Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Am I logged in or not? GDPR case study on the example of Chrome browser change

blog.lukaszolejnik.com

Post reply on HN
Print view View original

321–330 of 507 posts

Re: Am I logged in or not? GDPR case study on the example of Chrome browser change

#321

Post by colordrops »

ewjordan wrote: post #306
SmellyGhost wrote: post #88

Earlier quoted context omitted.

Here's one: https://twitter.com/__apf__/status/1044109217903198210

Yeah...and that thread says that the change is basically nothing, just a UI indicator: > Q: I don’t get, though — if you’re signed in to the browser but sync is off, then what does it mean to be signed in to the browser? What does it do besides sync? > A: Not much, you can think of it like a Gmail login state indicator. If that's fully the case, then there's nothing to see here and people are freaking out over nothin…

It's almost a certainty that they will continue down the slippery slope and start syncing data automatically in a future update. That sort of change has happened several times, so there is precedent.

Re: Am I logged in or not? GDPR case study on the example of Chrome browser change

#322

Post by pixl97 »

Sargos wrote: post #107
jonbronson wrote: post #38

Earlier quoted context omitted.

The lesson to companies should be, don't provide a Hobson's choice up front like this. Offer the webpage you meant to offer, and simply don't try to nickel and dime all the data out of your visitors.

So just kill the free and open internet and bring back the walled garden model of the mid 90s where you paid for website packages like you did for cable TV? That's not a future I want to live in. Europe is playing a dangerous game with the internet right now and I don't think they have enough tech-minded people in power to keep things sane and in check.

Free and open*

*conditions apply: everything you say and do is tracked by a multitude of companies and poorly secured.

Re: Am I logged in or not? GDPR case study on the example of Chrome browser change

#323

Post by airstrike »

ethbro wrote: post #309
buybackoff wrote: post #284

Earlier quoted context omitted.

These last couple of comments were probably some exaggerating pun... But after this story I was running privacy checkup, surprisingly found that my location history was on (after turning it off several times long before, which is a separate question why it turns on), turned it off again and then got 404 when trying to delete it. All this in a labyrinth of often circular links without much clue where the actual switch…

(A year later) 'Over 90% of our users don't choose to turn these settings off. So we made on the default and removed the option.' ... We passed the point where dark UX patterns deserved the benefit of doubt a few years ago. If it benefits the company, it's intentional.

This thread got progressively more accurate and more depressing at additional comment

Re: Am I logged in or not? GDPR case study on the example of Chrome browser change

#324

Post by tokyodude »

sea6ear wrote: post #283
dantheman wrote: post #89

Earlier quoted context omitted.

Because almost every user in the world wants it connected.

I've been in at least 2 corporate positions where there were strong reasons to separate your personal environment and your professional environment. I do not want synced browsers between my two environments. This change makes it inordinately difficult to maintain that separation while utilizing other parts of the google ecosystem.

I use two profiles for that.

Re: Am I logged in or not? GDPR case study on the example of Chrome browser change

#325

Post by quickben »

rifung wrote: post #295
tedivm wrote: post #3

I don't understand why the Chrome team is picking this hill to die on- their team (managers and developers) are all over twitter and reddit trying to explain the privacy violations away as if the people upset about this are just not understanding what's going on. I really expect this change to push a lot of people away from Chrome, and frankly I wouldn't be surprised if it started opening up more antitrust possibilit…

I work at Google; opinions are my own. > I don't understand why the Chrome team is picking this hill to die on- their team (managers and developers) are all over twitter and reddit trying to explain the privacy violations away as if the people upset about this are just not understanding what's going on. My impression is that this is the new norm at Google. It happens with everything, internal or external. The sad rea…

Use checkboxes?

Re: Am I logged in or not? GDPR case study on the example of Chrome browser change

#326

Post by CrendKing »

joshuamorton wrote: post #180
allenz wrote: post #167

Earlier quoted context omitted.

What's the point of signing in at all for users who don't use sync?

(if my understanding is correct) Consider the case of two users, Alice and Bob. Alice has sync enabled, Bob does not. Bob wants to check his email on Alice's computer, so he logs Alice off and logs into to his account. This syncs across all website he visits (due to shared auth cookies), but doesn't sync to the browser itself. Chrome is still logged into Alice's account, so Bob's browsing history is synced, but to Al…

Bob's browsing history is synced, but to Alice's history

I agree with you that this would upset Alice when she wants to check her personal browsing history. But isn't that the innate consequence of sharing your own computer with other persons? It is the same as Alice lending her MacBook to Bob without logging out herself first. Can't Alice simply log out her Chrome before giving to Bob?

Bob logging in to Gmail on Alice's computer will log out of Alice on Chrome, and log in to Bob

Why should Gmail (or any Google service) be so special? If Bob log in to his Outlook account, shouldn't the same treatment happen (which clearly indicate a persona switch)? It is clear that Google is using its monopoly power between Google services and Chrome to reinforce the bond between "average users" and itself. Imagine if Chrome dwindles at ~10% market share instead. Do you ever think the Chrome team would have done this feature?

