8 ms·

This is impressive doublespeak. > This ... header ... will not contain any personally identifiable information > a seed number which is randomly selected on f

by pdkl95 7y ago

This is impressive doublespeak. > This ... header ... will not contain any personally identifiable information > a seed number which is randomly selected on first run ... chosen between 0 and 7999 (13 bits of entropy) They are not including any PII... while creating a new identifier for each installation. 13 bits of entropy probably isn't a unique identifier iff you only look at that header in isolation. Combined with at least 24 additional bits[1] of entropy from the IPv4 Source Address field Google receives >=37 bits of entropy, which is almost certainly a unique ID for the browser. Linking that browser ID to a personal account is trivial as soon as someone logs in to any Google service. > Experiments may be further limited by country (determined by your IP address) They even admit to inspecting the IP address... > operating system, Chrome version and other parameters. ...and many additional sources of entropy. [1] why 24 bits instead of 32? The LSB of the address might be zeroed if the packet is affected by Googles faux-"anonymization" feature ( https://news.ycombinator.com/item?id=15167059 https://news.ycombinator.com/item?id=15167059 )

forgotmypw38 7y ago
Don't forget that just about any registration requires recaptcha these days
clSTophEjUdRanu 7y ago
>Linking that browser ID to a personal account is trivial as soon as someone logs in to any Google service. Wat? You mean to tell me they can identify you if you log into their service? Am I missing something here? Who cares?
- sildur 7y ago
  I care. I care that I even if I log off, even if I use a vpn, even if I go into incognito mode, they still can associate my requests with the account I initially logged in.
  - admax88q 7y ago
    I mean, if you don't want Google to track you, then you probably shouldn't use their browser...
  - meowface 7y ago
    The problem is any website can do that. Incognito-bypassing fingerprinting is difficult to prevent, unless you use something like uMatrix to disallow JavaScript from everything but a few select domains. This is a collection of random-ish unique-ish attributes. Any collection of such things can be used to track you, like installed fonts, installed extensions, etc. If this were just a set of meaningless encoded random numbers, then it's essentially a kind of cookie, but that's not what it is. This is (claimed to be) a collection of information that's useful and possibly needed by some backends when testing new Chrome features. It tells servers what your Chrome browser supports. The information is probably similar to "optimizeytvids=1,betajsparser=1". So, the only question is if Google is actually using this to help fingerprint users in addition to the pragmatic use case. It certainly could be used that way, and it's possible they are, but they have so many other ways of doing that with much higher fidelity / entropy if they want to. If this were intended as a sneaky undisclosed fingerprinting technique, I think they would've ensured it was actually 100% unique per installation, with a state space in the trillions, rather than 8000. Yes, this could be so sneaky that they took this into consideration and made it low-entropy to create plausible deniability while still being able to increase entropy when doing composite fingerprinting, but I think it's pretty unlikely. Also, 99% of the time they could probably just use use Google Analytics and Google login cookies to do this anyway.
    - rvnx 7y ago
      Maybe one actually useful non-advertising usage could be reCAPTCHA ? If you read carefully, it says nowhere than there is the limit to 8000. There is this limit of 8000 only if you disable usage statistics / crash reports.
      - meowface 7y ago
        Sorry about that, too late to edit it now. That is an important detail. If there are 32 or more different feature flags, then that's 4 billion unique states, which would be an effective fingerprint. I still think it's pretty unlikely they're using it in that way or would in the future, and I think Google fuzzing this for those who opt out of telemetry is probably a signal of good faith in this instance. They realize the privacy implications and provide a way to disengage, even if they don't intend to abuse the information. But of course the potential for abuse always remains. And the potential for (arguably) non-abusive tracking, like the possibility of it being used for bot detection by reCAPTCHA, as you say.
- make3 7y ago
  he means they can continue to identify you after you log off
  - pests 7y ago
    I think the argument is they have other methods like cookies they could also use. The fact you trust them not to use those methods extends to this form of tracking.
- mdiesel 7y ago
  If you browse the internet, they could know what websites are visited by the same person, but not who they are exactly. If you visit a load of websites, then also log into google, they connect the two and they know what websites were visited by you specifically.
- kag0 7y ago
  Normally you would only expect to be identified and tracked when using Google services when logged in. The significance of this post is that they would be able to identify and track you across all your usage of that browser installation regardless of if you've logged out, or say in an incognito window.
  - clSTophEjUdRanu 7y ago
    Ah. So I was missing something. Thanks for clarifying. That is alarming.
- poxrud 7y ago
  Yes you are missing something important. Once they've tied the browser ID to your personal account they can track you across all google properties, even the ones that you didn't log into.
  - asdfasgasdgasdg 7y ago
