7 ms·

> And the results were made in incognito mode so Google wasn't able to cheat with privileged information about me as a user. that's not what Incognito mode doe

> And the results were made in incognito mode so Google wasn't able to cheat with privileged information about me as a user. that's not what Incognito mode does. It prevents your search from being included in the browsing history and doesn't send cookies from active sessions, but that's about it. Google still knows this is you being unauthenticated. You don't need to be logged into google to be reliably targeted with ads that fit your profile.

jefftk 7y ago
Why do you think Google Search still knows who you are when you search in Incognito mode? (Or, in Firefox, if you open a private browsing window.) How would it know? There are advertising companies that use fingerprinting for ad targeting, but Google doesn't. (Disclosure: I work at Google on ads, speaking only for myself)
- Terretta 7y ago
  How does it know to offer (in incognito mode) a list of your accounts you might want to re-login to? (Not always, but often enough to raise an eyebrow.) Seems like a pretty good reason to think it still knows who you are. As to how that works, you tell us.
  - jefftk 7y ago
    Are you talking about the browser's autocomplete? That's not something servers can detect unless you interact with it. Or do you mean something else?
    - hiccuphippo 7y ago
      No. On login Google shows you your email address so you can click on it and only fill the password. Which means it knows you were logged in on that browser previously.
      - leni536 7y ago
        It knows that one from cookies, not applicable to incognito mode. Google probably does some other fingerprinting as well though.
      - jefftk 7y ago
        That shouldn't be possible in private browsing, unless you've previously logged into Google in that same private session. One way you could see something similar to this would be if you opened a clean session, logged into Google, logged out of Google, thought you closed the last incognito window but didn't, and then opened a new incognito window? Then the user cookie would still be in client-side storage
  - sgt101 7y ago
    Are you using random Mac addresses?
    - jefftk 7y ago
      The MAC address is not sent to the server, or accessible to web pages client-side, so that wouldn't matter.
      - tcd 7y ago
        It is if you're using Chrome or got any Google related properties installed on your PC.
        jefftk 7y ago
        I don't think this happens. How do you think it's being transferred? A header sent only on requests to Google properties? A special JS API in Chrome that only Google knows to call?
      - dreamcompiler 7y ago
        In theory. But it's not impossible for a nefarious browser to send it along as an HTTP header. Or a nefarious AP: https://news.ycombinator.com/item?id=21463266 https://news.ycombinator.com/item?id=21463266
        jefftk 7y ago
        Your link describes the Milan airport captive portal putting the MAC in the URL (don't do this). The referrer is automatically attached to any requests the page makes. This is a comically broken configuration, not something at all common.
      - sgt101 7y ago
        I realize that the last time I liked at this was in the context of wireless devices on a private subnet - which is why I thought it might be relevant. However I am curious, why is it, then, that Windows 10 has gone for randomisation?
  - JaRail 7y ago
    Chrome is linked to your google accounts and saves your account auth tokens. When you use incognito, it doesn't immediately send that info. However, it does offer to sign you in. This is different from remembering login/passwords.
- bogwog 7y ago
  So you're confirming that Google tracks you without using fingerprinting methods? That's not really surprising considering how much they data have on people. It's also a good example of their monopoly position; Android, Chrome, Chrome OS, advertising and analytics code on almost every website, ownership of multiple of the most popular websites and services on the internet puts them in a unique position that no one could ever hope to compete with realistically. Competitors have to rely on imperfect fingerprinting whereas Google can probably detect you with more accuracy than a DNA test.
  - lucb1e 7y ago
    > So you're confirming that Google tracks you without using fingerprinting methods? That's literally the opposite of what s/he just said. The person you're responding asked "How would it know?", implying that they (while being on the Google ads team) think there is no way to know without fingerprinting (or cookies from non-incognito mode).
    - jefftk 7y ago
      Right: fingerprinting is the general term for using something other than client-side storage (cookies, local storage) to determine identity. Incognito mode and other private sessions intentionally don't preserve client-side storage.
      - saagarjha 7y ago
        There are other ways to fingerprint users, though if Google is using them they’re certainly not making it obvious by allowing users in incognito mode the ability to sign in to their associated account.
