ip-protection

>Hi, connections through the proxies are encrypted multiple times to prevent Google from being able to access browsing data. In particular, the connection client-website is end-to-end encrypted, and so are the client-proxyA and client-proxyB connections. Because of this, the proxyA (operated by Google) will only be able to see the client IP address but won't be able to know which website is visited. The proxyB (operated by a partner) will be able to see the hostname of the website, but it won't know which client IP is accessing it. Neither proxy can see the URL nor the data due to the end-to-end encryption. With this design, no one - not even Google - can see who visited what website. Regarding log retention for the very limited information that we do have, let me confirm things internally and circle back. https://github.com/GoogleChrome/

This is not a user first approach. Ad tech heavily relies on IP address for fingerprinting. Chrome will eventually implement IP Protection for incognito users. I believe Chrome originally planned to roll out IP protection for all users. https://github.com/GoogleChrome/ip-protection?tab=readme-ov-...

Quite amusing to see Google’s own tracking domains in the initial list [1] of domains they’re going to apply this to. [1]: https://github.com/GoogleChrome/ip-protection/blob/master/Ma...

Seems like a step in the right direction. There are a bunch of considerations: - It's only a proposal - It only applies to domains in what they call the Masked Domain List (MDL), see [1] - The masked IP will be in the same country and same "coarse location" as your actual IP - It applies "when users are signed into their Google account in the Chrome browser before starting an Incognito session." 1. https://github.com/GoogleChrome/ip-protection?tab=readme-ov-...

Well, I mean, Google is planning that for all Chrome users: https://github.com/GoogleChrome/ip-protection

As justinclift points out elsewhere in this discussion, the article may have misreported that: > We are considering using 2 hops for improved privacy. A second proxy would be run by an external CDN, while Google runs the first hop. This ensures that neither proxy can see both the client IP address and the destination. — https://github.com/GoogleChrome/ip-protection#core-requireme... If they choose to go ahead with the second hop it would be the same as Apple’s approach. But it sounds like this has not been committed to yet.

Reading the front page the of GitHub repo with the Chrome "IP Protection" source code, it has this worrying statement: We are considering using 2 hops for improved privacy. A second proxy would be run by an external CDN ... https://github.com/GoogleChrome/ip-protection "Considering" means "we're thinking about it, but it's in no way final". Sounds like Google could implement a proxy solution but decide the 2nd hop for improved privacy isn't needed after all. Or make it optional, defaulting to OFF, etc.

Yes, but it’s end-to-end-encrypted. See https://github.com/GoogleChrome/ip-protection/issues/10 for example. Of course, Google can conceivably backdoor Chrome, and then the exfiltration of data wouldn’t be obvious from the client-side traffic.

Looks like TLS will encrypt traffic end to end, but plain HTTP would travel in the clear. https://github.com/GoogleChrome/ip-protection#core-requireme...

Nope, per the proposal [0] linked in the article: > the proxy and network intermediaries are not privy to the contents of the traffic [...] There is an end-to-end encrypted tunnel via TLS, from Chrome to the destination server. [0] https://github.com/GoogleChrome/ip-protection#core-requireme...