Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Am I logged in or not? GDPR case study on the example of Chrome browser change

blog.lukaszolejnik.com

Post reply on HN
Print view View original

171–180 of 507 posts

Re: Am I logged in or not? GDPR case study on the example of Chrome browser change

#171

Post by rhizome »

tedivm wrote: post #3

I don't understand why the Chrome team is picking this hill to die on- their team (managers and developers) are all over twitter and reddit trying to explain the privacy violations away as if the people upset about this are just not understanding what's going on. I really expect this change to push a lot of people away from Chrome, and frankly I wouldn't be surprised if it started opening up more antitrust possibilit…

Because they have business requirements that depend on people using this feature.

Re: Am I logged in or not? GDPR case study on the example of Chrome browser change

#172

Post by ngngngng »

LiterallyDoge wrote: post #116

It's just about respect. If you don't give your users a heads-up when you go to collect significant information about them, and then when they try to opt out, you cripple their browser, you do not respect them. I'm done with Google products.

I want to be done with Google products. But some of them are just so damn good. (Typed on my Pixel 2 XL)

Re: Am I logged in or not? GDPR case study on the example of Chrome browser change

#173

Post by RaleyField »

lrem wrote: post #126

As a Googler with no connection to the Chrome team: I'm pretty sure they made this change in good faith and are shocked people don't like it. Just imagine yourself in their shoes: wouldn't your first instinct be to explain yourself?

> I'm pretty sure they made this change in good faith

I'm not sure. Not one person in the entire chrome team raised their hand and explained that some users expect their browser to firewall web pages from the browser itself and to keep neutrality and not privilege some (first party) web pages?

Re: Am I logged in or not? GDPR case study on the example of Chrome browser change

#174

Post by tetha »

testvox wrote: post #141
Spearchucker wrote: post #103

Earlier quoted context omitted.

If an IP can be tied to a data subject's identity it's PII. If it can't, it's not. This isn't a debate.

So the answer is yes, they are PII. But that doesn't actually answer the question of whether or not collecting them without consent is illegal under the GDPR > “Processing shall be lawful only if and to the extent that at least one of the following applies: […] (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overri…

I'm currently thinking with a blue security mindset. I'm currently wondering if there is a difference between tracking an abstract attacker of my network, and tracking a person attacking my network.

Put in a blunt way - Looking at my logs, I am not trying to identify Mr William Butterscotch living at 22nd tower street, third floor, second door on the right. I'm trying to figure out if a set of IPs is actively scanning or ddos'ing my systems. Especially because these IPs might actually not be connected to any human at all - think of botnets just roaming the ipv4 space.

Re: Am I logged in or not? GDPR case study on the example of Chrome browser change

#175

Post by bduerst »

floatboth wrote: post #168
bduerst wrote: post #46

Earlier quoted context omitted.

DuckDuckGo doesn't really do it's own indexing, it's essentially just a reskin of Bing search.

It actually uses multiple sources for regular results, not just Bing: > from a variety of partners, including Oath (formerly Yahoo) and Bing https://duck.co/help/results/sources I remember Yandex being one of the sources as well.

Yahoo now uses Bing. Yandex is basically indexed Russian pages.

So unless you're searching in Russian, DDG is essentially a reskin of Bing search.

Re: Am I logged in or not? GDPR case study on the example of Chrome browser change

#176

Post by seqizz »

joshuamorton wrote: post #156
pg_bot wrote: post #143

Earlier quoted context omitted.

Shock and Denial is the first stage in the 7 stages of grief. The chrome team is clearly in the wrong here, and it will take some time for them to realize that they screwed up and that they need to fix it.

I also work at Google though have nothing to do with Chrome. This isn't "clear" to me. There are certainly complaints about this change within HN, but there are also people here saying that they appreciate the change, or that they're ambivalent. But the more important part of things is that HN has what, maybe 10000 active users? Chrome has over a billion. Even if every HN commenter was vehemently against this change,…

Wait, could a change be "better" if a (somewhat) random example group of 10k users are agreed the change is bad.

I am sorry but "abnormal users" is just funny. Who is "normal" and cares about privacy?

Re: Am I logged in or not? GDPR case study on the example of Chrome browser change

#177

Post by SippinLean »

kerng wrote: post #164
SippinLean wrote: post #161

Earlier quoted context omitted.

