6 ms·

Some time ago I noticed that in Chrome, every time you click "Never translate $language", $language quietly gets added to the Accept-Language header that Chrome

Some time ago I noticed that in Chrome, every time you click "Never translate $language", $language quietly gets added to the Accept-Language header that Chrome sends to every website! My header ended up looking like a permuted version of this: en-US,en;q=0.9,zh-CN;q=0.8,de;q=0.7,ja;q=0.6 I never manually configured any of those extra languages in the browser settings. All I had done was tell Chrome not to translate a few pages on some foreign news sites. Chrome then turned those one-off choices into persistent signals attached to every request. I'd be surprised if anyone in my vicinity share my exact combination of languages in that exact order, so this seems like a pretty strong fingerprinting vector. There was even a proposal to reduce this surface area, but it wasn't adopted: https://github.com/explainers-by-googlers/reduce-accept-language https://github.com/explainers-by-googlers/reduce-accept-lang...

hoofedear 11mo ago
Is Chrome trying to assume that, since you don’t want it to translate those pages/languages, that you can read them/want them in your header? Interesting
- onion2k 11mo ago
  I'd read it more generously than that. I think Chrome trying to stop the server choosing the language for you. By sending an accepts-language header (which your browser does regardless of what you use; it's not a Chrome thing) the server should return the page in a language you've said you'll accept. By adding the language to what you've told Chrome not to translate, it's attempting to show you pages in languages you want. I imagine Chrome is really adding the language to your browser preferences when you choose not to translate a page, and the HTTP client in the browser is generating request headers based on your preferred languages. A small (and largely unimportant) semantic point, but it's possible that the Google translate team weren't aware of how adding a preferred language might impact user privacy. That isn't to excuse the behaviour; they should have checked.
fsflover 11mo ago
Using Chrome and caring about privacy? I thought, after Google killed uBlock Origin, it had become beyond clear these two things were incompatible, https://news.ycombinator.com/item?id=41905368 https://news.ycombinator.com/item?id=41905368
- esseph 11mo ago
  uBlock origin just got replaced with uBlock lite for most people
  - fsflover 11mo ago
    Which, by design, doesn't protect you from actual spying, https://github.com/uBlockOrigin/uBOL-home/wiki/Frequently-asked-questions-(FAQ)#filtering-capabilities-which-cant-be-ported-to-mv3 https://github.com/uBlockOrigin/uBOL-home/wiki/Frequently-as...
  - anthk 11mo ago
    There's a way to enforce loading UBo in Chromium but you need to download the extension by hand (git clone it from GitHub) and load it in "developer mode" in the extension settings. Also, you need to enable some legacy options related to extensions in about:flags.
    - hopelite 11mo ago
      Which really puts a massive spotlight on you.
- autoexec 11mo ago
  Most people using chrome are also using Google's DNS servers too which hands them a list of every single domain you visit.
scrollop 11mo ago
PSA Don't use chrome.
- SV_BubbleTime 11mo ago
  Definitely a good STEP1, but it’s not like Firefox and Safari are finger printing secure.
  - capitainenemo 11mo ago
    Firefox does pretty damn well though, especially with privacy.resistFingerprinting set to true
    - wizzwizz4 11mo ago
      privacy.resistFingerprinting has potentially-unwanted side-effects, like wiping out most of your browser history (instead of the more sensible approach of just disabling purple links). I also recall something about it getting removed or nerfed, though I'm not sure whether that was a mere proposal.
      - noisem4ker 11mo ago
        It also does (or at least used to) mess with dates, due to it attempting to hide what time zone you're in.
        godshatter 11mo ago
        The browser should reasonably know what time zone you're in and what time zone you're reporting to the website and translate between them automatically.
        noisem4ker 11mo ago
        Yeah, "should". Too bad it's unfeasible. As soon as you e.g. print the current date as part of a paragraph somewhere, the browser loses track of it, and the website can just read the element's content and parse it back.
datavirtue 11mo ago
Hmmm...YouTube has been getting confused about the language and displaying random languages for the closed captions on videos. This was happening to me across smart TVs but I access YouTube randomly from various devices and browsers...but mostly Chrome when using a browser.
- deleted 11mo ago
  [deleted]
thaumasiotes 11mo ago
> There was even a proposal to reduce this surface area, but it wasn't adopted: >> Instead of sending a full list of the users' preferred languages from browsers and letting sites figure out which language to use, we propose a language negotiation process in the browser, which means in addition to the Content-Language header, the site also needs to respond with a header indicating all languages it supports Who thought that made sense? Show me the website that (1) is available in multiple languages, and also (2) can't display a list of languages to the user for manual selection.
- jm4 11mo ago
  What language do you put that list in? Would you still want to show it to every visitor when you know most of them speak a particular language? I use to do some work in this area. The first question is difficult and the second is no. We had the best results when we used various methods to detect the preferred language and then put up a language selector with a welcome message in that language. After they made a selection, it would stick on return visits.
  - thaumasiotes 11mo ago
    > What language do you put that list in? Would you still want to show it to every visitor when you know most of them speak a particular language? Judging by... a large number of websites, you make the list available in a topbar, and each language is named in itself. You don't apply one language to the entire list. Here's the first page that popped into my head as one that would probably offer multiple languages (and it does!): https://www.dyson.com/en https://www.dyson.com/en They've got the list in a page footer instead of a header, but otherwise it's an absolutely standard language selector. It does technically identify countries rather than languages. The options range from Azərbaycan to Україна. They are -- of course -- displayed to every visitor. Why would you want to force someone to consume your website in the wrong language? And why would the list be in a single language, again?
    - jm4 11mo ago
      You’re looking at it with the perspective of someone who understands the language the site defaults to. Most non-native speakers have a hard time finding the link and they leave.
deleted 11mo ago
[deleted]
biztos 11mo ago
How does it determine the order? Clearly it thinks you prefer Chinese to German. Was that correlated with the frequency of your requests on Google Translate? With your browsing history? With your shopping history?
- RamRodification 11mo ago
  $lang_header = $lang_header + $the_lang_choice_that_was_just_made
zzo38computer 11mo ago
This is a problem, that the software will try to guess what you mean by such things like this (it is not specific to this feature, but other features of computer programs in general; this is one specific case of that). Just because you do not want it to translate such a language (or any other langage) automatically does not necessarily mean that you can read it or that you want to request documents written in that language. Fingerprinting is not the only issue with this.

