4 ms·

If you strace chrome on linux it also picks up /etc/machine-id (or it did back when I looked), which is a 32 byte randomly generated string which uniquely ident

If you strace chrome on linux it also picks up /etc/machine-id (or it did back when I looked), which is a 32 byte randomly generated string which uniquely identifies you and on some systems is used as the DHCP ID across reboots.

commotionfever 7y ago
firefor / tor also read this file
- pbhjpbhj 7y ago
  What does tor do with it? Maybe pass it along in packet timing intervals, or something ... ;o)
augustk 7y ago
And this is a legal thing to do?
throwaway8941 7y ago
Which (among many other things) can be faked with firejail, if you absolutely have to run Chromium (e.g. for testing): --machine-id Spoof id number in /etc/machine-id file - a new random id is generated inside the sandbox. Example: $ firejail --machine-id
- GrayShade 7y ago
  Chromium doesn't seem to read that file.
chatmasta 7y ago
When puppeteer first came out I was nervous to use it for scraping because I could totally see Chrome pulling tricks like this to help recaptcha in identifying the bots. I’m still not convinced they aren’t.
xfs 7y ago
First I thought reading /etc/machine-id would be expected if Chrome uses D-bus or pulseaudio libraries which depend on D-bus, and /etc/machine-id is part of D-bus. But no, they really use it for tracking purposes. And in a sick twist they have this comment for it: std::string BrowserDMTokenStorageLinux::InitClientId() { // The client ID is derived from /etc/machine-id // (https://www.freedesktop.org/software/systemd/man/machine-id.html). As per // guidelines, this ID must not be transmitted outside of the machine, which // is why we hash it first and then encode it in base64 before transmitting // it.
- chias 7y ago
  In fairness, the guidelines they reference suggest you do exactly what the comment says they're doing (assuming they're keying the hash). The guidelines seem explicitly written with the idea that unique identifiers _derived from_ this value are not similarly quarantined, provided that you cannot take the derived value and "reverse" it back to the original identifier. Quoting from https://www.freedesktop.org/software/systemd/man/machine-id.html https://www.freedesktop.org/software/systemd/man/machine-id....: This ID uniquely identifies the host. It should be considered "confidential", and must not be exposed in untrusted environments, in particular on the network. If a stable unique identifier that is tied to the machine is needed for some application, the machine ID or any part of it must not be used directly. Instead the machine ID should be hashed with a cryptographic, keyed hash function, using a fixed, application-specific key. That way the ID will be properly unique, and derived in a constant way from the machine ID but there will be no way to retrieve the original machine ID from the application-specific one.
  - pbhjpbhj 7y ago
    What else is going to break if one randomises that ID (per boot or per hour, say)?
    - mc3 7y ago
      What about running Chrome inside a container?
JdeBP 7y ago
That's not a correct description. * http://jdebp.uk./Softwares/nosh/guide/commands/machine-id.xml http://jdebp.uk./Softwares/nosh/guide/commands/machine-id.xm...
- carlsborg 7y ago
  True, more precisely - 16 bytes, 32 hex characters. Your link is in agreement "The machine ID is usually generated from a random source during system installation or first boot and stays constant for all subsequent boots." And See https://wiki.debian.org/MachineId https://wiki.debian.org/MachineId at least one distro uses it for the DHCP ID.
  - JdeBP 7y ago
    "At least one distro" is not correct either. It's used by systemd-networkd, specifically. * http://jdebp.uk./Softwares/nosh/guide/commands/machine-id.xml http://jdebp.uk./Softwares/nosh/guide/commands/machine-id.xm...
    - carlsborg 7y ago
      Now you are nitpicking. Your new link says exactly this “ This broadcasts the machine ID (hashed with a known fixed salt) over the LAN as the unique client identifier part of the DHCP protocol. (Other DHCP clients tend to use MAC addresses for this.) It also broadcasts the machine ID locally on each link as part of Ethernet LLDP, if enabled.”
      - JdeBP 7y ago
        It is far from nitpicking to point out the gross inaccuracy of conflating one particular software with an entire operating system. systemd-networkd is not Debian.
        carlsborg 7y ago
        Nobody is conflating these two things, you are interpreting it that way.

