Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Never connect to ProtonMail using Chrome

old.reddit.com

Post reply on HN
Print view View original

111–120 of 289 posts

Re: Never connect to ProtonMail using Chrome

#111

Post by [deleted] »

anfilt wrote: post #62
moderation wrote: post #42

Earlier quoted context omitted.

I've seen a number of comments about http/2 and http/3 being driven by Google. The ideas originated there (SPDY and QUIC respectively) but in both cases many different entities backed the ideas and formulated specifications in IETF settings. I'm not sure I buy that somehow Google managed to hoodwink the people that toiled on these specifications in a non-Google environment and managed to influence them in such a way…

It's just an example of how much weight Google is able to throw around. That's a just one part of what would be needed for a browser. The more parts you add the harder it becomes to build a browser. Also I have read about QUIC there are some things that are interesting about it. However, there are things that I don't like. Moreover, this was something I read from IETF mail archive: "That QUIC isn't yet proven. That's…

[deleted]

Re: Never connect to ProtonMail using Chrome

#112

Post by cromwellian »

When I visit a website in a foreign language I've never translated before, Chrome asks my permission to translate the site, it doesn't do so automatically. You could argue they could give you more details on what it will do when you click the 'Translate' button, but to argue they shouldn't offer the feature as a permission-requested option at all seems pretty extreme.

I read a lot of foreign websites, and the built-in translate feature (which you can request in the right-click menu, or from the Toolbar) is a life saving feature, like, literally, I've been traveling, and Chrome built-in ability to translate helped in a medical emergency.

Re: Never connect to ProtonMail using Chrome

#113

Post by Maxion »

cpv wrote: post #71
rinchik wrote: post #10

If you care about privacy these days: Remote self-destructible VM for browsing with Firefox in incognito mode (only sites you NEED to, that REQUIRE JS), through multiple VPNs over multiple proxies. Everything else is command line HTML parsers (also on different, remote VMs), or API endpoints (HN API as an example?). Need email service? Self-hosted, tiny email-server somewhere in eastern Europe. DDNS etc. Local machin…

why eastern Europe?

Heh, the Netherlands is enough. No one gets stuff from some of those vps providers.

Re: Never connect to ProtonMail using Chrome

#114

Post by rgbrenner »

anfilt wrote: post #62
moderation wrote: post #42

Earlier quoted context omitted.

I've seen a number of comments about http/2 and http/3 being driven by Google. The ideas originated there (SPDY and QUIC respectively) but in both cases many different entities backed the ideas and formulated specifications in IETF settings. I'm not sure I buy that somehow Google managed to hoodwink the people that toiled on these specifications in a non-Google environment and managed to influence them in such a way…

It's just an example of how much weight Google is able to throw around. That's a just one part of what would be needed for a browser. The more parts you add the harder it becomes to build a browser. Also I have read about QUIC there are some things that are interesting about it. However, there are things that I don't like. Moreover, this was something I read from IETF mail archive: "That QUIC isn't yet proven. That's…

That's still something someone has to implement even it's not used much.

Not true. This is why alpn and the upgrade header exist. You do not need to implement any of the new protocols, and you can certainly skip a version if you don't think it's worth the effort.

Re: Never connect to ProtonMail using Chrome

#115

Post by gundmc »

gaius wrote: post #87

I’ve said it before: Chrome is a data collection app with a built-in web browser to keep you entertained while it does its real job.

Source?

Google makes Chrome because they can default the URL bar to search on Google without paying Traffic Acquisition Costs (Google pays browsers _a lot_ of money to have Google be their default search).

Google only makes money from Chrome by driving more traffic to their profit centers (like Search). And it works really, really well.

Chrome itself is not monetized and does not collect client data. Please, provide evidence to the contrary.

Re: Never connect to ProtonMail using Chrome

#116

Post by squarefoot »

delibash___ wrote: post #76
devoply wrote: post #8

Earlier quoted context omitted.

It's a bug but what is to stop Google from sending everything you type in any textbox to Google? Have they said anywhere that they won't do such a thing? Completely trivial to do and extremely useful in providing data about you to Google that they could potentially never look at and use to train AI.

And what's to stop Mozilla from doing so? Or any other browser?

The simple fact that Firefox is Open Source, therefore auditable, while Chrome is not.

ps. Nope, Chromium is not Chrome.

Re: Never connect to ProtonMail using Chrome

#117

Post by Waterluvian »

rinchik wrote: post #10

If you care about privacy these days: Remote self-destructible VM for browsing with Firefox in incognito mode (only sites you NEED to, that REQUIRE JS), through multiple VPNs over multiple proxies. Everything else is command line HTML parsers (also on different, remote VMs), or API endpoints (HN API as an example?). Need email service? Self-hosted, tiny email-server somewhere in eastern Europe. DDNS etc. Local machin…

The sarcasm is spot on. These things are so easy to a tiny subset of experts who seem incapable of stepping into the shoes of normal people. It's always frustrating when I want to improve privacy or security and it's just an "easy" but not actually, mess.

Let's Encrypt is probably the great example of actually getting it right. But normal people won't really ever need it.

Re: Never connect to ProtonMail using Chrome

#119

Post by izacus »

Deimorz wrote: post #11
reaperducer wrote: post #2

I just don't understand how so many people in the HN community, who are so vocal about privacy, turn around and use Chrome. Don't feed the beast.

The same reason that so many of them continue working for companies that blatantly violate principles they claim are important to them (privacy, open-source, anti-advertising, etc.): It's easy to be vocal about principles, but when it comes down to it, very few people are actually willing to impact their own comfort or convenience to truly follow them. It's simpler to just come up with a reasonable-seeming justificat…

> The same reason that so many of them continue working for companies that blatantly violate principles they claim are important to them (privacy, open-source, anti-advertising, etc.):

You're trying to paint people as hypocrites, where a more simple explanation is that maybe most of users even here on HN are not as concerned with the problem as you are. Vocal minority and all that.

Re: Never connect to ProtonMail using Chrome

#120

Post by rgbrenner »

anfilt wrote: post #32
dredmorbius wrote: post #26

Earlier quoted context omitted.

What frequently happens is that a simplified alternative appears. HTML5 rather than XHTML, Markdown vs. HTML or LaTeX, HTML, originally, vs. SGML or Sun's ... proprietary hypertext system (Vue?). Arguably, replacement of much office suite software with Web technologies. Multics -> Unix.

Moreover, we have gone from Microsoft pushing complexities to Google. Like the latest two HTTP protocols are both based of tech that google has already made. However, IETF is like that sounds good. It's got it's advantages, but there is very little push back saying well that makes things more complicated. For instance with HTTP/2 it has support for pushing files to the client. Most back end web stacks are still tryin…

The standard for h2 may not have required it, but practically it was required. There are middleboxes on the internet that assume any traffic over port 80 is http 1.1, and will destroy/interfere/break non-1.1 traffic. There are also servers that will respond with a 400 error if they see an unrecognized protocol in the upgrade header. This is why actual data shows h2 has a higher success rate when sent over tls.

IIRC MS/IE wanted to implement it, but they backed off because of these issues

Asking browsers to implement h2c is asking them to make their browsers flakier... their users would see a higher connection error rate... which the user WOULD attribute to their browser, especially if they open the same URL in another browser without h2c and it works.

Using the upgrade header instead of alpn is slower anyway.

Post reply on HN