35 ms·

Google tracks individual users per Chrome installation ID

2292 points by rvnx 7y ago

swiley 7y ago
Google consumer software is almost universally an active full frontal attack on you. Stop using it.
- a_wild_dandan 7y ago
  This sounded harder to do than it was in my experience. I figured the alternatives to their products would be less polished. But I switched to Firefox and honestly prefer it to Chrome. (They allow extensions on Android, meaning adblock, which is a game changer for me.) DDG for search is great. Protonmail for email is fine, etc. There isn't much in the Google ecosystem that I miss tbh.
  - acollins1331 7y ago
    The only thing I have problems finding something that works is Google maps. As an Android user there are a few different options but Google did make a damn good maps app.
  - Scarbutt 7y ago
    For me is google docs and maps.
    - dleslie 7y ago
      If you need online office and maps then there's Microsoft Office and Bing Maps. Office is an excellent product, well worth the few bucks a month. AFAIK, Office is fairly good about privacy.
pier25 7y ago
Chromium too?
- macinjosh 7y ago
  Doesn't look like it from my testing of version 81.0.4036.0. But in normal Chrome I do see it.
  - olah_1 7y ago
    Can you test it in Microsoft's new Edge browser based on Chromium? I'm very curious about that. (I don't know how to test such a thing myself, sorry :S)
    - ryneandal 7y ago
      I didn't see the x-client-header in the Edge insider browser when accessing YouTube.
      - pier25 7y ago
        I don't see it in Brave either
- Cthulhu_ 7y ago
  As another commenter pointed out, the list of domains the header is sent to is part of the Chromium codebase: https://chromium.googlesource.com/chromium/src/+/master/components/variations/net/variations_http_headers_unittest.cc https://chromium.googlesource.com/chromium/src/+/master/comp...
  - gempir 7y ago
    this is just a test case. It could very well be a much bigger list.
    - gruez 7y ago
      Actual list: https://cs.chromium.org/chromium/src/components/google/core/common/google_util.cc?q=IsGoogleAssociatedDomainUrl https://cs.chromium.org/chromium/src/components/google/core/... via: https://news.ycombinator.com/item?id=22237768 https://news.ycombinator.com/item?id=22237768
janpot 7y ago
Not endorsing this, but according to https://www.google.com/chrome/privacy/whitepaper.html#variations https://www.google.com/chrome/privacy/whitepaper.html#variat... > We want to build features that users want, so a subset of users may get a sneak peek at new functionality being tested before it’s launched to the world at large. A list of field trials that are currently active on your installation of Chrome will be included in all requests sent to Google. This Chrome-Variations header (X-Client-Data) will not contain any personally identifiable information, and will only describe the state of the installation of Chrome itself, including active variations, as well as server-side experiments that may affect the installation. > The variations active for a given installation are determined by a seed number which is randomly selected on first run. If usage statistics and crash reports are disabled, this number is chosen between 0 and 7999 (13 bits of entropy). If you would like to reset your variations seed, run Chrome with the command line flag “--reset-variation-state”. Experiments may be further limited by country (determined by your IP address), operating system, Chrome version and other parameters.
- rvnx 7y ago
  They key in the wording is: "If usage statistics and crash reports are disabled, this number is chosen between 0 and 7999 (13 bits of entropy)." "If, statistics are disabled." In chrome://version you can see the active variations. It seems to be pretty big numbers to be significant, and so far haven't observed duplicates. Since this header is generated server-side, you have only to believe I guess ? Plus why Doubleclick would need it :)
  - userbinator 7y ago
    That's basically saying "even if you opt out, we'll still try to track you, just not as much." Very unpleasant, but then again I'm not surprised to see this attitude from Google.
    - m463 7y ago
      Combine a few pieces of information like this and you get a decisively unique fingerprint. For example identifying individuals at work behind the same ip address.
Tepix 7y ago
According to https://www.google.com/chrome/privacy/whitepaper.html https://www.google.com/chrome/privacy/whitepaper.html "We want to build features that users want, so a subset of users may get a sneak peek at new functionality being tested before it’s launched to the world at large. A list of field trials that are currently active on your installation of Chrome will be included in all requests sent to Google. This Chrome-Variations header (X-Client-Data) will not contain any personally identifiable information, and will only describe the state of the installation of Chrome itself, including active variations, as well as server-side experiments that may affect the installation." While this header may not contain personally identifiable information, its presence will make every request by this user far more unique and thus easier to track. I do not see Google saying they won't use it to improve their tracking of people.
- goatinaboat 7y ago
  One click while logged into any Google property will be enough for them to permanently associate this GUID with your (shadow) account, they know it, and they know you know it too
cs702 7y ago
Doubtlessly, this will be rationalized and justified as being necessary for, and in the best interest of, consumers... ...but inevitably, it will be used for tracking -- regardless of intent. It might also get Google in trouble. Copying and pasting from the a comment in the OP's URL: > Example: https://www.youtube.com https://www.youtube.com - in network headers, look for x-client-data > Now, go to https://ad.doubleclick.net/abc https://ad.doubleclick.net/abc - and your browser also sends this magic x-client-data. > It's a unique ID to track a specific Chrome instance across all Google properties. > Really curious about your opinion, especially after the GDPR explicitly forbidding such tracking. Moreover, it doesn't make sense to anonymise user-agent if you have such backdoor.
- floatingatoll 7y ago
  This comment is unreadable on mobile. https://i.imgur.com/jFusqw0.png https://i.imgur.com/jFusqw0.png Could you please remove the four-space indent? You can wrap each paragraph in * ... * if you want to italic them.
  - cs702 7y ago
    Fixed. Sorry about that. Thank you for letting me know!
    - floatingatoll 7y ago
      No worries :)
  - metahost 7y ago
    You may give https://hackerweb.app https://hackerweb.app a try! Aside: It is read only though.
    - floatingatoll 7y ago
      I don’t appreciate your link to a third-party reader here, because you’re implying that the contradiction of HN’s style guidelines (code formatting is for code) is somehow made acceptable by the existence of an app that reformats it for only a few readers. If I switch to an app rather than ask the person to stop, the other HN mobile users who use a browser rather than app will continue to suffer. ”Use an app” is not an acceptable choice.
dathinab 7y ago
>It's a unique ID to track a specific Chrome instance across all Google properties. >Really curious about your opinion, especially after the GDPR explicitly forbidding such tracking. >Moreover, it doesn't make sense to anonymise user-agent if you have such backdoor Oh, but it does make sense because with this everyone _but_ google will have a harder time tracking people :\
_pmf_ 7y ago
Just ask: why does an advertising company make a browser?
- macinjosh 7y ago
  Not sure why this is being downvoted. It hits the nail on the head. If you are concerned about privacy around advertising then using a browser from the biggest online ad company is short sighted.
- Keloo 7y ago
  so that you don't have to pay royalties to other browsers for being the main search engine. I mean you have to pay one less. And if you have the most used browser, you save a lot.
  - josefx 7y ago
    In the good old days everyone and their grandmother just sideloaded their malware toolbars with freeware crap like picasa or maps or outright bundled their bloatware with the system like Google still does for Android.
- eternalban 7y ago
  Google is a total-spectrum surveillance company. Advertising is a product they offer to their clients. (No, that is not you and me.)
- Cthulhu_ 7y ago
  When Chrome was first developed, browsers and the web were relatively slow, and slowing down due to the popularization of Javascript and heavier websites. Google's worked on a number of technologies to make the web faster; Chrome (and V8), their own DNS, image and video compression technologies, AMP, HTTP/2 (SPDY), HTTP/3 (QUIC), webserver plugins (mod_pagespeed), benchmark tooling (Lighthouse), and extensive guides on website speed optimization. The reason is simple; faster internet = faster browsing = more page views = more ad impressions + more behaviour tracking data points. And it's a win-win for Google as well, because it earns them goodwill (well, except for AMP); especially at the time Chrome was a breath of fresh air compared to Firefox, and it's taken a lot of time and effort just to keep up, with mixed results (to the point where a number of manufacturers have just given up and adopted Chrome's renderer).
TheRealPomax 7y ago
So, an extremely unique identifier for tracking purposes, that effectively no one knows exists, and no one knows can be changed at all? With an obscure white paper that allows Google to claim they comply with the law because "they totally offer a way to change that and they even published that information to the web for anyone to find"? Gotcha.
- x0x0 7y ago
  Are you talking about the same thing? Because the identifier above is claimed to have 13b of entropy. Is there another high entropy identifier?
  - rvnx 7y ago
    13b, if usage statistics are disabled (not the default). Otherwise, unspecified amount of entropy.
    - x0x0 7y ago
      thanks. and ugh.
      - rvnx 7y ago
        Just referred as High Entropy: https://cs.chromium.org/chromium/src/components/metrics/entropy_state.cc?type=cs&sq=package:chromium&g=0&l=58 https://cs.chromium.org/chromium/src/components/metrics/entr...
    - asvitkine 7y ago
      Actually, the low entropy provider is used for any field trials that get included in the header. See: https://cs.chromium.org/chromium/src/components/variations/variations_seed_processor.cc?rcl=ddac4c3cc1528254008f9e7a2aea5d4426906bfd&l=258 https://cs.chromium.org/chromium/src/components/variations/v...
  - clarry 7y ago
    13b plus IP is already huge, but browsers leak so much more than that.
dragonsh 7y ago
This is another instance that google doesn’t care about users privacy and track without their consent by using chrome installation Id. This probably might be against GDPR, so Chrome installed base in Europe multiplied by per day fine, hopefully runs into a years revenue of google. Another lesson don’t trust for profit companies with privacy protection especially advertising technology company like google with motto like don’t be evil or organize world’s information designed to mislead.
- mateo1 7y ago
  Honestly, it's 2020, even if your technical understanding is so low that you have no idea what a "browser" is, you know that Google will do anything in it's impressive power to track down everything you do with legal or illegal means. Thanks to Snowden, this is no longer a conspiracy theory. It's a fact. Google should be fined for this but they probably won't be.
gunn 7y ago
To give them some credit: it's not sent when in incognito mode.
- macinjosh 7y ago
  How thoughtful of them!
DangerousPie 7y ago
If you haven't used Firefox in a while you should really give it another chance. It has vastly improved in terms of CPU and battery usage. It also has a lot of great privacy-enhancing features like tracking protection enabled by default and extensions like Facebook Container make it trivial to prevent tracking even further.
- deleted 7y ago
  [deleted]
- tapoxi 7y ago
  Or just use Ungoogled Chromium, and get the performance advantage of Chrome without the tracking.
  - Diederich 7y ago
    Is there a quick summary of what major site/features that will be unavailable in Chromium vs. Chrome? I assume, for example, that 'netflix' will be prominently on that list. Thanks.
    - deathanatos 7y ago
      I use Chromium; you can still Netflix. It does, however, require installation of "WideVine", which is an opaque, closed, binary blob. (But you're getting that with Chrome, too, I believe.) You can also do Netflix in Firefox, through exactly the same mechanism.
      - gruez 7y ago
        >You can also do Netflix in Firefox, through exactly the same mechanism. It's somewhat better on Firefox because they run the binary blobs in a sandbox.
  - DangerousPie 7y ago
    Is there actually still a performance advantage these days? Would be curious to see some benchmarks. I will say that Gmail/Hangouts feels faster in Chrome but that's obviously not a fair comparison.
kick 7y ago
