5 ms·

Chromium reads it, but are we sure it's sending it somewhere? Maybe it uses it for bookkeeping of local sessions or something like that.

by ez7r6i 8y ago

koolba 8y ago
I checked the Chromium source and for Linux they explicitly mention not being allowed to send it externally[0]; they hash it via SHA1, encode it as base64, and use that value. Interestingly for Windows they pull the machine id from the registry[1] and (at first glance) it doesn't seem like they're doing any hashing. The raw value gets used. Haven't checked if the value gets sent externally but based upon the comment on the Linux code I'd bet it's a yes. [0]: https://github.com/chromium/chromium/blob/aae20fb7d3616de40e2af077bb02aaecb2b13d7f/chrome/browser/policy/browser_dm_token_storage_linux.cc#L89-L111 https://github.com/chromium/chromium/blob/aae20fb7d3616de40e... [1]: https://github.com/chromium/chromium/blob/01a03aab2d89c93c157c9af52dca7ac20d8ed96b/chrome/browser/policy/browser_dm_token_storage_win.cc#L129-L148 https://github.com/chromium/chromium/blob/01a03aab2d89c93c15...
- jolmg 8y ago
  > I checked the Chromium source and for Linux they explicitly mention not being allowed to send it externally[0]; they hash it via SHA1, encode it as base64, and use that value. /etc/machine-id seems to be a random value. What purpose does hashing it before sending it do? The hash should still uniquely identify a machine. Am I missing something? Kind of makes me think that it's just done so people say "it's ok, because they're hashing it first, so it's secure!", while in reality hashing doesn't do anything to alleviate any concern.
  - MaulingMonkey 8y ago
    > Am I missing something? The source code links https://www.freedesktop.org/software/systemd/man/machine-id.html https://www.freedesktop.org/software/systemd/man/machine-id.... mentions hashing using an "application-specific key", which would at least make it not correlatable between different apps (so $WEBSITE can't correlate machine IDs with $WELL_BEHAVED_APP 's machine IDs.) But either I'm missing something, or Chromium is - it looks like it's straight up hashing the file and not actually using any application-specific keys!
- JohnFen 8y ago
  > they explicitly mention not being allowed to send it externally[0]; they hash it via SHA1, encode it as base64, and use that value. If it's sending that value out, then there is no logical difference between that and just sending out the machine-id in the first place.
floatingatoll 8y ago
/etc/machine-id reading was implemented in service of the Chromium "Enterprise" component: https://bugs.chromium.org/p/chromium/issues/detail?id=812641 https://bugs.chromium.org/p/chromium/issues/detail?id=812641 Comment 26 implements Linux support for reading the machine's unique identifier: https://chromium.googlesource.com/chromium/src.git/+/15dc90abe15779ca95102f3624dd71c7acef7aef https://chromium.googlesource.com/chromium/src.git/+/15dc90a... That patch is Linux-only support in service of the greater patch: https://chromium.googlesource.com/chromium/src.git/+/81a704029695ece3d4793433b453f42c4820ca79%5E%21/ https://chromium.googlesource.com/chromium/src.git/+/81a7040... And having read several rounds of "Device enrollment" phrases now, while the design document is non-public, I would hazard a guess that this is the essential components of enterprise device management. Google hashes the ID before making use of it, so the actual ID remains disguised, but this absolutely would be necessary if they were trying to implement ChromeOS enterprise device management. (You need a unique identifier per enterprise machine, etc.) Presumably they only care about this id file with respect to enterprise ChromeOS installations, since they make no effort at all to locate the file in any other location than the one. It looks more like they simply don't care about reading the file in non-enterprise circumstances, since either the machine is enterprise-managed or it isn't, and as they only transmit hashes of the ID rather than the ID itself, they're in compliance with the FreeDesktop guidelines that require this file to be present: https://www.freedesktop.org/software/systemd/man/machine-id.html https://www.freedesktop.org/software/systemd/man/machine-id....
JdeBP 8y ago
See http://jdebp.uk./Softwares/nosh/guide/commands/machine-id.xml#USERS http://jdebp.uk./Softwares/nosh/guide/commands/machine-id.xm...

