7 ms·

Every time there's something about online privacy with browsers, it's mostly Firefox or Safari. I wondered if Chrome had resisting fingerprinting on its radar (

Every time there's something about online privacy with browsers, it's mostly Firefox or Safari. I wondered if Chrome had resisting fingerprinting on its radar (guessing that it wouldn't be in Google's interests to add any feature that would thwart profiling users online), and I found this [1] confirming my guess (emphasis mine): > Since we don't believe it's feasible to provide some mode of Chrome that can truly prevent passive fingerprinting, we will mark all related bugs and feature requests as WontFix. I haven't read all the analyses in the links in that article, but this sounds defeatist and lazy, much unlike a stance that Chromium would take on security or performance on the web. Contrast the above with what this article says about Firefox: > Firefox's upcoming letterboxing feature is part of a larger project that started in 2016, called Tor Uplift. > Part of Tor Uplift, Mozilla developers have been slowly porting privacy-hardening features developed originally for the Tor Browser and integrating them into Firefox. If you value online privacy, your best choice is Firefox (though it requires some additional manual configuration). Safari comes second (its extensions directory could use more love). The choice where you can add more of your influence to is Firefox — by using it, evangelizing it and by donating (if feasible) to it. [1]: https://chromium.googlesource.com/chromium/src/+/master/docs/security/faq.md#Why-isnt-passive-browser-fingerprinting-including-passive-cookies_in-Chromes-threat-model https://chromium.googlesource.com/chromium/src/+/master/docs...