"Backdoor" this, "backdoor" that. Proprietary software company releases proprietary software that allows them to spy on you, how shocking. In which they sacrifice privacy to allow their ad network to target you better. https://www.blog.google/products/chrome/building-a-more-private-web/ https://www.blog.google/products/chrome/building-a-more-priv... In which they explicitly track you more under the guise of protecting your privacy. https://github.com/jkarlin/floc https://github.com/jkarlin/floc For every single claim Google makes about being pro-privacy, their definition of privacy ("data shared between you and Google and no one more") is implicit. It's a surveillance company that makes proprietary software to sell you ads. As soon as you get that into your head, you'll be much less shocked. "We personally get to track you" is not a unique stance, and it's far from a backdoor. It's just another vile move from a surveillance company that's pretty explicit that that's their goal.
- JadeNB 7y ago
  Sure, the general pattern of behaviour is familiar, but I didn't know about this specific manifestation, and now I do. What's the use of being so dismissive about specific information on which one can act?
  - kick 7y ago
    It's not a backdoor! Calling random anti-consumer behavior a backdoor is the privacy-equivalent of Godwin's law.
bamboozled 7y ago
You should also donate to Mozilla because it’s an insanely good piece o software for the price!
- dgudkov 7y ago
  Mozilla Corporation which makes the browser doesn't accept donations.
  - throwawa66 7y ago
    Do you know why that is?
    - tsukurimashou 7y ago
      because otherwise users would have a saying in the direction web browsers evolve and Google would be sad Half kidding there
      - throwawa66 7y ago
        So they’re accepting donations after all?
    - maeln 7y ago
      Mozilla Corporation is a for-profit company. Depending on the legislation it is sometimes forbidden to take donation, or at least very difficult/limited for company. Mozilla Foundation is the non-profit organization (and they do take donation).
      - Mountain_Skies 7y ago
        They probably can take donations just fine but there is no tax deduction for the donor.
        throwawa66 7y ago
eitland 7y ago
I haven't read this carefully enough to decide exactly how bad it is, but one thing seems clear to me: From what I see many techies are now aware and upset, and hardly anyone seems to want to defend Google anymore. I consider it more likely than not that Google will take some real beatings in the years to come. Kind of like Microsoft was fined by the US and EU, forced to advertise for competing browsers and ridiculed by Apple ads. On a case by case basis I think some of this will be well deserved, some less so, but few outside of employees and shareholders will cry. I also guess a lot of people, including certain owners and many in management hasn't deciphered the writing on the wall yet, and in that case it whatever comes next will be surprising.
- throwawa66 7y ago
  More and more people are blocking ads. Google’s business model is under threat. They will turn into hyenas in order to survive.
  - eitland 7y ago
    Good point. Although I feel their hyena nature has been visible for a while now and what we are now seeing is hungry hyena :-)
    - throwawa66 7y ago
      Oh it will get worse. Youtube will be riddled with ads every 5 minutes or so. Will take the cable tv path soon. The good news is that their greed will eventually crash themselves. Hey, i dont mind a little ad here and there even though I give 0 fucks about any product being advertised. But the quantity is becoming hard to process without adblockers. Had they not taken the full evil mode path I’d have considered paying for youtube. I think im better of weaning myself off almost completely. Or alternatives...
  - kmlx 7y ago
    i think their business model is just fine: https://www.google.co.uk/amp/s/9to5google.com/2020/02/03/alphabet-q4-2019-earnings/amp/ https://www.google.co.uk/amp/s/9to5google.com/2020/02/03/alp...
ec109685 7y ago
You can see all the domains they add the header to here: https://chromium.googlesource.com/chromium/src/+/master/components/variations/net/variations_http_headers_unittest.cc https://chromium.googlesource.com/chromium/src/+/master/comp... Previous discussion: https://news.ycombinator.com/item?id=21034849 https://news.ycombinator.com/item?id=21034849
- tbodt 7y ago
  Actual list: https://cs.chromium.org/chromium/src/components/google/core/common/google_util.cc?q=IsGoogleAssociatedDomainUrl https://cs.chromium.org/chromium/src/components/google/core/...
  - chatmasta 7y ago
    This seems like a cut-and-dry case of getting caught in monopolistic behavior. The code is right there. The Chrome codebase has special features for Google’s own web properties. I hope all these AGs suing google have some good tech advisors. It’s hard to keep track of all the nefarious things google has been up to over the past decade.
    - c0restraint 7y ago
      Perhaps you can send a summary to them, including the evidence?
    - akersten 7y ago
      > This seems like a cut-and-dry case of getting caught in monopolistic behavior. The code is right there. ??? Is "Darn, their browser only gets to track me on their own websites; if Google were playing fairly, they'd send the tracking header to all websites so I can be tracked more and have less privacy" the argument you're making here? And it's debatable that this header is actually serving a tracking purpose at all. Being limited to their own web properties cements it as a diagnostic to me. What use is a tracking header that only gets sent to domains they already know you're visiting?
owaislone 7y ago
I visited my family a couple of weeks ago and was shocked when my father told me that his phone 'received' some of our photos. I checked and a huge chunk of whatsapp photos that were backed up by my wife's phone had ended up in my dad's Google Photos account. I discounted it as my wife accidentally sharing the whatsapp folder with my dad but now I'm not so sure.
- Cthulhu_ 7y ago
  Yup, that's one of the issues you'll get with interlinked accounts; in this case, Whatsapp backs up / stores photos automatically to your phone's photo gallery, and said photo gallery is automatically synchronized with the cloud. I don't know exactly what's going on with your wife's / your father-in-law's accounts though, are they sharing Google accounts, photo albums, or were the photos shared in the same whatsapp group?
  - owaislone 7y ago
    > are they sharing Google accounts, photo albums, or were the photos shared in the same whatsapp group? None of these. They don't share any accounts. I don't share any account with my father either. Me and my wife use the shared galley feature. The photos that ended up on my fathers phone were shared by me and my wife with each other on whatsapp. I suspect either mine or my wife's gallery somehow "leaked" into my fathers even though none of the accounts have any connections AFAICT. Probably we clicked some share button somewhere accidentally but I couldn't find any shared galleries on any of our phones.
marriedWpt 7y ago
Ahh the good ol HN "stop using Google and start using Firefox" advertisement. It's a bit odd to see this in every Google thread. Btw, Firefox is too slow.
- fortran77 7y ago
  It's not odd at all. It's what the folks at Mozilla do. They jump in to every thread to push Firefox and Rust and make people think it's more widely used/better than it is.
  - falcolas 7y ago
    Not everything is a conspiracy. I'm not a Mozilla employee, have never been one (probably never will be one). Firefox is awesome, fast, and extensible. It's my daily driver for all of my machines.
    - SamPatt 7y ago
      Same. It works great and uses less RAM than Chrome.
    - bonestamp2 7y ago
      Side question: I've been trying to switch to firefox as my main browser but one thing is holding me up. When I'm using a private window, cookies are not shared between private tabs. I can see the advantage to that behavior, but is there a way to share them so that I can be logged into the same site in multiple private tabs? Unironically, I haven't had any luck googling this problem.
      - falcolas 7y ago
        If you open a new tab from an existing tab, your session persists across tabs. So, for example, middle clicking on the Hacker News logo will preserve your HN session across tabs.
        7y ago
reaperducer 7y ago
I don't understand why Google and some other tech companies use their users as involuntary, unpaid guinea pigs. No consent. No opt-out. What's the motivation? Is it simple laziness because they don't want to deal with wetware? Is it afraid that if people knew what was happening they wouldn't be happy? Google has eighty brazillion employees it can test new features on.
- duxup 7y ago
  Isn't that what most A/B testing is?
  - reaperducer 7y ago
    No, it's what unethical A/B testing is.
    - duxup 7y ago
      " involuntary, unpaid guinea pigs. No consent. No opt-out" That sounds like all A/B testing...
      - csallen 7y ago
        "Scientists run tests on guinea pigs. A/B testers run tests on me. Therefore I am a guinea pig. Guinea pigs have no rights. Therefore A/B testers are taking away my rights." I've never been a fan of this particular type of logic and reasoning (or lack thereof).
        duxup 7y ago
        Yeah I agree. A/B testing is generally ... innocuous. The idea that such a pattern is as severe / bad as described I don't think makes sense.
      - bayindirh 7y ago
        Firefox's testing (aka studies) are opt-in, not opt-out.
_jal 7y ago
I was fooled by Google for a while, thinking it was less evil than FB. They're just a little smarter about their shittiness.
chrshawkes 7y ago
I noticed this when doing work with Puppeteer lately. I thought about reporting it but didn't exactly know what I was looking at.
deeblering4 7y ago
I see people recommending Firefox, but I'll say that for mac users Safari is a very usable browser too. It's quite fast, and to my knowledge is not collecting/sharing my personal data with apple. https://www.apple.com/privacy/ https://www.apple.com/privacy/ These days I only use chrome for the g-suite tools that seem to require it to avoid mid-meeting crashes.
- throwawa66 7y ago
  Safari as well. Almost anything but Chrome. Both Safari and FF are good. Im only using these 2 myself
- Kiro 7y ago
  Safari is horrible for HTML5 games. Dealing with all sorts of issues to the point where I've more or less given up and just tell my Safari players to use something else.
  - ainar-g 7y ago
    Some of my front-end colleagues like to tell me that Safari is the new IE 6. Not in terms of the market domination (that's Crhome for you), but in terms of dragging the front-end back with unimplemented features, quirks, and bugs. The amount of hacks they have to add just to support Safari is uncomfortable.
    - yohannparis 7y ago
      No, they are confusing developing for Chomium first and not testing on all browsers. Safari is behind in terms of W3C features. But implementing unsupported features does not mean you are hacking to support Safari. They should look into the progressive enhancement principle and CSS @support feature.
      - Kiro 7y ago
        I'm strictly talking about the canvas and audio implementations, forcing me to use all kind of different hacks just to get a reasonable FPS in Safari. Audio I've given up on long time ago and don't get me started on Mobile Safari.
BLO716 7y ago
With that said, one can simply filter out these analytics with a c:\Windows\Systems32\Drivers\etc\hosts -> pointing to 0.0.0.0 or PiHole solution (https://pi-hole.net/ https://pi-hole.net/), yes? I mean, this is probably not the holistic solution, but this is why we have a firewall, vpn, antivirus, filters to just keep DNS in check, yes?
- GrayShade 7y ago
  So are you suggesting people should DNS block google.com and gmail.com?
  - BLO716 7y ago
    There are certain sub-domains that block certain things that keep most of the bad guys at bay, but to some extent yes. This is a fringe case of those activities, but being paranoid is not a bad thing these days, considering the level of red team activity and bad actors probing your network / computer / devices. Short of putting on the tin foil hat, mind you.
- janvidar 7y ago
  Yes, you can if you are willing to block google.com, android.com and youtube.com. doubleclick.com might not be terrible for most, though. Interesting enough, it does not add headers when accessing a country specific google domain in the EU - such as google.de or google.fr. Is that GDPR kicking in - with a nod the the brexiteers given that google.co.uk gets these headers... ?
  - ins0 7y ago
    Not sure, but my chrome will send the additional `x-client-data` header even when i'm on eg. `google.de`
scoutt 7y ago
PII concept is not the same for everyone/everywhere. For GDPR we have: > Article 4(1): ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; If this chrome browser ID is matched against a (for example) google account, then they can track every single person. And that is just a couple of IDs, let alone all the quantity of data they have. It's against GDPR to not be clear about this kind of ID. If my browser has an unique ID that is transmitted, then this ID can be coupled with other information to retrieve my identity and behavior, so it should be informed (in the EU). EDIT: TD;LR, hiding behind "there is no PII in that ID" is not enough.
- Mirioron 7y ago
  Who's going to raise this issue though? And what if they put this in the browser's T&C?
  - scoutt 7y ago
    > Who's going to raise this issue though? I'm sure there is someone out there who takes these kind of things seriously. Not me. I use firefox for that matter. > And what if they put this in the browser's T&C? Then the rest of GDPR applies: a clear message about the browser sending this info has to be shown, explaining why, with who they'll share it, the time they will keep this info, plus no auto opt-ins, the possibility of asking Google (or whatever) all the info relative to this ID and the option to cancel all the data, etc.
