News for hackers. Stuff that matters.

A comment on Devuan considers machine IDs. Parent comment

Re:Devuan considers machine IDs by jolmg on Saturday March 30, 2019 @01:28PM (#19530627)
> I checked the Chromium source and for Linux they explicitly mention not being allowed to send it externally[0]; they hash it via SHA1, encode it as base64, and use that value.

/etc/machine-id seems to be a random value. What purpose does hashing it before sending it do? The hash should still uniquely identify a machine. Am I missing something? Kind of makes me think that it's just done so people say "it's ok, because they're hashing it first, so it's secure!", while in reality hashing doesn't do anything to alleviate any concern.

[ Parent | on HN ]
Re:Devuan considers machine IDs by MaulingMonkey on Saturday March 30, 2019 @02:15PM (#19530851)
> Am I missing something?

The source code links https://www.freedesktop.org/software/systemd/man/machine-id.... mentions hashing using an "application-specific key", which would at least make it not correlatable between different apps (so $WEBSITE can't correlate machine IDs with $WELL_BEHAVED_APP 's machine IDs.)

But either I'm missing something, or Chromium is - it looks like it's straight up hashing the file and not actually using any application-specific keys!

[ Parent | on HN ]