4

In Chrome, I delete all cookies and site data. I close the browser and re-open it. I double check that All Cookies and Site Data is a blank list.

I type https://mail.google.com/ into the address bar. I'm redirected to a long URL starting with accounts.google.com, and I can see that 3 cookies are set - one from google.com, two from accounts.google.com.

I enter my gmail address and click Next.

The page refreshes, showing a non-generic profile picture, with a balloon saying "We'll only personalize this page when you're signing in from a familiar device or location."

How exactly do they decide that my device or location is "familiar"?

Is it based on IP? On IP geographic location? Are they browser-fingerprinting all my computers?

  • I'm using Chrome
  • I am not signed in to Chrome
  • My home page is chrome://newtab/
  • 1
    You can view your logon history from IP addresses, so we know that is tracked. I assumed it was just this, but theoretically Google could include browser metrics, which are surprisingly more unique than you might think, like specific version of Chrome with particular extensions enabled, screen resolution, etc. Then you could have two NAT'd device where one is "familiar" to Google, one is not. – armani Oct 28 '15 at 21:39
  • This is a question for Google. – schroeder Oct 28 '15 at 21:39
7

It appears to be based on your IP address and browser cookies.

According to a Google FAQ page:

To help make sign-in easier and more personal, you may see a screen with your profile picture and full name when signing in to Google. We’ll only show this information if you are signing in from a location or device you’ve signed in from before, like your home computer.

I tried entering my email into a VM that I've never used to log into my Google account (but has the same external IP address) and the Google account page still showed my profile picture.

I don't think it is by an IP's geographical location because multiple IP addresses may point to the same location. I've also used other networks (with different IPs) in close proximity to mine and had my device not be flagged as familiar.

I believe cookies are also used - I used to clear all cookies on browser close, resulting in my device not being marked as familiar in new locations (allowing me to make the observations above). Since I allowed cookies to persist, I noticed that my device was marked as familiar even though I logged in from a different location that I've never used before.

Summary of my observations:

Familiar devices are determined based on:

  1. IP address (but not geographic location).
  2. Browser cookies.
  • 2
    I think that the fact you tried a virgin VM with the same external IP address answers the question. – MM. Oct 29 '15 at 0:22
3

Familiar is a very loosely based word. When companies like Google say familiar they're normally talking about artificial intelligence deciding it is confident enough that it has seen enough patterns to decide that the machine you're using right then is one that they have seen you use before.

Do keep in mind that using Google Chrome for Google is the same as using Microsoft windows for Microsoft. It's literally their own little Disneyland where they can do basically whatever they want. Because of that, they get access to things that arent typical browser methods that they're able to get your information from. Sometimes it's a browser signature or sometimes it's your IP addresses coordinates.

I don't think they would release this information specifically because it pushes the creepy factor but in terms of computer science it's a tremendous revolution. I could verify you with patterns such as your movement patterns of the mouse, how your typing patterns look (forget keylogging, the speed of keys typed is enough to be unique), how you scroll through the page, where you like to hover the mouse when you're reading, there are a lot of ways to watch someone that make it so if you combine them all together it really does make you an individual who can be identified in a crowd.

If you go to chrome://flags you'll get a little better of a perspective of the information that is collected within the browser besides just the cookies. In the histograms section, you'll find analytical data towards the satisfaction of the searches that you made and all sorts of other data points that would make a data scientist smile.

Long story short, artificial intelligence and data science have grown far beyond cookies.

2

I would disagree with the accepted answer here. The two reasons given were IP address and browser cookies but some simple testing will show that the picture is much more complicated than that.

  1. Public IP addresses change all the time; using your laptop at a coffee shop will not trigger a warning as described by the author.
  2. Browser cookies are a bit simplistic for something like Google. Additionally if you open a private browsing window with any browser, cookies are not transferred. If you try to access Google you will again not trigger this warning.

The real story is much more complicated. Building on what @codykochmann wrote, I would take a look at the Panopticlick tool by the Electronic Frontier Foundation, especially the fingerprinting section. It is likely that a combination of factors are used by Google to figure out who exactly you are and this tool indicates what those might be.

While IP address is likely taken into account during the flagging process, it is only one factor among many that Google would use to track where you're logging in from.

0

They are using lots of static device features (sometimes called cross browser fingerprinting) and browser features. In that way they can model your login pattern based on your device fingerprinting plus location.

Some might say that location which is IP in that case could be misleading, but the thing is if you have enough data for a user, you can easily use external ip usage because ARN's are fixed for ISP's.

  • Other answers talk about browser fingerprinting. This does not answer if a location is familiar. Can you expand on what you mean by your second paragraph, especially in the light of the situation explained in the question?\ – schroeder Mar 18 at 8:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.