Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google tracks individual users per Chrome installation ID

github.com

Post reply on HN
Print view View original

531–540 of 642 posts

Re: Google tracks individual users per Chrome installation ID

#531

Post by henriquemaia »

wuliwong wrote: post #528
jariel wrote: post #514

Earlier quoted context omitted.

"Chrome was about freeing the world of a truly terrible web browser " Chrome is about establishing more control over the web to further the business objectives of Google and Alphabet. The problem with this belief of Google as some kind of 'benevolent actor' is a function of the new kind of branding they helped introduce, something that an entire generation of particularly young people are being duped by. 'Brand' used…

> The problem with this belief of Google as some kind of 'benevolent actor' You put 'benevolent actor' in quotes as if the comment you are replying to contained that. It didn't.

Stress quotes. That is just one of the possible devices to achieve that.

I see a lot of that here, people misunderstanding basic speech/writing conventions. Maybe giving the op the benefit of doubt, assuming s/he knows what s/he is doing, can help avoid some of those.

Re: Google tracks individual users per Chrome installation ID

#532

Post by killface »

macinjosh wrote: post #25
JMTQp8lwXL wrote: post #16

Earlier quoted context omitted.

Is there a reason for only sending this header to Google web properties and not all domains?

It is an abuse of Chrome's position in the marketplace. Google is using their powerful position to give themselves tracking capabilities that other online players can't access. It is a major competitive advantage for Google.

can't alternate browser makers who base on chromium simply disable that portion? like, I expect identifying users was a key business concern in moving Edge to Chromium. Is there something (other than work) preventing them from making it so it'll report back to microsoft-owned domains instead?

Re: Google tracks individual users per Chrome installation ID

#533

Post by cmroanirgo »

mabbo wrote: post #461
d1zzy wrote: post #362

TL;DR I think whoever posted that is trying to bury the UA anonymizing feature by derailing the discussion. What I'm seeing is an RFC for anonymizing parts of User-Agent in order to reduce UA based fingerprinting, which improves everyone's privacy, that's a good thing! Then I see someone comments how that could negatively impact existing websites or Chromium-derived browsers, comments which are totally fair and make…

I think the concern is that this disarms Google's competitors while keeping them fully-armed. Ads are a business, and they are Google's business. They are how they make money. And like all businesses, they are competitive. Tracking is a way to make more money off online advertising. By removing tracking from their competitors while keeping it for themselves, Google stand to make a lot of money off this change. Their…

Just yesterday I had to disable anti fingerprinting I'd enabled in Firefox because despite having a solid IP and and existing cookies to login to Google, it's security system rejected me, even after answering security questions. Turn off fingerprinting and I could log in.

So, this is a round about way of agreeing with the hidden dark patterns that Google are bringing to the web. It must stop.

Re: Google tracks individual users per Chrome installation ID

#534

Post by ajross »

mabbo wrote: post #461
d1zzy wrote: post #362

TL;DR I think whoever posted that is trying to bury the UA anonymizing feature by derailing the discussion. What I'm seeing is an RFC for anonymizing parts of User-Agent in order to reduce UA based fingerprinting, which improves everyone's privacy, that's a good thing! Then I see someone comments how that could negatively impact existing websites or Chromium-derived browsers, comments which are totally fair and make…

I think the concern is that this disarms Google's competitors while keeping them fully-armed. Ads are a business, and they are Google's business. They are how they make money. And like all businesses, they are competitive. Tracking is a way to make more money off online advertising. By removing tracking from their competitors while keeping it for themselves, Google stand to make a lot of money off this change. Their…

> while keeping them fully-armed.

That's sort of a fragile assumption though. I mean, yes, there's enough specificity in this number that it could be used (in combination with other fingerprinting techniques) to disambiguate a user. And yes, only Google would be capable of doing this. So it's abusable, in the same way that lots of software like this is abusable by the disributor. And that's worth pointing out and complaing about, sure.

But it's not tracking. It's not. It's a cookie that identifies the gross configuration of the browser. And Google claims that it's not being used for tracking.

So all the folks with the hyperbole about user tracking for advertising purposes need to come out with their evidence that Google is lying about this. Occam says that, no, it's probably just a misdesigned feature.

Re: Google tracks individual users per Chrome installation ID

#535

Post by tyingq »

mabbo wrote: post #461
d1zzy wrote: post #362

TL;DR I think whoever posted that is trying to bury the UA anonymizing feature by derailing the discussion. What I'm seeing is an RFC for anonymizing parts of User-Agent in order to reduce UA based fingerprinting, which improves everyone's privacy, that's a good thing! Then I see someone comments how that could negatively impact existing websites or Chromium-derived browsers, comments which are totally fair and make…

I think the concern is that this disarms Google's competitors while keeping them fully-armed. Ads are a business, and they are Google's business. They are how they make money. And like all businesses, they are competitive. Tracking is a way to make more money off online advertising. By removing tracking from their competitors while keeping it for themselves, Google stand to make a lot of money off this change. Their…

"I think the concern is that this disarms Google's competitors while keeping them fully-armed."

