Chrome browser bringing an IP address privacy tool to Incognito
48 comments
·February 13, 2025merek
Seems like a step in the right direction. There are a bunch of considerations:
- It's only a proposal
- It only applies to domains in what they call the Masked Domain List (MDL), see [1]
- The masked IP will be in the same country and same "coarse location" as your actual IP
- It applies "when users are signed into their Google account in the Chrome browser before starting an Incognito session."
1. https://github.com/GoogleChrome/ip-protection?tab=readme-ov-...
Timshel
Kind of as long as they can track you, it's good if others cannot.
Xunjin
That was my thought, why not allow this feature without the need to login in a Google account?
gruez
It's answered in the document:
>IP Protection will use client authentication to limit the ability of bad actors to leverage the proxies to amplify attacks on services on the Masked Domain List. Therefore, IP Protection will only be available to users that have been authenticated using the Google account they're signed in with in the Chrome browser prior to opening a new Incognito window.
lozenge
Because your use of a proxy is governed by certain terms, and you agreed to them by signing up to a Google account and signing into Chrome?
kobalsky
because it's not realistic to provide a proxy service without ensuring that the users are legitimate due to abuse, it would be like running a tor exit node.
there's no ethical way for Google to provide this service, they just shouldn't.
pluc
Because Google is an American corporation and as such will never do something that solely benefits its users and not also itself.
orphea
Exactly. It doesn't seem it has anything to do with user privacy. Google just tries to keep tracking data for themselves only.
reaperducer
Does Apple's IP hiding feature work without an iCloud login? I'm not at my computer, so I can't check.
imglorp
Yes. This is merely another stab at competition while increasing their own user activity profile corpus.
It's so transparent and ludicrous, at first I thought it was an Onion or April Fools post.
lordofgibbons
> when users are signed into their Google account in the Chrome browser before starting an Incognito session
Sounds like this is just another attempt by Google to gather the data for itself but make it harder for other advertisement companies.
gruez
What's the data that google is gathering? It doesn't even get what site you're visiting because the traffic is proxied to a CDN partner.
lordofgibbons
By using this, It gets your IP because you have to sign into Google. But other advert platforms don't get your IP
everdrive
How many websites really track by IP? Specifically when using Chrome? My understanding is that whether intentional or not, Google has done just about everything possible to make Chrome easier to fingerprint and track. I cannot imagine a new IP privacy tool doing anything to increase privacy for users, not merely increase website’s reliance on the other tracking methods built into Chrome.
crazygringo
> My understanding is that whether intentional or not, Google has done just about everything possible to make Chrome easier to fingerprint and track.
Can you provide any evidence about this in incognito mode though, specifically?
I'm not aware of a single thing Google has done to make incognito mode tracking easier.
People aren't doing most of their browsing in incognito, so it's not going to be something Google cares much about tracking you in.
Or to be more blunt -- your porn preferences aren't a valuable signal to know what clothing or car ads to show you.
dboreham
There's definitely some of it. Even on a subnet level. I know this because formerly I ran a small ISP where several of my neighbors were using our service, and hence were assigned IP addresses in the same small subnet. There were several cases of advert bleed over between homes (person in home A buys thing X and hey presto ads are served for thing X in home B).
xrisk
Quite amusing to see Google’s own tracking domains in the initial list [1] of domains they’re going to apply this to.
[1]: https://github.com/GoogleChrome/ip-protection/blob/master/Ma...
diggan
It's a great idea (from Google's POV) because then they can claim "Look, we also hide users IP from our own service!" which sounds great in marketing material, and not many will realize that it doesn't matter since the user is logged in with their Google account in Chrome so Google already have the data, this is just about hiding the data from companies that aren't Google.
drawfloat
I assume it's the same catch as cookies – Google doesn't need it, their competitors do.
molticrystal
Chrome improves IP privacy like they improved ad blocking and tracking with manifest v3. I'll stick to a chromium fork or librewolf and handle any IP privacy needs on my own, thank you.
ddtaylor
Bootleg K-mart version of Tor that Google thinks is private enough.
ripped_britches
Unless you’re a criminal, Tor is overkill for normal browsing and definitely painful to use. So probably an unfair comparison.
wutwutwat
Don't dirty the good name of k-mart's bluelight internet by lumping it in with this nonsense
rasengan
> No single proxy can see the origins that clients interact with and the clients' original IP address.
Wait, double hop is privacy theater in this case. If you control all the proxy gateways it doesn’t matter if you hop around them.
Even Apple’s privacy is technically more so than this although that’s not saying much. There are two entities in their mix — but a simple collusion between the two entities ends that privacy too.
topranks
They say they are outsourcing the second-hop proxy to a third party.
zarzavat
A third party that is paid by the first party is not much different from a first party.
It does seem like privacy theatre, anonymity protocols like Tor are carefully designed to make malicious cooperation difficult.
brookst
> A third party that is paid by the first party is not much different from a first party.
This is true from a technical trust perspective, but less true from a legal liability perspective.
If company A sells a product to users with the promise “it will be delivered by company B and we have no knowledge of what you do with it”, and then it turns out there the two companies had an agreement to share data and void that promise, company A is in for a world of hurt when the truth comes out.
Given the small number of people who are aware of and care about this stuff, it would be so much less expensive and less risky to just skip the lies in the first place.
What’s the upside of an elaborate architecture that is all window dressing, which creates a ton of liability, and which fraud likely to be discovered because it’s all written down in code and contracts?
null
null
delfinom
Google automatically MITM proxying incognito mode users surely won't end in tracking abuse by Google.
Surely.
westmeal
Hey the Google guy said something about not being evil. You think people would just lie?
null
Xunjin
I really don't understand why you were being downvoted, I do understand the snarky remark you did, but it ain't far from the truth.
gruez
"MITM proxying incognito mode" is so far from the truth. Google doesn't get the plaintext contents, unlike typical MITM. They don't even know what site you're connecting to because your traffic is sent encrypted to a CDN partner.
ulrikrasmussen
I want to like this, but I cannot possibly trust anything privacy related added to Chrome as long as Chrome is developed by the same company whose core business is to collect as much data about me as possible.
null
maineagetter
[dead]
> This protection applies [...] when users are signed into their Google account in the Chrome browser
Interesting scope. Wouldn't the people who don't log in with a Google account be the ones who care most about this feature?