Earlier quoted context omitted.
The simple fact that Firefox is Open Source, therefore auditable, while Chrome is not. ps. Nope, Chromium is not Chrome.
So use Chromium?
Alternative from the Reddit post:
Never connect to ProtonMail using Chrome
261–270 of 289 posts
Re: Never connect to ProtonMail using Chrome
#262Earlier quoted context omitted.
This looks like a good reminder that Google isn't just a loose bunch of tools, they have developed a full integrated ecosystem. If it's not what you want then it is overly intrusive and exceptionally hard to manage so you control just the functionality and personal security you want. Most end users, I think, just want something to work and are happy for all the magic to just happen. When you embrace it a lot of what…
I find I can replace just about everything Google makes except for Google Docs & Google Sheets. I wish I could find self-hosted, open-source versions of those, which I would install on my own server. I can just use desktop apps and sync the files through my server with git or rsync when I'm the only user (but using multiple clients), but as you're saying about the general public, for sharing with friends and family,…
Maybe LibreOffice online would fill the role? It is still pretty new, but showing great potential. https://www.libreoffice.org/download/libreoffice-online/
Re: Never connect to ProtonMail using Chrome
#263Earlier quoted context omitted.
> Question is, how does it know to ask? The html tag has a "lang" attribute, and the server itself can send a Content-Language HTTP header. Most CMSes these days set one or both once multi-lingual is enabled. Additionally the browser can utilize the OS or it's own spellcheck word database: check every word in every dictionary and the dictionary with the most matches is likely to be the relevant one.
> Additionally the browser can utilize the OS or it's own spellcheck word database: check every word in every dictionary and the dictionary with the most matches is likely to be the relevant one. Every word seems excessive, especially if a page has an excessive amount of text on it.
I have noticed that 'certain' sites that obfuscate titles by homoglyphs are recognized as vietnamese by chrome. That seems like something based on the actual content of the page.
Re: Never connect to ProtonMail using Chrome
#264RTFA - the user discovered that chrome was sending all text from all webpages to the translate service. The advice in the thread isn't "never connect to protonmail using Chrome." It's "don't use Chrome". 100% agree. Firefox is so good now, there's really no excuse.
> the user discovered that chrome was sending all text from all webpages to the translate service
That's what they claimed, not what they discovered. What they discovered was that Chrome was sending emails created in a specific webmail client to a translation service. Language detection is done client-side; text is only sent to the translation service if the client decides it's in the wrong language.
Re: Never connect to ProtonMail using Chrome
#265Analysis of web browser and ProtonMail: don't.
Re: Never connect to ProtonMail using Chrome
#266Earlier quoted context omitted.
Please, provide evidence to the contrary. Uhhh, this whole article is literally about Chrome exfiltrating personal data to Google... all the evidence is above.
No, it isn't. This isn't even an article. It's a reddit post from a French user who had configured Chrome to automatically translate French (this is not a default behavior) and was then horrified when Chrome tried to translate his web page. Maybe Chrome incorrectly detected French as the language, but we have no way of knowing because they didn't post any screenshots or additional information about the alleged event.
> It's a reddit post from a French user who had configured Chrome to automatically translate French (this is not a default behavior)
First of all, the option was not to automatically translate. It was to suggest to automatically translate. Which is the default in Chrome for all languages other than whatever the system language is. Now, the whole thing about "suggest" is that it shouldn't just blindly translate, but ask first. But in this case, apparently, it just translated anyway.
And second, the user specifically said that they disabled translation for French. Which is almost certainly true, as anyone who is not a native English speaker but uses an English OS and browser can testify (you get bugged by Chrome about whether you want to translate every time you open a website in your native language, so after the first 2-3 times you click "Never").
Re: Never connect to ProtonMail using Chrome
#267Earlier quoted context omitted.
> Those protocols are a lot more complicated than HTTP. So it's much harder for a small group to implement them. Why does a small group need to reimplement HTTP/2 and HTTP/3? It's important that we have more than 1 or 2 implementations, but we don't need more than a small handful, and we definitely don't need every independent group reimplementing them. We just need enough that anyone who needs it has access to an im…
Because then you get more parts of your stack that you don't really understand how they work and are unable to audit. We are basically doing with TLS. Which went fine - until people realized that one of the major go-to implementations of TLS contained years old unfixed bugs that could be remotely exploited.
Better for everyone to be using a small handful of battle-tested implementations written by experts than for everyone to roll their own implementation. The latter may mean that people have a better understanding of the component, but it's also pretty much guaranteed to mean the various implementations are buggy. Even very simple protocols are easy to introduce bugs into.
For example, it's pretty easy to write an HTTP/1.0 implementation, but it's also easy to open yourself up to DoS attacks if you do so. If you're writing a server, did you remember to put a limit on how large a request body can be before you shut down the request? Great! Did you remember to do that for the headers too? Limiting request bodies is an obvious thing to do. Limiting the size of headers, not so much. But maybe you thought of that anyway. What about dealing with clients that open lots of connections and veeery sloowly feed chunks of a request? The sockets are still active, but the connections are so slow you can easily exhaust all your resources just tracking sockets (or even run out of file descriptors). And this is just plain HTTP, without even considering interacting with TLS.
Re: Never connect to ProtonMail using Chrome
#268Earlier quoted context omitted.
This neither is nor was true though. In this context pages are sent only if you are on a page which looks like it could be translated and you request the translation. That's a long way from "every page"
In another thread here the OP is quoted as saying Chrome sent the data even when translation is disabled.
Disabled for specific languages. That means either: the page was misclassified as a different language, or there's a bug affecting those preferences, or it was a user mistake and the translation was turned on.
Re: Never connect to ProtonMail using Chrome
#269Earlier quoted context omitted.
Thanks for sharing this post! I installed maps.me to give it a try... Very surprised that one of the settings is "Use Google Play services to determine your current location"
Because the location provider from Play Services is an alternative to having the GPS turned on and gives an approximate location. There are some replacements like this by Mapzen https://github.com/lostzen/LOST
Depending on where you live (like the US) your telco is happily selling of data. So unless you have your phone in airplane mode your location is out there.
Re: Never connect to ProtonMail using Chrome
#270Earlier quoted context omitted.
> I don't entirely understand where exactly this applies, i.e. why you can create accounts on some sites without giving your age. That law is called COPPA ("Children Online Privacy Protection Act"). It applies to sites dedicated to children (as per https://www.ftc.gov/tips-advice/business-center/guidance/com... ). As Google uses one and the same account for all its services including YouTube, all Google accounts are…
You need to be at least 13 to use Google or YouTube, so they don't have to respect the intricacies of COPPA.
The very action of enforcing the "need to be at least 13" is respecting what COPPA demands.