8 ms·
Chrome client “variations” can be used to identify you (2020)
- Flankk 5y agoChrome also syncs your browser history and passwords with their servers. They have your search history. They have your private email. They have your YouTube history. They have your private documents and photos. They run your phone. They possibly run your laptop. I guess my point is it goes far beyond Chrome. Google is running the Borg hive mind.
- marderfarker2 5y agoThis is why China bans these companies long ago. Imagine handing your population’s intel on a silver platter to your adversary.
- lostlogin 5y agoWhen you’re actively persecuting a portion of your population, why not monetise it too?
- footlose_3815 5y agoToo bad we were slow to do the same thing with all the shitty lazily-named Chinese phone manufacturers like OnePlus who have free reign to skim our devices.
- est31 5y agoOne Plus, using a number and a sign, is lazily named as opposed to what? A company that's named after a misspelled number? A company named after the first two greek letters? A company named after a river in south america? A company named after fruits?
- arvigeus 5y agoThese companies are banned for refusing to share the data they collect with the government. Essentially the Chinese government is a competitor when comes to harvesting user data, not a privacy guard.
- marderfarker2 5y agoI don’t think it is ever intended to be a privacy guard but data exfiltration prevention and admittedly to control the narrative, as does with every country including your own for obvious reasons.
- ghostcluster 5y agoChrome is still the most popular desktop browser in China by far, and has a significant chunk of the mobile market. https://gs.statcounter.com/browser-market-share/all/china https://gs.statcounter.com/browser-market-share/all/china
- Thorrez 5y agoDoes China ban any non-LinkedIn Microsoft services or Apple services? I though they didn't. Signal is blocked in China, and I'm pretty sure it isn't handing the population's intel over to anyone. Full disclosure I work at Google.
- Barrin92 5y agotbf they're fairly competent with it, I don't think I've ever had anything Google related compromised. I'm honestly not sure what the better solution is. There's a lot of security theater around this where people will de-google their software and then run random binaries compiled by unknown people on the internet instead
- pixelgeek 5y ago> tbf they're fairly competent with it, I don't think I've ever had anything Google related compromised. It doesn't need to be compromised. The biggest ad and ad tracking company in the world has all that data.
- zagrebian 5y ago> I'm honestly not sure what the better solution is. How about a browser company that syncs your data on their servers but doesn’t examine it. Even better, they couldn’t do that even if they wanted to, because your data is encrypted on their servers. That company has also never been compromised. Does that sound better?
- Barrin92 5y agoI don't think Google does examine drive data by default, fairly sure it's encrypted. complete E2E encryption Signal style with you having sole access to the keys and sync is technically pretty non-trivial across multiple devices (also the reason they don't sync device history on previously unlinked devices), so there's a usability / security trade-off. Honestly not certain whether that fits the need of most users for most data they have.
- zagrebian 5y agoWhat do you mean by drive data?
- ddlutz 5y agoBorg is the name of the backend service that runs a lot of Google software - https://research.google.com/pubs/pub43438.html?hl=es#:~:text=Google's%20Borg%20system%20is%20a,tens%20of%20thousands%20of%20machines https://research.google.com/pubs/pub43438.html?hl=es#:~:text....
- shadowgovt 5y agoThat's the nod-and-wink joke about the name Kubernetes. While it's a "controller" (hence the name) its design was inspired by borg. ... Kubernetes, or "kube" for short. ;)
- bqmjjx0kac 5y agoCan you also explain the "rnetes" part? And why is it spelled with a K?
- shagmin 5y agoKubernetes is a Greek word meaning helmsman.
- Uehreka 5y ago> Kubernetes (κυβερνήτης, Greek for "helmsman" or "pilot" or "governor", and the etymological root of cybernetics) Source: https://en.wikipedia.org/wiki/Kubernetes?wprov=sfti1 https://en.wikipedia.org/wiki/Kubernetes?wprov=sfti1 (The Borg have cybernetic enhancements, I’m guessing that’s the link)
- weikju 5y agoAlso the Borg ships were called cubes (they were huge cubes)
- shadowgovt 5y agoIt's incredibly convenient. I sat down at a new laptop about a month ago and realized I was blanking on my bank account credentials. Fortunately, since I use Chrome, I was able to log in and get them clouded over. Whew!
- sodality2 5y agoThat means you were already logged into google. At that point just use Bitwarden.
