12 ms·

Not endorsing this, but according to https://www.google.com/chrome/privacy/whitepaper.html#variations https://www.google.com/chrome/privacy/whitepaper.html#vari

by janpot 7y ago

Not endorsing this, but according to https://www.google.com/chrome/privacy/whitepaper.html#variations https://www.google.com/chrome/privacy/whitepaper.html#variat... > We want to build features that users want, so a subset of users may get a sneak peek at new functionality being tested before it’s launched to the world at large. A list of field trials that are currently active on your installation of Chrome will be included in all requests sent to Google. This Chrome-Variations header (X-Client-Data) will not contain any personally identifiable information, and will only describe the state of the installation of Chrome itself, including active variations, as well as server-side experiments that may affect the installation. > The variations active for a given installation are determined by a seed number which is randomly selected on first run. If usage statistics and crash reports are disabled, this number is chosen between 0 and 7999 (13 bits of entropy). If you would like to reset your variations seed, run Chrome with the command line flag “--reset-variation-state”. Experiments may be further limited by country (determined by your IP address), operating system, Chrome version and other parameters.

rvnx 7y ago
They key in the wording is: "If usage statistics and crash reports are disabled, this number is chosen between 0 and 7999 (13 bits of entropy)." "If, statistics are disabled." In chrome://version you can see the active variations. It seems to be pretty big numbers to be significant, and so far haven't observed duplicates. Since this header is generated server-side, you have only to believe I guess ? Plus why Doubleclick would need it :)
- userbinator 7y ago
  That's basically saying "even if you opt out, we'll still try to track you, just not as much." Very unpleasant, but then again I'm not surprised to see this attitude from Google.
  - m463 7y ago
    Combine a few pieces of information like this and you get a decisively unique fingerprint. For example identifying individuals at work behind the same ip address.
JMTQp8lwXL 7y ago
Is there a reason for only sending this header to Google web properties and not all domains?
- macinjosh 7y ago
  It is an abuse of Chrome's position in the marketplace. Google is using their powerful position to give themselves tracking capabilities that other online players can't access. It is a major competitive advantage for Google.
  - killface 7y ago
    can't alternate browser makers who base on chromium simply disable that portion? like, I expect identifying users was a key business concern in moving Edge to Chromium. Is there something (other than work) preventing them from making it so it'll report back to microsoft-owned domains instead?
    - leshenka 7y ago
      I'm using Vivaldi on MacOS and it doesn't send this header. I'm sure others like Brave don't send it either.
- IshKebab 7y ago
  Err yeah, because it adds loads of data that can be used to track you.
- Cthulhu_ 7y ago
  Is it because Google's webapps will have their own a/b tests which use experimental features only available in Chrome perhaps? I mean personally I think they should do client-side feature detection and be back to being standards compliant and not creepy. The only reason why I'd consider such a flag is because they optimize the payload server-side to return a certain a/b test, but even with that they could do the default version first, do feature detection, and then set a session cookie for that domain only that loads the a/b test. My other Thought was that they test a feature that is implemented across Google's properties, e.g. something having to do with their account management.
some_random 7y ago
How many people will actually run chrome with a cli flag? It would be pretty impressive if every single person reading this thread did, but it probably won't even be that. Most people don't even touch their settings. 13 bits of entropy is far from a uuid (but to get it to that you need to disable some more settings, which again very few people do), but it's still plenty good enough to disambiguate individuals over time.
- Yeroc 7y ago
  And Google is certainly in a position to disambiguate that uuid to an individual as soon as they login to gmail or any other Google property!
pdkl95 7y ago
This is impressive doublespeak. > This ... header ... will not contain any personally identifiable information > a seed number which is randomly selected on first run ... chosen between 0 and 7999 (13 bits of entropy) They are not including any PII... while creating a new identifier for each installation. 13 bits of entropy probably isn't a unique identifier iff you only look at that header in isolation. Combined with at least 24 additional bits[1] of entropy from the IPv4 Source Address field Google receives >=37 bits of entropy, which is almost certainly a unique ID for the browser. Linking that browser ID to a personal account is trivial as soon as someone logs in to any Google service. > Experiments may be further limited by country (determined by your IP address) They even admit to inspecting the IP address... > operating system, Chrome version and other parameters. ...and many additional sources of entropy. [1] why 24 bits instead of 32? The LSB of the address might be zeroed if the packet is affected by Googles faux-"anonymization" feature ( https://news.ycombinator.com/item?id=15167059 https://news.ycombinator.com/item?id=15167059 )
- forgotmypw38 7y ago
  Don't forget that just about any registration requires recaptcha these days
- clSTophEjUdRanu 7y ago
  >Linking that browser ID to a personal account is trivial as soon as someone logs in to any Google service. Wat? You mean to tell me they can identify you if you log into their service? Am I missing something here? Who cares?
  - sildur 7y ago
    I care. I care that I even if I log off, even if I use a vpn, even if I go into incognito mode, they still can associate my requests with the account I initially logged in.
    - admax88q 7y ago
      I mean, if you don't want Google to track you, then you probably shouldn't use their browser...
flukus 7y ago
So they're tracking people and using them as guinea pigs, the lack of respect for users is astounding.
KCUOJJQJ 7y ago
Couldn't the Chrome installations receive a request from Google that says "Do you want to try out a new thing?", and couldn't the Chrome installations say yes with a certain probability? The only difference I can see is that the subset of users that are guinea pigs couldn't be the same in each test (if Google wanted that the subset is always the same).
tinus_hn 7y ago
So it’s just a poor excuse to send an evercookie.
kseistrup 7y ago
How does one apply the “--reset-variation-state” flag on a chromebook?

