Comment by danudey | Hacker News Reader

Comment by danudey | Hacker News Reader

Parent Full thread

I think there's another issue here though.

If I turn on Incognito mode and then go to Amazon, Amazon can obviously see what I'm doing. If I log into Amazon, then Amazon knows it's me and can track that. I think that's reasonable, but people didn't understand that that's the case and that's why Google has that disclaimer there.

That's different from browser fingerprinting[1] though. Fingerprinting techniques exist which can tell that you're you even if you're in incognito mode. For example, if you're visiting Pornhub every day in incognito mode, the company can still build a pretty reliable profile of you. If you then visit them not in incognito mode once, they may be able to take that incognito profile and associate it with you a lot more closely.

Likewise, if you visit Amazon from your browser all the time and then visit them in incognito mode, these fingerprinting techniques allow Amazon to know it's you already; they can "play dumb" by keeping you logged out, not showing you recommendations, etc., but they can still figure out it's you and use that to continue to build a profile on you.

The caveat here is that this is much more useful for some people than others. If I visit HN, then HN can fingerprint me in Incognito or not, but that's not extremely useful. If I visit literally anywhere else, Google/Doubleclick/etc. can fingerprint my browser, and since extensions like ad/tracker/etc. blockers don't work by default in incognito mode, they could potentially get an even better profile of you from Incognito mode than not.

Pretty gross, honestly.

[1] https://blog.mozilla.org/internetcitizen/2018/07/26/this-is-...

Google doesn't fingerprint browsers like other adtech networks do - that's why they're really pushing for on-device ad auctions[0] and removing the usefulness of third-party-cookie-based tracking all together[1]. It would strengthen their monopoly (other providers would have to invest in supporting this ad model) while also directly benefiting the consumer's privacy and not hurting their business model: ad clicks.

0: https://github.com/WICG/turtledove#turtledove

1: https://www.chromium.org/Home/chromium-privacy/privacy-sandb...

>Google doesn't fingerprint browsers like other adtech networks do

Citation needed :)

I'm taking part in the Browser Fingerprinting Project that was on here recently[1] and the only browser that isn't marked in the test as trackable so far is Firefox[2]. They don't use cookies for the test so third-party cookie sandboxing or blocking is irrelevant. If Google doesn't use browser fingerprinting as you say then they really should fix Chrome.

1: https://browser-fingerprint.cs.fau.de

2: I test most mainstream browsers as I already had them installed on Windows and Android devices for testing.

Google definitely does browser fingerprinting. I have been running bots for years to collect pricing data. They check your gpu, bunch of stuff from navigator, etc. The only thing I have not seen them do is canvas fingerprinting.

They claim they do not use fingerprinting for user identification for advertising. Some people would say that this is a weaker claim than not using fingerprinting.

They have admitted to using those sorts of information for fraud detection to detect fake ad clicks, bulk account creation, or other malicious activity. I also suspect they do some clustering on this data to determine what accounts are related so if there is malicious behavior from a cluster of accounts that appear to be the same user they can act on the whole cluster.

But there is no evidence that they use fingerprinting for targeting advertising.

Fair, I have no evidence they use fingerprinting info for advertising.

They definitely cluster fingerprints to block whole groups as does any decent antibot.

They definitely do some form of fingerprinting for content optimization. After browsing in incognito, Youtube was sketchily on-topic.

(esoteric science/technical topics which wouldn't come up by chance)

The issue isnt that they did or didn't.

The issue is that they can

Ok. By what mechanism could Google prevent themselves from ever being able to do this? The browser can be updated to do anything. It could start deleting hard drives tomorrow with a malicious update!

To make an analogy, most places ban entering with a weapon unless you are law enforcement on official duty. Not because any Joe that has a gun has killed someone with it.

But the danger is that he/she can. Thats why guns are regulated. Information is not a harmless dingus. Its a weapon, just as the gun was in the last century. Do we need a war to discover this?

The web is still a gunslinging wild west. We need regulation. EU is light years ahead in this regard and might just save us all from the tyranny of the Greay whom we trust to act in good faith - because they say they will. This strikes me as quite naive on our part.

Can you be more specific?

What technical thing can achieve the goal you want? No metaphors.