- shadowgovt 5y agoI'm not familiar with Bitwarden. After a bit of Wikipedia and web search research on them, I'm not sure why I'd trust 8Bit Solutions over Google for storage of my PII. Do they have the resources to keep it secure? What is their incentive structure to do so? What happens if they get bought? Should I be concerned about past errors such as "In March 2018, Bitwarden's web vault was criticized for embedding unconstrained third-party JavaScript from BootstrapCDN, Braintree, Google, and Stripe"? It sounds like it'd add an additional layer of complexity to my situation without an obvious up-side over my existing solution.
- paulryanrogers 5y agoBitwarden can be self hosted and there is at least one independently developed server.
- jyscao 5y agoBitwarden uses end-to-end encryption. So you don't have to trust them as much as Google.
- ameliaquining 5y agoChrome also offers the option to use end-to-end encryption.
- theamk 5y ago
- smoldesu 5y agoAnd so does Apple, Microsoft, and pretty much anyone else you share that info with. It's a little surreal to hear people complaining about companies having all their data when they were the ones who gave it to them in the first place. You want to buy privacy? They make you pay with convenience.
- lostlogin 5y agoThe expectation that everyone reads the TOS of services is laughable. They are impenetrable and they are long.
- authed 5y agoThey still have a few of my emails but besides that, only Youtube browsing... I use LineageOS without Gapps on my phone and some other web search engine, most of the time.
- mshroyer 5y agoChrome at least lets you opt into end-to-end encryption of your sync data. Unfortunately that isn't even an option on Edge yet.
- aaomidi 5y agoIirc they do allow e2ee for some stuff, like bookmarks.
- Thorrez 5y ago>Chrome also syncs your browser history and passwords with their servers. Only if you enable it, right? And I don't think it's enabled by default, I think it prompts you asking whether you want to or not. Full disclosure I work at Google, but not on anything related to this.
- hereforphone 5y agoI'll go ya one further. You shouldn't use any Google product.
- inversetelecine 5y agoSometimes you have no choice. Send an email to any @gmail.com address and you’re using a Google product. Then you have the myriad of analytics and tracking and such.
- lostlogin 5y agoYou can be emailing them with other domains too, if the user has a paid account with them.
- gorgoiler 5y agoIt’s a shame that Chrome turned out to be much more than just the chrome of the browser — the UI components built around the rendering and network engine. I would love to (1) see the two separated and (2) have a much smaller chrome on top. For example, I don’t even need tabs when my WM can handle that stuff for me. I’d also be quite happy for the browser to store no state in between sessions (yet still have the ability to assist with usernames and passwords — if I need persistent state between visits it’s usually handled by logging in to the handful of sites I care about.) This is part of a wider earthy-crunchiness I’ve found in my later life, including only using a (recycled, 100$) desktop computer instead of my MacBook, and turning it off when I’m not using it. In the true pedigree of earthy-crunchy types I also apparently cannot help proselytising about my life choices!
- ameliaquining 5y agoThey already are separated, in the sense that you can, and people do, embed Chromium-powered webviews in custom apps. I don't know if the particular app you're asking for exists, but there's no fundamental reason why it couldn't be built. (Having to re-log-into everywhere on every new session sounds like a nightmare, though, especially with phone-based 2FA, which unfortunately is still the best that most sites offer.)
- shadowgovt 5y agoChrome only sends these headers to Google-owned domains. As an attack surface, if you're worried about being spied on by the company that you got your browser from, I'd be more concerned about the closed-source control they have over the code in the browser itself than the unique identifier you're sending to their servers when you use their browser.
- c0nducktr 5y agoCan addons remove these headers? Like say I'm using uBlock Origin, does that do anything?
- paulryanrogers 5y agoPossibly with Manifest V2. While it lasts.
- tech234a 5y agoManifest V2 will last about 1 more year[1]. [1]: https://developer.chrome.com/docs/extensions/mv3/mv2-sunset/ https://developer.chrome.com/docs/extensions/mv3/mv2-sunset/
- random-string 5y agoThis is great and all - but what's the alternative? I've been using Firefox as my primary browser for about 2 years now - and the javascript engine on it has recently... sh*t the bed (I cannot paste links or images into facebook, I cannot paste text with line breaks into twitter, I cannot paste using reddit's "markdownmode"). I use google-chrome for netflix, recently chromium stopped working for netflix (apprently the browser is no longer supported) Edge isn't an option for me, brave isn't on my radar (WHY include cryptojunk with a BROWSER???, it's like the early 2000s where a major vendor was trying to claim that the browser is tied so closely to their kernel as to make it a part of an OS) Is Opera any good?
