The Register Home Page

back to article Google Chrome lacks protection against one of the most basic and common ways to track users online

Google markets its Chrome browser by citing its superior safety features, but according to privacy consultant Alexander Hanff, Chrome does not protect against browser fingerprinting – a method of tracking people online by capturing technical details about their browser. "There are at least thirty distinct fingerprinting …

  1. Anonymous Coward
    Anonymous Coward

    "one of the most basic and common ways to track users online"

    The purpose of Google Chrome is to track users, and with 67% browser market share, it's arguably the most common.

    Google didn't build Chrome because they care about users. They don't. They built Chrome to track users, and to a creepy degree. Tracking is the whole point of Google's business model. They're the world's largest purveyor of misinformation. Google gets paid to serve up junk information designed to lessen a user's logical decisionmaking, and that's more effective when they hoard every piece of info about that user possible. Hence, the Trojan Horse known as Chrome.

    Screw Google, use Firefox.

    1. elDog

      Be prepared for the anti-Firefox hordes.

      There seems to be a lot of Firefox bashing on other forums (reddit) without addressing concerns such as this one (privacy, fingerprinting).

      1. Anonymous Coward
        Anonymous Coward

        Re: Be prepared for the anti-Firefox hordes.

        Most people just accept advertising. It wouldn't be so profitable if it didn't work. /shrug

        If Mozilla closed up shop I'd fire up lynx before installing Chrome. Bring on the anti-Firefox hordes.

        1. _wojtek

          Re: Be prepared for the anti-Firefox hordes.

          there was this old research (for yahoo?) ages ago that supposedly showed that tracking users and showing "relevant" ads wasn't more effective than regular context based one. The suggestion was that ia just self propelling business : ad agencies successfully convinced everyone that it works and everyone is throwing money at them because of FOMO. And considering that most ads are just obnoxious and made ao that you often just accidentally click on then and voila - you have "clicks".

          1. blu3b3rry Silver badge

            Re: Be prepared for the anti-Firefox hordes.

            Most of the "relevant" ads are impressively daft. For example, buying a new smartphone saw adverts appear desperately trying to flog me a smartphone.

            Why? I just bought one and certainly don't need another.

            Additionally now I've been using uBlock and a few other privacy addons for a good while, (plus stopped using Google search and other G-suite products) the rare times I see adverts they don't tend to be "personalised" and seem to default to generic nonsense. Fine by me, I guess it's a sign that slightly less of my data is getting slurped.

          2. IamAProton Bronze badge

            Re: Be prepared for the anti-Firefox hordes.

            The problem is that it doesn't matter because advertisers pay more to show me targeted ads, doesn't matter if they are targeting me with the wrong ones.

            So Google gets more $$ because they are profiling me and advertisers are happy to pay more because they think they are showing ads to the right audience (they aren't).

            Google is happy, advertisers can't tell the difference anyways-

            Btw, I block ads (obviously) and I use Chameleon (In the past there was another FF extension doing the same, can't recall the name) just to mix up my "fingerprints"

      2. Someone Else Silver badge

        Re: Be prepared for the anti-Firefox hordes.

        Firefox bashing seems to be great sport, sorta like Micros~1 bashing. The latter is well deserved, of course. The former used to be, and Moz still tends to aim their .22 squarely at their phalanges from time to time, but is not nearly as warranted as one would believe, from reading this or other forums. I (generally) like Firefox. I use it at home on both Windows and Linux systems. (Surprisingly, my employer won't allow us to use Firefox, but will allow Chrome or Edge -- wonder why that is....)

      3. ThatOne Silver badge
        Unhappy

        Re: Be prepared for the anti-Firefox hordes.

        > There seems to be a lot of Firefox bashing

        There are indeed a lot of people blindly accusing Firefox of everything nasty happening anywhere (why did Firefox have to start a war in Iran anyway?). Their point always is, Firefox is the reason we can't have nice things, so switch to Chrome and let the big monopoly in the sky become reality at last.

        Now (as a long-time Mozilla/FF user) I do have to admit not everything is perfect with Firefox, and there have been a lot of rather questionable decisions made through the years. But it still is the best option, even if it is now utterly uncool among the youth (borderline something to be ashamed of). Having uncle Google's sweaty hand in your panties is way more trendy. Go figure.

      4. Anonymous Coward
        Anonymous Coward

        Re: Be prepared for the anti-Firefox hordes.

        After a decade of Googles data slurp, I still find it head shakingly bad that people are still surprised when stories like this come out.

