Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google tracks individual users per Chrome installation ID

github.com

Post reply on HN
Print view View original

631–640 of 642 posts

Re: Google tracks individual users per Chrome installation ID

#631

Post by carlsborg »

JdeBP wrote: post #626
carlsborg wrote: post #608

Earlier quoted context omitted.

True, more precisely - 16 bytes, 32 hex characters. Your link is in agreement "The machine ID is usually generated from a random source during system installation or first boot and stays constant for all subsequent boots." And See https://wiki.debian.org/MachineId at least one distro uses it for the DHCP ID.

"At least one distro" is not correct either. It's used by systemd-networkd, specifically. * http://jdebp.uk./Softwares/nosh/guide/commands/machine-id.xm...

Now you are nitpicking. Your new link says exactly this “ This broadcasts the machine ID (hashed with a known fixed salt) over the LAN as the unique client identifier part of the DHCP protocol. (Other DHCP clients tend to use MAC addresses for this.) It also broadcasts the machine ID locally on each link as part of Ethernet LLDP, if enabled.”

Re: Google tracks individual users per Chrome installation ID

#632

Post by kseistrup »

janpot wrote: post #4

Not endorsing this, but according to https://www.google.com/chrome/privacy/whitepaper.html#variat... > We want to build features that users want, so a subset of users may get a sneak peek at new functionality being tested before it’s launched to the world at large. A list of field trials that are currently active on your installation of Chrome will be included in all requests sent to Google. This Chrome-Variations he…

How does one apply the “--reset-variation-state” flag on a chromebook?

Re: Google tracks individual users per Chrome installation ID

#633

Post by JdeBP »

carlsborg wrote: post #631
JdeBP wrote: post #626

Earlier quoted context omitted.

"At least one distro" is not correct either. It's used by systemd-networkd, specifically. * http://jdebp.uk./Softwares/nosh/guide/commands/machine-id.xm...

Now you are nitpicking. Your new link says exactly this “ This broadcasts the machine ID (hashed with a known fixed salt) over the LAN as the unique client identifier part of the DHCP protocol. (Other DHCP clients tend to use MAC addresses for this.) It also broadcasts the machine ID locally on each link as part of Ethernet LLDP, if enabled.”

It is far from nitpicking to point out the gross inaccuracy of conflating one particular software with an entire operating system. systemd-networkd is not Debian.

Re: Google tracks individual users per Chrome installation ID

#634

Post by carlsborg »

JdeBP wrote: post #633
carlsborg wrote: post #631

Earlier quoted context omitted.

Now you are nitpicking. Your new link says exactly this “ This broadcasts the machine ID (hashed with a known fixed salt) over the LAN as the unique client identifier part of the DHCP protocol. (Other DHCP clients tend to use MAC addresses for this.) It also broadcasts the machine ID locally on each link as part of Ethernet LLDP, if enabled.”

It is far from nitpicking to point out the gross inaccuracy of conflating one particular software with an entire operating system. systemd-networkd is not Debian.

Nobody is conflating these two things, you are interpreting it that way.

Re: Google tracks individual users per Chrome installation ID

#636

Post by iakov »

raxxorrax wrote: post #146

This it outrageous. Browsers are user-agents, not advertising accelerators. They should hide as much personal identifiable information as possible. This is exactly why using a browser from an advertising company is not a good idea. They use it to improve their service... The lie gets old... This comment was sadly written in Chrome, since I need it for testing... edit: pretty much exactly 10 years ago they already tri…

>This comment was sadly written in Chrome, since I need it for testing...

You realize you can have multiple different browsers installed, right?

Re: Google tracks individual users per Chrome installation ID

#637

Post by codedokode »

chias wrote: post #369
xfs wrote: post #320

Earlier quoted context omitted.

First I thought reading /etc/machine-id would be expected if Chrome uses D-bus or pulseaudio libraries which depend on D-bus, and /etc/machine-id is part of D-bus. But no, they really use it for tracking purposes. And in a sick twist they have this comment for it: std::string BrowserDMTokenStorageLinux::InitClientId() { // The client ID is derived from /etc/machine-id // (https://www.freedesktop.org/software/systemd/…

In fairness, the guidelines they reference suggest you do exactly what the comment says they're doing (assuming they're keying the hash). The guidelines seem explicitly written with the idea that unique identifiers _derived from_ this value are not similarly quarantined, provided that you cannot take the derived value and "reverse" it back to the original identifier. Quoting from https://www.freedesktop.org/software/…

I think it doesn't make much sense to protect it because in popular Linux distributions an unprivileged user can access such identifiers as MAC addresses of network interfaces, HDD serial numbers etc.

> If a stable unique identifier that is tied to the machine is needed for some application,

Ideally there should be no stable identifiers accessible to untrusted applications.

Re: Google tracks individual users per Chrome installation ID

#639

Post by meowface »

imtringued wrote: post #610
meowface wrote: post #518

Earlier quoted context omitted.

Sorry about that, too late to edit it now. That is an important detail. If there are 32 or more different feature flags, then that's 4 billion unique states, which would be an effective fingerprint. I still think it's pretty unlikely they're using it in that way or would in the future, and I think Google fuzzing this for those who opt out of telemetry is probably a signal of good faith in this instance. They realize…

reCAPTCHA is the most abusive type of tracking. Google simply denys you usage of captcha if you do not give them enough personal information. It doesn't matter if you enter the captcha correctly 20 times. It won't let you in.

This is part of the bot detection, though. It's probably not "not enough personal information", it's "this truly seems like it is unlikely to be a legitimate device/person", due to the huge datasets they're working with. Same with Cloudflare and Tor. Once you operate a security service anywhere near that scale, you start to understand there are inherent challenges and tradeoffs like these,

Re: Google tracks individual users per Chrome installation ID

#640

Post by mabbo »

sriku wrote: post #567
mabbo wrote: post #461

Earlier quoted context omitted.

I think the concern is that this disarms Google's competitors while keeping them fully-armed. Ads are a business, and they are Google's business. They are how they make money. And like all businesses, they are competitive. Tracking is a way to make more money off online advertising. By removing tracking from their competitors while keeping it for themselves, Google stand to make a lot of money off this change. Their…

Much of such discussions demonize the company, but we need to look broader. Google is a public company and its shareholders, since they share the company, are also to be pointed out. Discouraging such behaviour is better done by the shareholders by dumping shares since Google could very well argue that if it didn't work to maximize ad revenue, it would not be operating according to fiduciary responsibility principles…

That is such short term thinking.

Doing unethical things because "We had to so the shareholders would make money" is such a cop-out. I see it just the opposite way. You have a duty to do things ethically so that in the long run customers continue to want to use your product. So that governments don't start going after you for the unethical things you do. So that other businesses will trust you and continue to work with you.

Here's an example: Huawei. They've reached out to me saying they'll pay me more than my employer and my commute will be shorter. No effing way. I'm sure I could make them a lot of money, but they're history of unethical behaviour is an instant deal-breaker for me. Others will, sure, but in the market of labor they're going to have a reduced supply because I'm surely not alone in this attitude.

Post reply on HN