[rasz_pl]

What if I can go from matrix scanning algorithm used by keyboard controllers firmware, usb descriptors used (hierarchy, order, meaning of fields, direction), kernel (usb driver, keyboard driver), system (windows keyboard event), program (event loop, logic, tons of stuff here to decide what to do), back to system (dsn query, cache or network driver), network(can start on 4th osi layer and go all the way to 1) .... up to the part how mighty Google cluster identifies you even when you are not logged in and browse in private mode with no cookies, concluded by the statement that clicking enter begins your adventure of being a product Google sells? Every step of the way from sub 10 millisecond (usb polling, in reality nothing happens when you press enter :P) up to three months in the future (Googles earning report).

edit: Doh, finally clicked on github link, and its just what I wrote, but crowd sourced.

[cbr]

    Google cluster identifies you even when you are not
    logged in and browse in private mode with no cookies

Source?

[mynameisvlad]

Not saying that Google itself does this (I doubt it, honestly), but browser fingerprinting does exist and your browser is, more than likely, unique:

https://panopticlick.eff.org

It isn't entirely unconceivable that a site may use browser fingerprinting to track you even when not signed in by associating your unique browser fingerprint to your account.

[cbr]

I agree that it's possible. I would be extremely surprised if Google were doing this, however, so I'm interested in why rasz_pl thinks they are.

[rasz_pl]

ex googlers startup

http://www.technologyreview.com/news/508176/get-ready-for-ad...

browser fingerprinting is old school and almost outdated by now

All Google needs is few hours of your online activity to associate a fresh newly installed system / browser / ip with a trace of crumbs you usually leave on the network, your 'online routine' - often visited pages, order of visits, time of day, time stamps, all thanks to ever present adsense. Not to mention everything you type in the Chrome address/search bar is reported back to the mothership one letter+timestamp at a time in the name of instant search/autosuggestions/autocomplete (keystroke dynamics), Google knows most common mistakes we make when entering urls/words (limited stylometry), Google has a whole warehouse of stylometry data inside gmail.

Everyone is doing it, Google, FB, Amazon all have acres of server farms grinding such data. Google even offers free DNS servers just to collect more of it. Small companies offer free url shorteners, image hosting, all great sources (who you share with, how popular you are, how far it reaches, for how long). Six degrees of separation etc, everyone wants to know your interests, ip, os, browser, email, phone numbers, address, friends, contacts, social graph influence. The more data sources the easier to correlate and aggregate. Just an example of visible usage - Amazon will give you different price depending on who it 'thinks' you are.

[cbr]

    associate a fresh newly installed system / browser / ip
    with a trace of crumbs you usually leave on the network

Again, I totally agree this is possible, but I haven't seen any evidence that they're doing it. If they were doing this they'd be using it for something, but it's not visible in any of the public products. For example, the company in the article you linked to, Drawbridge, talks about cross-device tracking as something they could sell to advertisers.

    Everyone is doing it, Google, FB, Amazon all have acres
    of server farms grinding such data.

"Everyone is doing it" is very different from "everyone is in a position to do it". If you have some evidence that a big reputable company, like the three you mention here, actually is "identifying you even when you are not logged in and browse in private mode with no cookies" I would love to see it.

    Google even offers free DNS servers just to
    collect more of it.

The privacy policy for Google's DNS [1] says "Google Public DNS does not permanently store personally identifiable information." Do you think they're not following the policy?

    Amazon will give you different price depending on who
    it 'thinks' you are.

Really? Some looking turns up Bezos saying "We've never tested and we never will test prices based on customer demographics." [2] (Even then, dynamic pricing is way less invasive than trying to connect User-A to User-A-In-Incognito-Mode.)

[1] https://developers.google.com/speed/public-dns/privacy [2] http://abcnews.go.com/Technology/story?id=119399

[gcr]

> "Google Public DNS does not permanently store personally identifiable information."

That depends on their (possibly very narrow) definition of which information is personally identifiable.

[jwatte]

I would be surprised if Google didn't use per-ip reputation and targeting at some level of their stack.

[cbr]

Like in DOS blocking? I'd expect that too. But this doesn't sound like the kind of thing rasz_pl would object to?

[jwatte]

Note that browser fingerprinting is a good thing for those fighting online fraud (such as credit card chargebacks.)

[jacquesm]

Credit card chargebacks are not always fraud.