6 ms·

Google dragged to UK watchdog over Chrome's upcoming IP address cloaking

107 points by Beggers1960 3y ago

cynusx 3y ago
Wouldn't that mean that all your web traffic is going through a google server?
- andylynch 3y ago
  Yes. It’s like a Googled version of Apple’s Private Relay.
- layer8 3y ago
  Yes, but it’s end-to-end-encrypted. See https://github.com/GoogleChrome/ip-protection/issues/10 https://github.com/GoogleChrome/ip-protection/issues/10 for example. Of course, Google can conceivably backdoor Chrome, and then the exfiltration of data wouldn’t be obvious from the client-side traffic.
  - quenix 3y ago
    If we assume Google to backdoor Chrome, the whole IP protection talk is irrelevant. They could backdoor it without needing that.
    - layer8 3y ago
      Chrome would need to contact Google servers to send the collected data. Such unexpected traffic would be more easily detectable without IP Protection. With IP Protection, Chrome is sending data to the Google proxy all the time, so it would be harder to detect extra data sent that way.
    - onedognight 3y ago
      The CA system and hence https/TLS is already backdoored, by construction. Any of root CA’s that your browser trusts can man-in—the-middle you unless you keep track of and pin certificates like Google does. These roots CAs are run by random companies and governments around the world. All of them have equal precedence in browsers.
      - layer8 3y ago
        It’s not that easy. They would also need to MITM the actual traffic, or the DNS.
        onedognight 3y ago
        Same with plain http.
      - basique 3y ago
        Any fake certificates the malicious CA signs will have to be written to a Certificate Transparency log, which would make noticing the fact that the CA has done something like this easy.
- JimDabell 3y ago
  From the third paragraph of the article: > It's designed to run Chrome browser connections through two proxies, one operated by Google and one operated by a third-party (eg, Cloudflare), so that the true public IP address of the user is obscured, hopefully thwarting attempts to track them around the web using that address.
  - justinclift 3y ago
    Reading the front page the of GitHub repo with the Chrome "IP Protection" source code, it has this worrying statement: We are considering using 2 hops for improved privacy. A second proxy would be run by an external CDN ... https://github.com/GoogleChrome/ip-protection https://github.com/GoogleChrome/ip-protection "Considering" means "we're thinking about it, but it's in no way final". Sounds like Google could implement a proxy solution but decide the 2nd hop for improved privacy isn't needed after all. Or make it optional, defaulting to OFF, etc.
    - buremba 3y ago
      ^ This is an important "detail".
  - eli 3y ago
    In other words what apple has been doing for years now
  - AnthonyMouse 3y ago
    Wouldn't this be useful as a way to avoid getting blocked or having to do a thousand CAPTCHAs when using Tor? Access the relay via Tor, the relay doesn't know who you are because of Tor, the website sees you as someone using the relay which is too many ordinary people to block.
    - mindslight 3y ago
      Yes, but such proxies will likely require authentication with a Google account, and Google will keep an audit log to prevent "abuse". So at best it works out for maintaining somewhat persistent nyms for well-scoped purposes (that you make with a burner SIM or buy from someone who did), but not as some panacea for Internet privacy. This is of course assuming that the roadmap for these proxies isn't tied into their push for remote attestation ala "Safety" Net and WEI, in which case your "nym" becomes the entire device.
- LinuxBender 3y ago
  Wouldn't that mean that all your web traffic is going through a google server? Yup just like most people using Android have their text messages routing through Google. Some don't even realize this.
  - Andrex 3y ago
    RCS E2EE and Group E2EE are live which makes this a less dangerous attack surface / a less useful ad data reservoir. Google Voice users like myself are SOL but I've never had pretenses that my messages there are private. They're probably stored in plaintext even, there's a lot of 15+ year old GrandCentral cruft underpinning Voice even to this day (speaking only as a user).
diroussel 3y ago