    2. Fred Flintstone Gold badge

      Re: "one of the most basic and common ways to track users online"

      .. and now you know why Microsoft based Edge on Chrome and not on Firefox.

      Exactly the same motives, and exactly the same amount of interest in protecting the user, namely none. It's actually even a negative value as they too are part of the problem..

      1. Scotech

        Re: "one of the most basic and common ways to track users online"

        Feels a little harsh, considering one of the very first changes they made to the base chromium package was to add in 'enhanced' tracking prevention as an optional extra. Optional not because they don't want you to use it, but because it breaks so many popular websites that are infested with tracking scripts that users who don't know or care about this stuff (i.e. the vast majority) tend to complain and just stop using the browser in favour of Chrome rather than going into the settings to figure out how to drop their pants. I've no love for Edge, but I do need to use it for work, and it's genuinely better than Chrome at respecting user privacy so long as it's configured correctly. Also, Brave was based on Chrome too?

        1. Anonymous Coward
          Anonymous Coward

          Re: "one of the most basic and common ways to track users online"

          If Google put any 'anti-tracking' features in Chrome you can be sue that it only blocks others from tracking not Google.

          Google/Alphabet has been on my shit list for years as the #1 company to avoid if at all possible.

          Just dismayed that my kids school has fixed on Google Classroom as their suite of choice. Schools as much as anywhere are places that Open Source should be the first choice rather than starting out by letting Google and MS harvest kids data from 5yr old (and I know they say they don't, I've even seen the contracts, but I don't belive them and evidence would suggest I'm right) .

          1. Anonymous Coward
            Anonymous Coward

            Re: "one of the most basic and common ways to track users online"

            I would be asking the school for their data protection assessment, and as you say, comparing it with reality. You then go back, point out that they are in the wrong, you don't consent, and that puts them in breach of GDPR.

            I bet they insist you use WhatsApp and Facebook for communications as well - many do. Any school allowing it's staff to use WhatApp to communicate with parents is breaking the law - unless they've taken the step of getting informed and freely given consent from every parent to have their data uploaded to Meta.

            1. Anonymous Coward
              Anonymous Coward

              Re: "one of the most basic and common ways to track users online"

              What happens when a parent doesn't use (cr)apps?

              1. Anonymous Coward
                Anonymous Coward

                Re: "one of the most basic and common ways to track users online"

                If schools make the use of the apps a core requirement they will also be providing devices like chromebooks or iPads.

                But it's heartening to see this particular education fetish seems to be ending. Mobiles are being banned in classrooms and I see Sweden is returning to books and paper, and the tech Bros are screaming about it - https://www.bbc.com/news/articles/cly0vk77vdko

                They want to get people young and hooked just like Big Tobacco did (does?).

            2. Anonymous Coward
              Anonymous Coward

              Re: "one of the most basic and common ways to track users online"

              Consent doesn't come into it unfortunately. With most government processing the lawful basis will be "Public task" or "Legitimate interest".

              1. I could be a dog really Silver badge

                Re: "one of the most basic and common ways to track users online"

                That's not a universal get out. It is NOT a core requirement to be able to provide/perform the public task. There are alternatives that don't break GDPR.

        2. DS999 Silver badge
          Megaphone

          Google doesn't want third parties to track

          They want to be the ONLY ones able to track, because that means they can charge a premium for their personalized ads.

    3. Philip Storry
      Mushroom

      Nope

      "Google didn't build Chrome because they care about users. They don't. They built Chrome to track users"

      Nope.

      Google built Chrome for much the same reason that Apple built Safari - because Microsoft were monopolistic gits.

      Back in the days of the browser wars, Microsoft pushed IE forward. They even did some good work creating things like XmlHttpRequest, which allowed for dynamic loading of data without having to reload the whole page - basically the groundwork for modern interactive web page technologies.

      But Microsoft also bundled Internet Explorer with Windows, and paid Apple to bundle IE on Macs. Yes, there was a time when the recommended and default browser for a Mac was Microsoft's Internet Explorer!

      This had the desired effect for Microsoft of killing their main browser competitor, Netscape. Microsoft then stopped developing Internet Explorer a little while after they'd effectively neutralised Netscape.

      Internet Explorer 6 was released in 2001, and Microsoft left it to wallow until 2006 when they released Internet Explorer 7 - five whole years!

      Apple moved first, as they realised that Microsoft's interest in browsers was fading - so they forked KDE's KHTML in 2003 and created Safari. That became the default browser on Apple's platforms, but on Windows we were still stuck with IE, Opera, or builds of Firefox so early that it wasn't actually called Firefox yet. (It was originally called Phoenix then Firebird, both names ran into trademark troubles.)