  - pbhjpbhj 7y ago
    I thought they needed explicit consent. T&Cs ain't that.
- shadowgovt 7y ago
  This is why I consider the GDPR to be unrealistically broad in its definition of PII; it denies even innocuous feature-mode-distinguishing headers intended to allow for bug-identification of massively-distributed software installs. If I'm given a forced choice between "more privacy" and "better software quality" I'm going to lean towards "better software quality."
c16 7y ago
Chrome explicitly having a line [1] of code to not send the `x-client-data` header to Yahoo made me laugh. [1] https://chromium.googlesource.com/chromium/src/+/master/components/variations/net/variations_http_headers_unittest.cc#47 https://chromium.googlesource.com/chromium/src/+/master/comp...
- jcl 7y ago
  FWIW, it looks like that's a test case -- it is not part of Chrome itself. They most likely just wanted an example of a third-party website, and could have used any non-Google site there.
  - c16 7y ago
    Yes, But they tested Yahoo of all websites to make sure they don't send tracking data, and not an unrelated website like wikipedia or archive.org. The only non-google test case too I might add.
    - gruez 7y ago
      It's a test case I wouldn't read too much into it. Maybe it's evidence of a massive anti-trust conspiracy at google, but it could very well be because it's the first domain that came to the programmer's mind at the time.
      - jmccorm 7y ago
        I wasn't aware of this, but it still seems like a thread worth pulling on. You're assuming, right? The reason I ask is that using any third-party company seems inappropriate. Even more so when Google has plenty of domains of its own to test against. Even more so when it is against a media/advertising company. And again, even more so against a company that changed from Google to Bing to power their search function. It seems to be an inappropriate or poor choice, doesn't it? There's no smoking gun here, but I don't think that concern might be dismissed out of hand. It might be good to see what Yahoo's take on this. This could even evolve into participation by the US Attorney General. I'd like to know more, either way. Like if Yahoo was independently added to the list at a later date, or if it was there from the start?
carlsborg 7y ago
If you strace chrome on linux it also picks up /etc/machine-id (or it did back when I looked), which is a 32 byte randomly generated string which uniquely identifies you and on some systems is used as the DHCP ID across reboots.
- commotionfever 7y ago
  firefor / tor also read this file
  - pbhjpbhj 7y ago
    What does tor do with it? Maybe pass it along in packet timing intervals, or something ... ;o)
- augustk 7y ago
  And this is a legal thing to do?
- throwaway8941 7y ago
  Which (among many other things) can be faked with firejail, if you absolutely have to run Chromium (e.g. for testing): --machine-id Spoof id number in /etc/machine-id file - a new random id is generated inside the sandbox. Example: $ firejail --machine-id
  - GrayShade 7y ago
    Chromium doesn't seem to read that file.
- chatmasta 7y ago
  When puppeteer first came out I was nervous to use it for scraping because I could totally see Chrome pulling tricks like this to help recaptcha in identifying the bots. I’m still not convinced they aren’t.
- xfs 7y ago
  First I thought reading /etc/machine-id would be expected if Chrome uses D-bus or pulseaudio libraries which depend on D-bus, and /etc/machine-id is part of D-bus. But no, they really use it for tracking purposes. And in a sick twist they have this comment for it: std::string BrowserDMTokenStorageLinux::InitClientId() { // The client ID is derived from /etc/machine-id // (https://www.freedesktop.org/software/systemd/man/machine-id.html). As per // guidelines, this ID must not be transmitted outside of the machine, which // is why we hash it first and then encode it in base64 before transmitting // it.
Ohn0 7y ago
What a mess
fnord77 7y ago
Can browser plugins control what headers go out? If so then a simple browser plugin could put a stop to this.
8ivek 7y ago
Got this from google white paper: "run Chrome with the command line flag "--reset-variation-state" to reset the value." I tried this and my "x-client-data" header changed.
mooreed 7y ago
It seems like a reasonable time to bring up the reformer project 'ungoogled-chrome' [1]. I have used it and new versions of Firefox for over 3 years and have seldom had to jump back to `Googlified Chrome.` Do know that installing via `brew` [2] means no - standard browser auto-update. Which in this case, makes sense to me. Aside: It seems to me the realist punk / anti-the-man software one can work on is a user respecting browser. I don't work on these, but I am very grateful for those out there who do. ------- - [1]: https://github.com/Eloston/ungoogled-chromium#downloads https://github.com/Eloston/ungoogled-chromium#downloads - [2]: Brew install via: `brew cask fetch eloston-chromium && brew cask install eloston-chromium` Enjoy old school browsing with new school development benefits.
balls187 7y ago
This is why I use firefox for personal browsing, and edge for work. Now that Edge / Chromium is out of beta, even better.
woho 7y ago
I use (sometimes/often) mitmproxy and remove or change suspect headers. It is also nice to remove all the fb, google and more crap from the html. And much more. It is a lot of work not to break a website. I don't know whether I am more trackable or not - this is the 'only browser' without x-client-data header.
raxxorrax 7y ago
This it outrageous. Browsers are user-agents, not advertising accelerators. They should hide as much personal identifiable information as possible. This is exactly why using a browser from an advertising company is not a good idea. They use it to improve their service... The lie gets old... This comment was sadly written in Chrome, since I need it for testing... edit: pretty much exactly 10 years ago they already tried their shit with a unique id. We should have learned from that experience.
- jaywalk 7y ago
  Well when the browser is created by an advertising company...
- deleted 7y ago
  [deleted]
- iakov 7y ago
  >This comment was sadly written in Chrome, since I need it for testing... You realize you can have multiple different browsers installed, right?
sergiotapia 7y ago
I dropped chrome a long time ago and switched to Brave. Does Brave have these same issues, considering it uses webkit for it's rendering engine? Am I just being paranoid? What a tumor google has become.
- pier25 7y ago
  Brave uses Chromium not Webkit.
bprasanna 7y ago
Obviously! What else to expect from Google! In the user personalization...
cft 7y ago
Just in time for their announcement that they plan to abolish third party cookies by 2021. Talk about monopoly.
orthecreedence 7y ago
I hate to say this, but duh. It's a closed-source browser made by an ad company. What the hell to do people expect?
bsharitt 7y ago
Everybody imagine going back 15 years and tell yourself that you're using a web browser made by the parent company of DoubleClick. Your 15 year ago self would think you're a moron (assuming that 15 years ago you were old enough to know what DoubleClick was).
- antisthenes 7y ago
  Doubleclick ads were, originally, what prompted me to seek an adblock extension. I think it was around 2006 that I got the extension for Firefox; Google bought them about a year later.
- Andrex 7y ago
  I can only speak for myself, but myself from 15 years ago would not have cared so strongly about the choice of browser. I believe I was using the newly-ad-less Opera at the time, and new/cared little about the company making it.
- kokey 7y ago
  My 15 year ago self would have taken a double helping of DoubleClick if my only choices were that or Internet Explorer 6.
  - heavyset_go 7y ago
    Firefox and Opera existed at the time.
- rplnt 7y ago
  I always believed that tech-savvy people using Google Chrome are morons. It's the perfect blend of Google being evil trying to force it to everyone, the browser being dumbed down to masses so much it's missing the most basic features, and I guess privacy concerns too when using browser from advertising company.
  - InterestBazinga 7y ago
    > DoubleClick What browser would you recommend?
MrZongle2 7y ago
I am Jack's complete lack of surprise. Firefox and DuckDuckGo, folks. Today's Google is no more benevolent than yesterday's Microsoft.
nurettin 7y ago
Please do not destroy vital testing apparatus.
jkepler 7y ago
Am I correct to understand that this backdoor tracking of individual users applies to the standard Chromium browser (i.e., the non Eloston ungoogled-chromium) as well as the Chrome browser? If so, its incredibly consistent with Google's surveillance capitalist business model.[1] Wow. I'm thankful for Firefox. -- [1] "The Age of Surveillance Capitalism", by Shoshana Zuboff, reviewed here: https://www.theguardian.com/books/2019/feb/02/age-of-surveillance-capitalism-shoshana-zuboff-review https://www.theguardian.com/books/2019/feb/02/age-of-surveil...
everdrive 7y ago
Is this Chrome the browser, ChromeOS, or both? And if so, will it be in Chromium?
AlphaWeaver 7y ago
According to this source code [0], it looks like this is in Chromium as well. Does that mean this affects Electron applications? [0]: https://chromium.googlesource.com/chromium/src/+/master/components/variations/net/variations_http_headers.cc https://chromium.googlesource.com/chromium/src/+/master/comp...
- nornagon 7y ago
  Electron maintainer here. Electron does not send this header.
  - croh 7y ago
    Thanks for clarification.
- Ndymium 7y ago
  Checked that Vivaldi doesn't seem to be sending this header.
- currysausage 7y ago
  Edge ("Edgium") doesn't appear to send this header. Neither does Chrome in Private or Guest Mode.
dazbe 7y ago
Wow, I didn't think sensationalist headlines were allowed on HN. I'm guessing mods are asleep or just don't care anymore. Edit: If the mods are listening, I've come up with an alternative title for you: "The Evil GOOGLE Has Installed a MALICIOUS BACKDOOR On All Chrome Users Machines To Sell PERSONAL DATA to RUSSIAN HACKERS on the DARK WEB". This will surely get the clicks now. You can thank me later.
- dang 7y ago
  The mods were asleep. That happens sometimes. If you really want to help, suggesting an accurate and neutral title, preferably using representative language from the article itself, is a great way to do that. We don't know enough to get it right in every case, even when awake.
nacho2sweet 7y ago
Break this company up.
jgon 7y ago
U S E F I R E F O X That is all.
masterfooo 7y ago
How about Electron apps?
outside1234 7y ago
Does this apply to Edge installations? (If not, another great reason to move to Edge.)
a3n 7y ago
"It's only metadata." https://en.wikipedia.org/wiki/PRISM_(surveillance_program)#Responses_to_disclosures https://en.wikipedia.org/wiki/PRISM_(surveillance_program)#R...
fnord77 7y ago
Can scripts from non-google sites making XHR requests to google domains see the outgoing request headers?
dmtroyer 7y ago
I must be dense but I never see the `x-client-data` header in the request headers of the network tab in developer tools.
- calibas 7y ago
  I just checked, I see it on Chrome when fetching resources from google.com, youtube.com, gstatic.com, and googlesyndication.com.
- throwawaylolx 7y ago
  I just tried it now on google.com, and it sent it in 6 requests. You can ctrl+f in developer tools in Chrome.
  - dessant 7y ago
    I think extensions can filter out the x-client-data header, though Google should definitely make this data collection opt-in. GDPR is very clear about this data being personal information [1], since Google has access to the IP address on the receiving end, which has been repeatedly tested in courts as being personal data. Google is engaging in personal data harvesting without user consent and control, and no amount of mental gymnastics presented in their privacy whitepaper [2] will save them in courts. [1] https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... [2] https://www.google.com/chrome/privacy/whitepaper.html#variations https://www.google.com/chrome/privacy/whitepaper.html#variat...
    - dmtroyer 7y ago
      Oh interesting, it must be an extension that is filtering it out for me (Ghostery, DDG Privacy Essentials or Adblock Plus in my case)
  - GrayShade 7y ago
    Can you also test under the incognito mode?
CommanderData 7y ago
We need the GDPR equivalent in the US.
StevePerkins 7y ago
Is this at the "Chrome" level, or baked in at the "Chromuim" level? And therefore also an issue for Brave, Opera, Vivaldi, new-Edge, and anything else jumping on the browser engine monoculture?
- jakoblorz 7y ago
  Don't forget Electron! Like Atom, VS Code etc
  - nornagon 7y ago
    Electron maintainer here. Electron doesn't send this header.
    - NotSammyHagar 7y ago
      Thank you for that.
- aloknnikhil 7y ago
  This is specifically on Chrome, it seems.
- robin_reala 7y ago
  Seems to be Chromium judging by some issue comments: https://github.com/chromium/chromium/blob/ccd149af47315e4c6f2fc45d55be1b271f39062c/components/variations/net/variations_http_headers.cc#L90 https://github.com/chromium/chromium/blob/ccd149af47315e4c6f...
- deleted 7y ago
  [deleted]
- pier25 7y ago
  I don't see it in Brave
- 98codes 7y ago
