Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google sued for secretly amassing vast trove of user data

bloomberg.com

Post reply on HN
Print view View original

161–170 of 195 posts

Re: Google sued for secretly amassing vast trove of user data

#161

Post by metroholografix »

bgwhn wrote: post #153
metroholografix wrote: post #142

Earlier quoted context omitted.

Well, there are definite benefits to being in full control of profile segmentation. You have no idea what the extension is doing unless you audit it. And even then, there are second-order effects that could surprise you [1]. Plus, the extension writer has to maximally cover the set of possibilities where a site can store/retrieve data. These are a lot of unknowns you're trusting and assumptions you're making. It's fa…

Sure, there's probably less exposure from nuking the profiles directory, but I don't think you're being fair to containers: - Containers are a feature built into Firefox, these extensions just expose a UI for it. The Multi-Account Containers plugin [1] is published by Mozilla. You don't need to trust anyone but Mozilla to use that base set of functionality. - The container functionality in Firefox is the result of so…

I reworded my comment. My point remains in that a lot of possible issues disappear if I just choose to destroy the entire directory. There is a clear difference between one Chrome instance (and all its associated windows/tabs) segmented into one profile directory and in-process segmentation. The issues at [1] seem to invoke unexpected behavior in that you're asking for a new temporary container but you can't know ahead of time if that's what you will get. I'm writing "seem" because it's not clear from the description how that interaction works. They could be better worded.

With segmentation enforced at instance boundary (rather than in-instance), there is no unexpected behavior of this sort. All links open in the segmented instance that the browser window/tab you're using belongs to. If you want a new container, you start a new instance and you know that's exactly what you will get. There is no possible "fail open" result. Note that I'm not saying the Firefox behavior you described is a major issue, just that it proves you can have unexpected scenarios.

Moreover, jedberg is correct in that cross-profile data leaking is possible (partly what I meant by "implementing profiles" properly), except that it's very easy to see if that's happening without auditing Chrome. Use a tool that records all filesystem operations (e.g. dtrace on macOS).

At the end of the day, I choose one set of trade-offs over another.

[1] https://github.com/stoically/temporary-containers/wiki/Isola...

Re: Google sued for secretly amassing vast trove of user data

#162

Post by Apes »

a9entroy wrote: post #68
Apes wrote: post #7

Earlier quoted context omitted.

There are the data privacy laws that mandate users be able to opt of tracking, and it should be pretty clear to a non-psychopathic company that a person using the private mode on their browser is opting out of any tracking. Google is one of the biggest companies in the world. Do they really need to be wringing their users as hard as they can to milk out every last drop of ad revenue potential?

That's not what incognito mode is. It literally says on the first page when you open incognito window. People want to skip reading technical details when provided but then get angry when a company does the exact thing they warned about. Also where does this end? Should car dealerships be allowed to analyze your data? Cars you've bought, cars you test drove etc.?

A disclaimer that a technical vulnerability exists isn't some kind of implicit invitation for a company like Google to use that vulnerability for their benefit. It's true that it's technically possible to track users using a private browsing mode, but it is not ethical.

If you have a car with a broken lock, that's not some kind of open invitation to burglars to steal whatever they want from your car.

Re: Google sued for secretly amassing vast trove of user data

#163

Post by specialist »

dvduval wrote: post #16

I know that Google is making money through use of my personal data. I wish they would be required boldly state on every page that my personal data is being used, and that they are profiting from it. Finally, there should be some steps offered to remedy some of the above such as requesting that parts of the data that would be convenient for me to have deleted would be deleted. And the parts that are inconvenient such…

My core issue is the unfulfilled promise of the panopticon.

I'm still waiting for the recommenders, personalizers which help me.

Not boost engagement. Not amplify tiny differences. Not catalysts for virality.

I was on the recommender, personalization team for a high end fashion retailer. Joining, I thought "Woohoo! Teach the computer tell me which dress shirt to buy! Pick the right t-shirts! Find tasteful but understated socks! Finally!"

It took me a while to peel back all the layers to reveal the team's secret sauce. Turns out there isn't any. The most performant algorithm was "stuff you've looked at before" (~70%), followed by "what's hot" and "what's new".

While most of our effort was put into all the Big Data Machine Learning Booyah stuff, I'd characterize the attributable "lift" as little better than noise. Terrible ROI. We would have been MUCH BETTER off improving the data quality, search features, and browsing experience.

(I had some other more radical ideas. A whole thesis built around authenticity and actual engagement. Way past StitchFix. Alas, too weird for the brick & mortar types. Imagine explaining TikTok influencers to your great aunt. But I'd be happy to have someone pay me for a brain dump.)

