3 ms·

> > Experiments may be further limited by country (determined by your IP address) > They even admit to inspecting the IP address... I don't think that sentenc

> > Experiments may be further limited by country (determined by your IP address) > They even admit to inspecting the IP address... I don't think that sentence admits what you say? Chrome could be determining which experiments to run client-side. Of course, when you visit a Google property, they needs must inspect your IP address to send a response to you, at a minimum. That goes for any site you might choose to visit. The existence of sufficient entropy to personally identify a site visitor is not a state secret. They do not need this chrome experiment seed to identify you, if that's a goal.

calibas 7y ago
Yeah, it's not a "state secret" but it's not common knowledge either. Their privacy policy says that specific header can't be used to identify you, but fails to mention it can be combined with other information to make browser fingerprinting trivial. If you don't know how all this works, which is true for most human beings, their privacy policy might give you the wrong impression.
- asdfasgasdgasdg 7y ago
  > says that specific header can't be used to identify you That's not what it says. It says the header won't contain PII, which is true. It can be linked to PII, but so can literally every bit of information you send to Google while logged into or otherwise using their services. A disclaimer to this effect would not have any purpose.
  - GrayShade 7y ago
    If I log in to my Google account once, they can associate that browser id with my account. Even if I log out, clear my cookies (and probably use the incognito mode), Google will be able to identify and follow me all over the Web. I don't know about your PII thing, but it's personal data under the GDPR.
    - asdfasgasdgasdg 7y ago
      AIUI GDPR restricts the handling and use of PII, not its existence. So it's PII under GDPR. Is Google misusing it? If so, that's an issue. If not, then it's kinda pointless to observe that it's PII under some possibly distinct legal definition than the one Google is using in its privacy policy.
    - _trampeltier 7y ago
      You can't even login into gmail, at least from firefox in incognito mode.
      - GrayShade 7y ago
        It works for me, at least with 2FA enabled.
  - calibas 7y ago
    That's the whole point. Using any Google service means they can easily personally identify you, that's what the privacy policy should explain. That's their policy towards privacy, you don't have any. For some reason I can't fathom, you claim mentioning this in their privacy policy "would not have any purpose". Instead of honesty, their privacy policy is a wonder of public relations where it seems like they care deeply about protecting your privacy.
    - asdfasgasdgasdg 7y ago
      We disagree about the purpose of privacy policies. I believe that privacy policies should describe how data will be used, not how it could be used. I just don't think a policy describing how data could be used is very useful, because it's going to be the same for all services. Under this formulation, Google's policy is (presumably, lacking any data to the contrary) honest with respect to this value.
      - emmelaich 7y ago
        > I believe that privacy policies should describe how data will be used, not how it could be used. This is key. If you subscribe to the "how it could be used" version, then even say possessing an android phone would be a violation of the privacy policy. Which is absurd.
      - shuckles 7y ago
        This is a fair distinction, though it does not include the option of discussing how the data _won’t_ be used.
        asdfasgasdgasdg 7y ago
        Per your observation, I would argue that the intent of the privacy policy as quoted above is pretty clear. When the policy says that the identifier doesn't contain PII, I believe that is meant to convey that it will not be used to identify you. But it's true that that use is not explicitly excluded. I'm not a lawyer so I couldn't tell you if being weasely in this way would count as fraud or not. Otoh, I suspect that Google is actually abiding by the spirit of the policy they wrote because honestly they have little to gain and much to lose by violating it.
bamboozled 7y ago
So if you use a VPN service for example, they still know who you are because of this. I would say even if you’re visiting in private mode. I see your point, but I also see how this will keep you identifiable.
- asdfasgasdgasdg 7y ago
  I don't math very much, but I would guess the intersection of these sets of people is nil: people who 1) use VPN to avoid tracking by Google 2) still log in to Google services from one of their networks and not the other 3) use the same Chrome profile on both. But suppose some small number exist who adopt this illogical and contradictory pattern of behavior. If Google is using this token for the purpose of tracking this tiny set of people when the vast majority could be tracked more easily via conventional means, it would imply that they are far more competent than I give them credit for.
  - ajsnigrutin 7y ago
    So, someone starting up a vpn and opening incognito mode?

