5 ms·

>Sick of Google tracking the websites you visit? Use a search engine that doesn't track you... You have fundamentally misunderstood how Google tracks your visi

>Sick of Google tracking the websites you visit? Use a search engine that doesn't track you... You have fundamentally misunderstood how Google tracks your visits. If website uses AdSense, they track you, if website uses Google Analytics, they track you, or Google fonts or scripts or what ever, they track you. This means that the problem is much larger and the solution is not very simple.

openasocket 9y ago
They can tell that a particular IP sent a request to their servers, but they can't correlate different requests to the same underlying entity without cookies. Simply saying "they track you" is misleading.
- eveningcoffee 9y ago
  I guess this was about scripts and fonts (because others are obvious cases). I did a test, beside IP address also User-Agent, Accept-Language and Referer headers were sent. Perhaps not good for very precise finger printing but still more that you claimed and can be cross correlated with other requests with more precise information. Google has claimed that they do not use this cases for tracking. One can believe this statement, or one can prefer to not do.
  - openasocket 9y ago
    How can you cross-correlate them? Most people are viewing the internet from behind a NAT, so there isn't a one-to-one mapping between IP address and person.
    - quickben 9y ago
      Plenty of ways, for example: https://panopticlick.eff.org/ https://panopticlick.eff.org/ and from there: https://panopticlick.eff.org/results?#fingerprintTable https://panopticlick.eff.org/results?#fingerprintTable
      - openasocket 9y ago
        Pretty much all of those fingerprints require the ability to run javascript on the client side. Getting static content from Google doesn't allow them to do any real fingerprinting. Obviously, if you're executing arbitrary code provided by Google, they will be able to track you pretty much always.
    - eveningcoffee 9y ago
      You cross correlate IP address and request header parameters (such as user agent, language etc) with previous requests (or future requests) with the same configuration but with known identity. It does not give you perfect match but is much more precise than just the IP address and with limited number of users would be probably sufficient to distinguish different users behind single IP address.
      - openasocket 9y ago
        I think you're overestimating the entropy of the request header parameters (assuming no cookies). How are they going to distinguish me from all the other English-speaking Windows users using Chrome? True, it is better than nothing, but I'm not sure what you could do with such low quality tracking data. You might be able to do something with that, but I can't think of any possible way to use that to violate my privacy.
        eveningcoffee 9y ago
        To clarify it further, for the case I described, I did not assume a user that actively tries to suppress the signal to Google, but assumed a user that only does not visit Google search (or any other its services). I then assumed that at certain moment this user can be uniquely identified (by AdSense, Analytics etc). Then accesses to pages without active tracking but with links to Google fonts or other passive API can be still identified with high confidence given the access happens from the same network. I do not know if such extra signal is interesting for Google, but it can be acquired. Also mind you that using an ad blocker is also a signal and can be assumed from the access pattern. The same logic applies also to an user who uses ad blocking but still uses limited Google services. Again I do not know how much Google finds this kind of signal interesting but it is possible to collect it.
Mathnerd314 9y ago
I don't think it's that hard, just email the people at http://viewdns.info/reversewhois/?q=dns-admin%40google.com http://viewdns.info/reversewhois/?q=dns-admin%40google.com for the full list of Google's domains and add it to a domain blacklist. Then you won't send any data to Google at all. It might break some sites, but sites are broken all the time...
- Mathnerd314 9y ago
  Or maybe just an IP block, that list seems shorter: http://bgp.he.net/AS15169 http://bgp.he.net/AS15169. https://www.pcmech.com/article/how-to-block-99-of-google-and-why-you-shouldnt-do-it-2/ https://www.pcmech.com/article/how-to-block-99-of-google-and...
andrewstuart2 9y ago
I'm very much aware of all the free tools provided by large companies that just end up reporting back to Google, Facebook, etc. There are ways to prevent those requests, however. Install a chrome extension to block all adsense & analytics requests, fonts, etc. Black hole their IP addresses or DNS. There are plenty of concerted efforts to improve anonymity despite these issues (e.g. the TOR browser). There are varying costs to these approaches but it's not impossible, or even that hard if you trust the Tor team more than Google. I'm not saying there aren't additional avenues worth investigating, but that you nearly always have to decide how much efficiency/cost you're willing to pay for anonymity.
- eveningcoffee 9y ago
  Then your statement is even worse because you knew that the issue is deeper but still went with over simplified false premise.