Chromium reads it, but are we sure it's sending it somewhere? Maybe it uses it for bookkeeping of local sessions or something like that.

by ez7r6i 8y ago

Chromium reads it, but are we sure it's sending it somewhere? Maybe it uses it for bookkeeping of local sessions or something like that.

koolba 8y ago

I checked the Chromium source and for Linux they explicitly mention not being allowed to send it externally[0]; they hash it via SHA1, encode it as base64, and use that value. Interestingly for Windows they pull the machine id from the registry[1] and (at first glance) it doesn't seem like they're doing any hashing. The raw value gets used. Haven't checked if the value gets sent externally but based upon the comment on the Linux code I'd bet it's a yes. [0]: https://github.com/chromium/chromium/blob/aae20fb7d3616de40e2af077bb02aaecb2b13d7f/chrome/browser/policy/browser_dm_token_storage_linux.cc#L89-L111 https://github.com/chromium/chromium/blob/aae20fb7d3616de40e... [1]: https://github.com/chromium/chromium/blob/01a03aab2d89c93c157c9af52dca7ac20d8ed96b/chrome/browser/policy/browser_dm_token_storage_win.cc#L129-L148 https://github.com/chromium/chromium/blob/01a03aab2d89c93c15...

jolmg 8y ago
> I checked the Chromium source and for Linux they explicitly mention not being allowed to send it externally[0]; they hash it via SHA1, encode it as base64, and use that value. /etc/machine-id seems to be a random value. What purpose does hashing it before sending it do? The hash should still uniquely identify a machine. Am I missing something? Kind of makes me think that it's just done so people say "it's ok, because they're hashing it first, so it's secure!", while in reality hashing doesn't do anything to alleviate any concern.
- MaulingMonkey 8y ago
  > Am I missing something? The source code links https://www.freedesktop.org/software/systemd/man/machine-id.html https://www.freedesktop.org/software/systemd/man/machine-id.... mentions hashing using an "application-specific key", which would at least make it not correlatable between different apps (so $WEBSITE can't correlate machine IDs with $WELL_BEHAVED_APP 's machine IDs.) But either I'm missing something, or Chromium is - it looks like it's straight up hashing the file and not actually using any application-specific keys!
JohnFen 8y ago
> they explicitly mention not being allowed to send it externally[0]; they hash it via SHA1, encode it as base64, and use that value. If it's sending that value out, then there is no logical difference between that and just sending out the machine-id in the first place.

floatingatoll 8y ago

/etc/machine-id reading was implemented in service of the Chromium "Enterprise" component: https://bugs.chromium.org/p/chromium/issues/detail?id=812641 https://bugs.chromium.org/p/chromium/issues/detail?id=812641 Comment 26 implements Linux support for reading the machine's unique identifier: https://chromium.googlesource.com/chromium/src.git/+/15dc90abe15779ca95102f3624dd71c7acef7aef https://chromium.googlesource.com/chromium/src.git/+/15dc90a... That patch is Linux-only support in service of the greater patch: https://chromium.googlesource.com/chromium/src.git/+/81a704029695ece3d4793433b453f42c4820ca79%5E%21/ https://chromium.googlesource.com/chromium/src.git/+/81a7040... And having read several rounds of "Device enrollment" phrases now, while the design document is non-public, I would hazard a guess that this is the essential components of enterprise device management. Google hashes the ID before making use of it, so the actual ID remains disguised, but this absolutely would be necessary if they were trying to implement ChromeOS enterprise device management. (You need a unique identifier per enterprise machine, etc.) Presumably they only care about this id file with respect to enterprise ChromeOS installations, since they make no effort at all to locate the file in any other location than the one. It looks more like they simply don't care about reading the file in non-enterprise circumstances, since either the machine is enterprise-managed or it isn't, and as they only transmit hashes of the ID rather than the ID itself, they're in compliance with the FreeDesktop guidelines that require this file to be present: https://www.freedesktop.org/software/systemd/man/machine-id.html https://www.freedesktop.org/software/systemd/man/machine-id....

JdeBP 8y ago

See http://jdebp.uk./Softwares/nosh/guide/commands/machine-id.xml#USERS http://jdebp.uk./Softwares/nosh/guide/commands/machine-id.xm...