14 ms·

So an HTTP GET request to another domain (fonts.googleapis.com) "leaked" website visitor's IP address to Google. What the hell? Google Translate: https://rewis

So an HTTP GET request to another domain (fonts.googleapis.com) "leaked" website visitor's IP address to Google. What the hell? Google Translate: https://rewis-io.translate.goog/urteile/urteil/lhm-20-01-2022-3-o-1749320/?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en-US&_x_tr_pto=wapp https://rewis-io.translate.goog/urteile/urteil/lhm-20-01-202... > The defendant is sentenced to pay the plaintiff €100.00 > The plaintiff has a claim against the defendant to refrain from passing on the plaintiff's IP addresses to Google under Section 823 (1) in conjunction with Section 1004 of the German Civil Code. > It is undisputed that the plaintiff's IP address was forwarded to Google when the plaintiff visited the defendant's website.

mro_name 5y ago
yes. That's a fact. A 3rd party is a 3rd party and a website leaks it's visitors to it. Just don't do it but serve your stuff from your domain.
- XCSme 5y ago
  > from your domain Not only from your own domain, but from your own servers. If you still server-side send the IP to Google servers, it's still sharing of personal data with a 3rd party. I wonder how this works when you rent servers from VPS providers. If you host data on their servers, does it mean you share it with them? What if this data is behind a root password? What if it's encrypted?
- arlcode 5y ago
  Also Google can definitely make use of That information because they know so much about the user that a single IP connect is enough to establish that a specific user visited that website.
- randalluk 5y ago
  Doesn't this attitude overlook the "agency" of the "User-Agent"?
  - maratc 5y ago
    Note the text: > It is undisputed that the plaintiff's IP address was forwarded to Google when the plaintiff visited the defendant's website. In this context, "It is undisputed" does not mean "It is a truth universally acknowledged by everyone", but rather "there is no dispute between the defendant and the plaintiff that this happened; in the light of that non-disagreement, the court is not required to decide whether that happened or not, and will accept that as a fact". So in this case, the defendant (as well as the plaintiff, of course) agreed that "the plaintiff's IP address was forwarded to Google when the plaintiff visited the defendant's website". If there was a place to bring forward this "agency argument", this was the place; however the defendant seems to have chosen not to bring it forward. It may be because the defendant's lawyers are unprofessional and forgot; it may also be because they are professional and so they knew this argument would not hold. P.S. see also https://news.ycombinator.com/item?id=30139489 https://news.ycombinator.com/item?id=30139489
  - 7373737373 5y ago
    Yeah, the plaintiff's browser made the request after all, no?
    - guipsp 5y ago
      Use this one weird trick to make all browser exploitation legal.
    - maratc 5y ago
      The plaintiff's browser did what the defendant's code ordered it to do. If the defendant's code violated GPDR (which seems to be the court's conclusion) by sending the plaintiff's browser somewhere, it's a defendant's problem, not plaintiff's.
      - 7373737373 5y ago
        Yeah, that's exactly the agency argument. It's not as if the plaintiff's browser is actually under control of the defendant, a user agent is not forced to follow the instructions that are contained in a website it requested on behalf of its user.
- mminer237 5y ago
  Note that if you are an American, this still isn't a solution. This ruling prohibits any US citizen having EU IP addresses. So if you as an American host your own servers, you either have to remove all connection logging or ban all Germans.
brtkdotse 5y ago
Running a website in Germany seems like a god damned nightmare: https://allaboutberlin.com/guides/abmahnung-creative-commons https://allaboutberlin.com/guides/abmahnung-creative-commons
- bruce343434 5y ago
  You just need to have a bit of common sense about what's good for your users and what's not good for them. That copyright example by the way, that applies everywhere.
  - drstewart 5y ago
    My common sense would say embedding a link to Google Fonts to make use of caching is possible is good for the user
    - bruce343434 5y ago
      https://news.ycombinator.com/item?id=30136221 https://news.ycombinator.com/item?id=30136221 > The browsers don't share third-party caches across domains, because it made it easier to leak information about which sites the user has visited.
    - neoromantique 5y ago
      And because of people like you we are stuck with NoScript and the like
- onli 5y ago
  That specific scam does not have to work anymore though. Abmahnungen in Germany are the most stupid and lawyer serving system in the world, but the CC image scam got closed by judges deciding no monetary harm was done. Possible that these lawyers are still trying, but note that the article started 2018.
  - account42 5y ago
    The linked article also never went to court because they decided to pay instead: > September 21: After months of silence, we have received another letter from Kanzlei Schröder. This time, they threaten to take us to court unless we pay 400€ by October 1. We decided to pay. That was our last interaction with Kanzlei Schröder.
onli 5y ago
Why "what the hell"? This is exactly what happened, and a logical consequence the moment IP addresses are classified as private data. Which it is in a system where it can be used to find the civil identity of the user, which is the case in Germany via Vorratsdatenspeicherung and the rampant misuse of the legal system. Note how the decision contains the question of whether leaking the IP was necessary. They noted it is not necessary to serve the fonts via Google, it can happen without leaking the IP (I assume they mean self-hosting): > Google Fonts kann durch die Beklagte auch genutzt werden, ohne dass beim Aufruf der Webseite eine Verbindung zu einem Google-Server hergestellt wird und eine Übertragung der IP-Adresse der Webseitennutzer an Google stattfindet. translated: > Google fonts can be used by the defendant in a different way, so that a connection to the website does not make a connection to the Google server, thus without transmitting the IP address of the website visitor to Google. Which is good news! It is a totally consistent decision with the current privacy rules and best practices: Do not save or leak private data if not necessary, always minimize data exposure as much as possible. The as much as possible part is very important - if there is no way to embed Youtube videos without leaking the address, then that's still possible to do. Sounds fair to me.