commotionfever 7y ago

firefor / tor also read this file

pbhjpbhj 7y ago
What does tor do with it? Maybe pass it along in packet timing intervals, or something ... ;o)

augustk 7y ago

And this is a legal thing to do?

throwaway8941 7y ago

Which (among many other things) can be faked with firejail, if you absolutely have to run Chromium (e.g. for testing): --machine-id Spoof id number in /etc/machine-id file - a new random id is generated inside the sandbox. Example: $ firejail --machine-id

GrayShade 7y ago
Chromium doesn't seem to read that file.

chatmasta 7y ago

When puppeteer first came out I was nervous to use it for scraping because I could totally see Chrome pulling tricks like this to help recaptcha in identifying the bots. I’m still not convinced they aren’t.

xfs 7y ago

First I thought reading /etc/machine-id would be expected if Chrome uses D-bus or pulseaudio libraries which depend on D-bus, and /etc/machine-id is part of D-bus. But no, they really use it for tracking purposes. And in a sick twist they have this comment for it: std::string BrowserDMTokenStorageLinux::InitClientId() { // The client ID is derived from /etc/machine-id // (https://www.freedesktop.org/software/systemd/man/machine-id.html). As per // guidelines, this ID must not be transmitted outside of the machine, which // is why we hash it first and then encode it in base64 before transmitting // it.

chias 7y ago
In fairness, the guidelines they reference suggest you do exactly what the comment says they're doing (assuming they're keying the hash). The guidelines seem explicitly written with the idea that unique identifiers _derived from_ this value are not similarly quarantined, provided that you cannot take the derived value and "reverse" it back to the original identifier. Quoting from https://www.freedesktop.org/software/systemd/man/machine-id.html https://www.freedesktop.org/software/systemd/man/machine-id....: This ID uniquely identifies the host. It should be considered "confidential", and must not be exposed in untrusted environments, in particular on the network. If a stable unique identifier that is tied to the machine is needed for some application, the machine ID or any part of it must not be used directly. Instead the machine ID should be hashed with a cryptographic, keyed hash function, using a fixed, application-specific key. That way the ID will be properly unique, and derived in a constant way from the machine ID but there will be no way to retrieve the original machine ID from the application-specific one.
- pbhjpbhj 7y ago
  What else is going to break if one randomises that ID (per boot or per hour, say)?
  - mc3 7y ago
    What about running Chrome inside a container?

JdeBP 7y ago

That's not a correct description. * http://jdebp.uk./Softwares/nosh/guide/commands/machine-id.xml http://jdebp.uk./Softwares/nosh/guide/commands/machine-id.xm...

carlsborg 7y ago
True, more precisely - 16 bytes, 32 hex characters. Your link is in agreement "The machine ID is usually generated from a random source during system installation or first boot and stays constant for all subsequent boots." And See https://wiki.debian.org/MachineId https://wiki.debian.org/MachineId at least one distro uses it for the DHCP ID.
- JdeBP 7y ago
  "At least one distro" is not correct either. It's used by systemd-networkd, specifically. * http://jdebp.uk./Softwares/nosh/guide/commands/machine-id.xml http://jdebp.uk./Softwares/nosh/guide/commands/machine-id.xm...
  - carlsborg 7y ago
    Now you are nitpicking. Your new link says exactly this “ This broadcasts the machine ID (hashed with a known fixed salt) over the LAN as the unique client identifier part of the DHCP protocol. (Other DHCP clients tend to use MAC addresses for this.) It also broadcasts the machine ID locally on each link as part of Ethernet LLDP, if enabled.”
    - JdeBP 7y ago
      It is far from nitpicking to point out the gross inaccuracy of conflating one particular software with an entire operating system. systemd-networkd is not Debian.
      - carlsborg 7y ago
        Nobody is conflating these two things, you are interpreting it that way.