security implications of /var/lib/dbus/machine-id. Thoughts?

Originally Posted by cynwulf which is why we hash it first and then encode it in base64 before transmitting it.

Yes, that's clearly not in line with the spirit of that "guideline", but no matter what you do with this, google will still find ways to identify you, because that's who they are, and what they do.

Originally Posted by GazL Yes, that's clearly not in line with the spirit of that "guideline", but no matter what you do with this, google will still find ways to identify you, because that's who they are, and what they do.

And they can do it easily with or without this file...

Originally Posted by kgha Works for me. Personally, I'm not that worried of what Google and other corporation might do with my identity (which they have, since I use an Android smartphone). I imagine that I can handle them. I reserve my tin foil hat for intrusions from various national security services. In the near future, getting a new smartphone or PC might mean hosting preinstalled spyware unbeknownst to me. And without pop-up ads.

OT, but I cannot resist...

https://www.youtube.com/watch?v=urglg3WimHA

..."Foil" by Weird Al.

"Just because you're paranoid, doesn't mean they aren't out to get you."

Originally Posted by upnort With some idle moments I fiddled with /var/lib/dbus/machine-id and not regenerating the file. Deleting the file, setting to zero size, or 32 zeroes results in X not launching with startx. The dbus-uuidgen man page states: "The important properties of the machine UUID are that 1) it remains unchanged until the next reboot and 2) it is different for any two running instances of the OS kernel." The first condition implies that regenerating at each boot is safe. As dbus is for IPC and not interhost communication, a sweet summer child view is the file should not be used by other software for non IPC purposes. Yet since the location of the file is well known, nothing stops other software from using the file as a fingerprint. Regenerating at each boot probably throws some sand into data mining and tracking gears, but even Slackware uses and needs the file.

If someone is concerned by machine-id there are two ways:

1

Share a machine-id spreaded on the net i.e. I generate a machine-id with a live distro I put the id on the net and everyone can overwrite the original machine-id with that supplied.

D-bus is stupid and don't give a s... if you have faked it so who uses machine-id to fingerprint will get million equals machine-id's hard to associate something to a single machine and consequently to a single user

2

Delete machine-id file on shutdown.
The system will generate an always different machine-id at every boot.

Simply add to "/etc/rc.d/rc.6" the command "rm /var/lib/dbus/machine-id" after the line which stops dbus.

Both solutions works flawlessly with Slackware 14.2 & SalixOS