Re: Am I logged in or not? GDPR case study on the example of Chrome browser change

#327

Post by Sidnicious »

ewjordan wrote: post #303

I'm still not clear about what the actual change in behavior even is - seeing some statements on Twitter from someone on the dev team, it sounded to me like there isn't actually any difference, just a UI change to show which Gmail account is currently logged into. If that's really all it is, I don't really get what people are upset about. Specifically, if there's no additional data being stored connected to your acco…

I work at Google, but all statements/opinions are my own.

My understanding is that there were two changes:

1. General responsibility for authenticating to Google services has been moved to Chrome, and being logged into Google is equivalent to being logged into Chrome. If sync is set up, logging back into Google also fixes your sync session, if it was broken (common — the warning in the toolbar is easy to ignore).

2. Sync has been separated from login as a Chrome feature, so that you can log into Google services without syncing Chrome’s data.

Confusion between being logged into Google (the Chrome new tab page looks a heck of a lot like the Google home page) and being logged into Chrome was a real problem. I’m not suggesting that this is the right solution… or the wrong one; this is weird territory.

It raises a question for both users and browser vendors: What does it mean to be logged into a web browser?

Re: Am I logged in or not? GDPR case study on the example of Chrome browser change

#328

Post by 0x54D5 »

rifung wrote: post #295
tedivm wrote: post #3

I don't understand why the Chrome team is picking this hill to die on- their team (managers and developers) are all over twitter and reddit trying to explain the privacy violations away as if the people upset about this are just not understanding what's going on. I really expect this change to push a lot of people away from Chrome, and frankly I wouldn't be surprised if it started opening up more antitrust possibilit…

I work at Google; opinions are my own. > I don't understand why the Chrome team is picking this hill to die on- their team (managers and developers) are all over twitter and reddit trying to explain the privacy violations away as if the people upset about this are just not understanding what's going on. My impression is that this is the new norm at Google. It happens with everything, internal or external. The sad rea…

That 0.1% doesn't take into account hours spent using the actual app. Power users tend to spend all day in a browser whereas a typical grandma might look at it for 15 minutes and close it. Meanwhile people who have multiple Google accounts and who spend literally all day in the browser are the ones that get the short end of the stick? That makes zero sense and it's why people are starting to hate Google just like any other corporation that makes decisions by committee. There should have been a product owner on the browser team that said "No this is a browser. Not an extension of GSuite."

The total indifference to people's valid use cases is what really grinds my gears.

Chrome is still the only browser that ruins my UX by putting a profile picker into the title bar. A place it has no business being. I literally made a patch and compiled my own version of Chromium for a while to get rid of it. https://github.com/hparadiz/chromium-disable-profile-button-...

I'm so tired of the arrogance. Chrome used to be a beautiful simplistic browser. Now it's just bloat. I'm done. Get off my computer. You guys had your chance and blew it.

Re: Am I logged in or not? GDPR case study on the example of Chrome browser change

#329

Post by manigandham »

pritambaral wrote: post #268
manigandham wrote: post #162

https://twitter.com/__apf__/status/1044109898013765632 > My teammates made this change to prevent surprises in a shared device scenario. In the past, people would sometimes sign out of the content area and think that meant they were no longer signed into Chrome, which could cause problems on a shared device I can see why there is pushback against this, but the issue described above is also understandable. There are v…

Except this doesn't actually "prevent surprises in a shared device scenario" for the web, in general; it does for Google sites and services only. Logging in to Facebook or Amazon or my personal blog does not show up as a browser indicator, nor does logging out of the browser also log one out of Facebook or Amazon or my personal blog. This makes Chrome less of a browser and more of gateway to Google services that happ…

Yes, but as I said, most people probably do consider it a single gateway to all of their Google services, browser included.

The big difference is that your Chrome account is your Google account, unlike any of the other sites you mention.

Re: Am I logged in or not? GDPR case study on the example of Chrome browser change

#330

Post by glandium »

pritambaral wrote: post #268
manigandham wrote: post #162

https://twitter.com/__apf__/status/1044109898013765632 > My teammates made this change to prevent surprises in a shared device scenario. In the past, people would sometimes sign out of the content area and think that meant they were no longer signed into Chrome, which could cause problems on a shared device I can see why there is pushback against this, but the issue described above is also understandable. There are v…

Except this doesn't actually "prevent surprises in a shared device scenario" for the web, in general; it does for Google sites and services only. Logging in to Facebook or Amazon or my personal blog does not show up as a browser indicator, nor does logging out of the browser also log one out of Facebook or Amazon or my personal blog. This makes Chrome less of a browser and more of gateway to Google services that happ…

Maybe they want every site to use Google for authentication? If that's their wish, then I so much wish Mozilla hadn't failed with BrowserID.
Post reply on HN