Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google sued for secretly amassing vast trove of user data

bloomberg.com

Post reply on HN
Print view View original

141–150 of 195 posts

Re: Google sued for secretly amassing vast trove of user data

#141

Post by flanbiscuit »

tsimionescu wrote: post #105
asdfasgasdgasdg wrote: post #29

Earlier quoted context omitted.

Which there is a warning of every time you open an incognito window. It's not fine print either, it's one of about six bullet points. "Your activity might still be visible to ... Websites you visit." This one is going nowhere I suspect. Just because a lawsuit asks for big damages does not mean the plaintiffs are likely to prevail on their claims.

While I share your skepticism of the suit, I think that that line may be seen as misleading. Google Analytics is NOT a website I visit, in general. Still, despite the Incognito mode, GA may well track me across the internet. Personally, I always took Incognito/In-Private browsing to be just a "delete cookies and history on exit" mode. But the way it is presented may suggest to many people that it is significantly mor…

> Personally, I always took Incognito/In-Private browsing to be just a "delete cookies and history on exit" mode.

This is how I've always interpreted it and the reason uBlock Origin is the only extension I've allowed in incognito/private mode

Re: Google sued for secretly amassing vast trove of user data

#142

Post by metroholografix »

jedberg wrote: post #137
metroholografix wrote: post #102

Getting some semblance of control over my browsing habits and enabling the implementation of multiple-proxy-based browsing strategies is one reason why I wrote chrome-private.sh [1]. I go through hundreds of disposable browsing profiles every day. [1] https://github.com/atomontage/chrome-private

Firefox containers does the same thing with a lot less work. If you get the multi-account-containers extension and the temporary containers extension, you won't have to log back into everything all the time but will still get isolation. https://addons.mozilla.org/en-US/firefox/addon/temporary-con... https://addons.mozilla.org/en-US/firefox/addon/multi-account... Edit: See below with a warning about using this with pr…

Well, there are definite benefits to being in full control of profile segmentation. You have no idea what the extension is doing unless you audit it. And even then, there are second-order effects that could surprise you [1]. Plus, the extension writer has to maximally cover the set of possibilities where a site can store/retrieve data. These are a lot of unknowns you're trusting and assumptions you're making.

It's far simpler to treat the profile directory as contaminated waste and nuke it at will. The only assumption you're making is that the browser implements a profile in a given directory properly.

[1] https://github.com/stoically/temporary-containers/wiki/Isola...

Re: Google sued for secretly amassing vast trove of user data

#144

Post by metroholografix »

thinkloop wrote: post #116
metroholografix wrote: post #102

Getting some semblance of control over my browsing habits and enabling the implementation of multiple-proxy-based browsing strategies is one reason why I wrote chrome-private.sh [1]. I go through hundreds of disposable browsing profiles every day. [1] https://github.com/atomontage/chrome-private

Interesting. Why disable gpu? > Disables 3D APIs / WebGL, GPU acceleration by default while allowing them to be re-enabled through command-line switches.

Mostly for security, rather than fingerprinting, concerns.

Fingerprinting avoidance is a complex issue and it's reached the point where you can't simply disable JavaScript / WebGL and assume you're ok. One needs to run additional extensions to project a browser-view that blends in. You can use chrome-private.sh as a base layer you can build on to get there, but you are not going to get it by default (which is why I'm not making any anti-fingerprinting claims in the README).

Re: Google sued for secretly amassing vast trove of user data

#145

Post by avian »

jedberg wrote: post #137
metroholografix wrote: post #102

Getting some semblance of control over my browsing habits and enabling the implementation of multiple-proxy-based browsing strategies is one reason why I wrote chrome-private.sh [1]. I go through hundreds of disposable browsing profiles every day. [1] https://github.com/atomontage/chrome-private

Firefox containers does the same thing with a lot less work. If you get the multi-account-containers extension and the temporary containers extension, you won't have to log back into everything all the time but will still get isolation. https://addons.mozilla.org/en-US/firefox/addon/temporary-con... https://addons.mozilla.org/en-US/firefox/addon/multi-account... Edit: See below with a warning about using this with pr…

Make sure to disable container sync when using this combination. It's easy to accumulate hundreds of temporary containers which somehow hoses your Firefox profile on Mozilla's sync server (and can also produce gigabytes of logs in your local profile directory).

It seems it's currently impossible to recover your profile once you reach "Maximum bytes per object exceeded" - the remote end won't even let you delete the offending data.

[1] https://github.com/stoically/temporary-containers/issues/371

[2] https://github.com/mozilla/multi-account-containers/issues/1...

Re: Google sued for secretly amassing vast trove of user data

#146

Post by myu701 »

utkarsh_apoorva wrote: post #84
dr_kiszonka wrote: post #43

(Disclaimer: I have a big personal gripe with Google, but I don't hate the company in general) Something has been on mind for a while. I see lawsuits against Google collecting / selling personal data and ideas to combat its monopoly in search. What I don't see is a discussion about regulating companies that have data on the majority of the population. I know for a fact that Google used search insights to inform strat…

Regulations, a lot of times, tend to have the opposite of the intended effect. In this case, you'd need to define what is meant by "having data". Is having an email or phone enough to qualify? Maybe yes. In that case, think of a rapidly growing startup, which breaches that mark (50% or whatever the law says) - and now has to comply with the law. But the startup is not capable of compliance, because the law was made f…

> In that case, think of a rapidly growing startup, which breaches that mark (50% or whatever the law says) - and now has to comply with the law.