- roca 5y ago> (I cannot paste links or images into facebook, I cannot paste text with line breaks into twitter, I cannot paste using reddit's "markdownmode"). This is not normal, something's broken with Firefox in your setup. Probably worth filing a bug. (Also it's almost certainly nothing to do with the JS engine.)
- ronnier 5y agoI've started using brave. Feels just like chrome and I can use the Chrome extensions. There's settings for everything so you can disable the parts you don't like.
- randoglando 5y agoCurious, why isn't Edge an option? It's supposed to be the best alternative right now.
- userbinator 5y agoMy guess is non-Windows user.
- davemtl 5y agoMicrosoft now provide binaries for Debian and RHEL based Distros. Used Edge on Ubuntu for more than 6+ months for work, probably one of the best experiences I had with a browser now that I think about it.
- diebeforei485 5y agoHonestly, I'm happy with Safari and Firefox (I use Firefox primarily as a Facebook quarantine, but also for the RECAP extension) on my Mac. I have no reason to ever use Chrome.
- JaceLightning 5y agoI swear there's an article with this exact title released everyday and 90% of the time it's BS.
- yjftsjthsd-h 5y agoSemi-regularly, yes. Why do you think it's BS?
- wycy 5y agoI use Firefox 99.9% of the time at home on my 2012 iMac and 2015 MacBook. I have zero problems whatsoever with it.
- dang 5y agoSince the article title is generically baity, I changed it (per https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html) to one that attempts to summarize what the article says. If anyone has a better suggestion—i.e. one that is more accurate and neutral—we can change it again. As for this thread: let's try to talk about the specific claim in the article. Generic "boo Chrome" or whatever is too repetitive for a good HN thread.
- gmewx 5y agoThe thing is that those numbers are not identifiers. They are just feature IDs. Although the combination of those numbers can still be used for tracking, this is specially hard because many users have the same varient combinations.
- userbinator 5y agoIt's unfortunate that there doesn't seem to be a truly "neutral" browser anymore, if you count only the ones that can run the JS-required app-sites which are an increasing percentage of sites that people need to use. Big Tech has made it effectively impossible for other independent browsers by making the "standards" extremely complex and continuously churning them, since only they have the resources to effect such complexity and continuous change; they also popularise the new stuff and attempt to "infect" as many sites with it as they can, usually by way of frameworks. This constant churn of the ecosystem helps reinforce the monopoly. To them, simple static pages which can be viewed with browsers other than the ones they "support" are a threat. https://anybrowser.org/campaign/ https://anybrowser.org/campaign/
- ofou 5y agoseems like there's one: https://github.com/Eloston/ungoogled-chromium https://github.com/Eloston/ungoogled-chromium
- onion2k 5y agoThe problem a new browser would face is much simpler, but far harder to solve, than anything on the tech side - why would users switch to it? Neutrality is not a benefit for most people. It wouldn't harm them, but it isn't enough of a reason to put the effort in to switching either. People being tracked en masse is a problem for society, but not really an issue for any individual. Expecting people to put in the time and effort individually to understand the benefit of switching browser, the tech knowhow needed to download and install the software, and how to move their data over to it, all for the benefit of society as a whole, is a pretty big ask. For a new, neutral browser to take any significant market share there has to be a benefit for individuals that's more than simple neutrality. Either that, or there would need to be some sort of international regulation of browsers to force vendors to stop tracking users so much. I don't see either happening.
- zagrebian 5y agoApple is doing quite well not implementing most of Google’s “standards”.
- pjmlp 5y ago
- modulus1 5y agoThe author talks as if this isn't documented... https://www.google.com/intl/en/chrome/privacy/whitepaper.html#variations https://www.google.com/intl/en/chrome/privacy/whitepaper.htm... > Additionally, a subset of low entropy variations are included in network requests sent to Google. The combined state of these variations is non-identifying, since it is based on a 13-bit low entropy value (see above).
- jataget 5y agoShould use Ungoogled Chromium builds instead. Moreover, should use Unmozilled Firefox as well.
- hdjjhhvvhga 5y ago> Can that ID be used to track you? Yes it can. And if it can, you can be 99% sure that Google is doing it. Why would they introduce even 1% of ambiguity if they don't have to? It would make no sense to them.