  I just checked Microsoft's Chromium-based Edge, and it isn't sending the headers.
sub7 7y ago
The sad part is that most times Google violates your privacy, it's just some PM who thinks having some data will be super important and in most cases they're wrong. Caveat here is that in 99.99999% cases it's also the case that nobody ever looks at your individual file but the fact that they could is bad enough.
bilekas 7y ago
Jesus.. It gets better and better..
d1zzy 7y ago
TL;DR I think whoever posted that is trying to bury the UA anonymizing feature by derailing the discussion. What I'm seeing is an RFC for anonymizing parts of User-Agent in order to reduce UA based fingerprinting, which improves everyone's privacy, that's a good thing! Then I see someone comments how that could negatively impact existing websites or Chromium-derived browsers, comments which are totally fair and make an argument that may not be a good idea doing this change because of that. Then someone mentions the _existing_ x-client-data headers attached to requests that uniquely identify a Chrome installation. Then a lot of comments on that, including here on HN. To me that's derailing the original issue. If we want to propose that Chrome remove those headers we should do so as a separate issue and have people comment/vote on that. By talking about it on the UA anonymizing proposal we are polluting that discussion and effectively stalling that proposal which, if approved, could improve privacy (especially since it will go into Chromium so then any non-Chrome builds can get the feature without having to worry about x-client-data that Chrome does).
- dessant 7y ago
  This is the equivalent of a protest, people are objecting to Google's illegal data harvesting practices in places that receive engagement, since that's the most effective way to get the word out and warn others. Google's reasoning that this is not personal data is meaningless in the face of GDPR, which considers an IP address personal data. Google has access to the IP address when they receive the data, therefore they are transmitting personal information without user consent and control, which is illegal.
  - csagan5 7y ago
    It could be argued that a similar violation is present (since March 2019) in Chromium for the Widevine CDM provisioning request, see https://github.com/bromite/bromite/issues/471 https://github.com/bromite/bromite/issues/471 Basically all users opening the browser will contact www.googleapis.com to get a unique "Protected Media Identifier", without opening any web page and even before any ToS/EULA is accepted (and there is no user consent either).
Havoc 7y ago
I’ve taken to using FF for browsing With noscript etc and chrome for when I need something to work well and can accept some tracking
- deleted 7y ago
  [deleted]
drderidder 7y ago
New motto: "Don't get caught being evil".
deleted 7y ago
[deleted]
sutro 7y ago
Bypassing CORS checks by "hiding" X-Client-Data: https://chromium.googlesource.com/chromium/src/+/f3ceca9d0fd61ffd099daf24847e27562b7da933 https://chromium.googlesource.com/chromium/src/+/f3ceca9d0fd...
csagan5 7y ago
Credits to the ungoogled-chromium project [0] for the patch [1] which is also used in Bromite since 15 February 2018 to prevent this type of leaks; see also my reply here: [2] [0]: https://github.com/Eloston/ungoogled-chromium https://github.com/Eloston/ungoogled-chromium [1]: https://github.com/bromite/bromite/blob/79.0.3945.139/build/patches/ungoogled-chromium-Disable-Google-host-detection.patch https://github.com/bromite/bromite/blob/79.0.3945.139/build/... [2]: https://github.com/bromite/bromite/issues/480#issuecomment-582070839 https://github.com/bromite/bromite/issues/480#issuecomment-5...
- gcb0 7y ago
  Which is not the right way to solve this problem. This is the reverse ad blocker problem. Just use firefox, where we can at least pretend that the full time paid contributors are not trying to shove Advertising and Tracking on us.
troseph 7y ago
No Facebook Firefox PiHole is my Live Love Laugh
olliej 7y ago
Am I getting this right? Irrespective of whether you use any other google products, if you use chrome google can now track you over any property that uses google ads, recaptcha, etc. The header is inserted by the browser after any extensions run, and google pins google properties so you can have an intermediate proxy that strips the header, so they gain persistent tracking of all users across most of the web? If it wasn’t a tracking vector why do they limit it to just google ads, etc? Why not other ad providers as well?
haecceity 7y ago
What does freezing mean here?
ravedave5 7y ago
It appears that chrome based Edge does not send this header. I've switched to firefox for everything I can switch, perhaps it time to use Edgeium over chrome for anything else.
- pbhjpbhj 7y ago
  MS Windows probably used the Skype to fingerprint you already, and don't need the browser to do it explicitly?
KenanSulayman 7y ago
Don’t forget that even if the number is varying only in an interval of 0 and 7999, this means without cookies a unique chrome installation can be identified if multiple users are using the same IP, like residential houses with families, etc. — that way it is possible to determine the unique amount of devices inside a house.
- KCUOJJQJ 7y ago
  >that way it is possible to determine the unique amount of devices inside a house. There are exceptions I guess. Imagine 8000 households in which couples live. Both partners own the same MacBook model. In 1/8000 cases Google would think there is only one person.
EastSmith 7y ago
Downvote me how many times you want, but Mozilla needs to fork Chromium, degoogle it and fix the web. Mozilla is the only internet entity I can say I trust, I am donating to it, and yet I am using Chrome and Brave on both Desktop and mobile. Just follow the users and fork it!
- jrockway 7y ago
  Mozilla makes a web browser called Firefox. You should try it!
  - EastSmith 7y ago
    I've used it for many years, then switched to chrome and since then I've tried it more times that I want to admit. I am also donating to it.
    - lucasverra 7y ago
      Switch to Edgium then - FF user
- ivm 7y ago
  Microsoft kind of did it with the new Edge: https://www.theverge.com/2019/4/8/18300772/microsoft-google-services-removed-changed-chromium-edge-browser https://www.theverge.com/2019/4/8/18300772/microsoft-google-...
  - EastSmith 7y ago
    I am using it, but Microsoft, as Brave and Google is a commercial entity I do not trust.
- pbhjpbhj 7y ago
  Well Mozilla burnt my trust in them over the last couple of years ... maybe Brave? Some don't like their model to tip content providers but they seem - and I've not made rigorous enquiries here (please inform!) - to be a relatively trustworthy mod of Chromium!?
krick 7y ago
Lol, is it news? I mean, it worked like this as long as I can remember, privacy conscious users were complaining for years, helplessly watching as Chrome market share grows, but nobody really cared, so... And now, suddenly, people act like this is big news and they are outraged by such blatant and unexpected(!) intrusion into their privacy. Wow. I don't even know how I feel about it anymore.
jacobwilliamroy 7y ago
Is this also true for all the standalone binaries that embed chromium?
metastart 7y ago
It's not in the Epic Privacy Browser (a chromium-based web browser) :-). Is it in Chromium?
blfr 7y ago
And, since it's per installation, it nicely ties all your profiles together for Google.
nojvek 7y ago
Well why does Chrome send this special header to only Google properties like YouTube and search and not the rest of the internet. It really seems fishy and a lot of double speak. I really don’t trust Google here.
- bonestamp2 7y ago
  > and not the rest of the internet Privacy issues aside, this might not help an antitrust case if one is brought against them.
userbinator 7y ago
As long as web developers continue to create (app-)sites that only work in the latest versions of Chrome(and Chromium-ish) browsers, giving users little effective choice over what browsers they can use, this sort of abusive behaviour will continue. The sort of "feature-racing" that Google engages in is ultimately harmful for the open web. Mozilla struggles to keep up, Opera surrendered a while ago, and more recently, Microsoft seems to have already given up completely. I feel like it's time we "hold the Web back" again. Leave behind the increasingly-walled-garden of "modern" appsites and their reliance on hostile browsers, and popularise simple HTML and CSS, with forms for interactivity, maybe even just a little JavaScript where absolutely necessary. Something that is usable with a browser like Dillo or Netsurf, or even one of the text-based ones. Making sites that are usable in more browsers than the top 2 (or 1) will weaken the amount of control that Google has, by allowing more browsers to appear and gain userbases.
- TheCraiggers 7y ago
  I wish, but that's not what most people want. Hell, it's not what designers want. Thinking back to the Myspace days, people would have the worst websites imaginable. Granted, that was all done with little more than HTML and javascript, but I have little doubt what they would have done with things like HTML5 and even more javascript.
  - AndrewKemendo 7y ago
    I have to agree with this. The last decade or so has really reinforced to me that we all ignore or are ignorant of fundamental structural problems with most of the systems we rely on - with us wanting them to "just work." We're all guilty of this, we just see it up close for the things that we're building and chide others who don't care. Meanwhile we ignore other fundamental structures of modern society.
  - asdff 7y ago
    There's got to be a balance between every website looking exactly the same and fading out of my memory with one identical hamburger menu after another and dancing babies on geocities.
mirimir 7y ago
I've always assumed that everything I install tracks me through some unique ID. That's arguably wrong for typical Linux packages, but being right just once is enough to justify the assumption. And for Google, it's arguably foolish to think that they don't.
altitudinous 7y ago
IP address inspection has been getting a large amount of attention recently. It is considered a privacy violation, yet it is required to determine location, so devs know which privacy laws apply. GDPR only applies in Europe, and CCPA only applies in California. How is one meant to determine which set of laws applies inside a piece of software without being able to determine location? A waste of time (don't bother) answer is : Just apply maximum privacy everywhere and you won't have to worry about it... The response is always going to be - Many free tools you use are funded by advertising etc and advertising depends on being able to know where someone is, at least to the country level. Cutting off location and therefore revenue is not going to give people the software they want. Other facts that usually matter - only 1-2% of people want to pay for private software. Everyone else wants the free option. Source : my apps. How is software meant to determine location?
deleted 7y ago
[deleted]
om2 7y ago
I'm surprised this hasn't gotten any mainstream tech press attention. Chrome's Privacy Whitepaper describes a number of privacy-questionable nonstandard headers which are only sent to Google services. Just try searching for X- here: https://www.google.com/chrome/privacy/whitepaper.html https://www.google.com/chrome/privacy/whitepaper.html And for ease of reading, a few others: > On Android, your location will also be sent to Google via an X-Geo HTTP request header if Google is your default search engine, the Chrome app has the permission to use your geolocation, and you haven’t blocked geolocation for www.google.com (or country-specific origins such as www.google.de) > To measure searches and Chrome usage driven by a particular campaign, Chrome inserts a promotional tag, not unique to you or your device, in the searches you perform on Google. This non-unique tag contains information about how Chrome was obtained, the week when Chrome was installed, and the week when the first search was performed. ... This non-unique promotional tag is included when performing searches via Google (the tag appears as a parameter beginning with "rlz=" when triggered from the Omnibox, or as an “x-rlz-string” HTTP header). > On Android and desktop, Chrome signals to Google web services that you are signed into Chrome by attaching an X-Chrome-Connected and/or C-Chrome-ID-Consistency-Request header to any HTTPS requests to Google-owned domains. On iOS, the CHROME_CONNECTED cookie is used instead.
- RonanTheGrey 7y ago
  Holy rotten metal batman... those are pretty bad. Why in the world isn't everyone up in arms over this?....
hitpointdrew 7y ago
Not shocking. I never trusted Chrome, and never switched over to it. I never understood that Firefox hate. I never thought it was "slow" like so many complaints I have seen. Apparently Firefox is fast and amazing again, I certainly think it is better than it was a several years ago, but again even several years ago I didn't ever think it was slow.
codedokode 7y ago
By the way, if you use Chrome and Google as a default search engine, Google gets a signal from your browser (with cookies) every time you open a new tab. You can check it with DevTools.
marco1 7y ago
Analysis of the same tracking mechanisms from September 2018, and its discussion on HN late last year: https://news.ycombinator.com/item?id=21034849 https://news.ycombinator.com/item?id=21034849

