Comment by newscracker | Hacker News Reader

Comment by newscracker | Hacker News Reader

Every time there's something about online privacy with browsers, it's mostly Firefox or Safari. I wondered if Chrome had resisting fingerprinting on its radar (guessing that it wouldn't be in Google's interests to add any feature that would thwart profiling users online), and I found this [1] confirming my guess (emphasis mine):

> Since we don't believe it's feasible to provide some mode of Chrome that can truly prevent passive fingerprinting, we will mark all related bugs and feature requests as WontFix.

I haven't read all the analyses in the links in that article, but this sounds defeatist and lazy, much unlike a stance that Chromium would take on security or performance on the web.

Contrast the above with what this article says about Firefox:

> Firefox's upcoming letterboxing feature is part of a larger project that started in 2016, called Tor Uplift.

> Part of Tor Uplift, Mozilla developers have been slowly porting privacy-hardening features developed originally for the Tor Browser and integrating them into Firefox.

If you value online privacy, your best choice is Firefox (though it requires some additional manual configuration). Safari comes second (its extensions directory could use more love). The choice where you can add more of your influence to is Firefox — by using it, evangelizing it and by donating (if feasible) to it.

[1]: https://chromium.googlesource.com/chromium/src/+/master/docs...

Here's a good comparison: Android Chrome's user agent:

Mozilla/5.0 (Linux; Android 6.0.1; SM-G928F Build/MMB29K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Mobile Safari/537.36

Versus Android Firefox's user agent: Mozilla/5.0 (Android 9; Mobile; rv:66.0) Gecko/66.0 Firefox/66.0

Note how the Chrome browser announces your phone model and software build version to the world.

With regional models with carrier customised software builds, simply the user agent can be used to fingerprint a user.

Yup it's disgusting. Even in private mode sites know it's me with my build version and ip.

To be honest most people are confused about "private mode", I agree there should be privacy options enabled by default with it, but the reality is pretty much "no browser history will be stored (locally) and your session / cookies will be isolated between private mode and "normal mode"

I don't expect serial numbers to be sent even in public mode. Android build plus ip might as well be a serial number.

Indeed. It's intended as a method of watching porn without having it pop up in the address autocomplete later when your kids are trying to go to the Peppa Pig website.

Google still knows my precise location sometimes even when I'm connected to a VPN. The browser itself uses more (Wifi network, phones linked to your account) than just your IP to determine it, and there's no way to control it.

It's ironic that in a time when the browser used matters less than ever thanks to good HTML5 standard support and differences lie more in the fringe, most recent corners of the living standard, the user agent strings are more detailed than ever.

It would help if the browser vendors, particularly Google, took a step back and spent some time thinking about why user agent strings were invented. They're more like cludges to know how to present a web page, which are less needed nowadays because you can request things like mobile device dimensions, provide HiDPI resources that are only used in case they are needed, provide entirely different views depending on mobile or web, etc. All without peeking at that ugly string. Beyond that, we have polyfills and frameworks that guarantee cross-browser compatibility and minimum supported versions, again without resorting to peeking at browser engine build numbers or worse because the detections are now largely integrated in the standards themselves.

Actually browser compatibility is not getting better, it is getting worse.

I was working for a firm last year that made a system with a browser front end that only supported Chrome and Safari, not Edge or Firefox -- this is happening everywhere, and it is why MS threw in the towel with Edge.

I don't think that anecdote fares well against the many ways in which browser compatibility has improved

Browser compatibility is better in early 2019 than I think it was in early 2011. I think it is worse than it was in early 2018.

Browser compatibility is improving because the incompatible browsers are dying off.

> guessing that it wouldn't be in Google's interests to add any feature that would thwart profiling users online

I would actually think the opposite. Wouldn't it be better because then only Google would have that information? Only Google would be able to fingerprint. This is of course under the assumption (which is currently accurate) that Google has the majority share of browsers. But maybe it wouldn't be, because it would teach others how to thwart their fingerprinting.

Yeah, with a google account and google login on every website they still can track everyone even without all these other methods.

I suspect that's the biggest reason Google was so interested in "https everywhere". That removed detailed browsing visibility from a lot of entities, but not Google.

Can you elaborate on that? Are you talking about the https everywhere extension from the EFF, because I wasn't aware Google had a part in that.

Google is steadily making it harder for users to use an http website.

I don't agree with him but Google penalizes non-HTTPS results etc.

