6 ms·

Disclaimer: Googler but I don't work on this and have no special knowledge. Opinions are my own. I don't believe Google itself is intentionally associating inc

by srj 3y ago

Disclaimer: Googler but I don't work on this and have no special knowledge. Opinions are my own. I don't believe Google itself is intentionally associating incognito profile data with non-incognito profile data. That does not prevent other websites from creating a simple map of (IP, user agent) -> Profile. I'm not sure how this could even be imagined to work otherwise, with a default VPN? Even then there are other browser fingerprinting techniques (e.g. window size) that can't really be stopped short of breaking browsing experience across many sites. Do any of the major web browsers do differently?

poisonborz 3y ago
Well, look at the other side: Incognito was born because Google does not allow you to turn off browser history in Chrome whatsoever.
imiric 3y ago
> I don't believe Google itself is intentionally associating incognito profile data with non-incognito profile data. Why not? Google makes more money on targeted ads. It's in their best interest to use an established user profile to show targeted ads in Incognito mode, and to augment that profile with data collected in Incognito mode, so that they can improve their overall targeting. It would be naive to think they're not doing this, especially when there's no clear public knowledge about what data is collected and how the targeting works. They're using cookies as a scapegoat because they don't actually need them for tracking at all. > That does not prevent other websites from creating a simple map of (IP, user agent) -> Profile. Individual websites rely on adtech to deliver ads, and often for analytics as well, no? Why would they implement the tracking themselves, when adtech does a much better job at it? Even if Google doesn't offer it explicitly as a feature, it would be trivial to match the analytics data to a user profile. > I'm not sure how this could even be imagined to work otherwise You mean, how it can be prevented? It's difficult since we don't know how sophisticated the tracking actually is. Using a VPN, random resolution and window size, disabling JS and browser features, etc., _probably_ helps. Some privacy-focused browsers like Mullvad and LibreWolf do some of this. I don't fool myself into thinking any of this is a silver bullet, and at some point, I have to prioritize my experience over privacy. But Google pioneered(?) "zero trust" access to their infrastructure for their employees with BeyondCorp, so they know a thing or two about securely identifying individual users regardless of the device they're using. I would think they're using behavior and network tracking in addition to just browser fingerprinting, but you would know more about this than me. In any case, this is a futile fight for privacy-minded individuals, and nothing will actually change until governments don't make it change. Considering they only caught up with cookies a few years ago, it's going to take many more years for them to catch up to the state of the art innerworkings of adtech. Assuming there are politicians who understand these technical aspects and haven't been bought yet, and users actually start caring about this. I'm not holding my breath.

by srj 3y ago

poisonborz 3y ago

Well, look at the other side: Incognito was born because Google does not allow you to turn off browser history in Chrome whatsoever.

imiric 3y ago

> I don't believe Google itself is intentionally associating incognito profile data with non-incognito profile data. Why not? Google makes more money on targeted ads. It's in their best interest to use an established user profile to show targeted ads in Incognito mode, and to augment that profile with data collected in Incognito mode, so that they can improve their overall targeting. It would be naive to think they're not doing this, especially when there's no clear public knowledge about what data is collected and how the targeting works. They're using cookies as a scapegoat because they don't actually need them for tracking at all. > That does not prevent other websites from creating a simple map of (IP, user agent) -> Profile. Individual websites rely on adtech to deliver ads, and often for analytics as well, no? Why would they implement the tracking themselves, when adtech does a much better job at it? Even if Google doesn't offer it explicitly as a feature, it would be trivial to match the analytics data to a user profile. > I'm not sure how this could even be imagined to work otherwise You mean, how it can be prevented? It's difficult since we don't know how sophisticated the tracking actually is. Using a VPN, random resolution and window size, disabling JS and browser features, etc., _probably_ helps. Some privacy-focused browsers like Mullvad and LibreWolf do some of this. I don't fool myself into thinking any of this is a silver bullet, and at some point, I have to prioritize my experience over privacy. But Google pioneered(?) "zero trust" access to their infrastructure for their employees with BeyondCorp, so they know a thing or two about securely identifying individual users regardless of the device they're using. I would think they're using behavior and network tracking in addition to just browser fingerprinting, but you would know more about this than me. In any case, this is a futile fight for privacy-minded individuals, and nothing will actually change until governments don't make it change. Considering they only caught up with cookies a few years ago, it's going to take many more years for them to catch up to the state of the art innerworkings of adtech. Assuming there are politicians who understand these technical aspects and haven't been bought yet, and users actually start caring about this. I'm not holding my breath.