Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google sued for secretly amassing vast trove of user data

bloomberg.com

Post reply on HN
Print view View original

131–140 of 195 posts

Re: Google sued for secretly amassing vast trove of user data

#131

Post by nitrogen »

StrangeDoctor wrote: post #124
thinkloop wrote: post #116

Earlier quoted context omitted.

Interesting. Why disable gpu? > Disables 3D APIs / WebGL, GPU acceleration by default while allowing them to be re-enabled through command-line switches.

Not OP, WebGL is a fast path to direct hardware execution and kernel space execution. It’s difficult to patch when things go wrong often requiring driver or kernel coordination. There might be issues with cross site memory leaking, but I’ve only seen white papers on how this might be an issue.

It's also used for fingerprinting, because there are a lot of different GPU configurations with slightly different reported features and slightly different e.g. rounding, dithering, antialiasing, and other rendering behaviors.

Re: Google sued for secretly amassing vast trove of user data

#132

Post by joshuamorton »

jlbnjmn wrote: post #129
joshuamorton wrote: post #80

Earlier quoted context omitted.

Quoting my chrome incognito screen: > Your activity might still be visible to: Websites you visit Your employer or school Your internet service provider

Interestingly absent is Google.

Google only has visibility into what you're doing as a subcategory of "websites you visit", so I'm not clear on the confusion here.

Re: Google sued for secretly amassing vast trove of user data

#133

Post by wegs »

asdfasgasdgasdg wrote: post #29
simonw wrote: post #8

Earlier quoted context omitted.

Found the full lawsuit PDF https://www.insurancejournal.com/app/uploads/2020/06/brown-v... It looks like this is mainly about the fact that Google Analytics still works even if you are in Incognito mode.

Which there is a warning of every time you open an incognito window. It's not fine print either, it's one of about six bullet points. "Your activity might still be visible to ... Websites you visit." This one is going nowhere I suspect. Just because a lawsuit asks for big damages does not mean the plaintiffs are likely to prevail on their claims.

That's not quite how the law works. If I tell you to get off of my property, and you stand on my lawn, you're trespassing, even if I didn't put up a military-grade wall. Or if I have a basic chain link fence, and you climb over it, you're clearly trespassing in situations where without the fence, if you were to incidentally walk across my lawn, you'd be okay.

The point of digital trespass laws is very similar. Just because your technological measures are imperfect (as the bullets say) doesn't authorize you to circumvent them.

What's damaging in this case is that Google created the signalling mechanism, gave it to users, and then intentionally chose to circumvent it.

Courts are also not machines. A lot of this comes down to intent and reasonableness. If you're fingerprinting my browser when I'm in incognito, that feels like an intentional digital trespass which courts would probably recognize. If you're incidentally collecting my IP in your server logs, that feels okay. Programmers get caught up in this all the time -- they read laws and contracts like code (strict literal meaning). Lawyers read them looking at things like impact, intent, whether things are substantially similar, and so on.

Re: Google sued for secretly amassing vast trove of user data

#134

Post by guyzero »

denzil_correa wrote: post #83
guyzero wrote: post #67

Earlier quoted context omitted.

Yes, all that data helped Google perfect its amazing chat and video calling app strategy.

And because they didn’t perfect their chat and video calling app strategy, it’s fine for companies to have unrestricted access to personal data without any oversight.

No one is arguing in favour of that, but the statement that all the data lets them perfect their strategies and shut out competitors is provably wrong.

Re: Google sued for secretly amassing vast trove of user data

#135

Post by altgoogler »

dvduval wrote: post #16

I know that Google is making money through use of my personal data. I wish they would be required boldly state on every page that my personal data is being used, and that they are profiting from it. Finally, there should be some steps offered to remedy some of the above such as requesting that parts of the data that would be convenient for me to have deleted would be deleted. And the parts that are inconvenient such…

Disclaimer: I work for Google.

FYI - Google does offer a series of tools for you to manage your data. If you are signed in there is my activity[1], and takeout[2]. There are options to control targeted ads[3] and auto-delete location and activity data older than 3 months[4].

[1] myactivity.google.com [2] takeout.google.com [3] https://support.google.com/ads/answer/2662922?hl=en [4] https://www.blog.google/technology/safety-security/automatic...

Re: Google sued for secretly amassing vast trove of user data

#136

Post by wegs »

shadowgovt wrote: post #101
oefrha wrote: post #13

Earlier quoted context omitted.