- ab_testing 5y ago
  Does that also imply that do not use a cdn to serve any of your assets as that will also leak the up address to third parties.
  - Jensson 5y ago
    If the CDN abides by GDPR laws and doesn't process user data then it is fine. But if the CDN you use process user data for its own gain rather than just serve the request then that goes against GDPR. It is your responsibility as a developer to ensure the services you use follow these laws. If you don't have a contract stating that the other part will honor GDPR then we will assume that the other part will misuse all data sent to them, so you aren't allowed to send any data at all.
    - iammarkbro 5y ago
noja 5y ago
Seems pretty simple to me. I visit not-google.com, then don't load anything from elsewhere without being asked first. It's not too dissimilar to app-level permissions.
- ChrisKnott 5y ago
  The counterargument to this is that you are knowingly using a piece of software that has, and has always had, the default behaviour of autoloading remote resource links it finds in HTML. This ruling could easily get overturned.
  - TotempaaltJ 5y ago
    The vast majority of people don't know what the last half of your message means. They cannot, and should not, be expected to make fully informed decisions. Industry (as always) has demonstrated they're not interested in educating or helping the user in any way about this. So they need to be regulated.
  - pwdisswordfish9 5y ago
    > you are knowingly using a piece of software that has, and has always had, the default behaviour of autoloading remote resource links it finds in HTML Actually, most people don’t actually know that. And why would they? Why should they get bogged down in such technical minutiae? Why require users to play tedious uBlock whack-a-mole of enabling resources from external domains until the website starts working in order to have any semblance of privacy? Just because something is common doesn’t make it right.
  - arlcode 5y ago
    Could be but I would not expect it. If the user visits foo.de they obviously expect that some data is transmitted to foo.de They also might know that companies use service providers and therefore necessary data might be shared with 3rd party companies (which is fine according to the GDPR). However the user can also expect that that a) foo.de minimizes data transmissions and b) 3rd parties conform to the GDPR rules (which Google can't). If the user is logged in to Google (e.g. for Gmail) Google would be able to connect the user with foo.de with a high likelihood. This in turn might expose the users behaviour to automatic analysis by foreign government agencies without any legal oversight (since the user most likely isn't a US citizen)
deleted 5y ago
[deleted]
mola 5y ago
Why do you think google fonts exist? For google to Get visitor IP all over the web without any form of user consent, this is exactly what the gdpr tries to kill.
- oblio 5y ago
  Nah, it's charity, come on. /s
- HL33tibCe7 5y ago
  What value exactly is there in Google seeing that IP X requested font Y, assuming there’s no Referer header - which there won’t be, assuming Referer-Policy is set sanely (which by default it is in all browsers)?
  - arlcode 5y ago
    If you are logged in to Google and visited YouTube earlier that day they already know that you are behind IP X with device Z and use that information later on by connecting it with the font API key of mydomain.de Remember that your user agent is sent as well.
    - Jyaif 5y ago
      What API key?
    - bryan_w 5y ago
      Pretty sure the font URL is a static link that doesn't require an "API key"
  - Acinyx 5y ago
    Under the GDPR, an IP address is personally identifiable data, so you can't leak it. And for someone with masses of extra data like Google it is enough to identify who is doing the browsing, so this isn't some crazy overreach.
    - 5y ago
laurent92 5y ago
The whole strategy with Google providing “services for everyone out of pure gratitude” is: - With Google Fonts, to track the identity of users AND the real popularity of websites, - With Google DNS 8.8.8.8, to track everyone’s DNS resolutions, - With Google Analytics, to track who sees what, even if they only display masked IPs to the owner of the GA profile, - Etc with Google Maps, emails, they don’t provide those services for free, they can track everyone’s profile, down to their obedience to Covid rules. I wouldn’t be surprised if Germany bans more aspects of using Google’s free services.
- Hnrobert42 5y ago
  I agree, but the court did not ban Google fonts. It required consent before using it.
benmmurphy 5y ago
The plaintiff’s IP address was also leaked to every intermediate router and potentially to the DNS server(s) that resolved the IP address.
- dathinab 5y ago
  Yes, but there is one small difference: The sharing with ruters etc. is required to operate the service (website). Using a Google CDN for fonts isn't (required for operating a website). The ruling explicitly points that out. Furthermore DNS is handled by the contract you signed with you ISP or you explicitly changing it. Same for some other parts.
  - XCSme 5y ago
    > Google CDN for fonts isn't Where is exactly is the line for needed for operating a website and being optional? What if you create your website in wix.com, the data from your domain will be shared with them AND it is needed for this data to be shared for operating the website. EDIT: To make it clear, I always recommend self-hosting fonts and agree that Google CDN fonts should be avoided. But even if you self-host the fonts, those are still hosted on a server that is very unlikely to be your basement.

