7 ms·

Google's response to this allegation: https://9to5google.com/2020/02/06/google-chrome-x-client-data-tracking/ https://9to5google.com/2020/02/06/google-chrome-x-

Google's response to this allegation: https://9to5google.com/2020/02/06/google-chrome-x-client-data-tracking/ https://9to5google.com/2020/02/06/google-chrome-x-client-dat... TL;DR, they claim that this header is sent to all Google-owned domains, and describes the feature flags that your browser has enabled, and it doesn't contain any PII. Oh wait They backpedalled on this by removing from the whitepaper their claim that the X-Client-Data field doesn't contain PII: https://vpnoverview.com/news/google-backpedals-on-claim-that-x-client-data-doesnt-contain-pi-information/ https://vpnoverview.com/news/google-backpedals-on-claim-that... Sigh. I guess the closest thing to a defence to your argument one could mount is "That's not true, Chrome sends it to all Google-owned domains!" which is... not a defence.

ttt0 6y ago
> it doesn't contain any PII. Even if that was the case, this is a bullshit argument. They don't need any PII, it's just more fingerprinting. They already have all the personal information they'll ever need by using all the other means.
- ElvisTrout 6y ago
  Surely fingerprinting is PII? It allows for mosaic identification.
  - ttt0 6y ago
    I don't know, are fonts installed on your system PII? Because it can be used for fingerprinting. But I don't know the precise definition, so maybe you're right.
    - ska 6y ago
      Perhaps a reasonable line to draw would be that if the content of the information is enough to fingerprint, the it is PII (regardless if broken into many messages) and the individual data doesn't matter.
      - ttt0 6y ago
        If we talk purely about "reasonable", I don't think it's even possible to draw any line, besides something obvious like unique user identifiers. It's hard to predict what data can be used for fingerprinting until someone actually does it, just like it's hard to predict what bugs are actually possible to exploit. I could never predict some of those things being used for that and yet here we are. So it can be a cat-and-mouse type of situation. And some of that information is probably legit useful for purposes other than tracking.
    - tremon 6y ago
      Intent matters. If you use the fonts list to identify persons, it's PII.
  - lmkg 6y ago
    Fingerprinting doesn't reveal an individual's name or passport number, so it's not PII. That's why PII is not a very useful concept in general, and why claims about privacy safeguards that over-focus on PII should be met with some skepticism. The laws are catching up this in regard. GDPR uses "personal data" and CCPA uses "personal information," both of which more generally refer to data that identifies an individual.
    - ttt0 6y ago
      At the same time let's not forget it's Google we're talking about. They are even parsing your emails to extract all the data from your transactions. They already have all your personal information, they just need to keep track of you when you're using other websites.
- baybal2 6y ago
  Yep, they have GREASE TLS bytes, TLS resume ticket, RLZ value, X-Geo header, UA header, JS APIs with persistent random values (which they do indeed use on adsense! This is why you get surprise WebGL code seemingly doing nonsense once a while in adsense ads) This cannot be a coincidence. They packed Chrome with fingerprints to work around GDPR by combining fingerprints on their side.
  - paulryanrogers 6y ago
    Doesn't that risk massive fines if proven? Like a percentage of all revenue?
    - baybal2 6y ago
      I believe they already did lawyerising, as written above. They grabbed onto the wording of PII as "personally identifiable information" that information is identifiable, but not personally identifiable, so it is ok to use for ads.
      - ngold 6y ago
        So we knows it's you, but you are a integer.
        teddyh 6y ago
        “I am not a number! I am a free man!” — The Prisoner
        WesolyKubeczek 6y ago
        Reminds me of this: "So here I was now, two years just to the day of being kicked and clanged into Staja 84F, dressed in the height of prison fashion, which was a one-piece suit of a very filthy like cal colour, and the number sewn on the groody part just above the old tick-tocker and on the back as well, so that going and coming I was 6655321 and not your little droog Alex not no longer."
        ricardo81 6y ago
joshuamorton 6y ago
[I work at Google, not on chrome] The current text of the whitepaper is "The combined state of these variations is non-identifying, since it is based on a 13-bit low entropy value (see above). These are transmitted using the "X-Client-Data" HTTP header, which contains a list of active variations"[0]. The X-Client-Data header is still described as non-identifying. You're reaching for controversy where there is none. I've had this conversation with GP before[1], and it's always unenjoyable, because it's like talking to a conspiracy theorist. There's no rational basis for Google doing what you and they suggest that Google is doing. And you're willing to take events that aren't actually evidence of any kind of malaction (like rewording a document to mean essentially the same thing) and try and draw nefarious conclusions out of those things. Like, why? If you start from the assumption that Google is acting unethically and is entirely untrustworthy, there are tons of other approaches they can take to do fingerprinting that wouldn't be detectable at all. If you're logged in, the entire conversation is moot. If they wanted to track you, they have your google account. So this only matters for logged out users, and even then, the value is marginal even if you assume Google isn't using any other form of nefarious tracking. And again that all assumes Google is openly lying. If you don't include that in your threat model, well, then, Google probably isn't lying. [0]: https://www.google.com/chrome/privacy/whitepaper.html#mediadrm https://www.google.com/chrome/privacy/whitepaper.html#mediad... [1]: https://news.ycombinator.com/item?id=24040675 https://news.ycombinator.com/item?id=24040675
- SheinhardtWigCo 6y ago
  > The X-Client-Data header is still described as non-identifying. That's a false description. 13 bits of entropy is more than most existing fingerprinting vectors. This header allows clients behind NAT to be identified with significantly greater precision. > There's no rational basis for Google doing what people suggest it's doing. There is. Their business lives and dies on their ability to track web users, and tracking methods are gradually being eliminated from web standards, therefore Google has a rational basis for adding new tracking methods that it can leverage - especially ones that only it can leverage. > If you start from the assumption that Google is acting unethically and is entirely untrustworthy I think the base assumption is less dramatic: that Google is simply acting in its own best interests by prioritizing growth over user privacy. > If you're logged in, the entire conversation is moot. If they wanted to track you, they have your google account. So this only matters for logged out users, and even then, the value is marginal even if you assume Google isn't using any other form of nefarious tracking. This is (obviously) about the hundreds of millions of Chrome users who are not logged in, and as I said above, 13 bits of entropy isn't marginal. > And again that all assumes Google is openly lying. If you don't include that in your threat model, well, then, Google probably isn't lying. Not necessarily. All it takes is a policy change. It looks like this: 1. Privacy regression is introduced and a restrictive policy is established, e.g. "we won't use that to track people". 2. 6-12 months go by; maybe a new VP gets hired, or a bizdev team discovers that this data could be leveraged for a significant bump in revenue. 3. The policy is relaxed to allow existing & future data to be used for fingerprinting. Nobody "lied" per se, but the end result is the same.