Combined with Privacy Sandbox [0], this means the browser can track you directly without cookies, but websites can't track you via IP address. So it has the effect of centralising the tracking to google only. I haven't used Chrome since this rolled out, since I didn't see a way to object to the new tracking. This is what the linked article [0] says: > It’s unclear if toggling these features off will stop Chrome from collecting these data altogether, or if it just won’t share the data with advertisers. [0] https://theconversation.com/google-chrome-just-rolled-out-a-new-way-to-track-you-and-serve-ads-heres-what-you-need-to-know-213150 https://theconversation.com/google-chrome-just-rolled-out-a-... [1] https://developer.chrome.com/en/blog/shipping-privacy-sandbox/#whats-shipping https://developer.chrome.com/en/blog/shipping-privacy-sandbo...
- jwells89 3y ago
  Depending on the user’s aims, that could still be a net win… limiting tracking to a single party versus N parties. Obviously not ideal as no tracking at all though.
  - mindslight 3y ago
    Normalizing VPN/proxy use is a fantastic development for the entire market. Sure, I can see a future where websites only allow traffic from naive connections, Apple proxy, or Google proxy. But I can just as likely see a future where many more "normie"-appearing providers spring up and website managers move on to some other feel-good check box besides IP discrimination.
  - pixl97 3y ago
    The particular issue here is where many people have the same complaint about Cloudflare. You're concentrating that single party to a single provider for a massive number of people. Hence now governments have a one stop shop for all the information they need.
  - kevingadd 3y ago
    That's assuming you can trust the single party not to pick winners to share data with and losers to keep out. With Apple we know they have a bunch of revenue streams based on selling actual products to users, so there's much less of a hazard there. With Google... who knows what they'll do to juice their next earnings report?
isodev 3y ago
That's an excellent example of the conflict of interest of trying to be an ad company and a proponent for privacy at the same time.
- leoh 3y ago
  Worse, it’s arguably anti-competitive behavior. Though, truth be told, once I looked at the facts, I would prefer Google to have my data siloed (which itself, yes is not good) than random third party data collectors that would sell it on data markets.
- deleted 3y ago
  [deleted]
- intelVISA 3y ago
  There's no conflict of interest, it's simply denying the enemy from pillaging big G's harvest (you).
sacrosanct 3y ago
> The Movement for an Open Web (MOW), an organization that has lobbied against Google's Privacy Sandbox initiative by claiming it's harmful to rival internet advertising businesses They have much more to be annoyed at. VPN companies, The Tor Project, AD blockers, etc I use the Google One VPN[0] to cloak my real IP, but only sparingly. For most of my Internet surfing I use a two hop VPN setup. One VPN router with kill switch mode, and then I connect to another VPN service on top of that, a sort of fake Tor / private relay setup. I don't funnel all my traffic into Google One's VPN. I like to compartment and not put all my eggs in one basket. Looks like I'll be doing the same when this new Google-owned IP cloaking feature ships. [0] https://one.google.com/about/vpn https://one.google.com/about/vpn
- yjftsjthsd-h 3y ago
  >> The Movement for an Open Web (MOW), an organization that has lobbied against Google's Privacy Sandbox initiative by claiming it's harmful to rival internet advertising businesses > They have much more to be annoyed at. VPN companies, The Tor Project, AD blockers, etc While I'm sure they dislike those, the key word here is rival - the claim is that Google has its own ad business, and is only deploying privacy features in a way that hurts other ad companies.
- PrimeMcFly 3y ago
  That seems unnecessary. Why not just forward through an anonymous SSH box?
leoh 3y ago
We really need to be thinking bigger here — Google included, to the degree there are pro-privacy folks in the org (which there) - in coming up with something that protects a lot more than the identity via IP of Chrome users, but all web traffic. I mean, maybe even rethinking IP, TCP/IP entirely.
- LinuxBender 3y ago
  In my opinion this would just be a cat and mouse arms race. Make something new and corporations will race to be the first to add their tracking to it.
- Andrex 3y ago
  I always thought there was something that could be done with the BitTorrent protocol... I don't know how well it would work, but an Internet that isn't so brittle mirrors are commonplace and accepted wisdom would be nice. BT isn't anonymous but a TCP/IP replacement version could be.
deleted 3y ago
[deleted]
muteor 3y ago
The anti abuse points from their github do not sound convincing to me. There will be a high value in farming accounts to either spam or attack. What do you do when the google proxy is dosing your service?