mro_name 5y ago

yes. That's a fact. A 3rd party is a 3rd party and a website leaks it's visitors to it. Just don't do it but serve your stuff from your domain.

XCSme 5y ago
> from your domain Not only from your own domain, but from your own servers. If you still server-side send the IP to Google servers, it's still sharing of personal data with a 3rd party. I wonder how this works when you rent servers from VPS providers. If you host data on their servers, does it mean you share it with them? What if this data is behind a root password? What if it's encrypted?
arlcode 5y ago
Also Google can definitely make use of That information because they know so much about the user that a single IP connect is enough to establish that a specific user visited that website.
randalluk 5y ago
Doesn't this attitude overlook the "agency" of the "User-Agent"?
- maratc 5y ago
  Note the text: > It is undisputed that the plaintiff's IP address was forwarded to Google when the plaintiff visited the defendant's website. In this context, "It is undisputed" does not mean "It is a truth universally acknowledged by everyone", but rather "there is no dispute between the defendant and the plaintiff that this happened; in the light of that non-disagreement, the court is not required to decide whether that happened or not, and will accept that as a fact". So in this case, the defendant (as well as the plaintiff, of course) agreed that "the plaintiff's IP address was forwarded to Google when the plaintiff visited the defendant's website". If there was a place to bring forward this "agency argument", this was the place; however the defendant seems to have chosen not to bring it forward. It may be because the defendant's lawyers are unprofessional and forgot; it may also be because they are professional and so they knew this argument would not hold. P.S. see also https://news.ycombinator.com/item?id=30139489 https://news.ycombinator.com/item?id=30139489
- 7373737373 5y ago
  Yeah, the plaintiff's browser made the request after all, no?
  - guipsp 5y ago
    Use this one weird trick to make all browser exploitation legal.
  - maratc 5y ago
    The plaintiff's browser did what the defendant's code ordered it to do. If the defendant's code violated GPDR (which seems to be the court's conclusion) by sending the plaintiff's browser somewhere, it's a defendant's problem, not plaintiff's.
    - 7373737373 5y ago
      Yeah, that's exactly the agency argument. It's not as if the plaintiff's browser is actually under control of the defendant, a user agent is not forced to follow the instructions that are contained in a website it requested on behalf of its user.
mminer237 5y ago
Note that if you are an American, this still isn't a solution. This ruling prohibits any US citizen having EU IP addresses. So if you as an American host your own servers, you either have to remove all connection logging or ban all Germans.