godelski 8y ago
> guessing that it wouldn't be in Google's interests to add any feature that would thwart profiling users online I would actually think the opposite. Wouldn't it be better because then only Google would have that information? Only Google would be able to fingerprint. This is of course under the assumption (which is currently accurate) that Google has the majority share of browsers. But maybe it wouldn't be, because it would teach others how to thwart their fingerprinting.
- baroffoos 8y ago
  Yeah, with a google account and google login on every website they still can track everyone even without all these other methods.
- tyingq 8y ago
  I suspect that's the biggest reason Google was so interested in "https everywhere". That removed detailed browsing visibility from a lot of entities, but not Google.
  - c0nducktr 8y ago
    Can you elaborate on that? Are you talking about the https everywhere extension from the EFF, because I wasn't aware Google had a part in that.
    - sleepychu 8y ago
      Google is steadily making it harder for users to use an http website.
    - robin_reala 8y ago
      They’re talking about Chrome’s (and other browsers’) marking of http sites as insecure, and Google-as-a-search-engine penalising non-HTTPS sites. These are good things.
    - scarejunba 8y ago
      I don't agree with him but Google penalizes non-HTTPS results etc.
    - tyingq 8y ago
      Serp positions and browser features, like: https://security.googleblog.com/2018/02/a-secure-web-is-here-to-stay.html https://security.googleblog.com/2018/02/a-secure-web-is-here...
  - nindalf 8y ago
    I've seen this tendency on HN - if this person/entity does something, I suspect it must be bad or selfish. On the subject of HTTPS - do you think the interests of ordinary consumers are in any way served by continuing on HTTP? Countless websites, even those accepting login credentials used to think that it was acceptable to not take the trouble to set up HTTPS. The only thing the operators of these websites cared about was being marked "insecure" by the most popular browser. The shift to HTTPS was a definite win for privacy for every person who uses the web. But no. Apparently, the "biggest reason" for the people working at Google pushing this because it was good for Google. They didn't care about all the benefits for end users, they only cared about themselves. It's sad that slander like this can become mainstream view in a forum like HN. Disclaimer - no connection to Google in any way. Don't even own Google stock.
- hedora 8y ago
  There’s been a lot of press recently about shady data brokers selling information to Facebook. I would be genuinely surprised if those same data brokers don’t sell to google. (In addition to full time data brokerage firms, there are third party phone app api’s that slurp data and feed it to advertisers. Facebook has at least one. Presumably google does too...)
  - tyingq 8y ago
    Google does buy data for sure. One example: https://www.bloomberg.com/news/articles/2018-08-30/google-and-mastercard-cut-a-secret-ad-deal-to-track-retail-sales https://www.bloomberg.com/news/articles/2018-08-30/google-an...
3pt14159 8y ago
There is a way to stop fingerprinting. That way is serving pages via distributed network (over a WoT or torrent-like thing). All these other ways do is give people the illusion that they're safe from being tracked, when the reality is that they're tracked just the same, but by fewer people so the data is more valuable. This means that the money is centralizing around the actors with the most inexplicable methods of tracking; which are almost always the worst actors. I hate it too, even though I'm not blameless. It's impossible to compete without a level playing field, and that playing field needs to be technically enforced, because otherwise we get region shopping and advertising / analytics models that push people to create intractable mechanisms so they can paper over how tracking fed into it. For example, imagine a world where I'm bidding to show an ad to a visitor of nytimes.com. Now, I may not track the user, but if anyone is, they can incorporate what they know and sell that traffic back to me on a CPA model. All I see is the incoming traffic. I don't track anyone (wink, wink) but there is no difference. In the long run this will either be solved one way or another, and all these online surveillance capitalism companies will crash and burn. Either we get a web with technical guarantees or we get a balkanized internet where every state makes their own weird laws about what is allowed or not.
- newscracker 8y ago
  > In the long run this will either be solved one way or another, and all these online surveillance capitalism companies will crash and burn. I sincerely hope that happens without causing more harm to people. It also seems to be a long way away.
  - kabacha 8y ago
    https://en.wikipedia.org/wiki/Accelerationism https://en.wikipedia.org/wiki/Accelerationism
- scottlocklin 8y ago
  I'm pretty sure sticking it on a distributed network is potentially much worse unless it is specifically designed to prevent tracking.
- 8y ago
Jonnax 8y ago
Here's a good comparison: Android Chrome's user agent: Mozilla/5.0 (Linux; Android 6.0.1; SM-G928F Build/MMB29K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Mobile Safari/537.36 Versus Android Firefox's user agent: Mozilla/5.0 (Android 9; Mobile; rv:66.0) Gecko/66.0 Firefox/66.0 Note how the Chrome browser announces your phone model and software build version to the world. With regional models with carrier customised software builds, simply the user agent can be used to fingerprint a user.
- homero 8y ago
  Yup it's disgusting. Even in private mode sites know it's me with my build version and ip.
  - tsukurimashou 8y ago
    To be honest most people are confused about "private mode", I agree there should be privacy options enabled by default with it, but the reality is pretty much "no browser history will be stored (locally) and your session / cookies will be isolated between private mode and "normal mode"
    - homero 8y ago
      I don't expect serial numbers to be sent even in public mode. Android build plus ip might as well be a serial number.
    - SmellyGeekBoy 8y ago
      Indeed. It's intended as a method of watching porn without having it pop up in the address autocomplete later when your kids are trying to go to the Peppa Pig website.
  - TheKarateKid 8y ago
    Google still knows my precise location sometimes even when I'm connected to a VPN. The browser itself uses more (Wifi network, phones linked to your account) than just your IP to determine it, and there's no way to control it.
deleted 8y ago
[deleted]
dwd 8y ago
Firefox is a good start, then it's also worth checking your browser with the EFF Panopticlick to see how your settings affect your uniqueness. https://panopticlick.eff.org https://panopticlick.eff.org

godelski 8y ago

> guessing that it wouldn't be in Google's interests to add any feature that would thwart profiling users online I would actually think the opposite. Wouldn't it be better because then only Google would have that information? Only Google would be able to fingerprint. This is of course under the assumption (which is currently accurate) that Google has the majority share of browsers. But maybe it wouldn't be, because it would teach others how to thwart their fingerprinting.