by janpot 7y ago

rvnx 7y ago

They key in the wording is: "If usage statistics and crash reports are disabled, this number is chosen between 0 and 7999 (13 bits of entropy)." "If, statistics are disabled." In chrome://version you can see the active variations. It seems to be pretty big numbers to be significant, and so far haven't observed duplicates. Since this header is generated server-side, you have only to believe I guess ? Plus why Doubleclick would need it :)

userbinator 7y ago
That's basically saying "even if you opt out, we'll still try to track you, just not as much." Very unpleasant, but then again I'm not surprised to see this attitude from Google.
- m463 7y ago
  Combine a few pieces of information like this and you get a decisively unique fingerprint. For example identifying individuals at work behind the same ip address.

JMTQp8lwXL 7y ago

Is there a reason for only sending this header to Google web properties and not all domains?

macinjosh 7y ago
It is an abuse of Chrome's position in the marketplace. Google is using their powerful position to give themselves tracking capabilities that other online players can't access. It is a major competitive advantage for Google.
- killface 7y ago
  can't alternate browser makers who base on chromium simply disable that portion? like, I expect identifying users was a key business concern in moving Edge to Chromium. Is there something (other than work) preventing them from making it so it'll report back to microsoft-owned domains instead?
  - leshenka 7y ago
    I'm using Vivaldi on MacOS and it doesn't send this header. I'm sure others like Brave don't send it either.
IshKebab 7y ago
Err yeah, because it adds loads of data that can be used to track you.
Cthulhu_ 7y ago
Is it because Google's webapps will have their own a/b tests which use experimental features only available in Chrome perhaps? I mean personally I think they should do client-side feature detection and be back to being standards compliant and not creepy. The only reason why I'd consider such a flag is because they optimize the payload server-side to return a certain a/b test, but even with that they could do the default version first, do feature detection, and then set a session cookie for that domain only that loads the a/b test. My other Thought was that they test a feature that is implemented across Google's properties, e.g. something having to do with their account management.

some_random 7y ago

How many people will actually run chrome with a cli flag? It would be pretty impressive if every single person reading this thread did, but it probably won't even be that. Most people don't even touch their settings. 13 bits of entropy is far from a uuid (but to get it to that you need to disable some more settings, which again very few people do), but it's still plenty good enough to disambiguate individuals over time.

Yeroc 7y ago
And Google is certainly in a position to disambiguate that uuid to an individual as soon as they login to gmail or any other Google property!

pdkl95 7y ago

This is impressive doublespeak. > This ... header ... will not contain any personally identifiable information > a seed number which is randomly selected on first run ... chosen between 0 and 7999 (13 bits of entropy) They are not including any PII... while creating a new identifier for each installation. 13 bits of entropy probably isn't a unique identifier iff you only look at that header in isolation. Combined with at least 24 additional bits[1] of entropy from the IPv4 Source Address field Google receives >=37 bits of entropy, which is almost certainly a unique ID for the browser. Linking that browser ID to a personal account is trivial as soon as someone logs in to any Google service. > Experiments may be further limited by country (determined by your IP address) They even admit to inspecting the IP address... > operating system, Chrome version and other parameters. ...and many additional sources of entropy. [1] why 24 bits instead of 32? The LSB of the address might be zeroed if the packet is affected by Googles faux-"anonymization" feature ( https://news.ycombinator.com/item?id=15167059 https://news.ycombinator.com/item?id=15167059 )

forgotmypw38 7y ago
Don't forget that just about any registration requires recaptcha these days
clSTophEjUdRanu 7y ago
>Linking that browser ID to a personal account is trivial as soon as someone logs in to any Google service. Wat? You mean to tell me they can identify you if you log into their service? Am I missing something here? Who cares?
- sildur 7y ago
  I care. I care that I even if I log off, even if I use a vpn, even if I go into incognito mode, they still can associate my requests with the account I initially logged in.
  - admax88q 7y ago
    I mean, if you don't want Google to track you, then you probably shouldn't use their browser...

flukus 7y ago

So they're tracking people and using them as guinea pigs, the lack of respect for users is astounding.

KCUOJJQJ 7y ago

Couldn't the Chrome installations receive a request from Google that says "Do you want to try out a new thing?", and couldn't the Chrome installations say yes with a certain probability? The only difference I can see is that the subset of users that are guinea pigs couldn't be the same in each test (if Google wanted that the subset is always the same).

tinus_hn 7y ago

So it’s just a poor excuse to send an evercookie.

kseistrup 7y ago

How does one apply the “--reset-variation-state” flag on a chromebook?