They’re talking about Chrome’s (and other browsers’) marking of http sites as insecure, and Google-as-a-search-engine penalising non-HTTPS sites. These are good things.

Serp positions and browser features, like: https://security.googleblog.com/2018/02/a-secure-web-is-here...

I've seen this tendency on HN - if this person/entity does something, I suspect it must be bad or selfish.

On the subject of HTTPS - do you think the interests of ordinary consumers are in any way served by continuing on HTTP? Countless websites, even those accepting login credentials used to think that it was acceptable to not take the trouble to set up HTTPS. The only thing the operators of these websites cared about was being marked "insecure" by the most popular browser. The shift to HTTPS was a definite win for privacy for every person who uses the web.

But no. Apparently, the "biggest reason" for the people working at Google pushing this because it was good for Google. They didn't care about all the benefits for end users, they only cared about themselves.

It's sad that slander like this can become mainstream view in a forum like HN.

Disclaimer - no connection to Google in any way. Don't even own Google stock.

> Apparently, the "biggest reason" for the people working at Google pushing this because it was good for Google.

I mean, when I do stuff at my job, I also do things that are good for the company that pays me. That's the job, right?

The problem is that Google has positioned itself in a way where things that are good for Google might be bad for humanity as a whole.

Stating that the push for https is bad for humanity is a preposterous statement. Please back it up with some facts.

> if this person/entity does something, I suspect it must be bad or selfish.

Isn't that the basic assumption that whole our economy rests upon?

I think calling it the "biggest reason" is wrong but not necessarily entirely wrong. There's a difference between Google's reasons and your benefit.

It could simply mean the interests aligned. I get my credentials encrypted and Google gets more [insert stuff here]. When the interests don't align the result is a bit different. You could be sending tracking/location data every few minutes, adblockers could be crippled, you could be forced to sign in to sync Chrome data, etc. Usually the very same stuff Google relies on for revenue.

So what I'm saying is that it's not that outlandish to assume Google had more reasons than your benefit.

"Biggest" doesn't mean only. I don't see a more compelling motive as the top one.

"I've seen this tendency on HN - if this person/entity does something, I suspect it must be bad or selfish."

Companies tend to do things that advance their competitive advantage.

"slander" - really? For "I suspect", followed by a theory that an online ad company might bandwagon something (otherwise good) that helps them for less than altruistic reasons?

Google is a corporation, the only goal of corporation is to make money.

So yes, that is the biggest reason - their business objective. It just happened that it also did something good for everyone.

> only goal of corporation is to make money

A corporation can set any goal the founders please. Making money need not be the dominant one. Obviously making enough to stay solvent helps with longevity.

Alphabet is a publicly traded company and the officers have a fiduciary duty to do what’s best for their shareholders. This normally means maximizing profits. A corporate officer could make a case to shareholders that not maximizing profits in X area could have Y long term benefit, but that’s not very common these days.

Maximising shareholder value is very often not what's best for shareholders. The current popular myth that it is somehow mandatory has been coincident with a definite change for the worse.

Hasn't Amazon been notable for actively avoiding profit through much of its existence?

https://www.forbes.com/sites/stevedenning/2017/04/27/harvard...

https://skeptics.stackexchange.com/questions/8146/are-u-s-co...

They reinvested their profits in themselves. That's not really avoiding profit (and I think there is a definition of profit that includes the company gaining value)

Of course, the officers of public companies try to do what’s best for shareholders. But here’s a different take on it by Tim Cook five years ago [1] (interpret it however you’d like):

> "When we work on making our devices accessible by the blind," he said, "I don't consider the bloody ROI." He said that the same thing about environmental issues, worker safety, and other areas where Apple is a leader.

> …

> He didn't stop there, however, as he looked directly at the NCPPR representative and said, "If you want me to do things only for ROI reasons, you should get out of this stock."

[1]: https://arstechnica.com/gadgets/2014/03/at-apple-shareholder...

Have you worked in one (or more than one) and observed it's high-level decision making? It's about money and nothing else. This is not unique or special and the only way you'll ever truly believe it is any different is if you make the grandly naive mistake of listening to the marketing department (either internal or external).

Google has long held the stance that anything that's good for the web is good for Google. Google is nearly ubiquitous online these days, so people spending more time online will almost certainly benefit their business.

That's why they don't need any ulterior motivation for efforts like HTTPS Everywhere, Google Fiber, or Chrome. The very fact that those technologies make the web safer, faster, or more powerful already benefits Google indirectly.