> But the startup is not capable of compliance, because the law was made for behemoths like google.

If I were 'king of the world' I would consider something like this, but would not have it be a binary 'must comply or exempt' but a spectrum of ranges from 'totally exempt' to 'totally regulated' depending on what percentage of 50% you had.

If you have 5% of user emails, you are responsible for the bottom 10% of regulations and/or you need to fully comply with the regulations for a sample size of 10% of your users.

IDK I need to give it more thought, but first, another zoom meeting awaits.

Re: Google sued for secretly amassing vast trove of user data

#147

Post by jedberg »

metroholografix wrote: post #142
jedberg wrote: post #137

Earlier quoted context omitted.

Firefox containers does the same thing with a lot less work. If you get the multi-account-containers extension and the temporary containers extension, you won't have to log back into everything all the time but will still get isolation. https://addons.mozilla.org/en-US/firefox/addon/temporary-con... https://addons.mozilla.org/en-US/firefox/addon/multi-account... Edit: See below with a warning about using this with pr…

Well, there are definite benefits to being in full control of profile segmentation. You have no idea what the extension is doing unless you audit it. And even then, there are second-order effects that could surprise you [1]. Plus, the extension writer has to maximally cover the set of possibilities where a site can store/retrieve data. These are a lot of unknowns you're trusting and assumptions you're making. It's fa…

Of course, all security is a trade off between convenience and privacy. But the hassle of a new profile all the time seems like a lot of extra inconvenience for little extra privacy.

So far in practice I've never seen the isolation fail. The combination of the two plugins seems to counteract each one's failures.

And Mozilla makes the multi-account-container plugin. I trust them a lot more than I trust Google to make Chrome not leak information across profiles.

Re: Google sued for secretly amassing vast trove of user data

#148

Post by neil_s »

Unless Google associates your anonymous browsing data from incognito mode, with your regular browsing data from regular mode, I don't see a case here. And I really doubt they do that, it would be such a clear and egregious violation of the reasonable expectation of privacy.

The other possible complaint could be that websites still can collect information on user behavior on the website, even if it is more anonymous in incognito mode. This is expressly what incognito mode says on the tin. You can use it to avoid saving your weird porn history locally, but not prevent websites from knowing what anonymous visitors are doing on their website. If the average consumer isn't tech-savvy enough to get this distinction, I'm not sure what Google could do besides putting this explicit warning in every new tab.

Summary: seems like this case will go nowhere, but still makes for soundbitey headlines and gives people an excuse to rehash their usual gripes that "my data is the next oil"

(IIUC, most ad targeting is still based on you explicitly searching for something you want to buy and ads matching those keywords, or retargeting from a website you've already visited but abandoned your shopping cart at, not some all-knowing profile of your deepest wants and desires).

Disclaimer: I work at Google but nowhere near the Analytics or Ads teams.

Re: Google sued for secretly amassing vast trove of user data

#149

Post by jedberg »

avian wrote: post #145
jedberg wrote: post #137

Earlier quoted context omitted.

Firefox containers does the same thing with a lot less work. If you get the multi-account-containers extension and the temporary containers extension, you won't have to log back into everything all the time but will still get isolation. https://addons.mozilla.org/en-US/firefox/addon/temporary-con... https://addons.mozilla.org/en-US/firefox/addon/multi-account... Edit: See below with a warning about using this with pr…

Make sure to disable container sync when using this combination. It's easy to accumulate hundreds of temporary containers which somehow hoses your Firefox profile on Mozilla's sync server (and can also produce gigabytes of logs in your local profile directory). It seems it's currently impossible to recover your profile once you reach "Maximum bytes per object exceeded" - the remote end won't even let you delete the o…

Good tip! I don't use sync so I didn't know about this one.

Re: Google sued for secretly amassing vast trove of user data

#150

Post by metroholografix »

jedberg wrote: post #147
metroholografix wrote: post #142

Earlier quoted context omitted.

Well, there are definite benefits to being in full control of profile segmentation. You have no idea what the extension is doing unless you audit it. And even then, there are second-order effects that could surprise you [1]. Plus, the extension writer has to maximally cover the set of possibilities where a site can store/retrieve data. These are a lot of unknowns you're trusting and assumptions you're making. It's fa…

Of course, all security is a trade off between convenience and privacy. But the hassle of a new profile all the time seems like a lot of extra inconvenience for little extra privacy. So far in practice I've never seen the isolation fail. The combination of the two plugins seems to counteract each one's failures. And Mozilla makes the multi-account-container plugin. I trust them a lot more than I trust Google to make…

I can say that I would prefer to use Firefox instead of Chrome, except that Firefox has no OSA scripting endpoints on macOS (a real shame) and I've written a lot of code that depends on Chrome APIs over the years.

Even if I did move to Firefox however, I would still implement a directory-based profile segmentation strategy.

Post reply on HN