        jefftk 7y ago
        "fingerprinting" is a catch-all term, so I'm not sure what you're saying with "there are other ways to fingerprint users".
- wolco 7y ago
  google records: ip address, browser fingerprinting. Try visiting from tor
  - jefftk 7y ago
    For spam / bot / fraud detection, yes. For ad targeting, no.
    - Nextgrid 7y ago
      Source? It’s in their best interests to also use it for ad targeting (in a plausibly deniable way so they don’t get in trouble). We’ve seen them using dark patterns to coerce users into opting into more data collection, and another advertising company got caught using phone numbers for ad purposes even if they originally promised to only use them for 2FA, so why should we trust them this time?
      - jefftk 7y ago
        Source: I work on ads at Google, and if we were doing this I'm pretty sure I'd know. If it was being used for targeting it would be practical to run an external study demonstrating that.
        Nextgrid 7y ago
        Apologies but I can’t really trust someone who works at a company whose best interests are to violate people’s privacy, confirmed by all the dark patterns (both on the web and in Android) and their lack of GDPR compliance. I would be very curious as to how you’d prove this is or isn’t happening with a reasonable degree of accuracy considering all the factors involved in ad targeting. Unless you’re willing to give us access to all your source code and SSH access to the systems running it, it’s reasonable people have their doubts.
        jefftk 7y ago
        > considering all the factors involved in ad targeting An external study to evaluate whether Google is using fingerprinting would be some work, but pretty doable. Targeted advertising is generally very blunt: if someone thinks you're especially interested in a valuable category they'll often pay a lot to advertise to you. So you could set something up where test browsers visit pages related to high-value categories (mattresses, asbestos cancer, credit cards, ...), clear client-side data, and then visit a site that loads ad scripts only from Google (to make sure you're not getting someone else's fingerprinting) and see whether the ads differ from a control group that never visited those pages.
- greggman2 7y ago
  Was this proof that google ads uses fingerprinting? https://meta.stackexchange.com/questions/331960/why-is-stack-overflow-trying-to-start-audio https://meta.stackexchange.com/questions/331960/why-is-stack...
  - jefftk 7y ago
    Reading the link, it sounds like that's (a) fraud detection and not targeting and (b) a third party, IAS, that the advertiser is including in their ads
deleted 7y ago
[deleted]
Mikeb85 7y ago
Do you have any evidence of what you claim? Anyhow, based on what I've seen, when you go into incognito mode it definitely doesn't use your profile when you go to Google services. Search results, suggestions, etc... are different. In fact, one of the use cases for incognito is using a different Google profile on a someone else's or a public computer. Keeping contextual search results from the 'main' profile logged into the browser would be counterproductive...
hombre_fatal 7y ago
This comment and everything downstream from it are a distraction from their point: Run their query from your machine or from Tor and you'll see the same results in Google and lack of results in DDG. Another example is a query for "elm dict". DDG has little idea what you're looking for while Google links you directly to the docs of Elm's Dict data-structure.
- throwawaymath 7y ago
  Thanks for the "elm dict" example. That's a really good one which actually does highlight practical differences between Google and DDG when I just tried it myself. Most of the time I see comments like this, people don't provide hard examples of queries they found unsatisfying with one search engine compared to another.
- Const-me 7y ago
  > DDG has little idea what you're looking for while Google links you directly to the docs of Elm's Dict data-structure. You know you're looking for a data structure, right? Add structure to your query, and DDG will do fine. Easy fix. The opposite case, when google thinks he knows what you're asking but it's wrong, is impossible to fix. I don't want them to be smart, I want them to be predictable and search what I say, not trying to reinterpret the query.
- franga2000 7y ago
  See, my experience is quite the opposite when it comes to programming documentation. Whether it's StackOverflow or Django/Python docs, DDG seems to always get me there faster. I switch to Google for absurdly specific errors because it's database is simply bigger, but every time I have to spend a few minutes throwing quotation marks around parts of the query to get Google to actually find anything useful.
Akababa 7y ago
I get the same results with a VPN, so regardless of how you slice it they win on relevance.
BurningFrog 7y ago
For this query, Google was better at understanding the question. Knowing the user had nothing to do with it.