Safari is the new IE, Chrome has been responsible for a huge number of positive changes in the browser landscape. I develop in Chrome because that's where the majority of our conversions come from. I (my QA team) also tests Safari, Firefox and other browsers where a significant number of conversions come from. I never heard "just use chrome" in any professional environment.

Same was true for IE, IE for instance pioneered asynchronous requests (which is pretty much the norm these days) and things like that - still was a bad browser though.

That's one point of comparison that glosses over Chrome's compliance with standards in stark contrast to IE.

Re: Am I logged in or not? GDPR case study on the example of Chrome browser change

#178

Post by pg_bot »

joshuamorton wrote: post #156
pg_bot wrote: post #143

Earlier quoted context omitted.

Shock and Denial is the first stage in the 7 stages of grief. The chrome team is clearly in the wrong here, and it will take some time for them to realize that they screwed up and that they need to fix it.

I also work at Google though have nothing to do with Chrome. This isn't "clear" to me. There are certainly complaints about this change within HN, but there are also people here saying that they appreciate the change, or that they're ambivalent. But the more important part of things is that HN has what, maybe 10000 active users? Chrome has over a billion. Even if every HN commenter was vehemently against this change,…

Perhaps I can clarify why this was a terrible decision.

As written this feature enables special privileges unavailable to other website developers via a direct integration with the browser. Imagine if some other company automatically added a feature directly to your browser without your consent. You would be rightfully angry if there was a yahoo/facebook/microsoft widget that you didn't approve being added to your toolbar. What's stopping the chrome team from adding more features to blur the line between the browser and google services?

There are boundaries between websites, browsers, and users that should not be violated. This is nothing more than google putting their thumb on the scale to unfairly influence user behavior in their interest.

Re: Am I logged in or not? GDPR case study on the example of Chrome browser change

#179

Post by jjcm »

kerng wrote: post #164
SippinLean wrote: post #161

Earlier quoted context omitted.

Safari is the new IE, Chrome has been responsible for a huge number of positive changes in the browser landscape. I develop in Chrome because that's where the majority of our conversions come from. I (my QA team) also tests Safari, Firefox and other browsers where a significant number of conversions come from. I never heard "just use chrome" in any professional environment.

Same was true for IE, IE for instance pioneered asynchronous requests (which is pretty much the norm these days) and things like that - still was a bad browser though.

I think the difference is that IE stopped innovating once they had the market cornered. Chrome is continously on the cutting edge of features and specs, even after it became the #1 browser.

Re: Am I logged in or not? GDPR case study on the example of Chrome browser change

#180

Post by joshuamorton »

allenz wrote: post #167
joshuamorton wrote: post #156

Earlier quoted context omitted.

I also work at Google though have nothing to do with Chrome. This isn't "clear" to me. There are certainly complaints about this change within HN, but there are also people here saying that they appreciate the change, or that they're ambivalent. But the more important part of things is that HN has what, maybe 10000 active users? Chrome has over a billion. Even if every HN commenter was vehemently against this change,…

What's the point of signing in at all for users who don't use sync?

(if my understanding is correct)

Consider the case of two users, Alice and Bob. Alice has sync enabled, Bob does not.

Bob wants to check his email on Alice's computer, so he logs Alice off and logs into to his account. This syncs across all website he visits (due to shared auth cookies), but doesn't sync to the browser itself. Chrome is still logged into Alice's account, so Bob's browsing history is synced, but to Alice's history. This can have any number of unwanted consequences, from privacy consequences to Bob depending on whether or not you think Alice or Google are bad/compromised, to weirdnesses for Alice when she tries to check her history again.

Post this change, Bob logging in to Gmail on Alice's computer will log out of Alice on Chrome, and log in to Bob, meaning that Bob's history is no longer synced. So for Bob, this is a privacy increase (since now Google and Alice have less access to his browsing history) in that situation, and a usability improvement for Alice.

You could maybe get a similar effect by having account consistency be a thing that always logs the current user out and only also logs you in if you opt in, but that can also I think lead to weird situations for everyday users.

In other words, the point of signing in is to make sure no one else can accidentally (or intentionally) siphon away your browsing history.

Post reply on HN