In conclusion, nothing this last decade has shaken my hunch that digital ads are a giant con job. At least outside of political advertising. (My bro has worked in ad tech for 15+ (?) years. Our spirited debate has never stopped.)

Re: Google sued for secretly amassing vast trove of user data

#164

Post by kodablah »

jason0597 wrote: post #155
metroholografix wrote: post #102

Getting some semblance of control over my browsing habits and enabling the implementation of multiple-proxy-based browsing strategies is one reason why I wrote chrome-private.sh [1]. I go through hundreds of disposable browsing profiles every day. [1] https://github.com/atomontage/chrome-private

Why not use ungoogled-chromium? https://github.com/Eloston/ungoogled-chromium

Different concerns. Ungoogled Chromium removes Google-specific features from Chrome. That is unrelated to non-Google-specific browsing features such as providing cookies back to hosts on repeat requests in the same profile.

Re: Google sued for secretly amassing vast trove of user data

#165

Post by bryan_w »

coronadisaster wrote: post #151
shadowgovt wrote: post #101

Earlier quoted context omitted.

> Wow the number of people on this thread claiming websites should be able to opt people out of logging based on whether they’re using a “private window” (which websites should have absolutely no idea about) makes me question if I’m even on Hacker News. Especially since "Websites shouldn't be able to tell if you're in incognito mode" has been highlighted in the past as a privacy ask, yes. People can at least agree "w…

obviously you don't now what the current incognito mode means (it has nothing to do with what you tell remove servers)

So inform us, how does incognito mode work in your world.

Re: Google sued for secretly amassing vast trove of user data

#166

Post by v7p1Qbt1im »

noncoml wrote: post #94

And yet these guys can't figure out that I don't have babies so they keep showing me ads for diapers. I guess it doesn't make a difference to them, as long as they get the ad revenue from Pampers

My profile is also ridiculously inaccurate. Though I do use ublock origin, privacy badger, etc and disabled most tracking features in my google account. Also on VPN pretty much all the time. I‘d really like to see the ad profile of someone who is completely transparent and doesn‘t spend any effort to obfuscate at all. I‘d imagine it would be much more accurate.

Interestingly my instagram ads are incredibly on point a lot of the time. You cant really hide your behavior in the app so the get a really good picture, probably.

Re: Google sued for secretly amassing vast trove of user data

#167

Post by uniqueid »

metroholografix wrote: post #102

Getting some semblance of control over my browsing habits and enabling the implementation of multiple-proxy-based browsing strategies is one reason why I wrote chrome-private.sh [1]. I go through hundreds of disposable browsing profiles every day. [1] https://github.com/atomontage/chrome-private

There is no hope of privacy on the internet today without some sort of "tumbling" strategy. It is wholely impossible for anyone to prevent all sources of their information from leaking, and once your data from one source is out there, the rest of your precautions are potentially useless. So the only viable strategy is to muddy the waters by creating enough spurious data that an attacker can't know what is real and what is fake.

Re: Google sued for secretly amassing vast trove of user data

#168

Post by shadowgovt »

wegs wrote: post #136
shadowgovt wrote: post #101

Earlier quoted context omitted.

> Wow the number of people on this thread claiming websites should be able to opt people out of logging based on whether they’re using a “private window” (which websites should have absolutely no idea about) makes me question if I’m even on Hacker News. Especially since "Websites shouldn't be able to tell if you're in incognito mode" has been highlighted in the past as a privacy ask, yes. People can at least agree "w…

How about: "Websites shouldn't do digital fingerprinting to intentionally circumvent incognito mode." Does this make sense to you as a legal argument? And yes, this does mean that if it comes to litigation, a lot of this will depend not just on what you did but why you did it. If you write analytics, unaware of incognito mode, you're probably okay. If you write that same exact code because your boss comes in and says…

That's the kind of feel-good law that ends up very unenforceable because it ignores technical reality. Not a fan.

If the exact same action does the exact same harm and is legal or illegal based on intent, enforcing that law is going to enrich a lot of lawyers but isn't going to practically rope in many company's behaviors.

Re: Google sued for secretly amassing vast trove of user data

#170

Post by coronadisaster »

bryan_w wrote: post #165
coronadisaster wrote: post #151

Earlier quoted context omitted.

obviously you don't now what the current incognito mode means (it has nothing to do with what you tell remove servers)

So inform us, how does incognito mode work in your world.

it doesn't keep history on your personal computer (that's it)... it doesn't erase history on remote computers like some of you appear to think

I think that it should do more, but it doesn't (a VPN or Tor would be nice in incog. mode)

Post reply on HN