Pretty sure that was their main reason for helping push https-everywhere. A good idea generally, but hurt every other entity trying to do tracking more than it hurt Google.

Re: Google tracks individual users per Chrome installation ID

#536

Post by randomdude402 »

akersten wrote: post #527
chatmasta wrote: post #279

Earlier quoted context omitted.

This seems like a cut-and-dry case of getting caught in monopolistic behavior. The code is right there. The Chrome codebase has special features for Google’s own web properties. I hope all these AGs suing google have some good tech advisors. It’s hard to keep track of all the nefarious things google has been up to over the past decade.

> This seems like a cut-and-dry case of getting caught in monopolistic behavior. The code is right there. ??? Is "Darn, their browser only gets to track me on their own websites; if Google were playing fairly, they'd send the tracking header to all websites so I can be tracked more and have less privacy" the argument you're making here? And it's debatable that this header is actually serving a tracking purpose at all…

You realize that whenever a user visits a page that uses AdWords, AdSense, or login via Google, they download a script file from one of those domains, right?

So a user can log into Google and then log out, tying that header data to whatever PII Google has attached to them, and future visits to any sites using those and probably other services can be attached to the individual, despite them having intended to be logged out of Google services.

Re: Google tracks individual users per Chrome installation ID

#537

Post by joshuamorton »

dessant wrote: post #523
joshuamorton wrote: post #517

Earlier quoted context omitted.

Interesting, TIL. That doesn't change the major point I was making though, which is that an anonymized identifier (such as the 13-bit ID under discussion) isn't personal info, even if it might have originally been collected along side data which is personal info. If I give you said 13 bit ID, you need other info to back out a single person, the anonymous ID corresponds to multiple IPs.

I think you're still missing the point. Google transmits personal data to their servers without user consent. The value of x-client-data is personal data, because it is associated with an IP address during transit, due to how HTTP requests work. The nature of the data, what is being done with it on the server, and the location of the server are all irrelevant in this instance, the only important part is that personal…

> The value of x-client-data is personal data, because it is associated with an IP address during transit, due to how HTTP requests work.

This is not correct. The x-client-data is not personal data. x-client-data associated with an IP address is personal data. As soon as you separate the client-data from the IP, the client data stops being personal data. IOW, the tuple (x-client-data, IP) is personal data. But x-client-data on its own isn't personal data, because it cannot be used to infer the IP on its own.

I don't know where you're getting this "if two pieces of data ever touch and one of them is personal data the other one is now also contaminated as personal data". It's not true. That would make the existence of anonymous data (which the GDPR specifies as a thing) practically speaking impossible to have on the web, since all requests are associated with the IP on receipt. (or actually even worse, it would make the process of anonymizing data impossible in general, since the anonymization process associates the anonymized data with the original personal data).

To be precise, the GDPR defines anonymized data as "data rendered anonymous in such a way that the data subject is not or no longer identifiable.". The x-client-data header is exactly that. The subject of the header is not identifiable by the x-client-data header alone. Therefore the header is anonymous and not subject to strong GDPR reqs.

For the client data header to be personal data, you'd need to describe a scheme such that, given an x-client-data header, and only an x-client-data header, you could identify one (and only one) unique person to whom that header corresponds. You're welcome to come up with such a scheme, but my intro CS classes taught me that bucketed hashing is irreversible, and with 8192 buckets, you're not going to be able to uniquely identify anyone specific.

Re: Google tracks individual users per Chrome installation ID

#538

Post by [deleted] »

raxxorrax wrote: post #146

This it outrageous. Browsers are user-agents, not advertising accelerators. They should hide as much personal identifiable information as possible. This is exactly why using a browser from an advertising company is not a good idea. They use it to improve their service... The lie gets old... This comment was sadly written in Chrome, since I need it for testing... edit: pretty much exactly 10 years ago they already tri…

[deleted]

Re: Google tracks individual users per Chrome installation ID

#539

Post by userbinator »

rvnx wrote: post #14
janpot wrote: post #4

Not endorsing this, but according to https://www.google.com/chrome/privacy/whitepaper.html#variat... > We want to build features that users want, so a subset of users may get a sneak peek at new functionality being tested before it’s launched to the world at large. A list of field trials that are currently active on your installation of Chrome will be included in all requests sent to Google. This Chrome-Variations he…

They key in the wording is: "If usage statistics and crash reports are disabled, this number is chosen between 0 and 7999 (13 bits of entropy)." "If, statistics are disabled." In chrome://version you can see the active variations. It seems to be pretty big numbers to be significant, and so far haven't observed duplicates. Since this header is generated server-side, you have only to believe I guess ? Plus why Doublecl…

That's basically saying "even if you opt out, we'll still try to track you, just not as much." Very unpleasant, but then again I'm not surprised to see this attitude from Google.

Re: Google tracks individual users per Chrome installation ID

#540

Post by garmaine »

bsharitt wrote: post #198

Everybody imagine going back 15 years and tell yourself that you're using a web browser made by the parent company of DoubleClick. Your 15 year ago self would think you're a moron (assuming that 15 years ago you were old enough to know what DoubleClick was).

I don’t use Chrome. Never have, never will. Why do you?
Post reply on HN