Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Never connect to ProtonMail using Chrome

old.reddit.com

Post reply on HN
Print view View original

161–170 of 289 posts

Re: Never connect to ProtonMail using Chrome

#161

Post by rocqua »

cromwellian wrote: post #112

When I visit a website in a foreign language I've never translated before, Chrome asks my permission to translate the site, it doesn't do so automatically. You could argue they could give you more details on what it will do when you click the 'Translate' button, but to argue they shouldn't offer the feature as a permission-requested option at all seems pretty extreme. I read a lot of foreign websites, and the built-i…

Question is, how does it know to ask?

If it is based on analysis done by the local machine, no problem. However, if it is based on analysis done by google servers, big problem!

Re: Never connect to ProtonMail using Chrome

#162

Post by [deleted] »

cromwellian wrote: post #132
cromwellian wrote: post #112

When I visit a website in a foreign language I've never translated before, Chrome asks my permission to translate the site, it doesn't do so automatically. You could argue they could give you more details on what it will do when you click the 'Translate' button, but to argue they shouldn't offer the feature as a permission-requested option at all seems pretty extreme. I read a lot of foreign websites, and the built-i…

Two downvotes for pointing out that it asks for permission to translate, and that the feature is pretty important if you're traveling in a foreign country and don't speak the language?

[deleted]

Re: Never connect to ProtonMail using Chrome

#163

Post by mschuster91 »

Nitramp wrote: post #154
creato wrote: post #147

Earlier quoted context omitted.

I just went to create a google account to see for myself because this sounds egregiously bad. I think you are exaggerating quite a bit: * Phone number is clearly marked as optional and it says they use it for security. (Of course, Facebook said the same thing, and look how that turned out...) * The only information requests that I think are unnecessary are date of birth (they say because some services are age restric…

> date of birth required US law has some requirements on accounts created by minors which essentially means you must check the age for people creating new accounts, and you must not allow accounts for people I don't entirely understand where exactly this applies, i.e. why you can create accounts on some sites without giving your age. It might only apply in some telecommunication accounts cases, or maybe (possibly mor…

> I don't entirely understand where exactly this applies, i.e. why you can create accounts on some sites without giving your age.

That law is called COPPA ("Children Online Privacy Protection Act"). It applies to sites dedicated to children (as per https://www.ftc.gov/tips-advice/business-center/guidance/com...). As Google uses one and the same account for all its services including YouTube, all Google accounts are potentially "dedicated to children" (YouTube IIRC has even a special section for videos suitable even for toddlers).

Re: Never connect to ProtonMail using Chrome

#164

Post by Rjevski »

marcinzm wrote: post #85

Chrome is fun, today I learned you cannot turn off auto-complete for a page in chrome. Possibly some really creative hacks can do it but those seem to be "fixed" every so often as well. Which is great when you're building a HIPAA compliant page and would prefer that people's medical information not get cached by chrome (and then uploaded to their cloud storage if you're logged in).

I agree with Chrome's decision here. The data remains the property of the user, they are free to cache it on their machine or upload it to Google if they so desire. Pages that disable autocomplete (or break it with hacks) should die.

Re: Never connect to ProtonMail using Chrome

#165

Post by mschuster91 »

marcinzm wrote: post #85

Chrome is fun, today I learned you cannot turn off auto-complete for a page in chrome. Possibly some really creative hacks can do it but those seem to be "fixed" every so often as well. Which is great when you're building a HIPAA compliant page and would prefer that people's medical information not get cached by chrome (and then uploaded to their cloud storage if you're logged in).

> Chrome is fun, today I learned you cannot turn off auto-complete for a page in chrome.

Because people were abusing it left-and-right to prevent password managers, and as e.g. banks (my own bank did this...) rarely listen to customers, Google instead decided to disable that opt-out for everyone instead.

Re: Never connect to ProtonMail using Chrome

#166

Post by rocqua »

xg15 wrote: post #139
eridius wrote: post #127

Earlier quoted context omitted.

> Those protocols are a lot more complicated than HTTP. So it's much harder for a small group to implement them. Why does a small group need to reimplement HTTP/2 and HTTP/3? It's important that we have more than 1 or 2 implementations, but we don't need more than a small handful, and we definitely don't need every independent group reimplementing them. We just need enough that anyone who needs it has access to an im…

Because then you get more parts of your stack that you don't really understand how they work and are unable to audit. We are basically doing with TLS. Which went fine - until people realized that one of the major go-to implementations of TLS contained years old unfixed bugs that could be remotely exploited.

I am not sure TLS would have been better if instead everyone rolled their own TLS implementation.

Nor do I think that a more diverse world of TLS implementations would've led to better auditing of openSSL. We had barely enough eyeballs to audit openSSL, let alone to audit more stuff.

The issue with openSSL was that the protocol was sufficiently complicated and sufficiently critical that people just picked the available option. Perhaps those who did look into the code they were running concluded it was bad, but weren't willing to create a new library. Besides, any new library would have the stigma of 'they are using a non-standard and new crypto library'.

In that case, the solution would've been louder complains about the code quality of openSSL.

Re: Never connect to ProtonMail using Chrome

#167

Post by mschuster91 »

rocqua wrote: post #161
cromwellian wrote: post #112

When I visit a website in a foreign language I've never translated before, Chrome asks my permission to translate the site, it doesn't do so automatically. You could argue they could give you more details on what it will do when you click the 'Translate' button, but to argue they shouldn't offer the feature as a permission-requested option at all seems pretty extreme. I read a lot of foreign websites, and the built-i…

Question is, how does it know to ask? If it is based on analysis done by the local machine, no problem. However, if it is based on analysis done by google servers, big problem!

> Question is, how does it know to ask?

The html tag has a "lang" attribute, and the server itself can send a Content-Language HTTP header. Most CMSes these days set one or both once multi-lingual is enabled.

Additionally the browser can utilize the OS or it's own spellcheck word database: check every word in every dictionary and the dictionary with the most matches is likely to be the relevant one.

Re: Never connect to ProtonMail using Chrome

#168

Post by Tsubasachan »

reaperducer wrote: post #2

I just don't understand how so many people in the HN community, who are so vocal about privacy, turn around and use Chrome. Don't feed the beast.

I don't use Chrome but the vast majority DOES and I share a planet with them. Google is everywhere these days. So far it doesn't impact me too much since I've been blocking ads profusely.

Re: Never connect to ProtonMail using Chrome

#169

Post by mschuster91 »

reaperducer wrote: post #2

I just don't understand how so many people in the HN community, who are so vocal about privacy, turn around and use Chrome. Don't feed the beast.

> I just don't understand how so many people in the HN community, who are so vocal about privacy, turn around and use Chrome.

1) Firefox is SLOW. I have ~400 tabs open on a Macbook right now in Chrome, Firefox snails around at 30-40 tabs.

2) Firefox dev tools sucked for a long time, compared to Chrome's. Same goes for Safari's dev tools - and don't get me started on the clusterf..k called Internet Explorer... that's why devs drove off to Chrome in the first place and stayed there.

Re: Never connect to ProtonMail using Chrome

#170

Post by ohthehugemanate »

RTFA - the user discovered that chrome was sending all text from all webpages to the translate service.

The advice in the thread isn't "never connect to protonmail using Chrome." It's "don't use Chrome".

100% agree. Firefox is so good now, there's really no excuse.

Post reply on HN