Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Never connect to ProtonMail using Chrome

old.reddit.com

Post reply on HN
Print view View original

171–180 of 289 posts

Re: Never connect to ProtonMail using Chrome

#171

Post by jacekm »

creato wrote: post #147
codedokode wrote: post #141

I would make the advice more general: avoid dealing with Google. Recently I had to install Hangouts app on the Android phone (it was easier than using it on desktop because I don't have the latest Chrome). One has to register a Google Account in order to use it, and I had to answer a lot of questions as if I was applying for a visa, including a phone number (of course I used a fake number) and date of birth. Then the…

I just went to create a google account to see for myself because this sounds egregiously bad. I think you are exaggerating quite a bit: * Phone number is clearly marked as optional and it says they use it for security. (Of course, Facebook said the same thing, and look how that turned out...) * The only information requests that I think are unnecessary are date of birth (they say because some services are age restric…

> Phone number is clearly marked as optional This is not always the case, Google may arbitrarily decide to make it obligatory for you (if they find some "suspicious" pattern).

Re: Never connect to ProtonMail using Chrome

#172

Post by amelius »

gipp wrote: post #24
ceejayoz wrote: post #21

Earlier quoted context omitted.

It sorta is, via ad targeting.

No it isn't. It's the difference between "Here's some money, please show this to young Democrats" and "Here's some money, please give me a list of young Democrats." That's a pretty damn big difference.

If you target an ad to young Democrats, and they click on it and buy the advertised product, then you know that they are young Democrats, and you'll have their personal information.

That's how Google leaks information.

Re: Never connect to ProtonMail using Chrome

#173

Post by mikorym »

po wrote: post #96
taneq wrote: post #79

I don't understand how this is related to ProtonMail. It reads more to me like "never use Chrome [if you care about all of your web content being sent to Google]". Sure, ProtonMail is likely to have personal, private stuff in it but so does a bunch of other things, eg. internet banking.

It's related because it's being reported by a user of ProtonMail into a ProtonMail forum. What you say about it being relevant to just about every page is definitely true.

Then the title should reflect this. At the moment the title seems to imply (wrongly) that this is something specific to ProtonMail. I took the comment to be about clarity.

Re: Never connect to ProtonMail using Chrome

#174

Post by nurzo »

reaperducer wrote: post #2

I just don't understand how so many people in the HN community, who are so vocal about privacy, turn around and use Chrome. Don't feed the beast.

Because it's faster. That's all there is to it. Yes, I know many people will come and tell me how wrong I am and how Firefox is so much faster in their experience. Maybe they will link to some synthetic benchmarks. I don't care. Chrome is faster.

Also the Developer Tools of Firefox are worthless... and not only because of how slow they are.

Re: Never connect to ProtonMail using Chrome

#175

Post by codedokode »

creato wrote: post #147
codedokode wrote: post #141

I would make the advice more general: avoid dealing with Google. Recently I had to install Hangouts app on the Android phone (it was easier than using it on desktop because I don't have the latest Chrome). One has to register a Google Account in order to use it, and I had to answer a lot of questions as if I was applying for a visa, including a phone number (of course I used a fake number) and date of birth. Then the…

I just went to create a google account to see for myself because this sounds egregiously bad. I think you are exaggerating quite a bit: * Phone number is clearly marked as optional and it says they use it for security. (Of course, Facebook said the same thing, and look how that turned out...) * The only information requests that I think are unnecessary are date of birth (they say because some services are age restric…

UPDATE: Location sharing is off by default.

> Phone number is clearly marked as optional

That is because your IP has a good reputation. For me registering a Gmail Account from Firefox looks like this [1]. Note that the text is misleading (this is not for my security, this is to prevent bulk registration).

> date of birth (they say because some services are age restricted)

If the user is over 18 you don't really need the day and month, year is enough.

> The "location history" option is off by default.

Ok, I deleted Google Account from phone (with two scary warnings that some of my data will be deleted from the phone), deleted Hangout's cache, forced stop it and tried to repeat the registration again. I made screenshots for every screen. If anyone needs, I can upload all of them.

It is weird, but this time Google didn't require me to confirm a phone number while it requires a number if I use a desktop browser and it required a number previous time. The phone is connected to Internet via desktop, so it has the same external IP. This is suspicious and might mean that Google has recognised my phone.

Here's what I observed:

- Google warns that it can exchange my device info (IMEI?) with a phone company [2] if I enter my phone number. Do phone companies sell data to Google?

- Terms of usage are written in a plain language, but they are three screens long and important options are hidden behind a spoiler [3]. Note that the button is named "More options" instead of "Choose what I share" or "No, I don't want to share" or something like this. Google doesn't really want you to click it.

- By default, "Save web & app activity" is enabled [4], and it includes "searches and associated information, such as location and activity from sites, apps and devices .... like Chrome history, for instance...". I don't understand whether this really means that they collect my browsing history and location or they meant something else (like stats calculated from those data).