      Five years later, after Microsoft had finally released IE 7 and were talking about a possible IE8, Google got sick and tired of having to work around the IE Trident engine's inadequacies, forked WebKit/KHTML and created Chrome. Not because they wanted to track people, but simply because - like Apple - they realised that relying on Microsoft to reliably ship a stable, standards compliant browser was a mug's game.

      That doesn't mean Chrome isn't slow to block fingerprinting/tracking technologies because of internal politics within Google. That may very well be the case, but I have no insight into that.

      But let's not rewrite history here - Chrome and Safari exist because Microsoft were monopolistic gits, who stopped development of IE once they'd achieved their monopolistic goals.

      1. Anonymous Coward
        Anonymous Coward

        Re: Nope

        Huh?

        Chrome pesters users to sign in with their Google account. Browser fingerprinting is unnecessary when the user creates an account with an advertising company, agrees to tracking in the TOS, and attaches that account to their browser. Google's core business is tracking users, and accounts do a much better job of that than browser fingerprinting can.

        The then-aspiring advertising monopolist didn't care about saving users from the OS monopolist. Their vision was identifying everyone across their entire web experience. Same reason they developed Android. Google saw the power of being on the client side to get around the concept of a browser as an intermediating sandbox.

        What ultimately doomed Netscape was the business model. Most users see browsers as a commodity and aren't going to pay, even for a better product. Netscape's only long-term profit hope was monetization through client-side advertising. Google's ad platform and widespread adoption as a default homepage would have proven far superior to whatever Netscape could have done on the client side by using its browser as a launching pad to get into the advertising business. Had Microsoft not bundled IE, Chrome would have still killed Netscape as a business through Google's dominance over users' web experiences. Even today, Google's tying of Chrome has driven Netscape's successor, Firefox, to a small browser share, which sadly stands at under 3% as of 2026.

        Apple is a huge company which makes two popular operating systems. Starting in the early 2000's, web browsers became the single most important piece of software an OS runs. It makes sense Apple would want a browser under their control. They could have abandoned Safari and become the biggest booster of Firefox, but they wanted control. Safari gave them control so they wouldn't have to cede it to Internet Explorer, Firefox, or the then-in-development Chrome.

      2. Calum Morrison

        Re: Nope

        If Google really just wanted to kick MS in the plums and give us users a decent browser (rather than track the hell out of us), why didn't it just throw more money at Mozilla? Who wants to reinvent the wheel when there's a perfectly good one taking chunks out of IE (apologies for the metaphor mixture)? Chrome came out years after Firefox, just around about the time "Don't be Evil" was looking more and more like a bad joke.

      3. Charlie Clark Silver badge
        Thumb Up

        Re: Nope

        Basically true, but it wasn't all about Microsoft: Apple wanted to cut Adobe out of the I-Phone market by ditching Flash. Google wanted to get rid of walled gardens altogether so that it had more space to sell ads (not just Adobe but also, RealPlayer, etc.) by extending the web to provide the necessary functions: Canvas, video, WebRTC, JIT for Javascript and buying YouTube to "make it happen". It ended up taking on Microsoft directly because Microsoft considered the HTML done and was still hoping for a brave new world based on ActiveX and Silverlight and, as a result, was actively blocking changes to HTML in W3C. Google is a data-slurping kraken but, in general, its contributions to web technologies have been solid and unencumbered.

        Apple later went on to add proprietary extensions to HTML for the I-Phone including the infamous "notch" bullshit, but has rarely contributed anything meaningful since then. Indeed, it actively opposed WebM for video and WebP for images because it couldn't control them and has fought tooth and nail to prevent WebApps being considered first-class citizens on I-Phones, because why should you allow some simple HTML, JS and resources when you can force the developer to buy a licence and embed the same content in a Safari webview that is only available from the AppStore.

        1. RPF

          Re: Nope

          To be fair to Apple, Flash was such a security nightmare, that decision was absolutely the right thing to do. It's probably why they oppose WebM and WebP as well?

          1. Charlie Clark Silver badge

            Re: Nope

            Flash was not that bad, it was really the plugin mechanism that enabled exploits and on the I-Phone, Apple had complete control of this.

            Apple likes selling licence fees but hates paying them: think of all that lovely cashflow just for "works with I-Phone", or FireWire connections. Using Flash for video meant paying Adobe a lot but also, potentially giving them the keys to the new walled garden. "Security" and "performance" were smoke bombs aimed to distract from the real reason.