- cedws 3y ago
  I was just watching a video[0] about how Private Relay under the hood and it sounds like authentication is somewhat tied to having genuine Apple hardware, as well as requiring an iCloud subscription. If Google's relay just requires a Google account, there's no doubt that dummy accounts will be used to abuse the service. Apparently Private Relay sends a dynamic config of relay servers to use which they could leverage at any time to unmask you. I'm guessing Google will do it similarly. [0] https://media.ccc.de/v/camp2023-57214-trustmerelay_investigating_apple_s_icloud_private_relay#t=1777 https://media.ccc.de/v/camp2023-57214-trustmerelay_investiga...
sdefresne 3y ago
Isn’t this similar to what Apple does with Safari on iPhone where they can hide your ip address by using iCloud servers as relay? Discussed here: https://news.ycombinator.com/item?id=31387019 https://news.ycombinator.com/item?id=31387019 or https://news.ycombinator.com/item?id=27467798 https://news.ycombinator.com/item?id=27467798 Why is it good when Apple does it but terrible when it is Google?
- Lio 3y ago
  Is it because Apple’s motivation is perceived to be selling protection to its hardware customers where as Google’s primary motivation is perceived to be to get a monopoly in the surveillance business?
- dilipdasilva 3y ago
  It is not ok for Apple or Google to do this while at the same time operating an ad business. If they feel this is in the best interest of the end user, then they should divest of either their ad business or control of the browser. Neither company is willing to do this. This IP move is anticompetitive as it consolidates even more control of the ad ecosystem in a handful of companies. Google’s response that they are placed at the same disadvantage as other third parties is not accurate. Google controls the browser and so has full control to communicate any data between the browser and their servers, bypassing the proxies. There is only one thing that drives these companies and that is maximizing profits for the benefit of their investors. This objective is fine. However, it is disingenuous for either of these companies to hide behind the defense that they care about the privacy of end users. If Apple cared about the privacy rights of all humans, why do they share all data belonging to their customers in China with the Chinese government. The only reason is profits. Google also shares all their customer’s data with any government that asks. If there were a thousand companies that each had access to a tiny sliver of a consumers data, we would have a system that naturally protects end user privacy. However, with a few companies controlling the vast majority of the consumer tech landscape, we now have a system where a few for-profit companies are keepers of our data and already sell out when their profits are at stake.
- olliej 3y ago
  From other comments it _sounds_ like Google's system is done as a single proxy, which is bizarre to me because it means google can see every site that is loaded which even for google seems on the nose. Apple's service is explicitly designed to prevent this exact problem. There's a write up for it on apple's security site (possibly part of the system security doc?). There are intentionally two layers, the connection from the device -> apple's servers, and then the connection from apple's servers to Akamai or cloud flare (or some other CDN). The connection to apple's servers is encrypted to a key from the 2nd layer CDN so apple can't read it, that request is forwarded to the CDN which decrypts it makes the request, then encrypts the response to the client's key and sends that to apple, apple forwards that encrypted blob on to the originating device which can then decrypt it. The end result is apple cannot ever see the destination or response, and the backend CDN can't see the device that made the request. That should be the design of _any_ privacy conscious proxy service (including all the questionable "privacy!" VPNs). That's kind of why I'm surprised that the claim is that Google's service is a single layer - it's so blatantly invasive.
gumballindie 3y ago
Welp Firefox it is then.
deleted 3y ago
[deleted]
redder23 3y ago
So Google is doing his why exactly? Since they know everything about everyone they now shut out the competition while sending all the IPs to their own proxy that will log them for themselves "for your privacy TM"??? I mean I would like this if it would not come from Google.
kobalsky 3y ago
is the proxy service available for user modified browsers? otherwise this sounds like WEI with a fake mustache

