium-derived browsers, comments which are totally fair and make…

This is the equivalent of a protest, people are objecting to Google's illegal data harvesting practices in places that receive engagement, since that's the most effective way to get the word out and warn others.

Google's reasoning that this is not personal data is meaningless in the face of GDPR, which considers an IP address personal data. Google has access to the IP address when they receive the data, therefore they are transmitting personal information without user consent and control, which is illegal.

Re: Google tracks individual users per Chrome installation ID

#414

Post by GrayShade »

asdfasgasdgasdg wrote: post #409
calibas wrote: post #394

Earlier quoted context omitted.

Yeah, it's not a "state secret" but it's not common knowledge either. Their privacy policy says that specific header can't be used to identify you, but fails to mention it can be combined with other information to make browser fingerprinting trivial. If you don't know how all this works, which is true for most human beings, their privacy policy might give you the wrong impression.

> says that specific header can't be used to identify you That's not what it says. It says the header won't contain PII, which is true. It can be linked to PII, but so can literally every bit of information you send to Google while logged into or otherwise using their services. A disclaimer to this effect would not have any purpose.

If I log in to my Google account once, they can associate that browser id with my account. Even if I log out, clear my cookies (and probably use the incognito mode), Google will be able to identify and follow me all over the Web.

I don't know about your PII thing, but it's personal data under the GDPR.

Re: Google tracks individual users per Chrome installation ID

#415

Post by csagan5 »

d1zzy wrote: post #362

TL;DR I think whoever posted that is trying to bury the UA anonymizing feature by derailing the discussion. What I'm seeing is an RFC for anonymizing parts of User-Agent in order to reduce UA based fingerprinting, which improves everyone's privacy, that's a good thing! Then I see someone comments how that could negatively impact existing websites or Chromium-derived browsers, comments which are totally fair and make…

The poster is the author of Kiwi browser, which unfortunately is closed source [0], but I have reason to believe he is familiar - as I am for the Bromite project - with all the (sometimes shady) internals of the Chromium codebase; it is indeed off-topic to discuss the header issue there but I would say that there is no explicit intention to derail it (and no advantage), just incorrect netiquette.

[0]: https://github.com/kiwibrowser/android/issues/12#issuecommen...

Re: Google tracks individual users per Chrome installation ID

#416

Post by croh »

nornagon wrote: post #374
AlphaWeaver wrote: post #261

According to this source code [0], it looks like this is in Chromium as well. Does that mean this affects Electron applications? [0]: https://chromium.googlesource.com/chromium/src/+/master/comp...

Electron maintainer here. Electron does not send this header.

Thanks for clarification.

Re: Google tracks individual users per Chrome installation ID

#417

Post by csagan5 »

dessant wrote: post #413
d1zzy wrote: post #362

TL;DR I think whoever posted that is trying to bury the UA anonymizing feature by derailing the discussion. What I'm seeing is an RFC for anonymizing parts of User-Agent in order to reduce UA based fingerprinting, which improves everyone's privacy, that's a good thing! Then I see someone comments how that could negatively impact existing websites or Chromium-derived browsers, comments which are totally fair and make…

This is the equivalent of a protest, people are objecting to Google's illegal data harvesting practices in places that receive engagement, since that's the most effective way to get the word out and warn others. Google's reasoning that this is not personal data is meaningless in the face of GDPR, which considers an IP address personal data. Google has access to the IP address when they receive the data, therefore the…

It could be argued that a similar violation is present (since March 2019) in Chromium for the Widevine CDM provisioning request, see https://github.com/bromite/bromite/issues/471

Basically all users opening the browser will contact www.googleapis.com to get a unique "Protected Media Identifier", without opening any web page and even before any ToS/EULA is accepted (and there is no user consent either).

Re: Google tracks individual users per Chrome installation ID

#418

Post by GrayShade »

throwawaylolx wrote: post #381
dmtroyer wrote: post #312

I must be dense but I never see the `x-client-data` header in the request headers of the network tab in developer tools.

I just tried it now on google.com, and it sent it in 6 requests. You can ctrl+f in developer tools in Chrome.

Can you also test under the incognito mode?

Re: Google tracks individual users per Chrome installation ID

#419

Post by calibas »

asdfasgasdgasdg wrote: post #409
calibas wrote: post #394

Earlier quoted context omitted.

Yeah, it's not a "state secret" but it's not common knowledge either. Their privacy policy says that specific header can't be used to identify you, but fails to mention it can be combined with other information to make browser fingerprinting trivial. If you don't know how all this works, which is true for most human beings, their privacy policy might give you the wrong impression.

> says that specific header can't be used to identify you That's not what it says. It says the header won't contain PII, which is true. It can be linked to PII, but so can literally every bit of information you send to Google while logged into or otherwise using their services. A disclaimer to this effect would not have any purpose.

That's the whole point. Using any Google service means they can easily personally identify you, that's what the privacy policy should explain.

That's their policy towards privacy, you don't have any. For some reason I can't fathom, you claim mentioning this in their privacy policy "would not have any purpose". Instead of honesty, their privacy policy is a wonder of public relations where it seems like they care deeply about protecting your privacy.

Re: Google tracks individual users per Chrome installation ID

#420

Post by GrayShade »

throwaway8941 wrote: post #179
carlsborg wrote: post #82

If you strace chrome on linux it also picks up /etc/machine-id (or it did back when I looked), which is a 32 byte randomly generated string which uniquely identifies you and on some systems is used as the DHCP ID across reboots.

Which (among many other things) can be faked with firejail, if you absolutely have to run Chromium (e.g. for testing): --machine-id Spoof id number in /etc/machine-id file - a new random id is generated inside the sandbox. Example: $ firejail --machine-id

Chromium doesn't seem to read that file.
Post reply on HN