            WebM was a direct royalty-free (it's arguable whether it was "encumbered" or not, but Google definitely indemnified it against claims) competitor to MP4 where Apple is a pool member. Getting Safari to play a different stream using the video tag was a real nightmare. The derived image format, WebP, was significantly better at a time when images were getting bigger again due to higher screen resolutions. Apple later introduced and tried to push HEIF.

      4. anothercynic Silver badge

        Re: Nope

        Have to agree with Philip here, but we also need to remember that while the initial goal of Chrome's existence may have been altruistic (it was, I'm old enough to remember), its current changes, given its parent company, do leave a bit to be desired. Those who want to profile users, what users do, what users browse for, everything the user does, will use Chrome for that, because that information is available.

        Safari on the other hand has had some features added that actively frustrate those looking for that telemetry, which is a good thing. Microsoft is probably in the Google camp with Edge, although again, Edge was originally designed to be a clean-sheet redesign of a browser with as little historical cruft as possible added. Choosing the WebKit/Chromium option was a matter of convenience.

        1. Anonymous Coward
          Anonymous Coward

          Re: Nope

          Re: Safari

          WebExtension Support

          Beginning in 2018, Apple made technical changes to Safari's content blocking functionality which prompted backlash from users[169] and developers[170] of ad blocking extensions, who said the changes made it impossible to offer a similar level of user protection found in other browsers. Internally, the update limited the number of blocking rules[171] which could be applied by third-party extensions, preventing the full implementation of community-developed blocklists. In response, several developers of popular ad and tracking blockers announced their products were being discontinued,[172] as they were now incompatible with Safari's newly limited content blocking features. Beginning with Safari 13, popular extensions such as uBlock Origin no longer work with Safari.[170]

          No thanks. I'll just stick with Firefox and the full-featured adblocker.

    4. Throatwarbler Mangrove Silver badge
      Flame

      Re: "one of the most basic and common ways to track users online"

      I'm shocked, shocked I say, to find that Google's browser does not provide privacy protections!

      Anyway, I'm running LibreWolf with strict tracking protections and privacy.resistfingerprinting enabled, and I haven't noticed significant issues accessing most Web sites. Every so often, something will break, requiring me to access a site via a Chrome-based browser, but it mostly works great, and I'm willing to eat a small amount of inconvenience for privacy and ad-blocking purposes. BONUS: it blocks autoplay media very effectively!

      As a side note, if there are any developers of any product, app, or site that implements autoplay, can you give yourself a quick shot to the gonads for me? Autoplay sucks, and literally everyone hates it and, by extension, YOU.

    5. FIA Silver badge

      Re: "one of the most basic and common ways to track users online"

      Google gets paid to serve up junk information designed to lessen a user's logical decisionmaking

      I think you're reading far too much into it.

      Alphabet sells advertising. That makes them lots of money. (Because they control the entire process and no-one seems to care about regulating them).

      That's why they make no effort to stop chrome allowing fingerprinting, it's good for tracking users.

      This isn't for some imagined nefarious world control reason.

      It's just to sell you adverts. (Which kind of makes it all worse I think).

      Never ascribe to malice or nefarious intent what can be explained by greed and self interest. Humans by and large aren't that clever or manipulative, but they are that greedy.

      1. Anonymous Coward
        Anonymous Coward

        Re: "one of the most basic and common ways to track users online"

        What do you think nearly all advertising is? It's junk information. Nearly all of it is based on logical fallacies, because it works, the most common of which is simple brand exposure. Classic familiarity bias.

        Why does the soda company hire a celebrity snowboarder to pull exxxxxtreme tricks then chug an overly caffeinated drink while a logo flashes on screen?

        Ever been to a booth at a trade show? That's marketing, but a salesman who knows the product can say something intelligent to a potential customer who has a problem and needs a solution.

        Ever read an independent, eight-page review of $CPU_CORP's latest processor? That's marketing too, but the details are useful if they come from an independent voice with some integrity (not Youtube influencer slop).

        Most mainstream advertising doesn't operate this way because logical thought doesn't work as well as deluging people in garbage. You can tell old-timey advertising by its use of complete sentences organized into paragraphs.

        Google sells user attention to the highest bidder by hoarding a creepy degree of information on users. The ad units are nearly all crap with nothing intelligent to say nor any logical reason to engage. When sellers have to outbid each other for user attention, everything we buy costs more, and Google wins. The easiest response is to just turn the advertising off, which takes less than five minutes in a fresh install of Firefox (on a basic level). Additional anti-ad tech can both bolster and layer the defense.