baroffoos 8y ago
Yeah, with a google account and google login on every website they still can track everyone even without all these other methods.
tyingq 8y ago
I suspect that's the biggest reason Google was so interested in "https everywhere". That removed detailed browsing visibility from a lot of entities, but not Google.
- c0nducktr 8y ago
  Can you elaborate on that? Are you talking about the https everywhere extension from the EFF, because I wasn't aware Google had a part in that.
  - sleepychu 8y ago
    Google is steadily making it harder for users to use an http website.
  - robin_reala 8y ago
    They’re talking about Chrome’s (and other browsers’) marking of http sites as insecure, and Google-as-a-search-engine penalising non-HTTPS sites. These are good things.
  - scarejunba 8y ago
    I don't agree with him but Google penalizes non-HTTPS results etc.
  - tyingq 8y ago
    Serp positions and browser features, like: https://security.googleblog.com/2018/02/a-secure-web-is-here-to-stay.html https://security.googleblog.com/2018/02/a-secure-web-is-here...
- nindalf 8y ago
  I've seen this tendency on HN - if this person/entity does something, I suspect it must be bad or selfish. On the subject of HTTPS - do you think the interests of ordinary consumers are in any way served by continuing on HTTP? Countless websites, even those accepting login credentials used to think that it was acceptable to not take the trouble to set up HTTPS. The only thing the operators of these websites cared about was being marked "insecure" by the most popular browser. The shift to HTTPS was a definite win for privacy for every person who uses the web. But no. Apparently, the "biggest reason" for the people working at Google pushing this because it was good for Google. They didn't care about all the benefits for end users, they only cared about themselves. It's sad that slander like this can become mainstream view in a forum like HN. Disclaimer - no connection to Google in any way. Don't even own Google stock.
hedora 8y ago
There’s been a lot of press recently about shady data brokers selling information to Facebook. I would be genuinely surprised if those same data brokers don’t sell to google. (In addition to full time data brokerage firms, there are third party phone app api’s that slurp data and feed it to advertisers. Facebook has at least one. Presumably google does too...)
- tyingq 8y ago
  Google does buy data for sure. One example: https://www.bloomberg.com/news/articles/2018-08-30/google-and-mastercard-cut-a-secret-ad-deal-to-track-retail-sales https://www.bloomberg.com/news/articles/2018-08-30/google-an...

3pt14159 8y ago

There is a way to stop fingerprinting. That way is serving pages via distributed network (over a WoT or torrent-like thing). All these other ways do is give people the illusion that they're safe from being tracked, when the reality is that they're tracked just the same, but by fewer people so the data is more valuable. This means that the money is centralizing around the actors with the most inexplicable methods of tracking; which are almost always the worst actors. I hate it too, even though I'm not blameless. It's impossible to compete without a level playing field, and that playing field needs to be technically enforced, because otherwise we get region shopping and advertising / analytics models that push people to create intractable mechanisms so they can paper over how tracking fed into it. For example, imagine a world where I'm bidding to show an ad to a visitor of nytimes.com. Now, I may not track the user, but if anyone is, they can incorporate what they know and sell that traffic back to me on a CPA model. All I see is the incoming traffic. I don't track anyone (wink, wink) but there is no difference. In the long run this will either be solved one way or another, and all these online surveillance capitalism companies will crash and burn. Either we get a web with technical guarantees or we get a balkanized internet where every state makes their own weird laws about what is allowed or not.

newscracker 8y ago
> In the long run this will either be solved one way or another, and all these online surveillance capitalism companies will crash and burn. I sincerely hope that happens without causing more harm to people. It also seems to be a long way away.
- kabacha 8y ago
  https://en.wikipedia.org/wiki/Accelerationism https://en.wikipedia.org/wiki/Accelerationism
scottlocklin 8y ago
I'm pretty sure sticking it on a distributed network is potentially much worse unless it is specifically designed to prevent tracking.
8y ago

Jonnax 8y ago

Here's a good comparison: Android Chrome's user agent: Mozilla/5.0 (Linux; Android 6.0.1; SM-G928F Build/MMB29K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Mobile Safari/537.36 Versus Android Firefox's user agent: Mozilla/5.0 (Android 9; Mobile; rv:66.0) Gecko/66.0 Firefox/66.0 Note how the Chrome browser announces your phone model and software build version to the world. With regional models with carrier customised software builds, simply the user agent can be used to fingerprint a user.

homero 8y ago
Yup it's disgusting. Even in private mode sites know it's me with my build version and ip.
- tsukurimashou 8y ago
  To be honest most people are confused about "private mode", I agree there should be privacy options enabled by default with it, but the reality is pretty much "no browser history will be stored (locally) and your session / cookies will be isolated between private mode and "normal mode"
  - homero 8y ago
    I don't expect serial numbers to be sent even in public mode. Android build plus ip might as well be a serial number.
  - SmellyGeekBoy 8y ago
    Indeed. It's intended as a method of watching porn without having it pop up in the address autocomplete later when your kids are trying to go to the Peppa Pig website.
- TheKarateKid 8y ago
  Google still knows my precise location sometimes even when I'm connected to a VPN. The browser itself uses more (Wifi network, phones linked to your account) than just your IP to determine it, and there's no way to control it.

deleted 8y ago

[deleted]

dwd 8y ago

Firefox is a good start, then it's also worth checking your browser with the EFF Panopticlick to see how your settings affect your uniqueness. https://panopticlick.eff.org https://panopticlick.eff.org