/etc/machine-id seems to be a random value. What purpose does hashing it before sending it do? The hash should still uniquely identify a machine. Am I missing something? Kind of makes me think that it's just done so people say "it's ok, because they're hashing it first, so it's secure!", while in reality hashing doesn't do anything to alleviate any concern.
The source code links https://www.freedesktop.org/software/systemd/man/machine-id.... mentions hashing using an "application-specific key", which would at least make it not correlatable between different apps (so $WEBSITE can't correlate machine IDs with $WELL_BEHAVED_APP 's machine IDs.)
But either I'm missing something, or Chromium is - it looks like it's straight up hashing the file and not actually using any application-specific keys!
If it's sending that value out, then there is no logical difference between that and just sending out the machine-id in the first place.
Interestingly for Windows they pull the machine id from the registry[1] and (at first glance) it doesn't seem like they're doing any hashing. The raw value gets used.
Haven't checked if the value gets sent externally but based upon the comment on the Linux code I'd bet it's a yes.
[0]: https://github.com/chromium/chromium/blob/aae20fb7d3616de40e...
[1]: https://github.com/chromium/chromium/blob/01a03aab2d89c93c15...