  2. Jamie Jones Silver badge

    "First, large scale blocking of cookies undermines people's privacy by encouraging opaque techniques such as fingerprinting," the company wrote at the time."

    "It's your fault - the reason the pervert tried to install a hidden camera in your bathroom is that you insist on closing the curtains when you shower. If you left them open, he probably wouldn't have bothered."

    1. Mark Simon

      That’s right. And locking doors only encourages burglars to try the windows, so you’re only encouraging breaking and entering.

  3. Dinanziame Silver badge

    I'm very pessimistic regarding tracking. It's probably possible to identify people by the way they move their mouse.

    That said, I think most people accept all cookies all of the time — they value their privacy less than the time it takes to protect it.

    1. stiine Silver badge
      Holmes

      It is possible to ID individuals by their mouse movements, and also by keyboard inputs (typing speed and cadence.)

      1. Jamie Jones Silver badge

        But it shouldn't be. There should be no access to mouse and keyboard events. I guess it's for the "running apps in the browser" feature, but in which case it should not be fired up until granted.

      2. kz20fl2

        I remember seeing a demo from a security vendor that fingerprinted your typing style, and if it markedly changed, software would lock you out of your session, because it might mean someone else had hijacked it.

        Bit annoying for when you log on slightly inebriated to read some mails.

    2. Someone Else Silver badge

      It's probably possible to identify people by the way they move their mouse.

      There was a story in Playboy† back in the seventies about a "futuristic" workplace where the system not only monitored user IDs and passwords, but also how the user IDs and passwords were entered, using hesitation between keystrokes, tendencies for typos, etc. to profile the user. This was ostensibly to identify when somebody was using another's ID/password to gain access to someone else's account. The story was about catching a disgruntled employee of the firm using purloined credentials to take company private information and using it against the company.

      Life imitates art (perhaps not immediately, but sooner or later...)

      †Yes, I did read it for the articles...

  4. Greybearded old scrote

    Useful illustration

    Panopticlick

    It usually tells me that I have strong protection. Then that my browser fingerprint is unique in the last 30 days of traffic.

    1. Anonymous Coward
      Anonymous Coward

      Re: Useful illustration

      I'm not sure how useful that is, I have most of the feature it suggests (VPN, Canvas, uBlock +more) and it gave me pretty much the same score as my work browser which has nothing.

      Either my measures don't make me blend in (tbh they are aimed at ad blocking really) or the site is not that good at doing what it says

      1. Jamie Jones Silver badge

        Re: Useful illustration

        Another one: https://amiunique.org/

      2. JWLong Silver badge

        Re: Useful illustration

        ""Either my measures don't make me blend in (tbh they are aimed at ad blocking really) or the site is not that good at doing what it says""

        As seen below it told me to use Brave, which I do. But, to even get the scan to work I had to turn off most protections Brave provides to have the scanner run. So, that tells me a lot about how important it is to kill scripting, dumping site cookies at session end, and other settings in a browser that need looking at.

        Also, with a pretty complete Host file I don't see ads anywhere I go.

        From Scan Site ""5. Consider using Firefox, Brave, or Tor Browser for better default privacy""

    2. scot stockwell
      Alert

      Re: Useful illustration

      "Then that my browser fingerprint is unique"

      That is NOT good. It means you are very easily tracked.

      Every addon, every setting, every choice you make is a datapoint that contributes to uniqueness.

      The more vanilla you are, the better.

      1. IamAProton Bronze badge

        Re: Useful illustration

        It's good if you change it often: if the browser (or some extension) managed to alter your fingerprint for every site and/or every x minutes then all the profiling goes out the window

    3. jpennycook Bronze badge

      Re: Useful illustration

      Try using the Mullvad browser, that should make you less fingerprintable: https://mullvad.net/en/browser

      TZP shows lots of things your browser is leaking: https://arkenfox.github.io/TZP/tzp.html

      and the original panopticlick, now called Cover Your Tracks: https://www.eff.org/pages/cover-your-tracks

      https://github.com/arkenfox/user.js/wiki/Appendix-B-Test-Sites-%5BFingerprinting%5D is useful to see how well your protection is working, but does have the caveat:-

      > Any probabilities or entropy from test sites are COMPLETE NONSENSE

      https://arkenfox.github.io/thorin/items/01aboutfingerprinting.html?view=presenter#50

  5. Anonymous Coward
    Anonymous Coward

    Chrome......Or Just Plain Chromium?

    The article is not very clear on this point!

