7 ms·

Welcome to 2009, I guess "Today we're helping people get better search results by extending Personalized Search to signed-out users worldwide (...)" https://g

Welcome to 2009, I guess "Today we're helping people get better search results by extending Personalized Search to signed-out users worldwide (...)" https://googleblog.blogspot.com/2009/12/personalized-search-for-everyone.html https://googleblog.blogspot.com/2009/12/personalized-search-...

wnevets 8y ago
Sounds like the "study" should have been just a google search.
- detaro 8y ago
  Because "they do X" makes looking into "what do the results of X look like" a completely pointless question?
  - icebraining 8y ago
    Yeah, the problem is more with the headline than the study.
harshvladha 8y ago
There's a difference between Signed out, and Incognito (no cookies)! + People generally tend to miss the point that Incognito doesn't prevent sharing the IP of the user. + I think DuckDuckGo's study missed out using VPN in their analysis. i.e., SignedIn vs Incognito vs (Incognito+VPN)
- Kalium 8y ago
  > There's a difference between Signed out, and Incognito (no cookies)! Is there? I was under the impression that Incognito and its cousins generally still accept and preserve cookies for the duration of the temporary session. This means that for this purpose, there isn't really a difference.
  - gfo 8y ago
    Incognito is supposed to give you a completely clean session that doesn't carry over the cache, cookies, etc. from your normal browsing context. In this study, my understanding is that result personalization carried over from a normal browsing session into the clean, Incognito session, likely due to IP correlation or possibly through User-Agent strings. So while Incognito has its own context that is wiped once the session has ended, the result personalization didn't need anything saved in the browser to recognize who you are.
    - grawprog 8y ago
      Hmmm I wonder if using a second browser, maybe based on a different renderer, in incognito with a different user-agent set up would be enough or if it would still get enough info. At that point it would still have your outgoing ip address at least is there anything else they could still match to a signed in session? I guess you could also route all traffic in the unsigned in session through a VPN too.
      - antsar 8y ago
        Quite a few variables are used to track you, many of which do not change between different browsers. Try this: https://panopticlick.eff.org/ https://panopticlick.eff.org/ Specifically, check out the "fingerprinting" details.
  - snowwrestler 8y ago
    Incognito will accept new cookies but to my understanding it won't serve existing cookies that pre-date the Incognito session. A fresh Incognito window is supposed to be like you cleared your history and cookies before opening it, and then cleared them again when you close it. But yeah, in between the browser acts as normal. In a normal (not Incognito) browser window, you don't have to be logged into Google for Google to read Google cookies. Logging out doesn't make you anonymous; they still know who you are.
- Bartweiss 8y ago
  The "even in Incognito" part of this is certainly the biggest result I see. And I agree on the study limitation; attempting to clean up localization effects after the fact doesn't feel like a strong fix. It should be possible to isolate device and location effects by using multiple devices in one location, then VPN-ing one device to multiple 'locations'. One thing that caught my eye was Google's response about Incognito: > The company did confirm that it does not personalize results for incognito searches using signed-in search history, and it also confirmed that it does not personalize results for the Top Stories row or the News tab in search. Since it's a corporate reply, the standard question is what's not present: a statement that Incognito isn't personalized, or isn't personalized beyond device type and location. Perhaps I'm too cynical, but "we don't personalize using X" parses as "we do personalize in other ways".