107 points by Beggers1960 3y ago

cynusx 3y ago

Wouldn't that mean that all your web traffic is going through a google server?

andylynch 3y ago
Yes. It’s like a Googled version of Apple’s Private Relay.
layer8 3y ago
Yes, but it’s end-to-end-encrypted. See https://github.com/GoogleChrome/ip-protection/issues/10 https://github.com/GoogleChrome/ip-protection/issues/10 for example. Of course, Google can conceivably backdoor Chrome, and then the exfiltration of data wouldn’t be obvious from the client-side traffic.
- quenix 3y ago
  If we assume Google to backdoor Chrome, the whole IP protection talk is irrelevant. They could backdoor it without needing that.
  - layer8 3y ago
    Chrome would need to contact Google servers to send the collected data. Such unexpected traffic would be more easily detectable without IP Protection. With IP Protection, Chrome is sending data to the Google proxy all the time, so it would be harder to detect extra data sent that way.
  - onedognight 3y ago
    The CA system and hence https/TLS is already backdoored, by construction. Any of root CA’s that your browser trusts can man-in—the-middle you unless you keep track of and pin certificates like Google does. These roots CAs are run by random companies and governments around the world. All of them have equal precedence in browsers.
    - layer8 3y ago
      It’s not that easy. They would also need to MITM the actual traffic, or the DNS.
      - onedognight 3y ago
        Same with plain http.
    - basique 3y ago
      Any fake certificates the malicious CA signs will have to be written to a Certificate Transparency log, which would make noticing the fact that the CA has done something like this easy.
JimDabell 3y ago
From the third paragraph of the article: > It's designed to run Chrome browser connections through two proxies, one operated by Google and one operated by a third-party (eg, Cloudflare), so that the true public IP address of the user is obscured, hopefully thwarting attempts to track them around the web using that address.
- justinclift 3y ago
  Reading the front page the of GitHub repo with the Chrome "IP Protection" source code, it has this worrying statement: We are considering using 2 hops for improved privacy. A second proxy would be run by an external CDN ... https://github.com/GoogleChrome/ip-protection https://github.com/GoogleChrome/ip-protection "Considering" means "we're thinking about it, but it's in no way final". Sounds like Google could implement a proxy solution but decide the 2nd hop for improved privacy isn't needed after all. Or make it optional, defaulting to OFF, etc.
  - buremba 3y ago
    ^ This is an important "detail".
- eli 3y ago
  In other words what apple has been doing for years now
- AnthonyMouse 3y ago
  Wouldn't this be useful as a way to avoid getting blocked or having to do a thousand CAPTCHAs when using Tor? Access the relay via Tor, the relay doesn't know who you are because of Tor, the website sees you as someone using the relay which is too many ordinary people to block.
  - mindslight 3y ago
    Yes, but such proxies will likely require authentication with a Google account, and Google will keep an audit log to prevent "abuse". So at best it works out for maintaining somewhat persistent nyms for well-scoped purposes (that you make with a burner SIM or buy from someone who did), but not as some panacea for Internet privacy. This is of course assuming that the roadmap for these proxies isn't tied into their push for remote attestation ala "Safety" Net and WEI, in which case your "nym" becomes the entire device.
LinuxBender 3y ago
Wouldn't that mean that all your web traffic is going through a google server? Yup just like most people using Android have their text messages routing through Google. Some don't even realize this.
- Andrex 3y ago
  RCS E2EE and Group E2EE are live which makes this a less dangerous attack surface / a less useful ad data reservoir. Google Voice users like myself are SOL but I've never had pretenses that my messages there are private. They're probably stored in plaintext even, there's a lot of 15+ year old GrandCentral cruft underpinning Voice even to this day (speaking only as a user).