  6. scot stockwell
    WTF?

    The privacy dilemma

    Check out: https://amiunique.org/fingerprint

    It gives a nice breakdown of all the datapoints that make up your browser finger print.

    There is a fundamental dichotomy in play here - the more you strive for privacy online, the more unique your browser fingerprint becomes and the easier you are to track.

    Browser fingerprint data will be bought from web hosts and aggregated and then offered for sale.

    1. Jamie Jones Silver badge

      Re: The privacy dilemma

      Well, whatever extension you use should not block these requests, but return the most generic fake results possible!

    2. RMclan

      Re: The privacy dilemma

      Ignoring that with me using Firefox it gives a Similarity Ratio of 1.6%, the fact I have some company specific fonts installed on my computer gives me a Similarity Ratio of 0.00% on that metric That means the website says I am unique amongst over 5 million fingerprints in their dataset and therefore easily tracked. Lesson to be learned, don't have custom or very rare fonts for your company letterheads, etc. if you don't want to be tracked online.

  7. mark l 2 Silver badge

    What good reason is there for having the details of my GPU, CPU, Keyboard layout etc available to any website that requests it? This should be info i specifically have to allow a website to access if i want it to be able to do so, not something that a browser freely gives up.

    I sounds like a privacy focus browser should be either outright refusing to provide this info or even better randomising this info every time you open the browser to stop fingerprinting being possible.

    1. Anonymous Coward
      Anonymous Coward

      Some of this stuff makes sense in an abstract sense. Keyboard layout, for example, helps localize content for international audiences. GPU/WebGL delivers richer, more efficient browsing for graphics-heavy pages. Video/Audio is an integral part of why many people use the web.

      Back in the day, users were bombarded with a litany of gross plugins: ActiveX, Flash, Realplayer, etc. Killing off all that junk was definitely good for the web.

      But Google saw an opportunity.

      These technologies could have been made privacy-preserving, which is why Google developers actively helped develop and push standards which weren't, and used the heft of its Chrome market share to ensure that privacy-preserving standards weren't adopted.

      That's why users who care about openness, privacy, and avoiding advertising shouldn't use any Chromium-derived browser. The mere usage of Google's platform gives them the heft to continue pushing bad standards in the future. Everyone using a non-Chrome derivative of Chromium is still giving Google the benefit of their useragent string.

    2. Anonymous Coward
      Anonymous Coward

      Screen size and language are probably the only extras that the browser should send.

    3. Someone Else Silver badge

      I[t] sounds like a privacy focus browser should be either outright refusing to provide this info or even better randomising this info every time you open the browser to stop fingerprinting being possible.

      Seems to me that randomizing it would be better. Decreasing the signal-to-noise ratio would make the practice useless.

  8. Claude Yeller Silver badge

    You could block JavaScript or use Tor

    Most fingerprinting is done using JavaScript. Selective use of NoScript helps.

    Tor makes it a point to block as much fingerprinting as they can. So selective browsing using a Tor browser would also help.

    But using Firefox is a good start. If a site doesn't work well in Firefox, use that single site in a Chrome derived browser.

    1. cd Silver badge

      Re: You could block JavaScript or use Tor

      On android there's Orbot for TOR VPN, works with Rethink.

  9. Anonymous Coward
    Anonymous Coward

    Wonka approved stalking

    Just think of the lifetime supply of chocolate.

    AC obvs

  10. QET

    Well d'uh, that's by design...

    Hell, the times Google proclaimed they were doing something about user privacy & "fingerprinting", it was in-the-end only to keep competitors out (IE: other web-user tracking companies).

    But when anti-monopoly watchdogs came a'sniffin', Google, predictably, gave up instead of protecting the users against themselves (Google).

    1. cd Silver badge

      Google stuff is manager-class, like microsoft. Not for smart people.

  11. DS999 Silver badge
    Boffin

    Fingerprinting could be (mostly) block by adding noise

    Only a subset of fonts installed on any Windows, Mac, Linux, Android, iOS device are ever used on the web. I mean a site might want to use WingDings or Comic Sans but it has to be prepared for non Windows devices that don't have those. Basically, a lot of the reported fonts are meaningless and only serve to fingerprint you - especially if you have added any fonts yourself or via the installation of a third party application. So only reliably report the subset of widely used on the web fonts your device supports, and randomly report other fonts that you also have (and maybe a few made up ones for the heck of it) Don't provide your exact screen resolution every time, you can randomly be a few pixels off in both X and Y and it isn't going to break any websites.