> Google has long held the stance that anything that's good for the web is good for Google.

Not denying that, but this could be reversed and would still make sense: Google has long held the stance that anything that's good for Google is good for the web.

Sorry, but there's really no reason to force HTTPS on static webpages, news sites, or any site where you're just browsing/consuming.

Google is smart enough where they could've enforced the penalty on sites that should use HTTPS, such as those with any kind of form submission or login. But they chose not to without much of a reason, and that's why I can believe it helped some hidden motive of theirs.

> Sorry, but there's really no reason to force HTTPS on static webpages...

I downvoted you because this is wrong. There are at least two good reasons for it:

1. It prevents MitM attacks. For example, some ISPs and free WiFi APs inject arbitrary code into unencrypted pages.

2. It improves privacy by hiding the request headers, including hostname.

There’s been a lot of press recently about shady data brokers selling information to Facebook. I would be genuinely surprised if those same data brokers don’t sell to google.

(In addition to full time data brokerage firms, there are third party phone app api’s that slurp data and feed it to advertisers. Facebook has at least one. Presumably google does too...)

Google does buy data for sure. One example: https://www.bloomberg.com/news/articles/2018-08-30/google-an...

Firefox is a good start, then it's also worth checking your browser with the EFF Panopticlick to see how your settings affect your uniqueness.

https://panopticlick.eff.org

There is a way to stop fingerprinting. That way is serving pages via distributed network (over a WoT or torrent-like thing).

All these other ways do is give people the illusion that they're safe from being tracked, when the reality is that they're tracked just the same, but by fewer people so the data is more valuable. This means that the money is centralizing around the actors with the most inexplicable methods of tracking; which are almost always the worst actors.

I hate it too, even though I'm not blameless. It's impossible to compete without a level playing field, and that playing field needs to be technically enforced, because otherwise we get region shopping and advertising / analytics models that push people to create intractable mechanisms so they can paper over how tracking fed into it.

For example, imagine a world where I'm bidding to show an ad to a visitor of nytimes.com. Now, I may not track the user, but if anyone is, they can incorporate what they know and sell that traffic back to me on a CPA model. All I see is the incoming traffic. I don't track anyone (wink, wink) but there is no difference.

In the long run this will either be solved one way or another, and all these online surveillance capitalism companies will crash and burn. Either we get a web with technical guarantees or we get a balkanized internet where every state makes their own weird laws about what is allowed or not.

> In the long run this will either be solved one way or another, and all these online surveillance capitalism companies will crash and burn.

I sincerely hope that happens without causing more harm to people. It also seems to be a long way away.

https://en.wikipedia.org/wiki/Accelerationism

I'm pretty sure sticking it on a distributed network is potentially much worse unless it is specifically designed to prevent tracking.

Protocol wise, basic shared VPNs will stop most everything short of a semi-global passive adversary. The problem is running hostile code on your own machine, coupled with browser makers thinking it is a generally fantastic idea to allow that hostile code to access a whole slew of security-sensitive information.

Sure, VPN won't repudiate the region bullshit, and can even be outright blocked. But if adoption rose to the point websites didn't want to lose the traffic, those would diminish.

However, I do agree a non-immediate user-centric protocol is sorely needed though, especially to stop those global snooping adversaries.

>and can even be outright blocked.

That's my biggest fear. Yesterday I woke up to find out that Three (a big telco provider in the UK) had blocked Mullvad's API path as 'adult content'. I had to physically go to a store and verify that I was an adult to be able to use my VPN - the very same VPN I use because I have so little trust in the UK Gov (I'm not from here and am not staying long term, but hate that the society reminds me of 1984 regularly),

I was referring to blocking by websites, as there is actually some competition between them. For example, a few major ecommerce sites frustrate or outright block traffic from my VPS, so I've simply stopping visiting them rather than poking holes.

A similar dynamic is present for ISPs wherein if most people expect "Internet access" to mean something that works with VPNs, then ISPs can't block it [0]. But that's a harder state to reach as there's much less competition between ISPs. A commerce site wouldn't want to forgo 10% of their business, but a government/quasi-government has no problem demonizing 10% of their subjects.

Which is why we ultimately do need non-real-time protocols and namespaces for the bulk of communication.

[0] Nagging systems like the UK would still exist, but they couldn't progress further to outright banning it.

Reply on news.ycombinator.com