brtkdotse 5y ago

Running a website in Germany seems like a god damned nightmare: https://allaboutberlin.com/guides/abmahnung-creative-commons https://allaboutberlin.com/guides/abmahnung-creative-commons

bruce343434 5y ago
You just need to have a bit of common sense about what's good for your users and what's not good for them. That copyright example by the way, that applies everywhere.
- drstewart 5y ago
  My common sense would say embedding a link to Google Fonts to make use of caching is possible is good for the user
  - bruce343434 5y ago
    https://news.ycombinator.com/item?id=30136221 https://news.ycombinator.com/item?id=30136221 > The browsers don't share third-party caches across domains, because it made it easier to leak information about which sites the user has visited.
  - neoromantique 5y ago
    And because of people like you we are stuck with NoScript and the like
onli 5y ago
That specific scam does not have to work anymore though. Abmahnungen in Germany are the most stupid and lawyer serving system in the world, but the CC image scam got closed by judges deciding no monetary harm was done. Possible that these lawyers are still trying, but note that the article started 2018.
- account42 5y ago
  The linked article also never went to court because they decided to pay instead: > September 21: After months of silence, we have received another letter from Kanzlei Schröder. This time, they threaten to take us to court unless we pay 400€ by October 1. We decided to pay. That was our last interaction with Kanzlei Schröder.

onli 5y ago

Why "what the hell"? This is exactly what happened, and a logical consequence the moment IP addresses are classified as private data. Which it is in a system where it can be used to find the civil identity of the user, which is the case in Germany via Vorratsdatenspeicherung and the rampant misuse of the legal system. Note how the decision contains the question of whether leaking the IP was necessary. They noted it is not necessary to serve the fonts via Google, it can happen without leaking the IP (I assume they mean self-hosting): > Google Fonts kann durch die Beklagte auch genutzt werden, ohne dass beim Aufruf der Webseite eine Verbindung zu einem Google-Server hergestellt wird und eine Übertragung der IP-Adresse der Webseitennutzer an Google stattfindet. translated: > Google fonts can be used by the defendant in a different way, so that a connection to the website does not make a connection to the Google server, thus without transmitting the IP address of the website visitor to Google. Which is good news! It is a totally consistent decision with the current privacy rules and best practices: Do not save or leak private data if not necessary, always minimize data exposure as much as possible. The as much as possible part is very important - if there is no way to embed Youtube videos without leaking the address, then that's still possible to do. Sounds fair to me.

ab_testing 5y ago
Does that also imply that do not use a cdn to serve any of your assets as that will also leak the up address to third parties.
- Jensson 5y ago
  If the CDN abides by GDPR laws and doesn't process user data then it is fine. But if the CDN you use process user data for its own gain rather than just serve the request then that goes against GDPR. It is your responsibility as a developer to ensure the services you use follow these laws. If you don't have a contract stating that the other part will honor GDPR then we will assume that the other part will misuse all data sent to them, so you aren't allowed to send any data at all.
  - iammarkbro 5y ago

noja 5y ago

Seems pretty simple to me. I visit not-google.com, then don't load anything from elsewhere without being asked first. It's not too dissimilar to app-level permissions.