calibas 7y ago

Yeah, it's not a "state secret" but it's not common knowledge either. Their privacy policy says that specific header can't be used to identify you, but fails to mention it can be combined with other information to make browser fingerprinting trivial. If you don't know how all this works, which is true for most human beings, their privacy policy might give you the wrong impression.

asdfasgasdgasdg 7y ago
> says that specific header can't be used to identify you That's not what it says. It says the header won't contain PII, which is true. It can be linked to PII, but so can literally every bit of information you send to Google while logged into or otherwise using their services. A disclaimer to this effect would not have any purpose.
- GrayShade 7y ago
  If I log in to my Google account once, they can associate that browser id with my account. Even if I log out, clear my cookies (and probably use the incognito mode), Google will be able to identify and follow me all over the Web. I don't know about your PII thing, but it's personal data under the GDPR.
  - asdfasgasdgasdg 7y ago
    AIUI GDPR restricts the handling and use of PII, not its existence. So it's PII under GDPR. Is Google misusing it? If so, that's an issue. If not, then it's kinda pointless to observe that it's PII under some possibly distinct legal definition than the one Google is using in its privacy policy.
  - _trampeltier 7y ago
    You can't even login into gmail, at least from firefox in incognito mode.
    - GrayShade 7y ago
      It works for me, at least with 2FA enabled.
- calibas 7y ago
  That's the whole point. Using any Google service means they can easily personally identify you, that's what the privacy policy should explain. That's their policy towards privacy, you don't have any. For some reason I can't fathom, you claim mentioning this in their privacy policy "would not have any purpose". Instead of honesty, their privacy policy is a wonder of public relations where it seems like they care deeply about protecting your privacy.
  - asdfasgasdgasdg 7y ago
    We disagree about the purpose of privacy policies. I believe that privacy policies should describe how data will be used, not how it could be used. I just don't think a policy describing how data could be used is very useful, because it's going to be the same for all services. Under this formulation, Google's policy is (presumably, lacking any data to the contrary) honest with respect to this value.
    - emmelaich 7y ago
      > I believe that privacy policies should describe how data will be used, not how it could be used. This is key. If you subscribe to the "how it could be used" version, then even say possessing an android phone would be a violation of the privacy policy. Which is absurd.
    - shuckles 7y ago
      This is a fair distinction, though it does not include the option of discussing how the data _won’t_ be used.
      - asdfasgasdgasdg 7y ago
        Per your observation, I would argue that the intent of the privacy policy as quoted above is pretty clear. When the policy says that the identifier doesn't contain PII, I believe that is meant to convey that it will not be used to identify you. But it's true that that use is not explicitly excluded. I'm not a lawyer so I couldn't tell you if being weasely in this way would count as fraud or not. Otoh, I suspect that Google is actually abiding by the spirit of the policy they wrote because honestly they have little to gain and much to lose by violating it.

bamboozled 7y ago

So if you use a VPN service for example, they still know who you are because of this. I would say even if you’re visiting in private mode. I see your point, but I also see how this will keep you identifiable.

asdfasgasdgasdg 7y ago
I don't math very much, but I would guess the intersection of these sets of people is nil: people who 1) use VPN to avoid tracking by Google 2) still log in to Google services from one of their networks and not the other 3) use the same Chrome profile on both. But suppose some small number exist who adopt this illogical and contradictory pattern of behavior. If Google is using this token for the purpose of tracking this tiny set of people when the vast majority could be tracked more easily via conventional means, it would imply that they are far more competent than I give them credit for.
- ajsnigrutin 7y ago
  So, someone starting up a vpn and opening incognito mode?