diroussel 3y ago

Combined with Privacy Sandbox [0], this means the browser can track you directly without cookies, but websites can't track you via IP address. So it has the effect of centralising the tracking to google only. I haven't used Chrome since this rolled out, since I didn't see a way to object to the new tracking. This is what the linked article [0] says: > It’s unclear if toggling these features off will stop Chrome from collecting these data altogether, or if it just won’t share the data with advertisers. [0] https://theconversation.com/google-chrome-just-rolled-out-a-new-way-to-track-you-and-serve-ads-heres-what-you-need-to-know-213150 https://theconversation.com/google-chrome-just-rolled-out-a-... [1] https://developer.chrome.com/en/blog/shipping-privacy-sandbox/#whats-shipping https://developer.chrome.com/en/blog/shipping-privacy-sandbo...

jwells89 3y ago
Depending on the user’s aims, that could still be a net win… limiting tracking to a single party versus N parties. Obviously not ideal as no tracking at all though.
- mindslight 3y ago
  Normalizing VPN/proxy use is a fantastic development for the entire market. Sure, I can see a future where websites only allow traffic from naive connections, Apple proxy, or Google proxy. But I can just as likely see a future where many more "normie"-appearing providers spring up and website managers move on to some other feel-good check box besides IP discrimination.
- pixl97 3y ago
  The particular issue here is where many people have the same complaint about Cloudflare. You're concentrating that single party to a single provider for a massive number of people. Hence now governments have a one stop shop for all the information they need.
- kevingadd 3y ago
  That's assuming you can trust the single party not to pick winners to share data with and losers to keep out. With Apple we know they have a bunch of revenue streams based on selling actual products to users, so there's much less of a hazard there. With Google... who knows what they'll do to juice their next earnings report?

isodev 3y ago

That's an excellent example of the conflict of interest of trying to be an ad company and a proponent for privacy at the same time.

leoh 3y ago
Worse, it’s arguably anti-competitive behavior. Though, truth be told, once I looked at the facts, I would prefer Google to have my data siloed (which itself, yes is not good) than random third party data collectors that would sell it on data markets.
deleted 3y ago
[deleted]
intelVISA 3y ago
There's no conflict of interest, it's simply denying the enemy from pillaging big G's harvest (you).

sacrosanct 3y ago

> The Movement for an Open Web (MOW), an organization that has lobbied against Google's Privacy Sandbox initiative by claiming it's harmful to rival internet advertising businesses They have much more to be annoyed at. VPN companies, The Tor Project, AD blockers, etc I use the Google One VPN[0] to cloak my real IP, but only sparingly. For most of my Internet surfing I use a two hop VPN setup. One VPN router with kill switch mode, and then I connect to another VPN service on top of that, a sort of fake Tor / private relay setup. I don't funnel all my traffic into Google One's VPN. I like to compartment and not put all my eggs in one basket. Looks like I'll be doing the same when this new Google-owned IP cloaking feature ships. [0] https://one.google.com/about/vpn https://one.google.com/about/vpn

yjftsjthsd-h 3y ago
>> The Movement for an Open Web (MOW), an organization that has lobbied against Google's Privacy Sandbox initiative by claiming it's harmful to rival internet advertising businesses > They have much more to be annoyed at. VPN companies, The Tor Project, AD blockers, etc While I'm sure they dislike those, the key word here is rival - the claim is that Google has its own ad business, and is only deploying privacy features in a way that hurts other ad companies.
PrimeMcFly 3y ago
That seems unnecessary. Why not just forward through an anonymous SSH box?

leoh 3y ago

We really need to be thinking bigger here — Google included, to the degree there are pro-privacy folks in the org (which there) - in coming up with something that protects a lot more than the identity via IP of Chrome users, but all web traffic. I mean, maybe even rethinking IP, TCP/IP entirely.