> The fact that the user uses a private window or other means to indicates they don't want to be tracked probably makes this a more clear case. That’s a very confusing statement. My server logs don’t filter incoming log entries based on user agent, and certainly not on whether you’re using a “private window” or not. In addition, the goal of a private/incognito session is to be indistinguishable from regular sessions,…

> Wow the number of people on this thread claiming websites should be able to opt people out of logging based on whether they’re using a “private window” (which websites should have absolutely no idea about) makes me question if I’m even on Hacker News. Especially since "Websites shouldn't be able to tell if you're in incognito mode" has been highlighted in the past as a privacy ask, yes. People can at least agree "w…

How about: "Websites shouldn't do digital fingerprinting to intentionally circumvent incognito mode." Does this make sense to you as a legal argument?

And yes, this does mean that if it comes to litigation, a lot of this will depend not just on what you did but why you did it.

If you write analytics, unaware of incognito mode, you're probably okay.

If you write that same exact code because your boss comes in and says "shad, we're losing A LOT of user data to users in incognito mode. Could you do some kind of digital fingerprinting so we can still track them?" then you might be criminally liable for digital trespass -- you've intentionally bypassed my security mechanism.

Re: Google sued for secretly amassing vast trove of user data

#137

Post by jedberg »

metroholografix wrote: post #102

Getting some semblance of control over my browsing habits and enabling the implementation of multiple-proxy-based browsing strategies is one reason why I wrote chrome-private.sh [1]. I go through hundreds of disposable browsing profiles every day. [1] https://github.com/atomontage/chrome-private

Firefox containers does the same thing with a lot less work. If you get the multi-account-containers extension and the temporary containers extension, you won't have to log back into everything all the time but will still get isolation.

https://addons.mozilla.org/en-US/firefox/addon/temporary-con...

https://addons.mozilla.org/en-US/firefox/addon/multi-account...

Edit: See below with a warning about using this with profile sync.

Re: Google sued for secretly amassing vast trove of user data

#138

Post by rasz »

thinkloop wrote: post #116
metroholografix wrote: post #102

Getting some semblance of control over my browsing habits and enabling the implementation of multiple-proxy-based browsing strategies is one reason why I wrote chrome-private.sh [1]. I go through hundreds of disposable browsing profiles every day. [1] https://github.com/atomontage/chrome-private

Interesting. Why disable gpu? > Disables 3D APIs / WebGL, GPU acceleration by default while allowing them to be re-enabled through command-line switches.

WebGL: getParameter: enum 0x9246 - fingerprinting 3d hardware. Personally I run a shim that rotates a list of most popular gpus.

Re: Google sued for secretly amassing vast trove of user data

#139

Post by wegs »

altgoogler wrote: post #135
dvduval wrote: post #16

I know that Google is making money through use of my personal data. I wish they would be required boldly state on every page that my personal data is being used, and that they are profiting from it. Finally, there should be some steps offered to remedy some of the above such as requesting that parts of the data that would be convenient for me to have deleted would be deleted. And the parts that are inconvenient such…

Disclaimer: I work for Google. FYI - Google does offer a series of tools for you to manage your data. If you are signed in there is my activity[1], and takeout[2]. There are options to control targeted ads[3] and auto-delete location and activity data older than 3 months[4]. [1] myactivity.google.com [2] takeout.google.com [3] https://support.google.com/ads/answer/2662922?hl=en [4] https://www.blog.google/technology/…

Disclaimer: I've used these tools.

Google is really good about takeout. It's really bad about maintaining my privacy. The opt-outs are limited in scope to the point of being almost meaningless. I don't mind ads being targeted as data being collected about me. Google's privacy tools are a joke.

Google's security tools are a joke too. Google silently drops security support for Android phones after two years, and people unwittingly walk around with zero-day exploitable phones. Chromebooks are similar. If you want to maintain a secure Google Apps domain, you need to pay Google huge bucks. It benefits everyone, especially Google, if the Internet is safe, and Google's attitude here will come back to bite it.

Re: Google sued for secretly amassing vast trove of user data

#140

Post by wdevanny »

utkarsh_apoorva wrote: post #84
dr_kiszonka wrote: post #43

(Disclaimer: I have a big personal gripe with Google, but I don't hate the company in general) Something has been on mind for a while. I see lawsuits against Google collecting / selling personal data and ideas to combat its monopoly in search. What I don't see is a discussion about regulating companies that have data on the majority of the population. I know for a fact that Google used search insights to inform strat…

Regulations, a lot of times, tend to have the opposite of the intended effect. In this case, you'd need to define what is meant by "having data". Is having an email or phone enough to qualify? Maybe yes. In that case, think of a rapidly growing startup, which breaches that mark (50% or whatever the law says) - and now has to comply with the law. But the startup is not capable of compliance, because the law was made f…

Are startups that have collected data on 50% (or even 10%) of the US population still small enough that complying would be burdensome?

The answer here depends a lot on what the hypothetical regulation would be.

Does anyone know how many consumer oriented startups reach 30 million customers?

Post reply on HN