7 ms·

TL;DR I think whoever posted that is trying to bury the UA anonymizing feature by derailing the discussion. What I'm seeing is an RFC for anonymizing parts of

by d1zzy 7y ago

TL;DR I think whoever posted that is trying to bury the UA anonymizing feature by derailing the discussion. What I'm seeing is an RFC for anonymizing parts of User-Agent in order to reduce UA based fingerprinting, which improves everyone's privacy, that's a good thing! Then I see someone comments how that could negatively impact existing websites or Chromium-derived browsers, comments which are totally fair and make an argument that may not be a good idea doing this change because of that. Then someone mentions the _existing_ x-client-data headers attached to requests that uniquely identify a Chrome installation. Then a lot of comments on that, including here on HN. To me that's derailing the original issue. If we want to propose that Chrome remove those headers we should do so as a separate issue and have people comment/vote on that. By talking about it on the UA anonymizing proposal we are polluting that discussion and effectively stalling that proposal which, if approved, could improve privacy (especially since it will go into Chromium so then any non-Chrome builds can get the feature without having to worry about x-client-data that Chrome does).

dessant 7y ago
This is the equivalent of a protest, people are objecting to Google's illegal data harvesting practices in places that receive engagement, since that's the most effective way to get the word out and warn others. Google's reasoning that this is not personal data is meaningless in the face of GDPR, which considers an IP address personal data. Google has access to the IP address when they receive the data, therefore they are transmitting personal information without user consent and control, which is illegal.
- csagan5 7y ago
  It could be argued that a similar violation is present (since March 2019) in Chromium for the Widevine CDM provisioning request, see https://github.com/bromite/bromite/issues/471 https://github.com/bromite/bromite/issues/471 Basically all users opening the browser will contact www.googleapis.com to get a unique "Protected Media Identifier", without opening any web page and even before any ToS/EULA is accepted (and there is no user consent either).
  - dessant 7y ago
    I think the Widevine CDM request is needed for the service to function, though they could certainly delay it until a website requires DRM. GDPR allows the use of personal data without consent when it is required to provide a service for the user. The personal data collected with the x-client-data header is not required for Google sites to function. Google uses the data to gain a technical advantage over other sites on the web, this is why the data collection in this case requires consent.
    - mokus 7y ago
      Whether consent is legally required or not, as a user I want that service, whatever it is, to not work until I consent to the exposure of my personal data. Given that it apparently has something to do with DRM, I would be disabling the service anyway.
      - baybal2 7y ago
        > Whether consent is legally required or not Lets not guess it, lets file a complaint, and see if we can get Google sued for n billions of euros.
csagan5 7y ago
The poster is the author of Kiwi browser, which unfortunately is closed source [0], but I have reason to believe he is familiar - as I am for the Bromite project - with all the (sometimes shady) internals of the Chromium codebase; it is indeed off-topic to discuss the header issue there but I would say that there is no explicit intention to derail it (and no advantage), just incorrect netiquette. [0]: https://github.com/kiwibrowser/android/issues/12#issuecomment-435690397 https://github.com/kiwibrowser/android/issues/12#issuecommen...
unapologetic 7y ago
The original issue is supposedly fingerprinting and privacy related. If that's true then Google should be called out for their poor behaviour.
lordlimecat 7y ago
>which improves everyone's privacy, that's a good thing! Except it does not affect Google, because Google has this install ID to use both for tracking and preventing ad-fraud. Which means Google competitors are terribly disadvantaged, as they cannot use that. Which not only reduces market diversity (contrary to TAG philosophy) but represents a significant conflict of interest for an organization proposing a major web standard change. These issues are very relevant to the original proposal, especially in light of the fact that Noone outside of Google is terribly interested in this change. Any time a dominant player is the strongest (or only) advocate for a change that would coincidentally and disproportionately benefit its corporate interests, the proposal should be viewed very skeptically.
- d1zzy 7y ago
  > Except it does not affect Google, because Google has this install ID to use both for tracking and preventing ad-fraud. So when Apple releases a privacy feature, that doesn't affect them as a business, we praise the feature or we say "except it doesn't affect Apple" and somehow try to argue how the feature is less valuable because of that?
  - dessant 7y ago
    Apple is not engaged in illegal data harvesting to gain a competitive advantage over other services in the same space. Google's collection of personal data with the x-client-data header without user consent is illegal under GDPR.
    - joshuamorton 7y ago