    I still don't understand. When I log into gmail, it logs me into all Google services. If I am worried about being tracked, surely my first mistake is logging in in the first place? Or visiting in the first place? After all, even if I click "log out," I'm only trusting Google that they unlinked the browser state from the account. If I trust them to do that, I don't see why I shouldn't trust them to ignore this experiment flag from Chrome, or at least not use it for tracking. If I don't trust them to avoid using the experiment state, I don't really see how you can trust them for anything. Anyway, if you're not building Chrome from source, then you have to trust that they aren't putting anything bad in it. And if you are building chrome from source, you can observe that they only send this experiment ID to certain domains, and they already know who you are on those domains anyway.
    - imtringued 7y ago
      >If I am worried about being tracked, surely my first mistake is logging in in the first place? Good luck completing a google captcha without a Google account or using Chrome.
  - judge2020 7y ago
    Unless you're running some extension that emulates FF's container tabs or something, it logs you into all G services. It would matter, though, if this header is still sent in incognito sessions.
asdfasgasdgasdg 7y ago
> > Experiments may be further limited by country (determined by your IP address) > They even admit to inspecting the IP address... I don't think that sentence admits what you say? Chrome could be determining which experiments to run client-side. Of course, when you visit a Google property, they needs must inspect your IP address to send a response to you, at a minimum. That goes for any site you might choose to visit. The existence of sufficient entropy to personally identify a site visitor is not a state secret. They do not need this chrome experiment seed to identify you, if that's a goal.
- calibas 7y ago
  Yeah, it's not a "state secret" but it's not common knowledge either. Their privacy policy says that specific header can't be used to identify you, but fails to mention it can be combined with other information to make browser fingerprinting trivial. If you don't know how all this works, which is true for most human beings, their privacy policy might give you the wrong impression.
  - asdfasgasdgasdg 7y ago
    > says that specific header can't be used to identify you That's not what it says. It says the header won't contain PII, which is true. It can be linked to PII, but so can literally every bit of information you send to Google while logged into or otherwise using their services. A disclaimer to this effect would not have any purpose.
    - GrayShade 7y ago
      If I log in to my Google account once, they can associate that browser id with my account. Even if I log out, clear my cookies (and probably use the incognito mode), Google will be able to identify and follow me all over the Web. I don't know about your PII thing, but it's personal data under the GDPR.
      - asdfasgasdgasdg 7y ago
coliveira 7y ago
> This ... header ... will not contain any personally identifiable information Except for everything you do on your browser. I'm so glad I haven't used Chrome for almost three years.
- deleted 7y ago
  [deleted]
skybrian 7y ago
Yes, if you have enough bits you can come up with a fingerprint, but that's not what PII means.
- tjoff 7y ago
  It becomes PII the instant you can correlate that fingerprint with any PII.
  - mega_dingus 7y ago
    This. A bank account number is consider PII. Knowing the bank name & account number will uniquely identify the account holder's name, which is PII.
    - fmajid 7y ago
      IP addresses are considered PII under both GDPR and CCPA.
      - shadowgovt 7y ago
        ... which is crazy unrealistic, since it's "PII" that can only stay "private" by collective agreement of every node in the network, but no accounting for the reality of network architecture in passing law, I guess. Maybe a deep expectation of anonymity while accessing a worldwide network of cooperative machines is something people should stop telling the public they should expect?
        labawi 7y ago
        Under GDPR you can use all the PII you reasonably need to provide expected services, you don't even need separate consent. But, if you have PII, the moment you use it for other purposes, or obtain/retain/share without proper cause, you are breaking the law. IMHO, that is very reasonable. Real world example - giving your phone number and information to your car mechanic / doctor / bank teller / plumber is reasonable. Using that information to score girls or ask donation for a puppy shelter would be considered improper.
adriantam 7y ago
> They are not including any PII... while creating a new identifier for each installation. 13 bits of entropy probably isn't a unique identifier iff you only look at that header in isolation. Combined with at least 24 additional bits[1] of entropy from the IPv4 Source Address field Google receives >=37 bits of entropy, which is almost certainly a unique ID for the browser. Linking that browser ID to a personal account is trivial as soon as someone logs in to any Google service. Now this is interesting. If without that 13 bits of entropy, what will Google lost? Is it because of this 13 bits then Google suddenly able to track what they were not? If the IPv4 address, user-agent string, or some other behavior is sufficient to reveal a great deal of stuff, we have a more serious problem than that 13 bits. I agree that 13-bit seed is a concern. But I am wondering if it is a concern per se, or its orchestration with something else. Of course, how/whether Google keeps those data also matters.
- rvnx 7y ago
  One clarification: - By default it's much more than 13 bits of entropy - If you disable usage statistics then you are limited to 13 bits of entropy
  - asvitkine 7y ago
    Actually, the low entropy provider is used for any field trials that get included in the header. See: https://cs.chromium.org/chromium/src/components/variations/variations_seed_processor.cc?rcl=ddac4c3cc1528254008f9e7a2aea5d4426906bfd&l=258 https://cs.chromium.org/chromium/src/components/variations/v...
- gruez 7y ago
  >Now this is interesting. If without that 13 bits of entropy, what will Google lost? Is it because of this 13 bits then Google suddenly able to track what they were not? At the very least, having those 13 bits of entropy along with a /24 subnet allows you to have device-level granularity, whereas a /24 subnet may be shared by hundreds of households.
  - rvnx 7y ago