- Saving Youtube search and watch history is enabled by default [5]

- You are right, location and voice history are off by default

- Backup to Google Drive is enabled by default [6][7][8]. I don't understand what it does, and what Google means by "data". Does it include all files in /sdcard? That would be scary and I definitely don't want it. Also, I don't remember if I saw this previous time. I had to retry registration several times late at night, I was tired and I could accidentally forget to disable it which would explain why contacts sync was enabled. Maybe it was my fault. But I am not sure.

- Note that the description of "Backup to Google Drive" is hidden behind a spoiler

- I checked whether sync is enabled and couldn't really understand anything. One screen says "Sync is OFF" [9], but another says "Last synced on xxx.xxx" [10]

- In detailed Google Account settings I found out that Google will save "contact info of people I interact with in Google Products" [11]

So you were right about location history - it is disabled by default. But there are so many settings and it is so easy to forget to disable anything. I wish I could update original comment for clarity.

[1] https://i.imgur.com/5lqfvWc.png

[2] https://i.imgur.com/4KOYlFW.png

[3] https://i.imgur.com/Wy9ZCp8.png

[4] https://i.imgur.com/xsaKJ3e.png

[5] https://i.imgur.com/5InPwMQ.png

[6] https://i.imgur.com/jpq0GBj.png

[7] https://i.imgur.com/7XjfCst.png

[8] https://i.imgur.com/LEynSlX.png

[9] https://i.imgur.com/LepQPnZ.png

[10] https://i.imgur.com/eHDuzY0.png

[11] https://i.imgur.com/qHNA2vP.png

Re: Never connect to ProtonMail using Chrome

#177

Post by codedokode »

creato wrote: post #147
codedokode wrote: post #141

I would make the advice more general: avoid dealing with Google. Recently I had to install Hangouts app on the Android phone (it was easier than using it on desktop because I don't have the latest Chrome). One has to register a Google Account in order to use it, and I had to answer a lot of questions as if I was applying for a visa, including a phone number (of course I used a fake number) and date of birth. Then the…

I just went to create a google account to see for myself because this sounds egregiously bad. I think you are exaggerating quite a bit: * Phone number is clearly marked as optional and it says they use it for security. (Of course, Facebook said the same thing, and look how that turned out...) * The only information requests that I think are unnecessary are date of birth (they say because some services are age restric…

But I still hate that Google took my account from Hangouts and added it to all other Google Apps on the phone.

Re: Never connect to ProtonMail using Chrome

#178

Post by Dylan16807 »

brohee wrote: post #153
Dylan16807 wrote: post #126

Earlier quoted context omitted.

> HTML5 rather than XHTML Huh? Parsing HTML5 is much more complicated than XHTML, and everything else is about the same.

The issue with XHTML is not parsing, it's generating valid one. The internet got years to try, failed, time to switch to something else... Because parsing invalid XHTML, which all browsers ended doing, is more complicated than parsing HTML5...

It's pretty easy to generate a valid XHTML doc. The issues come when someone is editing by hand and doesn't care.

> Because parsing invalid XHTML, which all browsers ended doing, is more complicated than parsing HTML5...

I don't understand what you mean. Isn't the non-strict parser for XHTML just the normal HTML parser? The complication levels should be equal.

Re: Never connect to ProtonMail using Chrome

#179

Post by codedokode »

Nitramp wrote: post #154
creato wrote: post #147

Earlier quoted context omitted.

I just went to create a google account to see for myself because this sounds egregiously bad. I think you are exaggerating quite a bit: * Phone number is clearly marked as optional and it says they use it for security. (Of course, Facebook said the same thing, and look how that turned out...) * The only information requests that I think are unnecessary are date of birth (they say because some services are age restric…

> date of birth required US law has some requirements on accounts created by minors which essentially means you must check the age for people creating new accounts, and you must not allow accounts for people I don't entirely understand where exactly this applies, i.e. why you can create accounts on some sites without giving your age. It might only apply in some telecommunication accounts cases, or maybe (possibly mor…

But if the user is over 18 then you need only the year without month and day.

Re: Never connect to ProtonMail using Chrome

#180

Post by codedokode »

codedokode wrote: post #141

I would make the advice more general: avoid dealing with Google. Recently I had to install Hangouts app on the Android phone (it was easier than using it on desktop because I don't have the latest Chrome). One has to register a Google Account in order to use it, and I had to answer a lot of questions as if I was applying for a visa, including a phone number (of course I used a fake number) and date of birth. Then the…

Cannot edit the post, so here is an update:

- I have rechecked and "Location sharing" is off by default, although "Share web & app activity" is on by default and it can include "searches and associated information, such as location and activity from sites, apps and devices .... like Chrome history, for instance..."

- I might accidentally forget to turn off "Backup to Google Cloud" when registering because I had to retry the registration several times and was tired. This would explain why sync was enabled. But I don't remember it clearly.

Post reply on HN