2292 points by rvnx 7y ago

swiley 7y ago

Google consumer software is almost universally an active full frontal attack on you. Stop using it.

a_wild_dandan 7y ago
This sounded harder to do than it was in my experience. I figured the alternatives to their products would be less polished. But I switched to Firefox and honestly prefer it to Chrome. (They allow extensions on Android, meaning adblock, which is a game changer for me.) DDG for search is great. Protonmail for email is fine, etc. There isn't much in the Google ecosystem that I miss tbh.
- acollins1331 7y ago
  The only thing I have problems finding something that works is Google maps. As an Android user there are a few different options but Google did make a damn good maps app.
- Scarbutt 7y ago
  For me is google docs and maps.
  - dleslie 7y ago
    If you need online office and maps then there's Microsoft Office and Bing Maps. Office is an excellent product, well worth the few bucks a month. AFAIK, Office is fairly good about privacy.

pier25 7y ago

Chromium too?

macinjosh 7y ago
Doesn't look like it from my testing of version 81.0.4036.0. But in normal Chrome I do see it.
- olah_1 7y ago
  Can you test it in Microsoft's new Edge browser based on Chromium? I'm very curious about that. (I don't know how to test such a thing myself, sorry :S)
  - ryneandal 7y ago
    I didn't see the x-client-header in the Edge insider browser when accessing YouTube.
    - pier25 7y ago
      I don't see it in Brave either
Cthulhu_ 7y ago
As another commenter pointed out, the list of domains the header is sent to is part of the Chromium codebase: https://chromium.googlesource.com/chromium/src/+/master/components/variations/net/variations_http_headers_unittest.cc https://chromium.googlesource.com/chromium/src/+/master/comp...
- gempir 7y ago
  this is just a test case. It could very well be a much bigger list.
  - gruez 7y ago
    Actual list: https://cs.chromium.org/chromium/src/components/google/core/common/google_util.cc?q=IsGoogleAssociatedDomainUrl https://cs.chromium.org/chromium/src/components/google/core/... via: https://news.ycombinator.com/item?id=22237768 https://news.ycombinator.com/item?id=22237768

janpot 7y ago

Not endorsing this, but according to https://www.google.com/chrome/privacy/whitepaper.html#variations https://www.google.com/chrome/privacy/whitepaper.html#variat... > We want to build features that users want, so a subset of users may get a sneak peek at new functionality being tested before it’s launched to the world at large. A list of field trials that are currently active on your installation of Chrome will be included in all requests sent to Google. This Chrome-Variations header (X-Client-Data) will not contain any personally identifiable information, and will only describe the state of the installation of Chrome itself, including active variations, as well as server-side experiments that may affect the installation. > The variations active for a given installation are determined by a seed number which is randomly selected on first run. If usage statistics and crash reports are disabled, this number is chosen between 0 and 7999 (13 bits of entropy). If you would like to reset your variations seed, run Chrome with the command line flag “--reset-variation-state”. Experiments may be further limited by country (determined by your IP address), operating system, Chrome version and other parameters.

rvnx 7y ago
They key in the wording is: "If usage statistics and crash reports are disabled, this number is chosen between 0 and 7999 (13 bits of entropy)." "If, statistics are disabled." In chrome://version you can see the active variations. It seems to be pretty big numbers to be significant, and so far haven't observed duplicates. Since this header is generated server-side, you have only to believe I guess ? Plus why Doubleclick would need it :)
- userbinator 7y ago
  That's basically saying "even if you opt out, we'll still try to track you, just not as much." Very unpleasant, but then again I'm not surprised to see this attitude from Google.
  - m463 7y ago
    Combine a few pieces of information like this and you get a decisively unique fingerprint. For example identifying individuals at work behind the same ip address.

Tepix 7y ago

According to https://www.google.com/chrome/privacy/whitepaper.html https://www.google.com/chrome/privacy/whitepaper.html "We want to build features that users want, so a subset of users may get a sneak peek at new functionality being tested before it’s launched to the world at large. A list of field trials that are currently active on your installation of Chrome will be included in all requests sent to Google. This Chrome-Variations header (X-Client-Data) will not contain any personally identifiable information, and will only describe the state of the installation of Chrome itself, including active variations, as well as server-side experiments that may affect the installation." While this header may not contain personally identifiable information, its presence will make every request by this user far more unique and thus easier to track. I do not see Google saying they won't use it to improve their tracking of people.

goatinaboat 7y ago
One click while logged into any Google property will be enough for them to permanently associate this GUID with your (shadow) account, they know it, and they know you know it too

cs702 7y ago

Doubtlessly, this will be rationalized and justified as being necessary for, and in the best interest of, consumers... ...but inevitably, it will be used for tracking -- regardless of intent. It might also get Google in trouble. Copying and pasting from the a comment in the OP's URL: > Example: https://www.youtube.com https://www.youtube.com - in network headers, look for x-client-data > Now, go to https://ad.doubleclick.net/abc https://ad.doubleclick.net/abc - and your browser also sends this magic x-client-data. > It's a unique ID to track a specific Chrome instance across all Google properties. > Really curious about your opinion, especially after the GDPR explicitly forbidding such tracking. Moreover, it doesn't make sense to anonymise user-agent if you have such backdoor.

floatingatoll 7y ago
This comment is unreadable on mobile. https://i.imgur.com/jFusqw0.png https://i.imgur.com/jFusqw0.png Could you please remove the four-space indent? You can wrap each paragraph in * ... * if you want to italic them.
- cs702 7y ago
  Fixed. Sorry about that. Thank you for letting me know!
  - floatingatoll 7y ago
    No worries :)
- metahost 7y ago
  You may give https://hackerweb.app https://hackerweb.app a try! Aside: It is read only though.
  - floatingatoll 7y ago
    I don’t appreciate your link to a third-party reader here, because you’re implying that the contradiction of HN’s style guidelines (code formatting is for code) is somehow made acceptable by the existence of an app that reformats it for only a few readers. If I switch to an app rather than ask the person to stop, the other HN mobile users who use a browser rather than app will continue to suffer. ”Use an app” is not an acceptable choice.

dathinab 7y ago

>It's a unique ID to track a specific Chrome instance across all Google properties. >Really curious about your opinion, especially after the GDPR explicitly forbidding such tracking. >Moreover, it doesn't make sense to anonymise user-agent if you have such backdoor Oh, but it does make sense because with this everyone _but_ google will have a harder time tracking people :\

_pmf_ 7y ago

Just ask: why does an advertising company make a browser?

macinjosh 7y ago
Not sure why this is being downvoted. It hits the nail on the head. If you are concerned about privacy around advertising then using a browser from the biggest online ad company is short sighted.
Keloo 7y ago
so that you don't have to pay royalties to other browsers for being the main search engine. I mean you have to pay one less. And if you have the most used browser, you save a lot.
- josefx 7y ago
  In the good old days everyone and their grandmother just sideloaded their malware toolbars with freeware crap like picasa or maps or outright bundled their bloatware with the system like Google still does for Android.
eternalban 7y ago
Google is a total-spectrum surveillance company. Advertising is a product they offer to their clients. (No, that is not you and me.)
Cthulhu_ 7y ago
When Chrome was first developed, browsers and the web were relatively slow, and slowing down due to the popularization of Javascript and heavier websites. Google's worked on a number of technologies to make the web faster; Chrome (and V8), their own DNS, image and video compression technologies, AMP, HTTP/2 (SPDY), HTTP/3 (QUIC), webserver plugins (mod_pagespeed), benchmark tooling (Lighthouse), and extensive guides on website speed optimization. The reason is simple; faster internet = faster browsing = more page views = more ad impressions + more behaviour tracking data points. And it's a win-win for Google as well, because it earns them goodwill (well, except for AMP); especially at the time Chrome was a breath of fresh air compared to Firefox, and it's taken a lot of time and effort just to keep up, with mixed results (to the point where a number of manufacturers have just given up and adopted Chrome's renderer).

TheRealPomax 7y ago

So, an extremely unique identifier for tracking purposes, that effectively no one knows exists, and no one knows can be changed at all? With an obscure white paper that allows Google to claim they comply with the law because "they totally offer a way to change that and they even published that information to the web for anyone to find"? Gotcha.

x0x0 7y ago
Are you talking about the same thing? Because the identifier above is claimed to have 13b of entropy. Is there another high entropy identifier?
- rvnx 7y ago
  13b, if usage statistics are disabled (not the default). Otherwise, unspecified amount of entropy.
  - x0x0 7y ago
    thanks. and ugh.
    - rvnx 7y ago
      Just referred as High Entropy: https://cs.chromium.org/chromium/src/components/metrics/entropy_state.cc?type=cs&sq=package:chromium&g=0&l=58 https://cs.chromium.org/chromium/src/components/metrics/entr...
  - asvitkine 7y ago
    Actually, the low entropy provider is used for any field trials that get included in the header. See: https://cs.chromium.org/chromium/src/components/variations/variations_seed_processor.cc?rcl=ddac4c3cc1528254008f9e7a2aea5d4426906bfd&l=258 https://cs.chromium.org/chromium/src/components/variations/v...
- clarry 7y ago
  13b plus IP is already huge, but browsers leak so much more than that.

dragonsh 7y ago

This is another instance that google doesn’t care about users privacy and track without their consent by using chrome installation Id. This probably might be against GDPR, so Chrome installed base in Europe multiplied by per day fine, hopefully runs into a years revenue of google. Another lesson don’t trust for profit companies with privacy protection especially advertising technology company like google with motto like don’t be evil or organize world’s information designed to mislead.

mateo1 7y ago
Honestly, it's 2020, even if your technical understanding is so low that you have no idea what a "browser" is, you know that Google will do anything in it's impressive power to track down everything you do with legal or illegal means. Thanks to Snowden, this is no longer a conspiracy theory. It's a fact. Google should be fined for this but they probably won't be.

gunn 7y ago

To give them some credit: it's not sent when in incognito mode.

macinjosh 7y ago
How thoughtful of them!

DangerousPie 7y ago

If you haven't used Firefox in a while you should really give it another chance. It has vastly improved in terms of CPU and battery usage. It also has a lot of great privacy-enhancing features like tracking protection enabled by default and extensions like Facebook Container make it trivial to prevent tracking even further.

deleted 7y ago
[deleted]
tapoxi 7y ago
Or just use Ungoogled Chromium, and get the performance advantage of Chrome without the tracking.
- Diederich 7y ago
  Is there a quick summary of what major site/features that will be unavailable in Chromium vs. Chrome? I assume, for example, that 'netflix' will be prominently on that list. Thanks.
  - deathanatos 7y ago
    I use Chromium; you can still Netflix. It does, however, require installation of "WideVine", which is an opaque, closed, binary blob. (But you're getting that with Chrome, too, I believe.) You can also do Netflix in Firefox, through exactly the same mechanism.
    - gruez 7y ago
      >You can also do Netflix in Firefox, through exactly the same mechanism. It's somewhat better on Firefox because they run the binary blobs in a sandbox.
- DangerousPie 7y ago
  Is there actually still a performance advantage these days? Would be curious to see some benchmarks. I will say that Gmail/Hangouts feels faster in Chrome but that's obviously not a fair comparison.

kick 7y ago

"Backdoor" this, "backdoor" that. Proprietary software company releases proprietary software that allows them to spy on you, how shocking. In which they sacrifice privacy to allow their ad network to target you better. https://www.blog.google/products/chrome/building-a-more-private-web/ https://www.blog.google/products/chrome/building-a-more-priv... In which they explicitly track you more under the guise of protecting your privacy. https://github.com/jkarlin/floc https://github.com/jkarlin/floc For every single claim Google makes about being pro-privacy, their definition of privacy ("data shared between you and Google and no one more") is implicit. It's a surveillance company that makes proprietary software to sell you ads. As soon as you get that into your head, you'll be much less shocked. "We personally get to track you" is not a unique stance, and it's far from a backdoor. It's just another vile move from a surveillance company that's pretty explicit that that's their goal.

