Hacker News Reader

Comment by Ajedi32 | Hacker News Reader

> "If y'all had just handed over your wallet when we asked, we wouldn't have had to hurt you. So really, this is your fault."

Seeing as Google doesn't engage in fingerprinting and are actively taking steps to block it[1], I don't think this is a fair characterization of Google's position.

[1]: https://blog.chromium.org/2019/05/improving-privacy-and-secu...

View on HN

Google does engage in fingerprinting in multiple of its products, but even if it didn't I don't think I would change my analogy.

Google's position here is, "obviously you're going to have to let us track you some way, and our way (cookies) is better than fingerprinting." It's still blaming privacy-conscious users for the actions that advertisers have taken, because those unreasonable privacy-conscious people couldn't be content with just blocking some of the trackers.

There's an underlying tone to this article that reads as, "you all messed this up because you didn't just leave well enough alone. Now we'll come in and fix it, but you're gonna have to compromise with us when we do." From my perspective -- no, users didn't break anything. This isn't our fault, and we should be allowed to broadly block cookies without being tracked in more pervasive ways.

But, if it makes you feel better you can change a word in my characterization to read:

> "If y'all had just handed over your wallet when we asked, they wouldn't have had to hurt you. So really, this is your fault."

>This is why Chrome plans to more aggressively restrict fingerprinting across the web. One way in which we’ll be doing this is reducing the ways in which browsers can be passively fingerprinted, so that we can detect and intervene against active fingerprinting efforts as they happen.

That seems like a 180 from their stance 2 years ago[1]. Their statement is low on details so I'll believe it when I see it. Right now the only browser with meaningful fingerprinting protection is tor browser/firefox.

[1] https://bugs.chromium.org/p/chromium/issues/detail?id=49075

The initial statement was low on details because it was just an statement of intention. Specific steps they're taking to combat fingerprinting are visible in their public bug tracker[1]. Also, let's not forget the privacy budget[2] system they just announced in the OP. That seems rather promising.

[1]: https://bugs.chromium.org/p/chromium/issues/list?q=component...

[2]: https://github.com/bslassey/privacy-budget

The cynic in me is 100% sure they calculated the impact of these changes to their ability to track users and found the impact negligible. Still, it probably does make tracking more difficult for other advertisers, so there's that.

Since Google has cookies dropped by google.com properties that they can use for user tracking, I'm surprised they haven't worked harder to reduce the effectiveness of fingerprinting in Chrome. They could make user tracking more difficult for ad companies that don't have cookies dropped by sites as popular as google.com while accurately marketing the Chrome changes as improving user privacy.

Doesn't reCaptcha alone rely extensively on fingerprinting?

It does. The more anti-fingerprinting measures you enact, the harder it is to pass to the point that it becomes nearly impossible to do.

Unless of course you're state-of-the-art neural net. Oh the irony...

Where does it say they don't engage in it?

Naturally, blocking other companies' fingerprinting is important to their business model.

I've downvoted you because, as others have pointed out, your statement that Google doesn't fingerprint is factually incorrect.

HN guidelines would prefer that you don't comment on downvoting, as it makes for boring reading. If you don't have anything substantive to add (such as, if "others have pointed out" your thoughts already), just vote and move on. :)

https://news.ycombinator.com/newsguidelines.html

Although the words "I'm downvoting you" aren't useful, I would argue that saying why you're downvoting someone is really important. Helps prevent the feeling of shooting the messenger.

In that case, "I'm downvoting you because you're wrong" could be condensed to "you're wrong."

I disagree. No one has posted any evidence that Google engages in fingerprinting users beyond simple user-controllable mechanisms like cookies. (Though several have indeed made that assertion with no evidence.)

ReCaptcha and Analytics both fingerprint.

Google Analytics does not fingerprint. Hits are identified with a user either by a first-party cookie (called the Client ID), or with a user-id value provided by the site owner. The site owner could provide their own fingerprinting value as a user-id, but the fingerprinting is not done by analytics itself.

(There are some cases where identifiers are pulled in from other systems, but none of them can be used as the basis for unifying users.)

GA records a lot of data about the user such as screen resolution and browser version. It doesn't do full fingerprinting to identify unique users but it uses many common fingerprinting techniques.

Like collecting any data at all? I mean “what browsers and what versions do I need to support” and “what resolutions do I need to design for” are pretty benign questions.

Re-Captcha doesn't fingerprint users. It uses statistical models to guess whether a particular user is a bot or not; it doesn't de-anonymize users or identify them in any way.

Analytics doesn't either, it uses regular cookies. (See sibling comments.)

Statistical models based on what? Browser characteristics that could also be used for fingerprinting?

Cookies, browser characteristics, user behavior, etc. Just because a certain bit of information could theoretically be used for fingerprinting users, doesn't mean any system that uses that information is doing fingerprinting.

Agreed, but it's incredibly naive to assume they are not. Google's product is it's users, and it's a known fact they manipulate results based on what they want you to think or what they think you want to see. They are completely shady on privacy.

I don't know why HN seems to be so stubborn about things like this. It's clear as day they fingerprint users, but seems like the majority of users here refuse to believe a corporation or government has done anything wrong unless they literally admit it in a press release.

IP address, the client/user ID, type of interaction, timestamp and a few other bits of data like your device hardware.

GA isn't nearly as invasive as people think. The real problem is data being combined on the backed and correlated across websites by ad networks, not the analytics itself.

Edit: Worth a look if you're interested in what's being collected: https://developers.google.com/analytics/devguides/collection...

> IP address, the client/user ID, type of interaction, timestamp and a few other bits of data like your device hardware.

Unfortunately, that sounds exactly like the set of information that can be used to fingerprint users.

So...fingerprinting?

Considering that we're talking about a company which owes probably nearly all of its not inconsiderable fortune to predicting people's behavior via mass surveillance, this comment seems to miss the forest for the trees a bit.

Reply on news.ycombinator.com