openasocket 9y ago

They can tell that a particular IP sent a request to their servers, but they can't correlate different requests to the same underlying entity without cookies. Simply saying "they track you" is misleading.

eveningcoffee 9y ago
I guess this was about scripts and fonts (because others are obvious cases). I did a test, beside IP address also User-Agent, Accept-Language and Referer headers were sent. Perhaps not good for very precise finger printing but still more that you claimed and can be cross correlated with other requests with more precise information. Google has claimed that they do not use this cases for tracking. One can believe this statement, or one can prefer to not do.
- openasocket 9y ago
  How can you cross-correlate them? Most people are viewing the internet from behind a NAT, so there isn't a one-to-one mapping between IP address and person.
  - quickben 9y ago
    Plenty of ways, for example: https://panopticlick.eff.org/ https://panopticlick.eff.org/ and from there: https://panopticlick.eff.org/results?#fingerprintTable https://panopticlick.eff.org/results?#fingerprintTable
    - openasocket 9y ago
      Pretty much all of those fingerprints require the ability to run javascript on the client side. Getting static content from Google doesn't allow them to do any real fingerprinting. Obviously, if you're executing arbitrary code provided by Google, they will be able to track you pretty much always.
  - eveningcoffee 9y ago
    You cross correlate IP address and request header parameters (such as user agent, language etc) with previous requests (or future requests) with the same configuration but with known identity. It does not give you perfect match but is much more precise than just the IP address and with limited number of users would be probably sufficient to distinguish different users behind single IP address.
    - openasocket 9y ago
      I think you're overestimating the entropy of the request header parameters (assuming no cookies). How are they going to distinguish me from all the other English-speaking Windows users using Chrome? True, it is better than nothing, but I'm not sure what you could do with such low quality tracking data. You might be able to do something with that, but I can't think of any possible way to use that to violate my privacy.
      - eveningcoffee 9y ago
        To clarify it further, for the case I described, I did not assume a user that actively tries to suppress the signal to Google, but assumed a user that only does not visit Google search (or any other its services). I then assumed that at certain moment this user can be uniquely identified (by AdSense, Analytics etc). Then accesses to pages without active tracking but with links to Google fonts or other passive API can be still identified with high confidence given the access happens from the same network. I do not know if such extra signal is interesting for Google, but it can be acquired. Also mind you that using an ad blocker is also a signal and can be assumed from the access pattern. The same logic applies also to an user who uses ad blocking but still uses limited Google services. Again I do not know how much Google finds this kind of signal interesting but it is possible to collect it.

Mathnerd314 9y ago

I don't think it's that hard, just email the people at http://viewdns.info/reversewhois/?q=dns-admin%40google.com http://viewdns.info/reversewhois/?q=dns-admin%40google.com for the full list of Google's domains and add it to a domain blacklist. Then you won't send any data to Google at all. It might break some sites, but sites are broken all the time...

Mathnerd314 9y ago
Or maybe just an IP block, that list seems shorter: http://bgp.he.net/AS15169 http://bgp.he.net/AS15169. https://www.pcmech.com/article/how-to-block-99-of-google-and-why-you-shouldnt-do-it-2/ https://www.pcmech.com/article/how-to-block-99-of-google-and...

andrewstuart2 9y ago

I'm very much aware of all the free tools provided by large companies that just end up reporting back to Google, Facebook, etc. There are ways to prevent those requests, however. Install a chrome extension to block all adsense & analytics requests, fonts, etc. Black hole their IP addresses or DNS. There are plenty of concerted efforts to improve anonymity despite these issues (e.g. the TOR browser). There are varying costs to these approaches but it's not impossible, or even that hard if you trust the Tor team more than Google. I'm not saying there aren't additional avenues worth investigating, but that you nearly always have to decide how much efficiency/cost you're willing to pay for anonymity.

eveningcoffee 9y ago
Then your statement is even worse because you knew that the issue is deeper but still went with over simplified false premise.