6 ms·

So this will be used entirely for invasive tracking by Google's advertising arms. Calling it a "trust token" is gaslighting, since the data being collected and

by 0xy 6y ago

So this will be used entirely for invasive tracking by Google's advertising arms. Calling it a "trust token" is gaslighting, since the data being collected and distributed to advertising companies is not properly disclosed nor easy to disable. Google has a habit of obscuring such practices, like the hard-coded "X-Client-Data" tracking backdoor header they send to DoubleClick and is impossible to disable, and never disclosed to anyone. If they'll do "X-Client-Data", you can be sure this backdoor will be even larger.

8organicbits 6y ago
Wow, I didn't see that before. https://vpnoverview.com/news/google-backpedals-on-claim-that-x-client-data-doesnt-contain-pi-information/ https://vpnoverview.com/news/google-backpedals-on-claim-that...
dehrmann 6y ago
Calling it a "trust token" is almost as deceptive as calling it a cookie. "Accept cookies. Um, yes? Me want cookie."
pm90 6y ago
Google’s existence is based on tracking user behavior. There is 0 chance they will let go of that ability.
joshuamorton 6y ago
So I think we've had this conversation before, but what do you believe that header is used for? Are you claiming that Google uses it for things beyond what they claim to and that Google is lying when it claims to not be using the header for ad tracking?
- 0xy 6y ago
  Without repeating the same arguments, it's possible that Google is using it for tracking purposes because their public statements were ambiguous. That aside though, this behavior is never disclosed to users and is impossible to disable. Do you think the average user knows that Chrome is sending unique identifiers to DoubleClick? Of course not, it was never disclosed and they were never given the option to disable it.
  - joshuamorton 6y ago
    Can you explain what is ambiguous about "This information helps us measure server-side metrics for large groups of installations; it is not used to identify or track individual users." > Do you think the average user knows that Chrome is sending unique identifiers to DoubleClick? What's your actual concern? What you've described here applies to nefarious data like the IP address.
    - 0xy 6y ago
      Okay I presume you've never worked in the ad or tracking industry, because the data being sent to DoubleClick without notification is gold for tracking purposes. This can also be considered anti-competitive behavior. DoubleClick has access to orders of magnitude more tracking data than its competitors. IP Addresses cannot be used to differentiate devices. X-Client-Data can, easily. My concerns are: - Their statement is ambiguous, and does not rule out use for tracking or advertising purposes, nor does it rule out future use for individual user tracking. - This "feature" was added sneakily. No notification, there's no user disclosure. Nothing. That just screams suspicious, given the value of the data being sent. - It cannot be disabled. This is the key point. Why can't it be disabled? - DoubleClick is in the whitelist for no reason other than ad tracking purposes. The amount of websites who make calls to DoubleClick and not GTM or GA must be vanishingly small. So the argument that you want to collect the most data is disingenuous. 87%(!!!) of the top 100,000 websites globally make calls to GA. My concern is Google has sneakily added a feature that can be used for tracking purposes while refusing to disclose it to end users and making it impossible to disable.
      - joshuamorton 6y ago
        > Okay I presume you've never worked in the ad or tracking industry Yes and no. I work on tooling very similar to the actual, intended, use of the x-client-data header (aggregate performance analysis). > because the data being sent to DoubleClick without notification is gold for tracking purposes What does it provide that other data that is accessible does not? > IP Addresses cannot be used to differentiate devices. Ah, I see, so in the case of multiple logged-out but non-incognito chrome users in the same household, x-client-data could be used to better target ads to specific devices in the household, instead of the household as a whole. That's