JadeNB 7y ago
Sure, the general pattern of behaviour is familiar, but I didn't know about this specific manifestation, and now I do. What's the use of being so dismissive about specific information on which one can act?
- kick 7y ago
  It's not a backdoor! Calling random anti-consumer behavior a backdoor is the privacy-equivalent of Godwin's law.

bamboozled 7y ago

You should also donate to Mozilla because it’s an insanely good piece o software for the price!

dgudkov 7y ago
Mozilla Corporation which makes the browser doesn't accept donations.
- throwawa66 7y ago
  Do you know why that is?
  - tsukurimashou 7y ago
    because otherwise users would have a saying in the direction web browsers evolve and Google would be sad Half kidding there
    - throwawa66 7y ago
      So they’re accepting donations after all?
  - maeln 7y ago
    Mozilla Corporation is a for-profit company. Depending on the legislation it is sometimes forbidden to take donation, or at least very difficult/limited for company. Mozilla Foundation is the non-profit organization (and they do take donation).
    - Mountain_Skies 7y ago
      They probably can take donations just fine but there is no tax deduction for the donor.
      - throwawa66 7y ago

eitland 7y ago

I haven't read this carefully enough to decide exactly how bad it is, but one thing seems clear to me: From what I see many techies are now aware and upset, and hardly anyone seems to want to defend Google anymore. I consider it more likely than not that Google will take some real beatings in the years to come. Kind of like Microsoft was fined by the US and EU, forced to advertise for competing browsers and ridiculed by Apple ads. On a case by case basis I think some of this will be well deserved, some less so, but few outside of employees and shareholders will cry. I also guess a lot of people, including certain owners and many in management hasn't deciphered the writing on the wall yet, and in that case it whatever comes next will be surprising.

throwawa66 7y ago
More and more people are blocking ads. Google’s business model is under threat. They will turn into hyenas in order to survive.
- eitland 7y ago
  Good point. Although I feel their hyena nature has been visible for a while now and what we are now seeing is hungry hyena :-)
  - throwawa66 7y ago
    Oh it will get worse. Youtube will be riddled with ads every 5 minutes or so. Will take the cable tv path soon. The good news is that their greed will eventually crash themselves. Hey, i dont mind a little ad here and there even though I give 0 fucks about any product being advertised. But the quantity is becoming hard to process without adblockers. Had they not taken the full evil mode path I’d have considered paying for youtube. I think im better of weaning myself off almost completely. Or alternatives...
- kmlx 7y ago
  i think their business model is just fine: https://www.google.co.uk/amp/s/9to5google.com/2020/02/03/alphabet-q4-2019-earnings/amp/ https://www.google.co.uk/amp/s/9to5google.com/2020/02/03/alp...

ec109685 7y ago

You can see all the domains they add the header to here: https://chromium.googlesource.com/chromium/src/+/master/components/variations/net/variations_http_headers_unittest.cc https://chromium.googlesource.com/chromium/src/+/master/comp... Previous discussion: https://news.ycombinator.com/item?id=21034849 https://news.ycombinator.com/item?id=21034849

tbodt 7y ago
Actual list: https://cs.chromium.org/chromium/src/components/google/core/common/google_util.cc?q=IsGoogleAssociatedDomainUrl https://cs.chromium.org/chromium/src/components/google/core/...
- chatmasta 7y ago
  This seems like a cut-and-dry case of getting caught in monopolistic behavior. The code is right there. The Chrome codebase has special features for Google’s own web properties. I hope all these AGs suing google have some good tech advisors. It’s hard to keep track of all the nefarious things google has been up to over the past decade.
  - c0restraint 7y ago
    Perhaps you can send a summary to them, including the evidence?
  - akersten 7y ago
    > This seems like a cut-and-dry case of getting caught in monopolistic behavior. The code is right there. ??? Is "Darn, their browser only gets to track me on their own websites; if Google were playing fairly, they'd send the tracking header to all websites so I can be tracked more and have less privacy" the argument you're making here? And it's debatable that this header is actually serving a tracking purpose at all. Being limited to their own web properties cements it as a diagnostic to me. What use is a tracking header that only gets sent to domains they already know you're visiting?

owaislone 7y ago

I visited my family a couple of weeks ago and was shocked when my father told me that his phone 'received' some of our photos. I checked and a huge chunk of whatsapp photos that were backed up by my wife's phone had ended up in my dad's Google Photos account. I discounted it as my wife accidentally sharing the whatsapp folder with my dad but now I'm not so sure.

Cthulhu_ 7y ago
Yup, that's one of the issues you'll get with interlinked accounts; in this case, Whatsapp backs up / stores photos automatically to your phone's photo gallery, and said photo gallery is automatically synchronized with the cloud. I don't know exactly what's going on with your wife's / your father-in-law's accounts though, are they sharing Google accounts, photo albums, or were the photos shared in the same whatsapp group?
- owaislone 7y ago
  > are they sharing Google accounts, photo albums, or were the photos shared in the same whatsapp group? None of these. They don't share any accounts. I don't share any account with my father either. Me and my wife use the shared galley feature. The photos that ended up on my fathers phone were shared by me and my wife with each other on whatsapp. I suspect either mine or my wife's gallery somehow "leaked" into my fathers even though none of the accounts have any connections AFAICT. Probably we clicked some share button somewhere accidentally but I couldn't find any shared galleries on any of our phones.

marriedWpt 7y ago

Ahh the good ol HN "stop using Google and start using Firefox" advertisement. It's a bit odd to see this in every Google thread. Btw, Firefox is too slow.

fortran77 7y ago
It's not odd at all. It's what the folks at Mozilla do. They jump in to every thread to push Firefox and Rust and make people think it's more widely used/better than it is.
- falcolas 7y ago
  Not everything is a conspiracy. I'm not a Mozilla employee, have never been one (probably never will be one). Firefox is awesome, fast, and extensible. It's my daily driver for all of my machines.
  - SamPatt 7y ago
    Same. It works great and uses less RAM than Chrome.
  - bonestamp2 7y ago
    Side question: I've been trying to switch to firefox as my main browser but one thing is holding me up. When I'm using a private window, cookies are not shared between private tabs. I can see the advantage to that behavior, but is there a way to share them so that I can be logged into the same site in multiple private tabs? Unironically, I haven't had any luck googling this problem.
    - falcolas 7y ago
      If you open a new tab from an existing tab, your session persists across tabs. So, for example, middle clicking on the Hacker News logo will preserve your HN session across tabs.
      - 7y ago

reaperducer 7y ago

I don't understand why Google and some other tech companies use their users as involuntary, unpaid guinea pigs. No consent. No opt-out. What's the motivation? Is it simple laziness because they don't want to deal with wetware? Is it afraid that if people knew what was happening they wouldn't be happy? Google has eighty brazillion employees it can test new features on.

duxup 7y ago
Isn't that what most A/B testing is?
- reaperducer 7y ago
  No, it's what unethical A/B testing is.
  - duxup 7y ago
    " involuntary, unpaid guinea pigs. No consent. No opt-out" That sounds like all A/B testing...
    - csallen 7y ago
      "Scientists run tests on guinea pigs. A/B testers run tests on me. Therefore I am a guinea pig. Guinea pigs have no rights. Therefore A/B testers are taking away my rights." I've never been a fan of this particular type of logic and reasoning (or lack thereof).
      - duxup 7y ago
        Yeah I agree. A/B testing is generally ... innocuous. The idea that such a pattern is as severe / bad as described I don't think makes sense.
    - bayindirh 7y ago
      Firefox's testing (aka studies) are opt-in, not opt-out.

_jal 7y ago

I was fooled by Google for a while, thinking it was less evil than FB. They're just a little smarter about their shittiness.

chrshawkes 7y ago

I noticed this when doing work with Puppeteer lately. I thought about reporting it but didn't exactly know what I was looking at.

deeblering4 7y ago

I see people recommending Firefox, but I'll say that for mac users Safari is a very usable browser too. It's quite fast, and to my knowledge is not collecting/sharing my personal data with apple. https://www.apple.com/privacy/ https://www.apple.com/privacy/ These days I only use chrome for the g-suite tools that seem to require it to avoid mid-meeting crashes.

throwawa66 7y ago
Safari as well. Almost anything but Chrome. Both Safari and FF are good. Im only using these 2 myself
Kiro 7y ago
Safari is horrible for HTML5 games. Dealing with all sorts of issues to the point where I've more or less given up and just tell my Safari players to use something else.
- ainar-g 7y ago
  Some of my front-end colleagues like to tell me that Safari is the new IE 6. Not in terms of the market domination (that's Crhome for you), but in terms of dragging the front-end back with unimplemented features, quirks, and bugs. The amount of hacks they have to add just to support Safari is uncomfortable.
  - yohannparis 7y ago
    No, they are confusing developing for Chomium first and not testing on all browsers. Safari is behind in terms of W3C features. But implementing unsupported features does not mean you are hacking to support Safari. They should look into the progressive enhancement principle and CSS @support feature.
    - Kiro 7y ago
      I'm strictly talking about the canvas and audio implementations, forcing me to use all kind of different hacks just to get a reasonable FPS in Safari. Audio I've given up on long time ago and don't get me started on Mobile Safari.

BLO716 7y ago

With that said, one can simply filter out these analytics with a c:\Windows\Systems32\Drivers\etc\hosts -> pointing to 0.0.0.0 or PiHole solution (https://pi-hole.net/ https://pi-hole.net/), yes? I mean, this is probably not the holistic solution, but this is why we have a firewall, vpn, antivirus, filters to just keep DNS in check, yes?

GrayShade 7y ago
So are you suggesting people should DNS block google.com and gmail.com?
- BLO716 7y ago
  There are certain sub-domains that block certain things that keep most of the bad guys at bay, but to some extent yes. This is a fringe case of those activities, but being paranoid is not a bad thing these days, considering the level of red team activity and bad actors probing your network / computer / devices. Short of putting on the tin foil hat, mind you.
janvidar 7y ago
Yes, you can if you are willing to block google.com, android.com and youtube.com. doubleclick.com might not be terrible for most, though. Interesting enough, it does not add headers when accessing a country specific google domain in the EU - such as google.de or google.fr. Is that GDPR kicking in - with a nod the the brexiteers given that google.co.uk gets these headers... ?
- ins0 7y ago
  Not sure, but my chrome will send the additional `x-client-data` header even when i'm on eg. `google.de`

scoutt 7y ago

PII concept is not the same for everyone/everywhere. For GDPR we have: > Article 4(1): ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; If this chrome browser ID is matched against a (for example) google account, then they can track every single person. And that is just a couple of IDs, let alone all the quantity of data they have. It's against GDPR to not be clear about this kind of ID. If my browser has an unique ID that is transmitted, then this ID can be coupled with other information to retrieve my identity and behavior, so it should be informed (in the EU). EDIT: TD;LR, hiding behind "there is no PII in that ID" is not enough.