ttt0 6y ago

> it doesn't contain any PII. Even if that was the case, this is a bullshit argument. They don't need any PII, it's just more fingerprinting. They already have all the personal information they'll ever need by using all the other means.

ElvisTrout 6y ago
Surely fingerprinting is PII? It allows for mosaic identification.
- ttt0 6y ago
  I don't know, are fonts installed on your system PII? Because it can be used for fingerprinting. But I don't know the precise definition, so maybe you're right.
  - ska 6y ago
    Perhaps a reasonable line to draw would be that if the content of the information is enough to fingerprint, the it is PII (regardless if broken into many messages) and the individual data doesn't matter.
    - ttt0 6y ago
      If we talk purely about "reasonable", I don't think it's even possible to draw any line, besides something obvious like unique user identifiers. It's hard to predict what data can be used for fingerprinting until someone actually does it, just like it's hard to predict what bugs are actually possible to exploit. I could never predict some of those things being used for that and yet here we are. So it can be a cat-and-mouse type of situation. And some of that information is probably legit useful for purposes other than tracking.
  - tremon 6y ago
    Intent matters. If you use the fonts list to identify persons, it's PII.
- lmkg 6y ago
  Fingerprinting doesn't reveal an individual's name or passport number, so it's not PII. That's why PII is not a very useful concept in general, and why claims about privacy safeguards that over-focus on PII should be met with some skepticism. The laws are catching up this in regard. GDPR uses "personal data" and CCPA uses "personal information," both of which more generally refer to data that identifies an individual.
  - ttt0 6y ago
    At the same time let's not forget it's Google we're talking about. They are even parsing your emails to extract all the data from your transactions. They already have all your personal information, they just need to keep track of you when you're using other websites.
baybal2 6y ago
Yep, they have GREASE TLS bytes, TLS resume ticket, RLZ value, X-Geo header, UA header, JS APIs with persistent random values (which they do indeed use on adsense! This is why you get surprise WebGL code seemingly doing nonsense once a while in adsense ads) This cannot be a coincidence. They packed Chrome with fingerprints to work around GDPR by combining fingerprints on their side.
- paulryanrogers 6y ago
  Doesn't that risk massive fines if proven? Like a percentage of all revenue?
  - baybal2 6y ago
    I believe they already did lawyerising, as written above. They grabbed onto the wording of PII as "personally identifiable information" that information is identifiable, but not personally identifiable, so it is ok to use for ads.
    - ngold 6y ago
      So we knows it's you, but you are a integer.
      - teddyh 6y ago
        “I am not a number! I am a free man!” — The Prisoner
      - WesolyKubeczek 6y ago
        Reminds me of this: "So here I was now, two years just to the day of being kicked and clanged into Staja 84F, dressed in the height of prison fashion, which was a one-piece suit of a very filthy like cal colour, and the number sewn on the groody part just above the old tick-tocker and on the back as well, so that going and coming I was 6655321 and not your little droog Alex not no longer."
      - ricardo81 6y ago

