Hacker News Reader

Comment by sarcasmic | Hacker News Reader

When I'm at work, I use my work computer, which has a long lived static IP, to log into my personal Google account. I have configured all of my browsers to clear cookies and storage upon closing. I never use signed-in Google Maps, but I sometimes use it from that computer, from fresh browser while logged out.

A week ago, I moved from my previous home that was close to my work, to a different city about 20 miles away. Since I wasn't sure where all the points of interest are, I've been turning on location on my Android phone and using signed-out Google Maps on my phone.

Yesterday, my work computer's signed-out Google Maps has centered its default view on my new city, on the exact highway interchange next to which I now live.

View on HN

When signed out, Google maps' initial view is entirely based on IP address. Sure, they could use cookies, but they don't. They could also use device profiling, but they don't.

The IP -> location mapping is googles secret sauce, but it collects data from a lot of places, and is for most users very accurate. We're talking street level accuracy in many cases. The data you or another user feeds into it you could easily get back as your reported location, especially if you were trying to fool it.

Your phone doing a wifi scan for nearby access points to determine it's own location, then doing a google search could easily mark your whole home external IP as being in that place (after a few hours), which would then affect non-signed in google services from other devices in your home.

There are cases it's very bad too though, especially VPN's and frequently-shifting dynamic IP's.

Anecdote about a bad case: I was in Barcelona for Mobile World Congress a couple years back and Google insisted I was in Milan, because the rental wifi was from there (I assume).

I was at CCC in Berlin a couple of years back, the conference network was assigned a subnet previously used in Russia - I was getting verification emails from services I use for months after.

Google can use user prediction to guess which account you are with your browser, ip, ism, mac address, and other persistant metadata. Its how their whole 'you signed in from a new location' security scheme works.

Sure, but why would they re-center the map for a logged-out device, even if they can tell it's overwhelmingly likely that it's the same user?

'you signed in from a new location' uses a cookie that remains after signout.

Clear cookies, and you'll see it again.

In Chrome, it also uses the TLS Client Channel ID, which is a persistent unique identifier established between a browser and a server which (on capable platforms) is derived from a key stored in a hardware security module, making it hard to steal. Ie. if you clone the hard drive of a computer, when you use the clone, Google will know you are a suspicious person, even though you have all the right cookies.

Thanks for the heads-up re: TLS Client Channel ID.

Sounds like another reason to limit my personal use of Google's Chrome browser.

> I have configured all of my browsers to clear cookies and storage upon closing.

Dumb question, but how often do you close your browser though? Mine stays running in the background so it's not often that it gets completely closed.

I close my browser (and all tabs, windows, and any instances of the same process) very frequently, and immediately after I'm done actively interacting with the page.

My point is, I highly doubt my browser usage pattern reflects the way the median user browses the web, and yet even my careful usage wasn't enough to keep Google from correlating enough data about my browsing's attributes (IP, sites visited, location info, logged-in geo-IP), and then expose that cross-bleed in my face.

Do you manually kill all browser processes? It's certainly plausible that there's a zombie process around so any singleton-thing that does cleanup on last process exit never got a chance to run.

This type of behavior isn't limited to Google. In Chaos Monkey (which is ancient technology at this point) he goes over how tracking can be accomplished across multiple devices.

That aside, to have a setting that doesn't do what it says is disturbing. If that's don't be evil then what's their definition of evil?

Reply on news.ycombinator.com