by pdkl95 7y ago

forgotmypw38 7y ago

Don't forget that just about any registration requires recaptcha these days

clSTophEjUdRanu 7y ago

>Linking that browser ID to a personal account is trivial as soon as someone logs in to any Google service. Wat? You mean to tell me they can identify you if you log into their service? Am I missing something here? Who cares?

sildur 7y ago
I care. I care that I even if I log off, even if I use a vpn, even if I go into incognito mode, they still can associate my requests with the account I initially logged in.
- admax88q 7y ago
  I mean, if you don't want Google to track you, then you probably shouldn't use their browser...
- meowface 7y ago
  The problem is any website can do that. Incognito-bypassing fingerprinting is difficult to prevent, unless you use something like uMatrix to disallow JavaScript from everything but a few select domains. This is a collection of random-ish unique-ish attributes. Any collection of such things can be used to track you, like installed fonts, installed extensions, etc. If this were just a set of meaningless encoded random numbers, then it's essentially a kind of cookie, but that's not what it is. This is (claimed to be) a collection of information that's useful and possibly needed by some backends when testing new Chrome features. It tells servers what your Chrome browser supports. The information is probably similar to "optimizeytvids=1,betajsparser=1". So, the only question is if Google is actually using this to help fingerprint users in addition to the pragmatic use case. It certainly could be used that way, and it's possible they are, but they have so many other ways of doing that with much higher fidelity / entropy if they want to. If this were intended as a sneaky undisclosed fingerprinting technique, I think they would've ensured it was actually 100% unique per installation, with a state space in the trillions, rather than 8000. Yes, this could be so sneaky that they took this into consideration and made it low-entropy to create plausible deniability while still being able to increase entropy when doing composite fingerprinting, but I think it's pretty unlikely. Also, 99% of the time they could probably just use use Google Analytics and Google login cookies to do this anyway.
  - rvnx 7y ago
    Maybe one actually useful non-advertising usage could be reCAPTCHA ? If you read carefully, it says nowhere than there is the limit to 8000. There is this limit of 8000 only if you disable usage statistics / crash reports.
    - meowface 7y ago
      Sorry about that, too late to edit it now. That is an important detail. If there are 32 or more different feature flags, then that's 4 billion unique states, which would be an effective fingerprint. I still think it's pretty unlikely they're using it in that way or would in the future, and I think Google fuzzing this for those who opt out of telemetry is probably a signal of good faith in this instance. They realize the privacy implications and provide a way to disengage, even if they don't intend to abuse the information. But of course the potential for abuse always remains. And the potential for (arguably) non-abusive tracking, like the possibility of it being used for bot detection by reCAPTCHA, as you say.
make3 7y ago
he means they can continue to identify you after you log off
- pests 7y ago
  I think the argument is they have other methods like cookies they could also use. The fact you trust them not to use those methods extends to this form of tracking.
mdiesel 7y ago
If you browse the internet, they could know what websites are visited by the same person, but not who they are exactly. If you visit a load of websites, then also log into google, they connect the two and they know what websites were visited by you specifically.
kag0 7y ago
Normally you would only expect to be identified and tracked when using Google services when logged in. The significance of this post is that they would be able to identify and track you across all your usage of that browser installation regardless of if you've logged out, or say in an incognito window.
- clSTophEjUdRanu 7y ago
  Ah. So I was missing something. Thanks for clarifying. That is alarming.
poxrud 7y ago
Yes you are missing something important. Once they've tied the browser ID to your personal account they can track you across all google properties, even the ones that you didn't log into.
- asdfasgasdgasdg 7y ago
  I still don't understand. When I log into gmail, it logs me into all Google services. If I am worried about being tracked, surely my first mistake is logging in in the first place? Or visiting in the first place? After all, even if I click "log out," I'm only trusting Google that they unlinked the browser state from the account. If I trust them to do that, I don't see why I shouldn't trust them to ignore this experiment flag from Chrome, or at least not use it for tracking. If I don't trust them to avoid using the experiment state, I don't really see how you can trust them for anything. Anyway, if you're not building Chrome from source, then you have to trust that they aren't putting anything bad in it. And if you are building chrome from source, you can observe that they only send this experiment ID to certain domains, and they already know who you are on those domains anyway.
  - imtringued 7y ago
    >If I am worried about being tracked, surely my first mistake is logging in in the first place? Good luck completing a google captcha without a Google account or using Chrome.
- judge2020 7y ago
  Unless you're running some extension that emulates FF's container tabs or something, it logs you into all G services. It would matter, though, if this header is still sent in incognito sessions.