hoofedear 11mo ago

Is Chrome trying to assume that, since you don’t want it to translate those pages/languages, that you can read them/want them in your header? Interesting

onion2k 11mo ago
I'd read it more generously than that. I think Chrome trying to stop the server choosing the language for you. By sending an accepts-language header (which your browser does regardless of what you use; it's not a Chrome thing) the server should return the page in a language you've said you'll accept. By adding the language to what you've told Chrome not to translate, it's attempting to show you pages in languages you want. I imagine Chrome is really adding the language to your browser preferences when you choose not to translate a page, and the HTTP client in the browser is generating request headers based on your preferred languages. A small (and largely unimportant) semantic point, but it's possible that the Google translate team weren't aware of how adding a preferred language might impact user privacy. That isn't to excuse the behaviour; they should have checked.

fsflover 11mo ago

Using Chrome and caring about privacy? I thought, after Google killed uBlock Origin, it had become beyond clear these two things were incompatible, https://news.ycombinator.com/item?id=41905368 https://news.ycombinator.com/item?id=41905368

esseph 11mo ago
uBlock origin just got replaced with uBlock lite for most people
- fsflover 11mo ago
  Which, by design, doesn't protect you from actual spying, https://github.com/uBlockOrigin/uBOL-home/wiki/Frequently-asked-questions-(FAQ)#filtering-capabilities-which-cant-be-ported-to-mv3 https://github.com/uBlockOrigin/uBOL-home/wiki/Frequently-as...
- anthk 11mo ago
  There's a way to enforce loading UBo in Chromium but you need to download the extension by hand (git clone it from GitHub) and load it in "developer mode" in the extension settings. Also, you need to enable some legacy options related to extensions in about:flags.
  - hopelite 11mo ago
    Which really puts a massive spotlight on you.
autoexec 11mo ago
Most people using chrome are also using Google's DNS servers too which hands them a list of every single domain you visit.

scrollop 11mo ago

PSA Don't use chrome.