the "gold" here? > - This "feature" was added sneakily. No notification, there's no user disclosure. Nothing. That just screams suspicious, given the value of the data being sent. Sure, sort of, in 2012[0]. Doubleclick was added a bit later, in 2014[1]. The reasoning, at the time, is provided in the linked bug[2]. Sure looks nefarious. So was this an 8+ year scheme? Now, there are (at least) two possible ways to look at this, either it's an almost decade long scheme, or alternatively no one on chrome had any intent of ever tracking individual users, and it wasn't even considered. The bug also provides some more insight, doubleclick and GA serve different types of data, and that might matter for measuring things about QUIC. > DoubleClick is in the whitelist for no reason other than ad tracking purposes. The amount of websites who make calls to DoubleClick and not GTM or GA must be vanishingly small. Literally the first website I picked, CNN.com, has doubleclick sources, but not GTM or GA (at least as far as I can tell). > and does not rule out use for tracking or advertising purposes I will once again ask for a scheme by which the header is both useful for tracking or advertising, and isn't used for tracking individual users. It seems like you're claiming that Google is attempting to split hairs and say that tracking individual devices is different from tracking individual users. I've explained before why something like x-client-data can actually be a useful privacy-preserving tool elsewhere[3] (since it allows you to join across a quasi-identifier instead of a PII-identifier). [0]: https://chromium.googlesource.com/chromium/src.git/+/f89fdab13152123f737dc84f5910362fa6569f7f%5E%21/chrome/browser/renderer_host/chrome_resource_dispatcher_host_delegate.cc https://chromium.googlesource.com/chromium/src.git/+/f89fdab... [1]: https://chromium.googlesource.com/chromium/src.git/+/64d617ec7c502ea5ce5ec8f6f97580000541a854 https://chromium.googlesource.com/chromium/src.git/+/64d617e... [2]: https://bugs.chromium.org/p/chromium/issues/detail?id=379341 https://bugs.chromium.org/p/chromium/issues/detail?id=379341 [3]: https://news.ycombinator.com/item?id=22244282 https://news.ycombinator.com/item?id=22244282
- minerjoe 6y ago
  Yes. Google seems to be lying. Which would not suprise me or many people. If they cared they would allow for the header to be disabled. They do not.
- minerjoe 6y ago
  You seem like a nice fellow. And smart! How about somehow aligning your life's work to not further the goals of enormous corporations that do not seem to have the best interests of us at heart.
  - joshuamorton 6y ago
    From my (insider, biased, more informed, however you want to describe it) point of view, the fears you have are unfounded. Why should I chose to pursue a different employer based on someone else's ill-founded concerns? Elaborating a bit more, there's a motte and Bailey you're pulling here. I'd agree that Google doesn't have broadly "the best interests of us" at heart, but that's true for every corporation. If that's your bar for ethical action, you're asking me to not participate in capitalism as a whole. I look forward to that world too, but unfortunately we aren't there today.
    - minerjoe 6y ago
      > we aren't there today Be the change you wish to see in the world. Waiting for others is the problem.
      - joshuamorton 6y ago
        There's, broadly speaking, a difference between telling me to find a different employer based on an unfounded concern (what you did) and asking me to work to enact a more socialist future. It's not even clear that the two are aligned in all cases.
        minerjoe 6y ago
        I'm not sure who you are reading, but I never suggested that you find another employer. I suggested you figure out a way to use your limited time here on Mother Earth to not further the giant machine that is seemingly destroying everything of true value on this planet. Big order, yes, but you are young and it's not too late to make a change for the better (for us all). It's a high bar, but I have faith in you.
SquareWheel 6y ago
> Calling it a "trust token" is gaslighting It's a token for gauging trust. What else would you call it? The way "gaslighting" is used today, it's lost all possible meaning.