Mirioron 7y ago
Who's going to raise this issue though? And what if they put this in the browser's T&C?
- scoutt 7y ago
  > Who's going to raise this issue though? I'm sure there is someone out there who takes these kind of things seriously. Not me. I use firefox for that matter. > And what if they put this in the browser's T&C? Then the rest of GDPR applies: a clear message about the browser sending this info has to be shown, explaining why, with who they'll share it, the time they will keep this info, plus no auto opt-ins, the possibility of asking Google (or whatever) all the info relative to this ID and the option to cancel all the data, etc.
- pbhjpbhj 7y ago
  I thought they needed explicit consent. T&Cs ain't that.
shadowgovt 7y ago
This is why I consider the GDPR to be unrealistically broad in its definition of PII; it denies even innocuous feature-mode-distinguishing headers intended to allow for bug-identification of massively-distributed software installs. If I'm given a forced choice between "more privacy" and "better software quality" I'm going to lean towards "better software quality."

c16 7y ago

Chrome explicitly having a line [1] of code to not send the `x-client-data` header to Yahoo made me laugh. [1] https://chromium.googlesource.com/chromium/src/+/master/components/variations/net/variations_http_headers_unittest.cc#47 https://chromium.googlesource.com/chromium/src/+/master/comp...

jcl 7y ago
FWIW, it looks like that's a test case -- it is not part of Chrome itself. They most likely just wanted an example of a third-party website, and could have used any non-Google site there.
- c16 7y ago
  Yes, But they tested Yahoo of all websites to make sure they don't send tracking data, and not an unrelated website like wikipedia or archive.org. The only non-google test case too I might add.
  - gruez 7y ago
    It's a test case I wouldn't read too much into it. Maybe it's evidence of a massive anti-trust conspiracy at google, but it could very well be because it's the first domain that came to the programmer's mind at the time.
    - jmccorm 7y ago
      I wasn't aware of this, but it still seems like a thread worth pulling on. You're assuming, right? The reason I ask is that using any third-party company seems inappropriate. Even more so when Google has plenty of domains of its own to test against. Even more so when it is against a media/advertising company. And again, even more so against a company that changed from Google to Bing to power their search function. It seems to be an inappropriate or poor choice, doesn't it? There's no smoking gun here, but I don't think that concern might be dismissed out of hand. It might be good to see what Yahoo's take on this. This could even evolve into participation by the US Attorney General. I'd like to know more, either way. Like if Yahoo was independently added to the list at a later date, or if it was there from the start?

carlsborg 7y ago

If you strace chrome on linux it also picks up /etc/machine-id (or it did back when I looked), which is a 32 byte randomly generated string which uniquely identifies you and on some systems is used as the DHCP ID across reboots.

commotionfever 7y ago
firefor / tor also read this file
- pbhjpbhj 7y ago
  What does tor do with it? Maybe pass it along in packet timing intervals, or something ... ;o)
augustk 7y ago
And this is a legal thing to do?
throwaway8941 7y ago
Which (among many other things) can be faked with firejail, if you absolutely have to run Chromium (e.g. for testing): --machine-id Spoof id number in /etc/machine-id file - a new random id is generated inside the sandbox. Example: $ firejail --machine-id
- GrayShade 7y ago
  Chromium doesn't seem to read that file.
chatmasta 7y ago
When puppeteer first came out I was nervous to use it for scraping because I could totally see Chrome pulling tricks like this to help recaptcha in identifying the bots. I’m still not convinced they aren’t.
xfs 7y ago
First I thought reading /etc/machine-id would be expected if Chrome uses D-bus or pulseaudio libraries which depend on D-bus, and /etc/machine-id is part of D-bus. But no, they really use it for tracking purposes. And in a sick twist they have this comment for it: std::string BrowserDMTokenStorageLinux::InitClientId() { // The client ID is derived from /etc/machine-id // (https://www.freedesktop.org/software/systemd/man/machine-id.html). As per // guidelines, this ID must not be transmitted outside of the machine, which // is why we hash it first and then encode it in base64 before transmitting // it.

Ohn0 7y ago

What a mess

fnord77 7y ago

Can browser plugins control what headers go out? If so then a simple browser plugin could put a stop to this.

8ivek 7y ago

Got this from google white paper: "run Chrome with the command line flag "--reset-variation-state" to reset the value." I tried this and my "x-client-data" header changed.

mooreed 7y ago

It seems like a reasonable time to bring up the reformer project 'ungoogled-chrome' [1]. I have used it and new versions of Firefox for over 3 years and have seldom had to jump back to `Googlified Chrome.` Do know that installing via `brew` [2] means no - standard browser auto-update. Which in this case, makes sense to me. Aside: It seems to me the realist punk / anti-the-man software one can work on is a user respecting browser. I don't work on these, but I am very grateful for those out there who do. ------- - [1]: https://github.com/Eloston/ungoogled-chromium#downloads https://github.com/Eloston/ungoogled-chromium#downloads - [2]: Brew install via: `brew cask fetch eloston-chromium && brew cask install eloston-chromium` Enjoy old school browsing with new school development benefits.

balls187 7y ago

This is why I use firefox for personal browsing, and edge for work. Now that Edge / Chromium is out of beta, even better.

woho 7y ago

I use (sometimes/often) mitmproxy and remove or change suspect headers. It is also nice to remove all the fb, google and more crap from the html. And much more. It is a lot of work not to break a website. I don't know whether I am more trackable or not - this is the 'only browser' without x-client-data header.

raxxorrax 7y ago

This it outrageous. Browsers are user-agents, not advertising accelerators. They should hide as much personal identifiable information as possible. This is exactly why using a browser from an advertising company is not a good idea. They use it to improve their service... The lie gets old... This comment was sadly written in Chrome, since I need it for testing... edit: pretty much exactly 10 years ago they already tried their shit with a unique id. We should have learned from that experience.

jaywalk 7y ago
Well when the browser is created by an advertising company...
deleted 7y ago
[deleted]
iakov 7y ago
>This comment was sadly written in Chrome, since I need it for testing... You realize you can have multiple different browsers installed, right?

sergiotapia 7y ago

I dropped chrome a long time ago and switched to Brave. Does Brave have these same issues, considering it uses webkit for it's rendering engine? Am I just being paranoid? What a tumor google has become.

pier25 7y ago
Brave uses Chromium not Webkit.

bprasanna 7y ago

Obviously! What else to expect from Google! In the user personalization...

cft 7y ago

Just in time for their announcement that they plan to abolish third party cookies by 2021. Talk about monopoly.

orthecreedence 7y ago

I hate to say this, but duh. It's a closed-source browser made by an ad company. What the hell to do people expect?

bsharitt 7y ago

Everybody imagine going back 15 years and tell yourself that you're using a web browser made by the parent company of DoubleClick. Your 15 year ago self would think you're a moron (assuming that 15 years ago you were old enough to know what DoubleClick was).

antisthenes 7y ago
Doubleclick ads were, originally, what prompted me to seek an adblock extension. I think it was around 2006 that I got the extension for Firefox; Google bought them about a year later.
Andrex 7y ago
I can only speak for myself, but myself from 15 years ago would not have cared so strongly about the choice of browser. I believe I was using the newly-ad-less Opera at the time, and new/cared little about the company making it.
kokey 7y ago
My 15 year ago self would have taken a double helping of DoubleClick if my only choices were that or Internet Explorer 6.
- heavyset_go 7y ago
  Firefox and Opera existed at the time.
rplnt 7y ago
I always believed that tech-savvy people using Google Chrome are morons. It's the perfect blend of Google being evil trying to force it to everyone, the browser being dumbed down to masses so much it's missing the most basic features, and I guess privacy concerns too when using browser from advertising company.
- InterestBazinga 7y ago
  > DoubleClick What browser would you recommend?

MrZongle2 7y ago

I am Jack's complete lack of surprise. Firefox and DuckDuckGo, folks. Today's Google is no more benevolent than yesterday's Microsoft.

nurettin 7y ago

Please do not destroy vital testing apparatus.

jkepler 7y ago

Am I correct to understand that this backdoor tracking of individual users applies to the standard Chromium browser (i.e., the non Eloston ungoogled-chromium) as well as the Chrome browser? If so, its incredibly consistent with Google's surveillance capitalist business model.[1] Wow. I'm thankful for Firefox. -- [1] "The Age of Surveillance Capitalism", by Shoshana Zuboff, reviewed here: https://www.theguardian.com/books/2019/feb/02/age-of-surveillance-capitalism-shoshana-zuboff-review https://www.theguardian.com/books/2019/feb/02/age-of-surveil...

everdrive 7y ago

Is this Chrome the browser, ChromeOS, or both? And if so, will it be in Chromium?

AlphaWeaver 7y ago

According to this source code [0], it looks like this is in Chromium as well. Does that mean this affects Electron applications? [0]: https://chromium.googlesource.com/chromium/src/+/master/components/variations/net/variations_http_headers.cc https://chromium.googlesource.com/chromium/src/+/master/comp...

nornagon 7y ago
Electron maintainer here. Electron does not send this header.
- croh 7y ago
  Thanks for clarification.
Ndymium 7y ago
Checked that Vivaldi doesn't seem to be sending this header.
currysausage 7y ago
Edge ("Edgium") doesn't appear to send this header. Neither does Chrome in Private or Guest Mode.

dazbe 7y ago

Wow, I didn't think sensationalist headlines were allowed on HN. I'm guessing mods are asleep or just don't care anymore. Edit: If the mods are listening, I've come up with an alternative title for you: "The Evil GOOGLE Has Installed a MALICIOUS BACKDOOR On All Chrome Users Machines To Sell PERSONAL DATA to RUSSIAN HACKERS on the DARK WEB". This will surely get the clicks now. You can thank me later.

dang 7y ago
The mods were asleep. That happens sometimes. If you really want to help, suggesting an accurate and neutral title, preferably using representative language from the article itself, is a great way to do that. We don't know enough to get it right in every case, even when awake.

nacho2sweet 7y ago

Break this company up.

jgon 7y ago

U S E F I R E F O X That is all.

masterfooo 7y ago

How about Electron apps?

outside1234 7y ago

Does this apply to Edge installations? (If not, another great reason to move to Edge.)

a3n 7y ago

"It's only metadata." https://en.wikipedia.org/wiki/PRISM_(surveillance_program)#Responses_to_disclosures https://en.wikipedia.org/wiki/PRISM_(surveillance_program)#R...

fnord77 7y ago

Can scripts from non-google sites making XHR requests to google domains see the outgoing request headers?

dmtroyer 7y ago

I must be dense but I never see the `x-client-data` header in the request headers of the network tab in developer tools.

calibas 7y ago
I just checked, I see it on Chrome when fetching resources from google.com, youtube.com, gstatic.com, and googlesyndication.com.
throwawaylolx 7y ago
I just tried it now on google.com, and it sent it in 6 requests. You can ctrl+f in developer tools in Chrome.
- dessant 7y ago
  I think extensions can filter out the x-client-data header, though Google should definitely make this data collection opt-in. GDPR is very clear about this data being personal information [1], since Google has access to the IP address on the receiving end, which has been repeatedly tested in courts as being personal data. Google is engaging in personal data harvesting without user consent and control, and no amount of mental gymnastics presented in their privacy whitepaper [2] will save them in courts. [1] https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... [2] https://www.google.com/chrome/privacy/whitepaper.html#variations https://www.google.com/chrome/privacy/whitepaper.html#variat...
  - dmtroyer 7y ago
    Oh interesting, it must be an extension that is filtering it out for me (Ghostery, DDG Privacy Essentials or Adblock Plus in my case)
- GrayShade 7y ago
  Can you also test under the incognito mode?

CommanderData 7y ago

We need the GDPR equivalent in the US.