  - frandroid 8y ago
    Google definitely personalizes based on geoIP location, that's not exactly a secret.
    - garysahota93 8y ago
      It's not a secret, but I don't think we're doing enough to keep this on the forefront of people's minds. Every time I hear this, I am shocked! Only to then remember I already knew this but somehow let it slide...
      - singingboyo 8y ago
        I mean, what's the difference between this and customizing billboard ads based on where the billboard is? IMO the issue is not google using IP-based location info. The issue (if there really is one) is people assuming/believing the internet hides their location.
        garysahota93 8y ago
        hmm, that's a very interesting point. I guess that famous saying of "if you're not paying, then YOU are the product" kinda falls into play here, huh?
- jakelazaroff 8y ago
  Even with a VPN it's possible to somewhat reliably fingerprint browsers, no? You can check user agent, screen size, installed plug-ins, etc.
  - nielsbot 8y ago
    Yes, see antsar's comment below: Try this: https://panopticlick.eff.org/ https://panopticlick.eff.org/
  - bo1024 8y ago
    Disable javascript by default!
canadianwriter 8y ago
Google has said they aren't using "much" personalization these days: https://searchengineland.com/google-admits-its-using-very-limited-personalization-in-search-results-305469 https://searchengineland.com/google-admits-its-using-very-li... and: https://www.seroundtable.com/google-personalized-search-is-very-light-25745.html https://www.seroundtable.com/google-personalized-search-is-v... So it comes as a bit of a surprise that it isn't as light as they have been saying recently.
Bartweiss 8y ago
I don't think this DuckDuckGo being sloppy, just The Verge. The real headline here is that the effect extends to Incognito mode. In the 2009 post, Google said: > ...customize search results for you based upon 180 days of search activity linked to an anonymous cookie in your browser... You'll know when we customize results because a "View customizations" link will appear... Clicking the link will let you... turn off this type of customization None of that appears to be match the study results here. Incognito mode isn't supposed to pick up session cookies from normal browsing, no customization notice appears, and an option to turn the behavior off certainly isn't provided.
- xvector 8y ago
  Honestly, Google is almost certainly using canvas fingerprinting to track you across accounts, webpages, and more regardless of incognito. There should be zero expectation of privacy when using a Google service. I've switched to searx.me, which wraps Google and (optionally) a bunch of other search engines.
  - esrauch 8y ago
    Do you have a citation that they do canvas fingerprinting or are you just guessing?
    - GunlogAlm 8y ago
      Probably not, hence "almost certainly".
    - mda 8y ago
      They don't. But welcome to HN Where conspiracy is more prevalent then truth.
      - doctorpangloss 8y ago
        I don’t know dude, it would take Google the whole of 5 minutes to publish how they track people. It’s not like they haven’t already prepared a contingency eg for congress. You’re being really flippant about speculation, which is a total red herring. The point is they’re not honest.
sixothree 8y ago
To be fair, I have noticed more and more "creep" (take that how you like) related to logged out behavior from Google.
- px4n 8y ago
  To be fair, I have noticed more and more "creep" from Google full stop. I was hoping GDPR was going to put some sort of dent into this behaviour from large corporations, alas.
NoPicklez 8y ago
It's interesting the tone of the blog as well, I bet if that article was written today it would've had a lot more rigor around the language being used. And it would be ensuring users that their security and privacy isn't be compromised, as opposed to this blog which is simply describing what Google thinks is a great feature that the public would be benefit from.