    You could add some noise to user agent reporting with bogus browser or OS subversions. i.e. I'm on iOS 26.4.1 on my iPhone, there's no reason it can't report 26.4.1.3. Or heck maybe go the other way and just report "iOS 26" and hide among nearly a billion others like me - does a website really need to know the minor version number? Ditto with browser version strings, I know those are used in scripts for feature enablement or workarounds but you can add bogus subversion numbers to add noise.

    Add noise in enough places where it really doesn't matter to the actual function of websites but insures your browser never provides the same fingerprint on subsequent visits and you make tracking that much harder. Yes they could defend against some of this by trying to filter out the noise but the more filtering they are forced to do the less unique your fingerprint is and the harder you are to track.

  12. Anonymous Coward
    Anonymous Coward

    Does anyone else remember being able to turn off JavaScript and still have a working browser?

    Young people may not believe it, but in the early days of the internet JavaScript was considered a security issue.

    Lot's of us turned it off by default.

    Try doing that now.

    1. Tim99 Silver badge

      Re: Does anyone else remember being able to turn off JavaScript and still have a working browser?

      I'm an old fart who can't be bothered with a lot of this. I am certainly not expert.

      My small website has standard HTML, a web-safe font universal font that doesn't have to come from elsewhere, 5 tabs, 12 buttons, a single CSS file, and no Javascript, Python, etc. Depending on the vagaries of the hosting company and the punters, it takes about 1-3 seconds to load completely without caching. OK it's simple, but one of my design imperatives was "no code", and that I would write it with a simple text editor - That was after self-interest kicked in, when I realised that the "recommended" stuff could have serious costs and bloat.

    2. Phil Koenig

      Re: Does anyone else remember being able to turn off JavaScript and still have a working browser?

      Lot's of us turned it off by default.

      Try doing that now.

      You obviously don't realize it or you would not have made this comment - but this is one of the best things that smartphones did for the WWW in general: push web developers into finally adopting "Responsive website design" that adapts to the user-agent and provides a usable display of page content whether the user is using a 30" desktop monitor or a 4" smartphone display.

      And the nice little "stowaway" on that is that Responsive Design ALSO dictates that a user-agent must be able to display at least basic content whether or not it runs javascript or not.

      So in fact, MANY websites these days will display a large proportion of their content with no JS at all on the browser. The BBC for example works great with no JS enabled.

      So in fact, despite the best efforts of the tech tycoons in THIS particular area, smartphones actually helped make the WWW safe for JS-free browsing again. In fact more like what Tim Berners-Lee's original concept for the WWW was - at least for that little part of it. (To be sure, in every other respect it's worse now)

    3. Stephen7Eastern

      Re: Does anyone else remember being able to turn off JavaScript and still have a working browser?

      uBlockOrigin allows blocking JavaScript. I have JavaScript disabled by default and whitelist only sites of interest where required. Over 70% of the internet still functions fine without JS, including theregister, old.reddit.com, etc. Blocking JavaScript is not only more private and much safer, but the internet is a much more delightful with JavaScript disabled.

  13. Anonymous Coward
    Anonymous Coward

    A single third party request is all you need

    That one tracking pixel or downloaded java script hands to a web server your entire browser id string and the referer URL that sent you there.

    Oh and it can set a cookie if you're being lazy.

  14. Anonymous Coward
    Anonymous Coward

    Whether I see adverts or not

    Whether I get tracked or not.

    I ain’t clicking on your stupid ads.

    Ever.

    Most of the ads on YouTube (for example) are clearly for fake products or straight up scams.

  15. Sleep deprived

    "Firefox has privacy.resistFingerprinting"

    Well, not on Android, where Firefox doesn't let you access about:config "for your own protection" ...

    Fortunately, forks like Waterfox don't implement this disempowering restriction.

  16. Phil Koenig

    "A feature, not a bug". [Google]

    If you ever hear Google crowing about doing something to protect your privacy, what that actually means is that at the same time, they secretly added 3 NEW things that destroy your privacy.

    When it was obvious a few years ago that web users had gotten wise to the privacy depredations of browser cookies/local storage and enterprising coders had created handy tools to neuter that snooping, Google "changed course".

    Out of the blue, they declared: "3rd-party cookies are so bad and so yesterday, we shall eliminate support for them entirely!'

    But at the exact same time, they created NEW privacy threats. First in the form of "FLoC" - "Federated Learning of Cohorts" - which was basically just a new way to snoop that wasn't called "cookies".

    But the techies and civil libertarians were not impressed, and a chorus of criticism arose from the ranks about this new privacy threat. Less than a year after "FLoC" was rolled-out, it was dead.