LinuxBender 3y ago
In my opinion this would just be a cat and mouse arms race. Make something new and corporations will race to be the first to add their tracking to it.
Andrex 3y ago
I always thought there was something that could be done with the BitTorrent protocol... I don't know how well it would work, but an Internet that isn't so brittle mirrors are commonplace and accepted wisdom would be nice. BT isn't anonymous but a TCP/IP replacement version could be.

deleted 3y ago

[deleted]

muteor 3y ago

The anti abuse points from their github do not sound convincing to me. There will be a high value in farming accounts to either spam or attack. What do you do when the google proxy is dosing your service?

cedws 3y ago
I was just watching a video[0] about how Private Relay under the hood and it sounds like authentication is somewhat tied to having genuine Apple hardware, as well as requiring an iCloud subscription. If Google's relay just requires a Google account, there's no doubt that dummy accounts will be used to abuse the service. Apparently Private Relay sends a dynamic config of relay servers to use which they could leverage at any time to unmask you. I'm guessing Google will do it similarly. [0] https://media.ccc.de/v/camp2023-57214-trustmerelay_investigating_apple_s_icloud_private_relay#t=1777 https://media.ccc.de/v/camp2023-57214-trustmerelay_investiga...

sdefresne 3y ago

Isn’t this similar to what Apple does with Safari on iPhone where they can hide your ip address by using iCloud servers as relay? Discussed here: https://news.ycombinator.com/item?id=31387019 https://news.ycombinator.com/item?id=31387019 or https://news.ycombinator.com/item?id=27467798 https://news.ycombinator.com/item?id=27467798 Why is it good when Apple does it but terrible when it is Google?

Lio 3y ago
Is it because Apple’s motivation is perceived to be selling protection to its hardware customers where as Google’s primary motivation is perceived to be to get a monopoly in the surveillance business?
dilipdasilva 3y ago
It is not ok for Apple or Google to do this while at the same time operating an ad business. If they feel this is in the best interest of the end user, then they should divest of either their ad business or control of the browser. Neither company is willing to do this. This IP move is anticompetitive as it consolidates even more control of the ad ecosystem in a handful of companies. Google’s response that they are placed at the same disadvantage as other third parties is not accurate. Google controls the browser and so has full control to communicate any data between the browser and their servers, bypassing the proxies. There is only one thing that drives these companies and that is maximizing profits for the benefit of their investors. This objective is fine. However, it is disingenuous for either of these companies to hide behind the defense that they care about the privacy of end users. If Apple cared about the privacy rights of all humans, why do they share all data belonging to their customers in China with the Chinese government. The only reason is profits. Google also shares all their customer’s data with any government that asks. If there were a thousand companies that each had access to a tiny sliver of a consumers data, we would have a system that naturally protects end user privacy. However, with a few companies controlling the vast majority of the consumer tech landscape, we now have a system where a few for-profit companies are keepers of our data and already sell out when their profits are at stake.
olliej 3y ago
From other comments it _sounds_ like Google's system is done as a single proxy, which is bizarre to me because it means google can see every site that is loaded which even for google seems on the nose. Apple's service is explicitly designed to prevent this exact problem. There's a write up for it on apple's security site (possibly part of the system security doc?). There are intentionally two layers, the connection from the device -> apple's servers, and then the connection from apple's servers to Akamai or cloud flare (or some other CDN). The connection to apple's servers is encrypted to a key from the 2nd layer CDN so apple can't read it, that request is forwarded to the CDN which decrypts it makes the request, then encrypts the response to the client's key and sends that to apple, apple forwards that encrypted blob on to the originating device which can then decrypt it. The end result is apple cannot ever see the destination or response, and the backend CDN can't see the device that made the request. That should be the design of _any_ privacy conscious proxy service (including all the questionable "privacy!" VPNs). That's kind of why I'm surprised that the claim is that Google's service is a single layer - it's so blatantly invasive.

gumballindie 3y ago

Welp Firefox it is then.

deleted 3y ago

[deleted]

redder23 3y ago

So Google is doing his why exactly? Since they know everything about everyone they now shut out the competition while sending all the IPs to their own proxy that will log them for themselves "for your privacy TM"??? I mean I would like this if it would not come from Google.

kobalsky 3y ago

is the proxy service available for user modified browsers? otherwise this sounds like WEI with a fake mustache