Devuan considers machine IDs • Hacker News Board

Re: Devuan considers machine IDs

#71

Post by JohnFen » Sun, Mar 31, 2019, 10:27 PM UTC

koolba wrote: post #29

ez7r6i wrote: post #11

Earlier quoted context omitted.

Chromium reads it, but are we sure it's sending it somewhere? Maybe it uses it for bookkeeping of local sessions or something like that.

I checked the Chromium source and for Linux they explicitly mention not being allowed to send it externally[0]; they hash it via SHA1, encode it as base64, and use that value. Interestingly for Windows they pull the machine id from the registry[1] and (at first glance) it doesn't seem like they're doing any hashing. The raw value gets used. Haven't checked if the value gets sent externally but based upon the comment…

> they explicitly mention not being allowed to send it externally[0]; they hash it via SHA1, encode it as base64, and use that value.

If it's sending that value out, then there is no logical difference between that and just sending out the machine-id in the first place.

Re: Devuan considers machine IDs

#72

Post by JohnFen » Sun, Mar 31, 2019, 10:29 PM UTC

swinglock wrote: post #23

Removing it just makes it more difficult to write legit programs that has use of such features while anything nefarious will be able to find other things to use as fingerprints, including hardware serials, MACs and their own fingerprint files spread across the filesystem in non-standard locations. Unless the OS is meant to be built for privacy and has a goal to run every app in a sandbox where nothing is fingerprinta…

> Removing it just makes it more difficult to write legit programs

Yeah, that's something I simply could not care less about.

That said, I don't remove it. I set its permissions so that it isn't world-readable instead.

Re: Devuan considers machine IDs

#73

Post by JohnFen » Sun, Mar 31, 2019, 10:32 PM UTC

swinglock wrote: post #21

mirimir wrote: post #20

Earlier quoted context omitted.

Because the machine-id by default never changes after OS installation.

Neither does a file Chrome generates. Not even if reinstalled.

In Linux, I can find and nuke everything that Chrome (or any other app) generates.

Re: Devuan considers machine IDs

#74

Post by yellowapple » Mon, Apr 01, 2019, 3:35 AM UTC

mirimir wrote: post #4

nickysielicki wrote: post #2

If a file on your computer is being used by a program to send information to someone, the answer isn't to destroy/randomize the file and break other applications, the answer is to not use the program that is sending your information somewhere.

Sure, but how do you know what programs are misusing it?

Rename it and see which programs complain :)

Re: Devuan considers machine IDs

#75

Post by wicket » Mon, Apr 01, 2019, 4:14 AM UTC

wicket wrote: post #26

CodeArtisan wrote: post #12

can't you simply symlink /etc/machine-id to /dev/random?

That won't work because /etc/machine-id is supposed to return a 32 character hex string, but I like the idea. You could do something like this: # rm -f /etc/machine-id # mkfifo /etc/machine-id # while true; do head -c 16 /dev/urandom | od -A n -x | tr -d ' ' > /etc/machine-id; done &

A word of warning. If you try this, make sure the last command is started on boot and runs before D-Bus! I completely forgot I had done this, and I just spent a few hours trying to figure out why my system was hanging on boot. It turns out that D-Bus reads /etc/machine-id on start-up, and naturally by design, it will wait until it receives data from the named pipe before proceeding with execution.

Re: Devuan considers machine IDs

#76

Post by swinglock » Thu, Apr 04, 2019, 9:24 PM UTC

JohnFen wrote: post #72

swinglock wrote: post #23

Removing it just makes it more difficult to write legit programs that has use of such features while anything nefarious will be able to find other things to use as fingerprints, including hardware serials, MACs and their own fingerprint files spread across the filesystem in non-standard locations. Unless the OS is meant to be built for privacy and has a goal to run every app in a sandbox where nothing is fingerprinta…

> Removing it just makes it more difficult to write legit programs Yeah, that's something I simply could not care less about. That said, I don't remove it. I set its permissions so that it isn't world-readable instead.

Why?