Hacker News Reader

Comment by novaRom | Hacker News Reader

From their privacy policy:

"When you install Vivaldi browser, each installation profile is assigned a unique user ID that is stored on your computer. Vivaldi will send a message using HTTPS directly to our servers located in Iceland every 24 hours containing this ID, version, cpu architecture, screen resolution and time since last message. We anonymize the IP address of Vivaldi users by removing the last octet of the IP address from your Vivaldi client then we store the resolved approximate location after using a local geoip lookup. The purpose of this collection is to determine the total number of active users and their geographical distribution."

Is this information enough for them to uniquely identify and track each user?

View on HN

Hey, here's Gaëlle Medeiros-Logeay, Data Protection Officer at Vivaldi.

The data we collect is not personally identifiable, and we try to keep it as minimal as possible. :)

We're not in the business of collecting data, and we do not sell them to advertisers like others do. The collected data helps us to understand where most of our users come from.

Our stats show us which country our users are located in and nothing more. We don't do data profiling. We just look at trends.

We don't see any browsing history, it's all stored locally so that only you can see your own browsing history. If you use Sync, then the data is encrypted.

If you want to read more about our privacy, this article wrote about us at length on this topic: https://www.ghacks.net/2018/01/30/vivaldi-browser-privacy/

Hope this clarifies things for you. :)

The collected data helps us to understand where most of our users come from.

You can simply log the downloads. I have no problem with that.

Can we please stop with the whole phoning-home trend? It's scary that such things have even become acceptable.

> The data we collect is not personally identifiable, and we try to keep it as minimal as possible. :)

Hey Gaëlle!

Huh? Unique ID + /24 + screen resolution is the opposite of "not personally identifiable". You may not use it that way yet, but that's only because no one applied enough incentive or force yet.

There aren't all that many Vivaldi users out there so the /24 is probably already enough to uniquely identify the user in many cases.

Yes, it is enough: https://panopticlick.eff.org/

PS: my result

Your browser fingerprint appears to be unique among the 1,852,797 tested in the past 45 days.

Currently, we estimate that your browser has a fingerprint that conveys at least 20.82 bits of identifying information.

I'm pretty sure Panopticlick gathers a lot more information than Vivaldi is claiming to here.

Just putting this out there but... does any browser pass the fingerprinting test?

Quick look with Firefox, Brave, Safari and all has similar results for me.

I did read once that Tor should pass, but never had a chance to try

That is an interesting site. It made me think that the best way to avoid this tracking is to have the most common OS with the most common Browser and all default settings.

I am a linux and firefox user in Brazil. I am probably very easy to track combining this information with my geolocation and ISP.

Is there a way to opt-out or disable this telemetry? Under privacy laws isn't Vivaldi supposed to give users a choice: whether they want to be tracked or not?

>Is this information enough for them to uniquely identify and track each user?

No. How could they identify who i am based on that information alone?

1) each installation profile is assigned a unique user ID that is stored on your computer

2) every 24 hours it sends IP, ID, version, cpu architecture, screen resolution and time since last message

3) then we store the resolved approximate location after using a local geoip lookup

So, what they have for each ID: approximate location, CPU architecture, screen resolution. They can easily know places you visited.

From Quant's privacy policy: "French law makes it mandatory to keep some connection data (e.g. user ID used, URL or position, nature of the operation, time…) for one year."

Add to that that we don’t know how the ID is generated and it can be system derrived.

But how how they identify me?

Statistically, if they geolocate you once per 24h, they will find you either at home or at work. Once both locations are known, determining which is which does not strike me as very hard.

Yeap. When I got my first android phone Google needed one roundtrip to determine where I live and work.

But their only method of location is IP, with the last octet removed. No way that's accurate enough to identify your home and work location.

If you are working in any bigger company they have more than a C class, so they can identify company. If you go there frequently you are employee. You can infer how often /24 changes, means you are traveling or even commuting between work and home. You can't infer exact location but some close area can be guessed. They have a set of data for bigger group so they can create highly probable guesses what people may be doing and where they are.

To be exact, it is 'the IP address of Vivaldi users by removing the last octet of the IP address'.

It's true that they can still approximate location based on that. But unless you're travelling a lot so that you've many locations in their record, it's impossible for them to identify you.

Identifying a user does not have to mean that they can know your home address and name. Identification can mean that one is able to determine whether a user is the same across two separate instances of usage/visit.

Reply on news.ycombinator.com