by 0xy 6y ago

8organicbits 6y ago

Wow, I didn't see that before. https://vpnoverview.com/news/google-backpedals-on-claim-that-x-client-data-doesnt-contain-pi-information/ https://vpnoverview.com/news/google-backpedals-on-claim-that...

dehrmann 6y ago

Calling it a "trust token" is almost as deceptive as calling it a cookie. "Accept cookies. Um, yes? Me want cookie."

pm90 6y ago

Google’s existence is based on tracking user behavior. There is 0 chance they will let go of that ability.

joshuamorton 6y ago

So I think we've had this conversation before, but what do you believe that header is used for? Are you claiming that Google uses it for things beyond what they claim to and that Google is lying when it claims to not be using the header for ad tracking?

0xy 6y ago
Without repeating the same arguments, it's possible that Google is using it for tracking purposes because their public statements were ambiguous. That aside though, this behavior is never disclosed to users and is impossible to disable. Do you think the average user knows that Chrome is sending unique identifiers to DoubleClick? Of course not, it was never disclosed and they were never given the option to disable it.
- joshuamorton 6y ago
  Can you explain what is ambiguous about "This information helps us measure server-side metrics for large groups of installations; it is not used to identify or track individual users." > Do you think the average user knows that Chrome is sending unique identifiers to DoubleClick? What's your actual concern? What you've described here applies to nefarious data like the IP address.
  - 0xy 6y ago
    Okay I presume you've never worked in the ad or tracking industry, because the data being sent to DoubleClick without notification is gold for tracking purposes. This can also be considered anti-competitive behavior. DoubleClick has access to orders of magnitude more tracking data than its competitors. IP Addresses cannot be used to differentiate devices. X-Client-Data can, easily. My concerns are: - Their statement is ambiguous, and does not rule out use for tracking or advertising purposes, nor does it rule out future use for individual user tracking. - This "feature" was added sneakily. No notification, there's no user disclosure. Nothing. That just screams suspicious, given the value of the data being sent. - It cannot be disabled. This is the key point. Why can't it be disabled? - DoubleClick is in the whitelist for no reason other than ad tracking purposes. The amount of websites who make calls to DoubleClick and not GTM or GA must be vanishingly small. So the argument that you want to collect the most data is disingenuous. 87%(!!!) of the top 100,000 websites globally make calls to GA. My concern is Google has sneakily added a feature that can be used for tracking purposes while refusing to disclose it to end users and making it impossible to disable.
    - joshuamorton 6y ago
      > Okay I presume you've never worked in the ad or tracking industry Yes and no. I work on tooling very similar to the actual, intended, use of the x-client-data header (aggregate performance analysis). > because the data being sent to DoubleClick without notification is gold for tracking purposes What does it provide that other data that is accessible does not? > IP Addresses cannot be used to differentiate devices. Ah, I see, so in the case of multiple logged-out but non-incognito chrome users in the same household, x-client-data could be used to better target ads to specific devices in the household, instead of the household as a whole. That's the "gold" here? > - This "feature" was added sneakily. No notification, there's no user disclosure. Nothing. That just screams suspicious, given the value of the data being sent. Sure, sort of, in 2012[0]. Doubleclick was added a bit later, in 2014[1]. The reasoning, at the time, is provided in the linked bug[2]. Sure looks nefarious. So was this an 8+ year scheme? Now, there are (at least) two possible ways to look at this, either it's an almost decade long scheme, or alternatively no one on chrome had any intent of ever tracking individual users, and it wasn't even considered. The bug also provides some more insight, doubleclick and GA serve different types of data, and that might matter for measuring things about QUIC. > DoubleClick is in the whitelist for no reason other than ad tracking purposes. The amount of websites who make calls to DoubleClick and not GTM or GA must be vanishingly small. Literally the first website I picked, CNN.com, has doubleclick sources, but not GTM or GA (at least as far as I can tell). > and does not rule out use for tracking or advertising purposes I will once again ask for a scheme by which the header is both useful for tracking or advertising, and isn't used for tracking individual users. It seems like you're claiming that Google is attempting to split hairs and say that tracking individual devices is different from tracking individual users. I've explained before why something like x-client-data can actually be a useful privacy-preserving tool elsewhere[3] (since it allows you to join across a quasi-identifier instead of a PII-identifier). [0]: https://chromium.googlesource.com/chromium/src.git/+/f89fdab13152123f737dc84f5910362fa6569f7f%5E%21/chrome/browser/renderer_host/chrome_resource_dispatcher_host_delegate.cc https://chromium.googlesource.com/chromium/src.git/+/f89fdab... [1]: https://chromium.googlesource.com/chromium/src.git/+/64d617ec7c502ea5ce5ec8f6f97580000541a854 https://chromium.googlesource.com/chromium/src.git/+/64d617e... [2]: https://bugs.chromium.org/p/chromium/issues/detail?id=379341 https://bugs.chromium.org/p/chromium/issues/detail?id=379341 [3]: https://news.ycombinator.com/item?id=22244282 https://news.ycombinator.com/item?id=22244282
minerjoe 6y ago
Yes. Google seems to be lying. Which would not suprise me or many people. If they cared they would allow for the header to be disabled. They do not.
minerjoe 6y ago
You seem like a nice fellow. And smart! How about somehow aligning your life's work to not further the goals of enormous corporations that do not seem to have the best interests of us at heart.
- joshuamorton 6y ago
  From my (insider, biased, more informed, however you want to describe it) point of view, the fears you have are unfounded. Why should I chose to pursue a different employer based on someone else's ill-founded concerns? Elaborating a bit more, there's a motte and Bailey you're pulling here. I'd agree that Google doesn't have broadly "the best interests of us" at heart, but that's true for every corporation. If that's your bar for ethical action, you're asking me to not participate in capitalism as a whole. I look forward to that world too, but unfortunately we aren't there today.
  - minerjoe 6y ago
    > we aren't there today Be the change you wish to see in the world. Waiting for others is the problem.
    - joshuamorton 6y ago
      There's, broadly speaking, a difference between telling me to find a different employer based on an unfounded concern (what you did) and asking me to work to enact a more socialist future. It's not even clear that the two are aligned in all cases.
      - minerjoe 6y ago
        I'm not sure who you are reading, but I never suggested that you find another employer. I suggested you figure out a way to use your limited time here on Mother Earth to not further the giant machine that is seemingly destroying everything of true value on this planet. Big order, yes, but you are young and it's not too late to make a change for the better (for us all). It's a high bar, but I have faith in you.

SquareWheel 6y ago

> Calling it a "trust token" is gaslighting It's a token for gauging trust. What else would you call it? The way "gaslighting" is used today, it's lost all possible meaning.