wnevets 8y ago

Sounds like the "study" should have been just a google search.

detaro 8y ago
Because "they do X" makes looking into "what do the results of X look like" a completely pointless question?
- icebraining 8y ago
  Yeah, the problem is more with the headline than the study.

harshvladha 8y ago

There's a difference between Signed out, and Incognito (no cookies)! + People generally tend to miss the point that Incognito doesn't prevent sharing the IP of the user. + I think DuckDuckGo's study missed out using VPN in their analysis. i.e., SignedIn vs Incognito vs (Incognito+VPN)

Kalium 8y ago
> There's a difference between Signed out, and Incognito (no cookies)! Is there? I was under the impression that Incognito and its cousins generally still accept and preserve cookies for the duration of the temporary session. This means that for this purpose, there isn't really a difference.
- gfo 8y ago
  Incognito is supposed to give you a completely clean session that doesn't carry over the cache, cookies, etc. from your normal browsing context. In this study, my understanding is that result personalization carried over from a normal browsing session into the clean, Incognito session, likely due to IP correlation or possibly through User-Agent strings. So while Incognito has its own context that is wiped once the session has ended, the result personalization didn't need anything saved in the browser to recognize who you are.
  - grawprog 8y ago
    Hmmm I wonder if using a second browser, maybe based on a different renderer, in incognito with a different user-agent set up would be enough or if it would still get enough info. At that point it would still have your outgoing ip address at least is there anything else they could still match to a signed in session? I guess you could also route all traffic in the unsigned in session through a VPN too.
    - antsar 8y ago
      Quite a few variables are used to track you, many of which do not change between different browsers. Try this: https://panopticlick.eff.org/ https://panopticlick.eff.org/ Specifically, check out the "fingerprinting" details.
- snowwrestler 8y ago
  Incognito will accept new cookies but to my understanding it won't serve existing cookies that pre-date the Incognito session. A fresh Incognito window is supposed to be like you cleared your history and cookies before opening it, and then cleared them again when you close it. But yeah, in between the browser acts as normal. In a normal (not Incognito) browser window, you don't have to be logged into Google for Google to read Google cookies. Logging out doesn't make you anonymous; they still know who you are.
Bartweiss 8y ago
The "even in Incognito" part of this is certainly the biggest result I see. And I agree on the study limitation; attempting to clean up localization effects after the fact doesn't feel like a strong fix. It should be possible to isolate device and location effects by using multiple devices in one location, then VPN-ing one device to multiple 'locations'. One thing that caught my eye was Google's response about Incognito: > The company did confirm that it does not personalize results for incognito searches using signed-in search history, and it also confirmed that it does not personalize results for the Top Stories row or the News tab in search. Since it's a corporate reply, the standard question is what's not present: a statement that Incognito isn't personalized, or isn't personalized beyond device type and location. Perhaps I'm too cynical, but "we don't personalize using X" parses as "we do personalize in other ways".
- frandroid 8y ago
  Google definitely personalizes based on geoIP location, that's not exactly a secret.
  - garysahota93 8y ago
    It's not a secret, but I don't think we're doing enough to keep this on the forefront of people's minds. Every time I hear this, I am shocked! Only to then remember I already knew this but somehow let it slide...
    - singingboyo 8y ago
      I mean, what's the difference between this and customizing billboard ads based on where the billboard is? IMO the issue is not google using IP-based location info. The issue (if there really is one) is people assuming/believing the internet hides their location.
      - garysahota93 8y ago
        hmm, that's a very interesting point. I guess that famous saying of "if you're not paying, then YOU are the product" kinda falls into play here, huh?
jakelazaroff 8y ago
Even with a VPN it's possible to somewhat reliably fingerprint browsers, no? You can check user agent, screen size, installed plug-ins, etc.
- nielsbot 8y ago
  Yes, see antsar's comment below: Try this: https://panopticlick.eff.org/ https://panopticlick.eff.org/
- bo1024 8y ago
  Disable javascript by default!

canadianwriter 8y ago

Google has said they aren't using "much" personalization these days: https://searchengineland.com/google-admits-its-using-very-limited-personalization-in-search-results-305469 https://searchengineland.com/google-admits-its-using-very-li... and: https://www.seroundtable.com/google-personalized-search-is-very-light-25745.html https://www.seroundtable.com/google-personalized-search-is-v... So it comes as a bit of a surprise that it isn't as light as they have been saying recently.

Bartweiss 8y ago

I don't think this DuckDuckGo being sloppy, just The Verge. The real headline here is that the effect extends to Incognito mode. In the 2009 post, Google said: > ...customize search results for you based upon 180 days of search activity linked to an anonymous cookie in your browser... You'll know when we customize results because a "View customizations" link will appear... Clicking the link will let you... turn off this type of customization None of that appears to be match the study results here. Incognito mode isn't supposed to pick up session cookies from normal browsing, no customization notice appears, and an option to turn the behavior off certainly isn't provided.

xvector 8y ago
Honestly, Google is almost certainly using canvas fingerprinting to track you across accounts, webpages, and more regardless of incognito. There should be zero expectation of privacy when using a Google service. I've switched to searx.me, which wraps Google and (optionally) a bunch of other search engines.
- esrauch 8y ago
  Do you have a citation that they do canvas fingerprinting or are you just guessing?
  - GunlogAlm 8y ago
    Probably not, hence "almost certainly".
  - mda 8y ago
    They don't. But welcome to HN Where conspiracy is more prevalent then truth.
    - doctorpangloss 8y ago
      I don’t know dude, it would take Google the whole of 5 minutes to publish how they track people. It’s not like they haven’t already prepared a contingency eg for congress. You’re being really flippant about speculation, which is a total red herring. The point is they’re not honest.

sixothree 8y ago

To be fair, I have noticed more and more "creep" (take that how you like) related to logged out behavior from Google.

px4n 8y ago
To be fair, I have noticed more and more "creep" from Google full stop. I was hoping GDPR was going to put some sort of dent into this behaviour from large corporations, alas.

NoPicklez 8y ago

It's interesting the tone of the blog as well, I bet if that article was written today it would've had a lot more rigor around the language being used. And it would be ensuring users that their security and privacy isn't be compromised, as opposed to this blog which is simply describing what Google thinks is a great feature that the public would be benefit from.