SV_BubbleTime 11mo ago
Definitely a good STEP1, but it’s not like Firefox and Safari are finger printing secure.
- capitainenemo 11mo ago
  Firefox does pretty damn well though, especially with privacy.resistFingerprinting set to true
  - wizzwizz4 11mo ago
    privacy.resistFingerprinting has potentially-unwanted side-effects, like wiping out most of your browser history (instead of the more sensible approach of just disabling purple links). I also recall something about it getting removed or nerfed, though I'm not sure whether that was a mere proposal.
    - noisem4ker 11mo ago
      It also does (or at least used to) mess with dates, due to it attempting to hide what time zone you're in.
      - godshatter 11mo ago
        The browser should reasonably know what time zone you're in and what time zone you're reporting to the website and translate between them automatically.
        noisem4ker 11mo ago
        Yeah, "should". Too bad it's unfeasible. As soon as you e.g. print the current date as part of a paragraph somewhere, the browser loses track of it, and the website can just read the element's content and parse it back.

datavirtue 11mo ago

Hmmm...YouTube has been getting confused about the language and displaying random languages for the closed captions on videos. This was happening to me across smart TVs but I access YouTube randomly from various devices and browsers...but mostly Chrome when using a browser.

deleted 11mo ago
[deleted]

thaumasiotes 11mo ago

> There was even a proposal to reduce this surface area, but it wasn't adopted: >> Instead of sending a full list of the users' preferred languages from browsers and letting sites figure out which language to use, we propose a language negotiation process in the browser, which means in addition to the Content-Language header, the site also needs to respond with a header indicating all languages it supports Who thought that made sense? Show me the website that (1) is available in multiple languages, and also (2) can't display a list of languages to the user for manual selection.

jm4 11mo ago
What language do you put that list in? Would you still want to show it to every visitor when you know most of them speak a particular language? I use to do some work in this area. The first question is difficult and the second is no. We had the best results when we used various methods to detect the preferred language and then put up a language selector with a welcome message in that language. After they made a selection, it would stick on return visits.
- thaumasiotes 11mo ago
  > What language do you put that list in? Would you still want to show it to every visitor when you know most of them speak a particular language? Judging by... a large number of websites, you make the list available in a topbar, and each language is named in itself. You don't apply one language to the entire list. Here's the first page that popped into my head as one that would probably offer multiple languages (and it does!): https://www.dyson.com/en https://www.dyson.com/en They've got the list in a page footer instead of a header, but otherwise it's an absolutely standard language selector. It does technically identify countries rather than languages. The options range from Azərbaycan to Україна. They are -- of course -- displayed to every visitor. Why would you want to force someone to consume your website in the wrong language? And why would the list be in a single language, again?
  - jm4 11mo ago
    You’re looking at it with the perspective of someone who understands the language the site defaults to. Most non-native speakers have a hard time finding the link and they leave.

deleted 11mo ago

[deleted]

biztos 11mo ago

How does it determine the order? Clearly it thinks you prefer Chinese to German. Was that correlated with the frequency of your requests on Google Translate? With your browsing history? With your shopping history?

RamRodification 11mo ago
$lang_header = $lang_header + $the_lang_choice_that_was_just_made

zzo38computer 11mo ago

This is a problem, that the software will try to guess what you mean by such things like this (it is not specific to this feature, but other features of computer programs in general; this is one specific case of that). Just because you do not want it to translate such a language (or any other langage) automatically does not necessarily mean that you can read it or that you want to request documents written in that language. Fingerprinting is not the only issue with this.