asdfasgasdgasdg 7y ago

> > Experiments may be further limited by country (determined by your IP address) > They even admit to inspecting the IP address... I don't think that sentence admits what you say? Chrome could be determining which experiments to run client-side. Of course, when you visit a Google property, they needs must inspect your IP address to send a response to you, at a minimum. That goes for any site you might choose to visit. The existence of sufficient entropy to personally identify a site visitor is not a state secret. They do not need this chrome experiment seed to identify you, if that's a goal.

calibas 7y ago
Yeah, it's not a "state secret" but it's not common knowledge either. Their privacy policy says that specific header can't be used to identify you, but fails to mention it can be combined with other information to make browser fingerprinting trivial. If you don't know how all this works, which is true for most human beings, their privacy policy might give you the wrong impression.
- asdfasgasdgasdg 7y ago
  > says that specific header can't be used to identify you That's not what it says. It says the header won't contain PII, which is true. It can be linked to PII, but so can literally every bit of information you send to Google while logged into or otherwise using their services. A disclaimer to this effect would not have any purpose.
  - GrayShade 7y ago
    If I log in to my Google account once, they can associate that browser id with my account. Even if I log out, clear my cookies (and probably use the incognito mode), Google will be able to identify and follow me all over the Web. I don't know about your PII thing, but it's personal data under the GDPR.
    - asdfasgasdgasdg 7y ago

coliveira 7y ago

> This ... header ... will not contain any personally identifiable information Except for everything you do on your browser. I'm so glad I haven't used Chrome for almost three years.

deleted 7y ago
[deleted]

skybrian 7y ago

Yes, if you have enough bits you can come up with a fingerprint, but that's not what PII means.

tjoff 7y ago
It becomes PII the instant you can correlate that fingerprint with any PII.
- mega_dingus 7y ago
  This. A bank account number is consider PII. Knowing the bank name & account number will uniquely identify the account holder's name, which is PII.
  - fmajid 7y ago
    IP addresses are considered PII under both GDPR and CCPA.
    - shadowgovt 7y ago
      ... which is crazy unrealistic, since it's "PII" that can only stay "private" by collective agreement of every node in the network, but no accounting for the reality of network architecture in passing law, I guess. Maybe a deep expectation of anonymity while accessing a worldwide network of cooperative machines is something people should stop telling the public they should expect?
      - labawi 7y ago
        Under GDPR you can use all the PII you reasonably need to provide expected services, you don't even need separate consent. But, if you have PII, the moment you use it for other purposes, or obtain/retain/share without proper cause, you are breaking the law. IMHO, that is very reasonable. Real world example - giving your phone number and information to your car mechanic / doctor / bank teller / plumber is reasonable. Using that information to score girls or ask donation for a puppy shelter would be considered improper.

adriantam 7y ago

> They are not including any PII... while creating a new identifier for each installation. 13 bits of entropy probably isn't a unique identifier iff you only look at that header in isolation. Combined with at least 24 additional bits[1] of entropy from the IPv4 Source Address field Google receives >=37 bits of entropy, which is almost certainly a unique ID for the browser. Linking that browser ID to a personal account is trivial as soon as someone logs in to any Google service. Now this is interesting. If without that 13 bits of entropy, what will Google lost? Is it because of this 13 bits then Google suddenly able to track what they were not? If the IPv4 address, user-agent string, or some other behavior is sufficient to reveal a great deal of stuff, we have a more serious problem than that 13 bits. I agree that 13-bit seed is a concern. But I am wondering if it is a concern per se, or its orchestration with something else. Of course, how/whether Google keeps those data also matters.

rvnx 7y ago
One clarification: - By default it's much more than 13 bits of entropy - If you disable usage statistics then you are limited to 13 bits of entropy
- asvitkine 7y ago
  Actually, the low entropy provider is used for any field trials that get included in the header. See: https://cs.chromium.org/chromium/src/components/variations/variations_seed_processor.cc?rcl=ddac4c3cc1528254008f9e7a2aea5d4426906bfd&l=258 https://cs.chromium.org/chromium/src/components/variations/v...
gruez 7y ago
>Now this is interesting. If without that 13 bits of entropy, what will Google lost? Is it because of this 13 bits then Google suddenly able to track what they were not? At the very least, having those 13 bits of entropy along with a /24 subnet allows you to have device-level granularity, whereas a /24 subnet may be shared by hundreds of households.
- rvnx 7y ago