jefftk 7y ago

Why do you think Google Search still knows who you are when you search in Incognito mode? (Or, in Firefox, if you open a private browsing window.) How would it know? There are advertising companies that use fingerprinting for ad targeting, but Google doesn't. (Disclosure: I work at Google on ads, speaking only for myself)

Terretta 7y ago
How does it know to offer (in incognito mode) a list of your accounts you might want to re-login to? (Not always, but often enough to raise an eyebrow.) Seems like a pretty good reason to think it still knows who you are. As to how that works, you tell us.
- jefftk 7y ago
  Are you talking about the browser's autocomplete? That's not something servers can detect unless you interact with it. Or do you mean something else?
  - hiccuphippo 7y ago
    No. On login Google shows you your email address so you can click on it and only fill the password. Which means it knows you were logged in on that browser previously.
    - leni536 7y ago
      It knows that one from cookies, not applicable to incognito mode. Google probably does some other fingerprinting as well though.
    - jefftk 7y ago
      That shouldn't be possible in private browsing, unless you've previously logged into Google in that same private session. One way you could see something similar to this would be if you opened a clean session, logged into Google, logged out of Google, thought you closed the last incognito window but didn't, and then opened a new incognito window? Then the user cookie would still be in client-side storage
- sgt101 7y ago
  Are you using random Mac addresses?
  - jefftk 7y ago
    The MAC address is not sent to the server, or accessible to web pages client-side, so that wouldn't matter.
    - tcd 7y ago
      It is if you're using Chrome or got any Google related properties installed on your PC.
      - jefftk 7y ago
        I don't think this happens. How do you think it's being transferred? A header sent only on requests to Google properties? A special JS API in Chrome that only Google knows to call?
    - dreamcompiler 7y ago
      In theory. But it's not impossible for a nefarious browser to send it along as an HTTP header. Or a nefarious AP: https://news.ycombinator.com/item?id=21463266 https://news.ycombinator.com/item?id=21463266
      - jefftk 7y ago
        Your link describes the Milan airport captive portal putting the MAC in the URL (don't do this). The referrer is automatically attached to any requests the page makes. This is a comically broken configuration, not something at all common.
    - sgt101 7y ago
      I realize that the last time I liked at this was in the context of wireless devices on a private subnet - which is why I thought it might be relevant. However I am curious, why is it, then, that Windows 10 has gone for randomisation?
- JaRail 7y ago
  Chrome is linked to your google accounts and saves your account auth tokens. When you use incognito, it doesn't immediately send that info. However, it does offer to sign you in. This is different from remembering login/passwords.
bogwog 7y ago
So you're confirming that Google tracks you without using fingerprinting methods? That's not really surprising considering how much they data have on people. It's also a good example of their monopoly position; Android, Chrome, Chrome OS, advertising and analytics code on almost every website, ownership of multiple of the most popular websites and services on the internet puts them in a unique position that no one could ever hope to compete with realistically. Competitors have to rely on imperfect fingerprinting whereas Google can probably detect you with more accuracy than a DNA test.
- lucb1e 7y ago
  > So you're confirming that Google tracks you without using fingerprinting methods? That's literally the opposite of what s/he just said. The person you're responding asked "How would it know?", implying that they (while being on the Google ads team) think there is no way to know without fingerprinting (or cookies from non-incognito mode).
  - jefftk 7y ago
    Right: fingerprinting is the general term for using something other than client-side storage (cookies, local storage) to determine identity. Incognito mode and other private sessions intentionally don't preserve client-side storage.
    - saagarjha 7y ago
      There are other ways to fingerprint users, though if Google is using them they’re certainly not making it obvious by allowing users in incognito mode the ability to sign in to their associated account.
      - jefftk 7y ago
        "fingerprinting" is a catch-all term, so I'm not sure what you're saying with "there are other ways to fingerprint users".
wolco 7y ago
google records: ip address, browser fingerprinting. Try visiting from tor
- jefftk 7y ago
  For spam / bot / fraud detection, yes. For ad targeting, no.
  - Nextgrid 7y ago
    Source? It’s in their best interests to also use it for ad targeting (in a plausibly deniable way so they don’t get in trouble). We’ve seen them using dark patterns to coerce users into opting into more data collection, and another advertising company got caught using phone numbers for ad purposes even if they originally promised to only use them for 2FA, so why should we trust them this time?
    - jefftk 7y ago
      Source: I work on ads at Google, and if we were doing this I'm pretty sure I'd know. If it was being used for targeting it would be practical to run an external study demonstrating that.
      - Nextgrid 7y ago
        Apologies but I can’t really trust someone who works at a company whose best interests are to violate people’s privacy, confirmed by all the dark patterns (both on the web and in Android) and their lack of GDPR compliance. I would be very curious as to how you’d prove this is or isn’t happening with a reasonable degree of accuracy considering all the factors involved in ad targeting. Unless you’re willing to give us access to all your source code and SSH access to the systems running it, it’s reasonable people have their doubts.
        jefftk 7y ago
        > considering all the factors involved in ad targeting An external study to evaluate whether Google is using fingerprinting would be some work, but pretty doable. Targeted advertising is generally very blunt: if someone thinks you're especially interested in a valuable category they'll often pay a lot to advertise to you. So you could set something up where test browsers visit pages related to high-value categories (mattresses, asbestos cancer, credit cards, ...), clear client-side data, and then visit a site that loads ad scripts only from Google (to make sure you're not getting someone else's fingerprinting) and see whether the ads differ from a control group that never visited those pages.
greggman2 7y ago
Was this proof that google ads uses fingerprinting? https://meta.stackexchange.com/questions/331960/why-is-stack-overflow-trying-to-start-audio https://meta.stackexchange.com/questions/331960/why-is-stack...
- jefftk 7y ago
  Reading the link, it sounds like that's (a) fraud detection and not targeting and (b) a third party, IAS, that the advertiser is including in their ads

