Hacker News Reader

Comment by KenanSulayman | Hacker News Reader

Google does not need any cookies for Google properties because Google Chrome sends an `x-client-data` header to them.

The x-clint-data header is for experiments, not personalization:

Additionally, a subset of low entropy variations are included in network requests sent to Google. The combined state of these variations is non-identifying, since it is based on a 13-bit low entropy value (see above). These are transmitted using the "X-Client-Data" HTTP header, which contains a list of active variations. On Android, this header may include a limited set of external server-side experiments, which may affect the Chrome installation. This header is used to evaluate the effect on Google servers - for example, a networking change may affect YouTube video load speed or an Omnibox ranking update may result in more helpful Google Search results.

https://www.google.com/chrome/privacy/whitepaper.html#variat...

(Disclosure: I work for Google, speaking only for myself)

However Google claims it is used, it's a fingerprinting strategy that only a company with Google's level of monopoly in controlling both the biggest browser and the biggest several websites can employ.

For it to be a fingerprinting strategy it would need to be used for fingerprinting, and that page has Google publicly claiming that it is not.

I'm not a lawyer, but I would expect if Google were not telling the truth here it would go very poorly for them.

But Google has been not telling the truth on all sorts of things, and Google is under investigation by the federal government, 49 US states, the European Union, and several other entities for misconduct and illegal activity with regards to both monopolization and privacy violations. The idea that it'd go very badly if Google were to lie may be true: And Google is currently going through exactly that.

To ask us to "trust your word" while you're actually actively being accused of a lot of misconduct by a lot of very reputable sources is... kinda hard to buy into? We gave Google the benefit of the doubt for far, far too long, and it screwed us. We're done trusting you.

What I'm claiming is not specific to Google. In general, large companies very rarely take a strategy of publicly saying "we don't do X" and then trying to secretly do X. It doesn't work out well for them, because they aren't the kind of entity that can pull off that kind of deception. Documents get subpoenaed, auditors look at things, whistleblowers release things, things get leaked.

You're referencing anti-trust and privacy investigations, but those don't seem to be about lies?

But that's exactly what's happening to your employer right now. Millions of emails are being reviewed, misconduct has been found, and yes, lies to the public have been told.

You perhaps forget that whistleblowers have quit Google and revealed truths Google didn't want people to know. People with the same inside knowledge you have realized they could no longer square where they worked with their personal ethical standards.

We're here, today. "Just trust us, and obviously it'd go badly for us if we're lying" isn't a line that's going to work anymore, because your CEO might be in jail by the end of the year.

I'm reasonably confident all four CEOs made statements that could be viewed as perjury last week. Some of them have already been news stories since the hearing. Statements they made directly contradict factual information in a few cases.

> lies to the public have been told

Link?

This is getting into sea lioning territory here. And it misses the point: This isn't about lawyering out of one specific claim. It's that when you are being investigated for misconduct and deception[0], your word something is true is no longer a viable discussion point.

If you can't prove X-Client-Data isn't able to be used for fingerprinting, we should assume that it is. And just like DoubleClick data, even if it isn't used now, we should assume Google may alter the deal later, as it has done many times before.

[0]Literally the words Australia used a few days ago is "deception by design": https://www.afr.com/technology/deception-by-design-accc-laun...

Reply on news.ycombinator.com