StevePerkins 7y ago

Is this at the "Chrome" level, or baked in at the "Chromuim" level? And therefore also an issue for Brave, Opera, Vivaldi, new-Edge, and anything else jumping on the browser engine monoculture?

jakoblorz 7y ago
Don't forget Electron! Like Atom, VS Code etc
- nornagon 7y ago
  Electron maintainer here. Electron doesn't send this header.
  - NotSammyHagar 7y ago
    Thank you for that.
aloknnikhil 7y ago
This is specifically on Chrome, it seems.
robin_reala 7y ago
Seems to be Chromium judging by some issue comments: https://github.com/chromium/chromium/blob/ccd149af47315e4c6f2fc45d55be1b271f39062c/components/variations/net/variations_http_headers.cc#L90 https://github.com/chromium/chromium/blob/ccd149af47315e4c6f...
deleted 7y ago
[deleted]
pier25 7y ago
I don't see it in Brave
98codes 7y ago
I just checked Microsoft's Chromium-based Edge, and it isn't sending the headers.

sub7 7y ago

The sad part is that most times Google violates your privacy, it's just some PM who thinks having some data will be super important and in most cases they're wrong. Caveat here is that in 99.99999% cases it's also the case that nobody ever looks at your individual file but the fact that they could is bad enough.

bilekas 7y ago

Jesus.. It gets better and better..

d1zzy 7y ago

TL;DR I think whoever posted that is trying to bury the UA anonymizing feature by derailing the discussion. What I'm seeing is an RFC for anonymizing parts of User-Agent in order to reduce UA based fingerprinting, which improves everyone's privacy, that's a good thing! Then I see someone comments how that could negatively impact existing websites or Chromium-derived browsers, comments which are totally fair and make an argument that may not be a good idea doing this change because of that. Then someone mentions the _existing_ x-client-data headers attached to requests that uniquely identify a Chrome installation. Then a lot of comments on that, including here on HN. To me that's derailing the original issue. If we want to propose that Chrome remove those headers we should do so as a separate issue and have people comment/vote on that. By talking about it on the UA anonymizing proposal we are polluting that discussion and effectively stalling that proposal which, if approved, could improve privacy (especially since it will go into Chromium so then any non-Chrome builds can get the feature without having to worry about x-client-data that Chrome does).

dessant 7y ago
This is the equivalent of a protest, people are objecting to Google's illegal data harvesting practices in places that receive engagement, since that's the most effective way to get the word out and warn others. Google's reasoning that this is not personal data is meaningless in the face of GDPR, which considers an IP address personal data. Google has access to the IP address when they receive the data, therefore they are transmitting personal information without user consent and control, which is illegal.
- csagan5 7y ago
  It could be argued that a similar violation is present (since March 2019) in Chromium for the Widevine CDM provisioning request, see https://github.com/bromite/bromite/issues/471 https://github.com/bromite/bromite/issues/471 Basically all users opening the browser will contact www.googleapis.com to get a unique "Protected Media Identifier", without opening any web page and even before any ToS/EULA is accepted (and there is no user consent either).

Havoc 7y ago

I’ve taken to using FF for browsing With noscript etc and chrome for when I need something to work well and can accept some tracking

deleted 7y ago
[deleted]

drderidder 7y ago

New motto: "Don't get caught being evil".

deleted 7y ago

[deleted]

sutro 7y ago

Bypassing CORS checks by "hiding" X-Client-Data: https://chromium.googlesource.com/chromium/src/+/f3ceca9d0fd61ffd099daf24847e27562b7da933 https://chromium.googlesource.com/chromium/src/+/f3ceca9d0fd...

csagan5 7y ago

Credits to the ungoogled-chromium project [0] for the patch [1] which is also used in Bromite since 15 February 2018 to prevent this type of leaks; see also my reply here: [2] [0]: https://github.com/Eloston/ungoogled-chromium https://github.com/Eloston/ungoogled-chromium [1]: https://github.com/bromite/bromite/blob/79.0.3945.139/build/patches/ungoogled-chromium-Disable-Google-host-detection.patch https://github.com/bromite/bromite/blob/79.0.3945.139/build/... [2]: https://github.com/bromite/bromite/issues/480#issuecomment-582070839 https://github.com/bromite/bromite/issues/480#issuecomment-5...

gcb0 7y ago
Which is not the right way to solve this problem. This is the reverse ad blocker problem. Just use firefox, where we can at least pretend that the full time paid contributors are not trying to shove Advertising and Tracking on us.

troseph 7y ago

No Facebook Firefox PiHole is my Live Love Laugh

olliej 7y ago

Am I getting this right? Irrespective of whether you use any other google products, if you use chrome google can now track you over any property that uses google ads, recaptcha, etc. The header is inserted by the browser after any extensions run, and google pins google properties so you can have an intermediate proxy that strips the header, so they gain persistent tracking of all users across most of the web? If it wasn’t a tracking vector why do they limit it to just google ads, etc? Why not other ad providers as well?

haecceity 7y ago

What does freezing mean here?

ravedave5 7y ago

It appears that chrome based Edge does not send this header. I've switched to firefox for everything I can switch, perhaps it time to use Edgeium over chrome for anything else.

pbhjpbhj 7y ago
MS Windows probably used the Skype to fingerprint you already, and don't need the browser to do it explicitly?

KenanSulayman 7y ago

Don’t forget that even if the number is varying only in an interval of 0 and 7999, this means without cookies a unique chrome installation can be identified if multiple users are using the same IP, like residential houses with families, etc. — that way it is possible to determine the unique amount of devices inside a house.

KCUOJJQJ 7y ago
>that way it is possible to determine the unique amount of devices inside a house. There are exceptions I guess. Imagine 8000 households in which couples live. Both partners own the same MacBook model. In 1/8000 cases Google would think there is only one person.

EastSmith 7y ago

Downvote me how many times you want, but Mozilla needs to fork Chromium, degoogle it and fix the web. Mozilla is the only internet entity I can say I trust, I am donating to it, and yet I am using Chrome and Brave on both Desktop and mobile. Just follow the users and fork it!

jrockway 7y ago
Mozilla makes a web browser called Firefox. You should try it!
- EastSmith 7y ago
  I've used it for many years, then switched to chrome and since then I've tried it more times that I want to admit. I am also donating to it.
  - lucasverra 7y ago
    Switch to Edgium then - FF user
ivm 7y ago
Microsoft kind of did it with the new Edge: https://www.theverge.com/2019/4/8/18300772/microsoft-google-services-removed-changed-chromium-edge-browser https://www.theverge.com/2019/4/8/18300772/microsoft-google-...
- EastSmith 7y ago
  I am using it, but Microsoft, as Brave and Google is a commercial entity I do not trust.
pbhjpbhj 7y ago
Well Mozilla burnt my trust in them over the last couple of years ... maybe Brave? Some don't like their model to tip content providers but they seem - and I've not made rigorous enquiries here (please inform!) - to be a relatively trustworthy mod of Chromium!?

krick 7y ago

Lol, is it news? I mean, it worked like this as long as I can remember, privacy conscious users were complaining for years, helplessly watching as Chrome market share grows, but nobody really cared, so... And now, suddenly, people act like this is big news and they are outraged by such blatant and unexpected(!) intrusion into their privacy. Wow. I don't even know how I feel about it anymore.

jacobwilliamroy 7y ago

Is this also true for all the standalone binaries that embed chromium?

metastart 7y ago

It's not in the Epic Privacy Browser (a chromium-based web browser) :-). Is it in Chromium?

blfr 7y ago

And, since it's per installation, it nicely ties all your profiles together for Google.

nojvek 7y ago

Well why does Chrome send this special header to only Google properties like YouTube and search and not the rest of the internet. It really seems fishy and a lot of double speak. I really don’t trust Google here.

bonestamp2 7y ago
> and not the rest of the internet Privacy issues aside, this might not help an antitrust case if one is brought against them.

userbinator 7y ago

As long as web developers continue to create (app-)sites that only work in the latest versions of Chrome(and Chromium-ish) browsers, giving users little effective choice over what browsers they can use, this sort of abusive behaviour will continue. The sort of "feature-racing" that Google engages in is ultimately harmful for the open web. Mozilla struggles to keep up, Opera surrendered a while ago, and more recently, Microsoft seems to have already given up completely. I feel like it's time we "hold the Web back" again. Leave behind the increasingly-walled-garden of "modern" appsites and their reliance on hostile browsers, and popularise simple HTML and CSS, with forms for interactivity, maybe even just a little JavaScript where absolutely necessary. Something that is usable with a browser like Dillo or Netsurf, or even one of the text-based ones. Making sites that are usable in more browsers than the top 2 (or 1) will weaken the amount of control that Google has, by allowing more browsers to appear and gain userbases.

TheCraiggers 7y ago
I wish, but that's not what most people want. Hell, it's not what designers want. Thinking back to the Myspace days, people would have the worst websites imaginable. Granted, that was all done with little more than HTML and javascript, but I have little doubt what they would have done with things like HTML5 and even more javascript.
- AndrewKemendo 7y ago
  I have to agree with this. The last decade or so has really reinforced to me that we all ignore or are ignorant of fundamental structural problems with most of the systems we rely on - with us wanting them to "just work." We're all guilty of this, we just see it up close for the things that we're building and chide others who don't care. Meanwhile we ignore other fundamental structures of modern society.
- asdff 7y ago
  There's got to be a balance between every website looking exactly the same and fading out of my memory with one identical hamburger menu after another and dancing babies on geocities.

mirimir 7y ago

I've always assumed that everything I install tracks me through some unique ID. That's arguably wrong for typical Linux packages, but being right just once is enough to justify the assumption. And for Google, it's arguably foolish to think that they don't.

altitudinous 7y ago

IP address inspection has been getting a large amount of attention recently. It is considered a privacy violation, yet it is required to determine location, so devs know which privacy laws apply. GDPR only applies in Europe, and CCPA only applies in California. How is one meant to determine which set of laws applies inside a piece of software without being able to determine location? A waste of time (don't bother) answer is : Just apply maximum privacy everywhere and you won't have to worry about it... The response is always going to be - Many free tools you use are funded by advertising etc and advertising depends on being able to know where someone is, at least to the country level. Cutting off location and therefore revenue is not going to give people the software they want. Other facts that usually matter - only 1-2% of people want to pay for private software. Everyone else wants the free option. Source : my apps. How is software meant to determine location?

deleted 7y ago

[deleted]

om2 7y ago

I'm surprised this hasn't gotten any mainstream tech press attention. Chrome's Privacy Whitepaper describes a number of privacy-questionable nonstandard headers which are only sent to Google services. Just try searching for X- here: https://www.google.com/chrome/privacy/whitepaper.html https://www.google.com/chrome/privacy/whitepaper.html And for ease of reading, a few others: > On Android, your location will also be sent to Google via an X-Geo HTTP request header if Google is your default search engine, the Chrome app has the permission to use your geolocation, and you haven’t blocked geolocation for www.google.com (or country-specific origins such as www.google.de) > To measure searches and Chrome usage driven by a particular campaign, Chrome inserts a promotional tag, not unique to you or your device, in the searches you perform on Google. This non-unique tag contains information about how Chrome was obtained, the week when Chrome was installed, and the week when the first search was performed. ... This non-unique promotional tag is included when performing searches via Google (the tag appears as a parameter beginning with "rlz=" when triggered from the Omnibox, or as an “x-rlz-string” HTTP header). > On Android and desktop, Chrome signals to Google web services that you are signed into Chrome by attaching an X-Chrome-Connected and/or C-Chrome-ID-Consistency-Request header to any HTTPS requests to Google-owned domains. On iOS, the CHROME_CONNECTED cookie is used instead.

RonanTheGrey 7y ago
Holy rotten metal batman... those are pretty bad. Why in the world isn't everyone up in arms over this?....

hitpointdrew 7y ago

Not shocking. I never trusted Chrome, and never switched over to it. I never understood that Firefox hate. I never thought it was "slow" like so many complaints I have seen. Apparently Firefox is fast and amazing again, I certainly think it is better than it was a several years ago, but again even several years ago I didn't ever think it was slow.

codedokode 7y ago

By the way, if you use Chrome and Google as a default search engine, Google gets a signal from your browser (with cookies) every time you open a new tab. You can check it with DevTools.

marco1 7y ago

Analysis of the same tracking mechanisms from September 2018, and its discussion on HN late last year: https://news.ycombinator.com/item?id=21034849 https://news.ycombinator.com/item?id=21034849