deleted 7y ago

[deleted]

Mikeb85 7y ago

Do you have any evidence of what you claim? Anyhow, based on what I've seen, when you go into incognito mode it definitely doesn't use your profile when you go to Google services. Search results, suggestions, etc... are different. In fact, one of the use cases for incognito is using a different Google profile on a someone else's or a public computer. Keeping contextual search results from the 'main' profile logged into the browser would be counterproductive...

hombre_fatal 7y ago

This comment and everything downstream from it are a distraction from their point: Run their query from your machine or from Tor and you'll see the same results in Google and lack of results in DDG. Another example is a query for "elm dict". DDG has little idea what you're looking for while Google links you directly to the docs of Elm's Dict data-structure.

throwawaymath 7y ago
Thanks for the "elm dict" example. That's a really good one which actually does highlight practical differences between Google and DDG when I just tried it myself. Most of the time I see comments like this, people don't provide hard examples of queries they found unsatisfying with one search engine compared to another.
Const-me 7y ago
> DDG has little idea what you're looking for while Google links you directly to the docs of Elm's Dict data-structure. You know you're looking for a data structure, right? Add structure to your query, and DDG will do fine. Easy fix. The opposite case, when google thinks he knows what you're asking but it's wrong, is impossible to fix. I don't want them to be smart, I want them to be predictable and search what I say, not trying to reinterpret the query.
franga2000 7y ago
See, my experience is quite the opposite when it comes to programming documentation. Whether it's StackOverflow or Django/Python docs, DDG seems to always get me there faster. I switch to Google for absurdly specific errors because it's database is simply bigger, but every time I have to spend a few minutes throwing quotation marks around parts of the query to get Google to actually find anything useful.

Akababa 7y ago

I get the same results with a VPN, so regardless of how you slice it they win on relevance.

BurningFrog 7y ago

For this query, Google was better at understanding the question. Knowing the user had nothing to do with it.