Hacker News Reader

Comment by driverdan | Hacker News Reader

ReCaptcha and Analytics both fingerprint.

Google Analytics does not fingerprint. Hits are identified with a user either by a first-party cookie (called the Client ID), or with a user-id value provided by the site owner. The site owner could provide their own fingerprinting value as a user-id, but the fingerprinting is not done by analytics itself.

(There are some cases where identifiers are pulled in from other systems, but none of them can be used as the basis for unifying users.)

GA records a lot of data about the user such as screen resolution and browser version. It doesn't do full fingerprinting to identify unique users but it uses many common fingerprinting techniques.

Like collecting any data at all? I mean “what browsers and what versions do I need to support” and “what resolutions do I need to design for” are pretty benign questions.

Re-Captcha doesn't fingerprint users. It uses statistical models to guess whether a particular user is a bot or not; it doesn't de-anonymize users or identify them in any way.

Analytics doesn't either, it uses regular cookies. (See sibling comments.)

Statistical models based on what? Browser characteristics that could also be used for fingerprinting?

Cookies, browser characteristics, user behavior, etc. Just because a certain bit of information could theoretically be used for fingerprinting users, doesn't mean any system that uses that information is doing fingerprinting.

Agreed, but it's incredibly naive to assume they are not. Google's product is it's users, and it's a known fact they manipulate results based on what they want you to think or what they think you want to see. They are completely shady on privacy.

I don't know why HN seems to be so stubborn about things like this. It's clear as day they fingerprint users, but seems like the majority of users here refuse to believe a corporation or government has done anything wrong unless they literally admit it in a press release.

IP address, the client/user ID, type of interaction, timestamp and a few other bits of data like your device hardware.

GA isn't nearly as invasive as people think. The real problem is data being combined on the backed and correlated across websites by ad networks, not the analytics itself.

Edit: Worth a look if you're interested in what's being collected: https://developers.google.com/analytics/devguides/collection...

> IP address, the client/user ID, type of interaction, timestamp and a few other bits of data like your device hardware.

Unfortunately, that sounds exactly like the set of information that can be used to fingerprint users.

So...fingerprinting?

Reply on news.ycombinator.com