joshuamorton 6y ago

[I work at Google, not on chrome] The current text of the whitepaper is "The combined state of these variations is non-identifying, since it is based on a 13-bit low entropy value (see above). These are transmitted using the "X-Client-Data" HTTP header, which contains a list of active variations"[0]. The X-Client-Data header is still described as non-identifying. You're reaching for controversy where there is none. I've had this conversation with GP before[1], and it's always unenjoyable, because it's like talking to a conspiracy theorist. There's no rational basis for Google doing what you and they suggest that Google is doing. And you're willing to take events that aren't actually evidence of any kind of malaction (like rewording a document to mean essentially the same thing) and try and draw nefarious conclusions out of those things. Like, why? If you start from the assumption that Google is acting unethically and is entirely untrustworthy, there are tons of other approaches they can take to do fingerprinting that wouldn't be detectable at all. If you're logged in, the entire conversation is moot. If they wanted to track you, they have your google account. So this only matters for logged out users, and even then, the value is marginal even if you assume Google isn't using any other form of nefarious tracking. And again that all assumes Google is openly lying. If you don't include that in your threat model, well, then, Google probably isn't lying. [0]: https://www.google.com/chrome/privacy/whitepaper.html#mediadrm https://www.google.com/chrome/privacy/whitepaper.html#mediad... [1]: https://news.ycombinator.com/item?id=24040675 https://news.ycombinator.com/item?id=24040675

SheinhardtWigCo 6y ago
> The X-Client-Data header is still described as non-identifying. That's a false description. 13 bits of entropy is more than most existing fingerprinting vectors. This header allows clients behind NAT to be identified with significantly greater precision. > There's no rational basis for Google doing what people suggest it's doing. There is. Their business lives and dies on their ability to track web users, and tracking methods are gradually being eliminated from web standards, therefore Google has a rational basis for adding new tracking methods that it can leverage - especially ones that only it can leverage. > If you start from the assumption that Google is acting unethically and is entirely untrustworthy I think the base assumption is less dramatic: that Google is simply acting in its own best interests by prioritizing growth over user privacy. > If you're logged in, the entire conversation is moot. If they wanted to track you, they have your google account. So this only matters for logged out users, and even then, the value is marginal even if you assume Google isn't using any other form of nefarious tracking. This is (obviously) about the hundreds of millions of Chrome users who are not logged in, and as I said above, 13 bits of entropy isn't marginal. > And again that all assumes Google is openly lying. If you don't include that in your threat model, well, then, Google probably isn't lying. Not necessarily. All it takes is a policy change. It looks like this: 1. Privacy regression is introduced and a restrictive policy is established, e.g. "we won't use that to track people". 2. 6-12 months go by; maybe a new VP gets hired, or a bizdev team discovers that this data could be leveraged for a significant bump in revenue. 3. The policy is relaxed to allow existing & future data to be used for fingerprinting. Nobody "lied" per se, but the end result is the same.