>Information is not a harmless dingus. Its a weapon, just as the gun was in the last century.

This is a silly analogy, what is Google doing or planning to do with this information that is dangerous, and how does that stack up against the potential benefits of Google and other tech companies collecting this type of data?

>what is Google doing or planning to do with this information that is dangerous

That is not the right question because if a rogue US administration, that is, an administration willing to defy US courts and the US Constitution wanted Google's data, there is probably nothing Google could do to stop them from getting it.

(Such an administration could probably only get away with that during a time of national emergency, e.g., a war or a massive solar flare knocking out most of that nation's electricity for a month, but there are undemocratic elements in every country who are basically waiting for such national emergencies.)

At least I've never heard of a plan, from Google or anyone else, that would allow Google to successfully thwart, e.g., a surprise raid by thousands of US law-enforcement officers.

In other words, Google's data-collection practices are a menace (to US residents at least) even if we could be guaranteed that Google would never willingly use it in any bad way.

SO you want Information need to be regulated? is that your point?

EU is light years ahead in propaganda, that's about it. It has its mouth full of GDPR while it's quietly preparing China-style firewall, tracked digital money and encryption ban.

>By what mechanism could Google prevent themselves from ever being able to do this?

The law.

The law cannot prevent you from doing something, it can only punish you if you do it.

that is a nonsense statement. "doing something" = "do it"

if you mean, cant stop you considering it, then thats fair, but then the point has no value?

I'm not sure I understand what you mean.

What's difficult about this? The law prevents people from doing the wrong thing every day using the threat of jail time or worse.

Claiming laws only punish actions taken so they can't be "preventitive" by preventing others from taking those actions is either naive or just plain intellectually dishonest.

The US is a country that has laws inaccessible to the public with no way of knowing whether you're breaking those laws. It's either naive or just plain intellectually dishonest to think that these laws exist as a preventative measure.

But one can break a law and get away with it. It's selectively enforced.

But the claim I was responding to was that it does not matter whether Google is doing this now, what matters is that they can do it. A law which imposes penalties on what you can do rather than what you are doing seems fraught.

> >By what mechanism could Google prevent themselves from ever being able to do this? > The law.

I'd really rather not see companies like Google (it any other, for that matter) making laws. Lobbying is bad enough.

They can't without violating (or at least changing) their privacy policy.

You and all your friends are welcome to each bring an arbitration case against them if they have been doing it or if they do it without you agreeing to an updated privacy policy.

If they haven't, then you have nothing to complain about. If they change their privacy policies to allow it, then complain.

Yeah and google can do all of the above considering just about every website uses google analytics and all that analytics data is sent back to google's servers. Then they can sweep up whatever they missed using Chrome or Android or google-owned service metadata (i.e. google search, google maps, etc).

Google Analytics is the service that connects it all and google has convinced companies to give them this data access for free. (well, in exchange for visibility to parts of that data displayed on fancy trinkets)

This is the web-equivalent of omnipresent facial recognition tied to a central database.

Like fingerprinting, facial recognition is not perfect (e.g. you can have a lookalike, twin, etc.) but is still damn frightening.

Perhaps this viewpoint can convince some more people of Google's (potential) evilness.

How does this relate to Google though? Do you mean they should get rid of incognito mode? Cause it doesn't succeed at preventing all websites from tracking you? Or that they should be liable for making people believe it could when it couldn't?

incognito mode is not made to hide you from the internet. it's made to hide your activities from being logged into your browser.

How can Amazon see what you’re doing in incognito if you haven’t logged in? An incognito session is cleared of all cookies so you need to log in to establish your identity. It doesn’t stop Google Analytics from loading but will log you as a new user/session because previous session cookie is gone.

Now, there is also fingerprinting techniques but at the time incognito mode was released these were not widely known and incognito meant: make me look like an anonymous user on the internet NOT make me invisible.

I think a lot of the problem is, the average person doesnt know the difference between your browser not tracking your activity, and the internet tracking your activity.

incognito mode is to hide from your browser history and tracking, it has nothing to do with the servers you visit.

Speaking of pornhub...

There used to be a way to see your pornhub search history even if you were always incognito, right on the site. It worked really well but I never figured out how it worked.

Reply on news.ycombinator.com