ChrisKnott 5y ago
The counterargument to this is that you are knowingly using a piece of software that has, and has always had, the default behaviour of autoloading remote resource links it finds in HTML. This ruling could easily get overturned.
- TotempaaltJ 5y ago
  The vast majority of people don't know what the last half of your message means. They cannot, and should not, be expected to make fully informed decisions. Industry (as always) has demonstrated they're not interested in educating or helping the user in any way about this. So they need to be regulated.
- pwdisswordfish9 5y ago
  > you are knowingly using a piece of software that has, and has always had, the default behaviour of autoloading remote resource links it finds in HTML Actually, most people don’t actually know that. And why would they? Why should they get bogged down in such technical minutiae? Why require users to play tedious uBlock whack-a-mole of enabling resources from external domains until the website starts working in order to have any semblance of privacy? Just because something is common doesn’t make it right.
- arlcode 5y ago
  Could be but I would not expect it. If the user visits foo.de they obviously expect that some data is transmitted to foo.de They also might know that companies use service providers and therefore necessary data might be shared with 3rd party companies (which is fine according to the GDPR). However the user can also expect that that a) foo.de minimizes data transmissions and b) 3rd parties conform to the GDPR rules (which Google can't). If the user is logged in to Google (e.g. for Gmail) Google would be able to connect the user with foo.de with a high likelihood. This in turn might expose the users behaviour to automatic analysis by foreign government agencies without any legal oversight (since the user most likely isn't a US citizen)

deleted 5y ago

[deleted]

mola 5y ago

Why do you think google fonts exist? For google to Get visitor IP all over the web without any form of user consent, this is exactly what the gdpr tries to kill.

oblio 5y ago
Nah, it's charity, come on. /s
HL33tibCe7 5y ago
What value exactly is there in Google seeing that IP X requested font Y, assuming there’s no Referer header - which there won’t be, assuming Referer-Policy is set sanely (which by default it is in all browsers)?
- arlcode 5y ago
  If you are logged in to Google and visited YouTube earlier that day they already know that you are behind IP X with device Z and use that information later on by connecting it with the font API key of mydomain.de Remember that your user agent is sent as well.
  - Jyaif 5y ago
    What API key?
  - bryan_w 5y ago
    Pretty sure the font URL is a static link that doesn't require an "API key"
- Acinyx 5y ago
  Under the GDPR, an IP address is personally identifiable data, so you can't leak it. And for someone with masses of extra data like Google it is enough to identify who is doing the browsing, so this isn't some crazy overreach.
  - 5y ago

laurent92 5y ago

The whole strategy with Google providing “services for everyone out of pure gratitude” is: - With Google Fonts, to track the identity of users AND the real popularity of websites, - With Google DNS 8.8.8.8, to track everyone’s DNS resolutions, - With Google Analytics, to track who sees what, even if they only display masked IPs to the owner of the GA profile, - Etc with Google Maps, emails, they don’t provide those services for free, they can track everyone’s profile, down to their obedience to Covid rules. I wouldn’t be surprised if Germany bans more aspects of using Google’s free services.

Hnrobert42 5y ago
I agree, but the court did not ban Google fonts. It required consent before using it.

benmmurphy 5y ago

The plaintiff’s IP address was also leaked to every intermediate router and potentially to the DNS server(s) that resolved the IP address.

dathinab 5y ago
Yes, but there is one small difference: The sharing with ruters etc. is required to operate the service (website). Using a Google CDN for fonts isn't (required for operating a website). The ruling explicitly points that out. Furthermore DNS is handled by the contract you signed with you ISP or you explicitly changing it. Same for some other parts.
- XCSme 5y ago
  > Google CDN for fonts isn't Where is exactly is the line for needed for operating a website and being optional? What if you create your website in wix.com, the data from your domain will be shared with them AND it is needed for this data to be shared for operating the website. EDIT: To make it clear, I always recommend self-hosting fonts and agree that Google CDN fonts should be avoided. But even if you self-host the fonts, those are still hosted on a server that is very unlikely to be your basement.