      This relies on the (unfounded) assumption that this pseudonymous ID is being used for tracking purposes and that Google is actively lying about it.
      - dessant 7y ago
        GDPR treats an IP address as personal data. The data is not transmitted through an anonymizing network, so Google has access to the user's IP address when they receive the data. Anything that is associated with personal data also becomes personal information, therefore Google is transmitting personal data without user consent, which is illegal. Asking for consent is not required under GDPR when the data collection is needed for a service to function. This is not the case here, Google services function without receiving that header, the data is used by Google to gain a technical advantage over other web services.
mabbo 7y ago
I think the concern is that this disarms Google's competitors while keeping them fully-armed. Ads are a business, and they are Google's business. They are how they make money. And like all businesses, they are competitive. Tracking is a way to make more money off online advertising. By removing tracking from their competitors while keeping it for themselves, Google stand to make a lot of money off this change. Their motivations are not honest, but they're pushing them as if this is the high road. It isn't. It's the dirty low road of dominating the online ad business, made possible by their dominance in the browser market. And it's always been the end-goal of Chrome browser.
- aidos 7y ago
  While I agree with some of your comment, I feel like it’s harsh to paint the whole chrome enterprise with that brush. Chrome was about freeing the world of a truly terrible web browser and a lot of devoted devs have spent a lot of time working on it. There’s an advertising aspect that it’s right to call out, but I think on the whole it was done to make the internet better, because the internet is google’s business too. EDIT I just wanted to point out that a load of people have poured their lives into making Google Chrome the amazing bit of software that it is and suggesting that the end-goal has been entirely about supplying ads does a great disservice to their personal contributions.
  - TeMPOraL 7y ago
    The way I see it, both of these can be (and most likely are) true. Intentions of the company aren't usually the same as intentions of individual contributors (or even whole teams). The Web is Google's business - the more stuff happens on the Web, the more money they can eventually make of it. Advertising is how they make most of that money, so this is what they're protecting. But beyond that, Chrome answered a real need and a lot of hard-working people made it into a best-in-class browser.
  - taneq 7y ago
    It wasn’t some noble mission to free the world. Chrome was always about Google controlling the client side of the web to guarantee their advertising access to web users. The ability to extract additional data from the user was a nice bonus.
rvnx 7y ago
https://cs.chromium.org/chromium/src/components/google/core/common/google_util.cc?type=cs&sq=package:chromium&g=0&l=285 https://cs.chromium.org/chromium/src/components/google/core/... Just thinking out loud. What happens, let's say, if someone malicious buys youtube.vg and puts a SSL certificate on it ? Will they be able to collect the ID ? I guess so ?
- gdm85 7y ago
  Yes, but they would also need a valid TLS certificate? A country's government could also take over the TLD and grab its traffic overnight.
3xblah 7y ago
The Google employee argues that through UA-CH Google wants to disincetivise "allow" and "block" lists. After many years of testing HTTP headers, IMO this really is a non-issue. Most websites return text/html just fine without sending any UA header at all. What is an issue are the various ways websites try to coax users to download, install and use a certain browser. Another related issue with Google Chrome is users getting better integration and performance when using Chrome with Google websites than they would if they used other clients. ^1 Some make the analogy to Microsoft where it was common for Microsoft software to integrate and perform better on Microsoft Windows whereas third party software was noticably worse to integrate and perform on that OS. This leads to less user agent diversity. Users will choose what works best. UA diversity is really a more important goal than privacy, or privacy in Chrome. The biggest privacy gains are not going to come from begging Google to make changes to Chrome. They could however come from making it easier for users to switch away from using Chrome and to use other clients. That requires some cooperation from websites as well as Google. Those other clients could theoretically be written by anyone, not just large companies and organisations that are dependent on the online ad sales business. It would be relatively easy to achieve "privacy-by-design" in such clients. There is no rule that says users have to use a single UA to access every website. There needs to be choice. For example, HN is a relatively simple website that does not require a large, complex browser like Chrome, Safari, Firefox, etc. to read. It generates a considerable amount of traffic and stands as proof that simpler websites can be popular. Varying the UA header does not result in drastic differences in the text/html returned by the server. 1. Recently we saw Google exclude use of certain clients to access Gmail.

by d1zzy 7y ago

dessant 7y ago

This is the equivalent of a protest, people are objecting to Google's illegal data harvesting practices in places that receive engagement, since that's the most effective way to get the word out and warn others. Google's reasoning that this is not personal data is meaningless in the face of GDPR, which considers an IP address personal data. Google has access to the IP address when they receive the data, therefore they are transmitting personal information without user consent and control, which is illegal.

csagan5 7y ago
It could be argued that a similar violation is present (since March 2019) in Chromium for the Widevine CDM provisioning request, see https://github.com/bromite/bromite/issues/471 https://github.com/bromite/bromite/issues/471 Basically all users opening the browser will contact www.googleapis.com to get a unique "Protected Media Identifier", without opening any web page and even before any ToS/EULA is accepted (and there is no user consent either).
- dessant 7y ago
  I think the Widevine CDM request is needed for the service to function, though they could certainly delay it until a website requires DRM. GDPR allows the use of personal data without consent when it is required to provide a service for the user. The personal data collected with the x-client-data header is not required for Google sites to function. Google uses the data to gain a technical advantage over other sites on the web, this is why the data collection in this case requires consent.
  - mokus 7y ago
    Whether consent is legally required or not, as a user I want that service, whatever it is, to not work until I consent to the exposure of my personal data. Given that it apparently has something to do with DRM, I would be disabling the service anyway.
    - baybal2 7y ago
      > Whether consent is legally required or not Lets not guess it, lets file a complaint, and see if we can get Google sued for n billions of euros.

csagan5 7y ago

The poster is the author of Kiwi browser, which unfortunately is closed source [0], but I have reason to believe he is familiar - as I am for the Bromite project - with all the (sometimes shady) internals of the Chromium codebase; it is indeed off-topic to discuss the header issue there but I would say that there is no explicit intention to derail it (and no advantage), just incorrect netiquette. [0]: https://github.com/kiwibrowser/android/issues/12#issuecomment-435690397 https://github.com/kiwibrowser/android/issues/12#issuecommen...

unapologetic 7y ago

The original issue is supposedly fingerprinting and privacy related. If that's true then Google should be called out for their poor behaviour.

lordlimecat 7y ago

>which improves everyone's privacy, that's a good thing! Except it does not affect Google, because Google has this install ID to use both for tracking and preventing ad-fraud. Which means Google competitors are terribly disadvantaged, as they cannot use that. Which not only reduces market diversity (contrary to TAG philosophy) but represents a significant conflict of interest for an organization proposing a major web standard change. These issues are very relevant to the original proposal, especially in light of the fact that Noone outside of Google is terribly interested in this change. Any time a dominant player is the strongest (or only) advocate for a change that would coincidentally and disproportionately benefit its corporate interests, the proposal should be viewed very skeptically.

d1zzy 7y ago
> Except it does not affect Google, because Google has this install ID to use both for tracking and preventing ad-fraud. So when Apple releases a privacy feature, that doesn't affect them as a business, we praise the feature or we say "except it doesn't affect Apple" and somehow try to argue how the feature is less valuable because of that?
- dessant 7y ago
  Apple is not engaged in illegal data harvesting to gain a competitive advantage over other services in the same space. Google's collection of personal data with the x-client-data header without user consent is illegal under GDPR.
  - joshuamorton 7y ago
    This relies on the (unfounded) assumption that this pseudonymous ID is being used for tracking purposes and that Google is actively lying about it.
    - dessant 7y ago
      GDPR treats an IP address as personal data. The data is not transmitted through an anonymizing network, so Google has access to the user's IP address when they receive the data. Anything that is associated with personal data also becomes personal information, therefore Google is transmitting personal data without user consent, which is illegal. Asking for consent is not required under GDPR when the data collection is needed for a service to function. This is not the case here, Google services function without receiving that header, the data is used by Google to gain a technical advantage over other web services.

mabbo 7y ago

I think the concern is that this disarms Google's competitors while keeping them fully-armed. Ads are a business, and they are Google's business. They are how they make money. And like all businesses, they are competitive. Tracking is a way to make more money off online advertising. By removing tracking from their competitors while keeping it for themselves, Google stand to make a lot of money off this change. Their motivations are not honest, but they're pushing them as if this is the high road. It isn't. It's the dirty low road of dominating the online ad business, made possible by their dominance in the browser market. And it's always been the end-goal of Chrome browser.

aidos 7y ago
While I agree with some of your comment, I feel like it’s harsh to paint the whole chrome enterprise with that brush. Chrome was about freeing the world of a truly terrible web browser and a lot of devoted devs have spent a lot of time working on it. There’s an advertising aspect that it’s right to call out, but I think on the whole it was done to make the internet better, because the internet is google’s business too. EDIT I just wanted to point out that a load of people have poured their lives into making Google Chrome the amazing bit of software that it is and suggesting that the end-goal has been entirely about supplying ads does a great disservice to their personal contributions.
- TeMPOraL 7y ago
  The way I see it, both of these can be (and most likely are) true. Intentions of the company aren't usually the same as intentions of individual contributors (or even whole teams). The Web is Google's business - the more stuff happens on the Web, the more money they can eventually make of it. Advertising is how they make most of that money, so this is what they're protecting. But beyond that, Chrome answered a real need and a lot of hard-working people made it into a best-in-class browser.
- taneq 7y ago
  It wasn’t some noble mission to free the world. Chrome was always about Google controlling the client side of the web to guarantee their advertising access to web users. The ability to extract additional data from the user was a nice bonus.

rvnx 7y ago

https://cs.chromium.org/chromium/src/components/google/core/common/google_util.cc?type=cs&sq=package:chromium&g=0&l=285 https://cs.chromium.org/chromium/src/components/google/core/... Just thinking out loud. What happens, let's say, if someone malicious buys youtube.vg and puts a SSL certificate on it ? Will they be able to collect the ID ? I guess so ?

gdm85 7y ago
Yes, but they would also need a valid TLS certificate? A country's government could also take over the TLD and grab its traffic overnight.

3xblah 7y ago

The Google employee argues that through UA-CH Google wants to disincetivise "allow" and "block" lists. After many years of testing HTTP headers, IMO this really is a non-issue. Most websites return text/html just fine without sending any UA header at all. What is an issue are the various ways websites try to coax users to download, install and use a certain browser. Another related issue with Google Chrome is users getting better integration and performance when using Chrome with Google websites than they would if they used other clients. ^1 Some make the analogy to Microsoft where it was common for Microsoft software to integrate and perform better on Microsoft Windows whereas third party software was noticably worse to integrate and perform on that OS. This leads to less user agent diversity. Users will choose what works best. UA diversity is really a more important goal than privacy, or privacy in Chrome. The biggest privacy gains are not going to come from begging Google to make changes to Chrome. They could however come from making it easier for users to switch away from using Chrome and to use other clients. That requires some cooperation from websites as well as Google. Those other clients could theoretically be written by anyone, not just large companies and organisations that are dependent on the online ad sales business. It would be relatively easy to achieve "privacy-by-design" in such clients. There is no rule that says users have to use a single UA to access every website. There needs to be choice. For example, HN is a relatively simple website that does not require a large, complex browser like Chrome, Safari, Firefox, etc. to read. It generates a considerable amount of traffic and stands as proof that simpler websites can be popular. Varying the UA header does not result in drastic differences in the text/html returned by the server. 1. Recently we saw Google exclude use of certain clients to access Gmail.