    Undaunted, Google then took aim at content-blocking browser extensions, and declared that they will "improve" the extension manifest API to "Increase everyone's privacy and security!~!"

    But of course Manifest v3 mostly just made it very difficult to engineer content-blockers designed to recover some kind of privacy online.

    Nowadays, Google's Android OS users are being told that the reason that they are making life hell for those who try to opt-out of Google's android snooping tools and customize their devices to maintain a shred of privacy, is in fact to "Improve their security".

    Oh, thank you! Sound familiar?

    In reality, it's a ploy to try to maintain their app store monopoly in the face of worldwide demands to "open up" the mobile app stores of Apple and Google.

    At least they're consistent...

  17. frankvw Silver badge
    Black Helicopters

    The tip of the iceberg

    Interesting discussions here on privacy and tracking. Mostly valid points, too. A shame that they're almost entirely irrelevant.

    The reality of the situation is that we all get tracked seven different ways from Sunday all the time no matter what we do, and not just by Google. For example, let's say that:

    - Someone in your household or workplace has an Android device

    - Someone in your household or workplace has a Facebook account

    - Someone in your household or workplace has a Google account

    - Someone in your household or workplace uses Whatsapp

    Just to name a few; the list is by no means complete. That tells Alphabet, Meta et al that you are associated with those users, just based on IP addresses, network routing, the time you go online etc. It all gets aggregated; it all gets analyzed. When you run enough of that "noise" through a statistical algorithm (which is exactly what Alphabet and Meta excel at) a pattern begins to appear. Eventually that pattern becomes a clear picture.

    Which browser you use and how "private" it claims to be is completely irrelevant. You exist in an online ecosystem along with many other people. As soon as you go online, your data traffic can be tracked, because that's how the Internet works.

    Gmail is even worse. As soon as you send one email to someone with a Gmail account, the details in your SMTP envelope and email header fields are in their system and on their radar. And we know for a fact that Google scans Gmail content. In a day and age when top level government officials discuss air strikes on leaky social media it's only a matter of time before someone else forwards an email from you to a Gmail account, and if that email has anything in it that will identify you personally (say, your name, phone number or place of employment in your email signature) they've got you. It's all downhill from there on in. Avoiding Gmail may seem fine in theory, but because the people you co-exist with don't avoid it, you get sucked in as well, whether you like it or not. You can't avoid it.

    And that's only Alphabet and Meta. Don't even get me started on what government agencies are doing with that data.

    Don't get me wrong, I'm not saying there's no point in analyzing thoroughly what goes on under the bonnet of Chrome and all it's derivatives. There is. But let's not kid ourselves when it comes to privacy. You have none, no matter what you do or don't do. It was gone the moment you connected your first device to the Internet.

  18. Fruit and Nutcase Silver badge
    Joke

    Disclosure

    "digital fingerprinting is okay if it's disclosed",

    As Google CEO, the buck stops with you. Now drop 'em and assume the position whilst I get a gloved finger ready for digital fingerprinting

  19. Andy The Hat

    The "Don't be evil" mantra has slid past "Don't get caught being evil" all the way to "Don't be evil unless it makes money".

  20. El.Mich.
    Big Brother

    The headline / title is quite obviously FAR too long!

    "Google Chrome lacks protection", ...

    ... would have been sufficient and mostly adequate and correct.

    SCNR! ;-)

  21. Filippo Silver badge

    I'm convinced that we've been approaching this problem from a fundamentally wrong angle. The reason I don't worry very much about being tracked everywhere when visiting a shopping mall isn't that I only go there with a full face mask; it's that the shop owners are outright forbidden from uploading their security camera footage to an ad broker.

    Similarly, browser features that enhance privacy are a great thing - but I don't want to "win" the arms race; I want to not be in an arms race to begin with.

    Just pass legislation to ban tracking. Off the top of my head, I'd just state that everything that an endpoint sends you, including the originating IP address, is personally identifiable information as per GDPR. It can't be shared with third parties, and you can't use this as an excuse to deny service. Build tightly defined exceptions for CDNs and VPNs. Maybe for SSO services, I guess, although personally I wouldn't be sad to see them go. Those things can work, but they have to keep data siloed. Yes, many other things would break (among which the business models of most social media), but guess what, in most cases, they were only designed that way in order to track you, and can be redesigned so they don't need to.

    There are probably problems with that particular definition, but the point is - we all know why the big techs do this. Let's stop debating the how. Kill the fundamental reason.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon