6 ms·

I wonder if these extensions are so hard to spot because spying is a core feature of Google Chrome, and most top extensions do this. For example, the extraordi

by 0xy 6y ago

I wonder if these extensions are so hard to spot because spying is a core feature of Google Chrome, and most top extensions do this. For example, the extraordinarily popular extension Honey phones home about your purchases, shopping habits and other data without adequately disclosing that fact. It's hard to see why Google would care when Chrome was always a trojan horse to co-opt web standards for their own purposes and to prevent measures taken against invasive tracking and data collection in the first place. Tracking is built directly into Chrome's source. Chrome will send "X-Client-Data" headers with a low-entropy identifier on every request to DoubleClick, an advertising agency owned by Google. DoubleClick's hostname is explicitly whitelisted in Chrome source code. Chrome was always meant for massive spying, and any "crackdowns" are only a reaction to media pressure.

sandstrom 6y ago
Here are more details about 'X-Client-Data'. I'm not saying it's necessarily a good practice (and maybe it's something they should stop doing), but I wouldn't call it "spying". It's analytics, used to test new Chrome features. https://9to5google.com/2020/02/06/google-chrome-x-client-data-tracking/ https://9to5google.com/2020/02/06/google-chrome-x-client-dat...
- 0xy 6y ago
  Why is DoubleClick in the whitelist?
  - joshuamorton 6y ago
    Presumably, since, as the list you're referring to mentions, it's a Google owned property, and accessed by a lot of people, even those who don't usually access other google properties, which makes it really useful for analytics on a broader selection of sites/connections. Like, the function you're referring to, `IsGoogleAssociatedDomainUrl`, seems to only be used to log some information about https. Or at least that's all I found from searching for it. So it's even less innocuous, the use appears to be "we'd like to know if our sites are broken under HTTPS", vs. just HTTPS being broken in general. [I work at Google, but don't work anywhere near chrome, and I know basically nothing about it] Edit: You were referring to a different spot (experiments), where what I originally said applies. Having more analytics is really useful when trying to diagnose problems.
    - 0xy 6y ago
      This would make sense if they needed to collect that information organically, but there's already requests made to Google as soon as Chrome launches. So, no, it's not required for analytics. [1] That leaves... ad tracking. Chrome will send a tracking ID to DoubleClick with every request to that host. Doesn't this prove that Chrome is a trojan horse used for ads and tracking purposes? [1] https://twitter.com/jonathansampson/status/1165493206441779200 https://twitter.com/jonathansampson/status/11654932064417792...
      - joshuamorton 6y ago
        > This would make sense if they needed to collect that information organically, but there's already requests made to Google as soon as Chrome launches. So, no, it's not required for analytics. Wait what? You don't think there's analytics that can be done about the browser itself? Let's say chrome ships a new experiment, that when enabled on certain devices uses 100% of the CPU until chrome is closed. Analytics sent on browser startup would provide insight into that. If you're asking why they need both: having analytics in the context of a given page is also useful. If you can see that different experiments in chrome cause different performance impacts when loading the same page, that's also useful data that you can't get from analytics sent on startup. Nor could you centralize the logging of that information, as it would essentially be sending your browser history to Google all in one request, which is even easier to track. > Doesn't this prove that Chrome is a trojan horse used for ads and tracking purposes? Bluntly, no.
        0xy 6y ago
        Let me put it another way. Do you think the average user knows of or would approve of Google Chrome itself sending information to an advertising network that could be used to track their behaviors and identity? Do you think this "feature" is adequately disclosed to customers downloading Google Chrome, that it includes a DoubleClick tracking backdoor that no other ad network or website receives.
        joshuamorton 6y ago
dontblink 6y ago
Wow talk about revisionism! Chrome was meant as a hedge against IE and lesser so against Firefox. Microsoft owned the desktop with Windows and could easily shut Google out. See the reason surrounding the creation of the Google toolbar. Similarly Android is a hedge against IOS and mobile search.
- 0xy 6y ago
  IE had bad standards support and bad defaults, while Chrome will actively track you on practically every site by sending an identifier to a whitelist including DoubleClick. Would you be defending it if it was called "DoubleClick Browser"? Google wants to secure the status quo with their own browser. What is the status quo? Massive spying, surveillance and tracking. This is why Safari and Firefox implemented strict measures against third-party cookies which Chrome watered down until it was practically useless or didn't implement at all. If Chrome is such an open and independent project, what do you think are the chances of a PR being approved that removed DoubleClick from the tracking header whitelist?
  - mehrdadn 6y ago
    Are you talking about Chrome or Chromium?
    - 0xy 6y ago
      Chromium, but they're effectively the same. The average user doesn't know what Chromium is. https://chromium.googlesource.com/chromium/src/+/e51dcb0c148a1b0ab0080808d8d1b914d02f6057/chrome/browser/metrics/variations/variations_http_header_provider.cc https://chromium.googlesource.com/chromium/src/+/e51dcb0c148...
      - mehrdadn 6y ago
        I see, thanks. I'm looking at that source and confused what it's actually doing though. What is the "tracking" aspect? I see ShouldAppendHeaders() returns true on doubleclick.net, but on the face of it, it seems to just be saying: "Should we send experimental headers to this URL? If it's doubleclick.net, then yes." But they claim [1] this X-Client-Data header is used for experimenting with Chrome, not for tracking. But you're claiming they're using it for tracking, so you're claiming they're lying... which I mean is certainly possible, but I see no evidence for it. What's your basis for claiming they're lying with such certainty? [1] https://9to5google.com/2020/02/06/google-chrome-x-client-data-tracking/ https://9to5google.com/2020/02/06/google-chrome-x-client-dat...
peteretep 6y ago
I was going to shitpost "people wouldn't be using Chrome if they minded being spied on" but your take is much more eloquent.

by 0xy 6y ago

sandstrom 6y ago

Here are more details about 'X-Client-Data'. I'm not saying it's necessarily a good practice (and maybe it's something they should stop doing), but I wouldn't call it "spying". It's analytics, used to test new Chrome features. https://9to5google.com/2020/02/06/google-chrome-x-client-data-tracking/ https://9to5google.com/2020/02/06/google-chrome-x-client-dat...

0xy 6y ago
Why is DoubleClick in the whitelist?
- joshuamorton 6y ago
  Presumably, since, as the list you're referring to mentions, it's a Google owned property, and accessed by a lot of people, even those who don't usually access other google properties, which makes it really useful for analytics on a broader selection of sites/connections. Like, the function you're referring to, `IsGoogleAssociatedDomainUrl`, seems to only be used to log some information about https. Or at least that's all I found from searching for it. So it's even less innocuous, the use appears to be "we'd like to know if our sites are broken under HTTPS", vs. just HTTPS being broken in general. [I work at Google, but don't work anywhere near chrome, and I know basically nothing about it] Edit: You were referring to a different spot (experiments), where what I originally said applies. Having more analytics is really useful when trying to diagnose problems.
  - 0xy 6y ago
    This would make sense if they needed to collect that information organically, but there's already requests made to Google as soon as Chrome launches. So, no, it's not required for analytics. [1] That leaves... ad tracking. Chrome will send a tracking ID to DoubleClick with every request to that host. Doesn't this prove that Chrome is a trojan horse used for ads and tracking purposes? [1] https://twitter.com/jonathansampson/status/1165493206441779200 https://twitter.com/jonathansampson/status/11654932064417792...
    - joshuamorton 6y ago
      > This would make sense if they needed to collect that information organically, but there's already requests made to Google as soon as Chrome launches. So, no, it's not required for analytics. Wait what? You don't think there's analytics that can be done about the browser itself? Let's say chrome ships a new experiment, that when enabled on certain devices uses 100% of the CPU until chrome is closed. Analytics sent on browser startup would provide insight into that. If you're asking why they need both: having analytics in the context of a given page is also useful. If you can see that different experiments in chrome cause different performance impacts when loading the same page, that's also useful data that you can't get from analytics sent on startup. Nor could you centralize the logging of that information, as it would essentially be sending your browser history to Google all in one request, which is even easier to track. > Doesn't this prove that Chrome is a trojan horse used for ads and tracking purposes? Bluntly, no.
      - 0xy 6y ago
        Let me put it another way. Do you think the average user knows of or would approve of Google Chrome itself sending information to an advertising network that could be used to track their behaviors and identity? Do you think this "feature" is adequately disclosed to customers downloading Google Chrome, that it includes a DoubleClick tracking backdoor that no other ad network or website receives.
        joshuamorton 6y ago

dontblink 6y ago

Wow talk about revisionism! Chrome was meant as a hedge against IE and lesser so against Firefox. Microsoft owned the desktop with Windows and could easily shut Google out. See the reason surrounding the creation of the Google toolbar. Similarly Android is a hedge against IOS and mobile search.

0xy 6y ago
IE had bad standards support and bad defaults, while Chrome will actively track you on practically every site by sending an identifier to a whitelist including DoubleClick. Would you be defending it if it was called "DoubleClick Browser"? Google wants to secure the status quo with their own browser. What is the status quo? Massive spying, surveillance and tracking. This is why Safari and Firefox implemented strict measures against third-party cookies which Chrome watered down until it was practically useless or didn't implement at all. If Chrome is such an open and independent project, what do you think are the chances of a PR being approved that removed DoubleClick from the tracking header whitelist?
- mehrdadn 6y ago
  Are you talking about Chrome or Chromium?
  - 0xy 6y ago
    Chromium, but they're effectively the same. The average user doesn't know what Chromium is. https://chromium.googlesource.com/chromium/src/+/e51dcb0c148a1b0ab0080808d8d1b914d02f6057/chrome/browser/metrics/variations/variations_http_header_provider.cc https://chromium.googlesource.com/chromium/src/+/e51dcb0c148...
    - mehrdadn 6y ago
      I see, thanks. I'm looking at that source and confused what it's actually doing though. What is the "tracking" aspect? I see ShouldAppendHeaders() returns true on doubleclick.net, but on the face of it, it seems to just be saying: "Should we send experimental headers to this URL? If it's doubleclick.net, then yes." But they claim [1] this X-Client-Data header is used for experimenting with Chrome, not for tracking. But you're claiming they're using it for tracking, so you're claiming they're lying... which I mean is certainly possible, but I see no evidence for it. What's your basis for claiming they're lying with such certainty? [1] https://9to5google.com/2020/02/06/google-chrome-x-client-data-tracking/ https://9to5google.com/2020/02/06/google-chrome-x-client-dat...

peteretep 6y ago

I was going to shitpost "people wouldn't be using Chrome if they minded being spied on" but your take is much more eloquent.