Live data from Hacker News

Am I logged in or not? GDPR case study on the example of Chrome browser change

blog.lukaszolejnik.com

331–340 of 507 posts

Re: Am I logged in or not? GDPR case study on the example of Chrome browser change

#332
post #98
post #3

I don't understand why the Chrome team is picking this hill to die on- their team (managers and developers) are all over twitter and reddit trying to explain the privacy violations away as if the people upset about this are just not understanding what's going on. I really expect this change to push a lot of people away from Chrome, and frankly I wouldn't be surprised if it started opening up more antitrust possibilit…

I've been considering switching over to Firefox after being a day-one adopter of Chrome and this helped become a tipping point to get me to switch over. Though, full disclosure: I've been working to limit Google services in my day-to-day life (Maps, Gmail, and now Chrome) in the last couple of months over privacy concerns.

After reading a little I randomly plonked on Brave. Selfishly, I wanted to know if our stuff worked on it- encryption, chunking etc. To my joy, it does and.... Brave is pretty cool. Converted.

I have noticed Xero doesn't work on Brave. Not my product so not so concerned but I'm going to investigate to see what Xero is doing that we are not. ie why my dev's stuff works and xero's does not.

Re: Am I logged in or not? GDPR case study on the example of Chrome browser change

#333
post #196
post #185

Earlier quoted context omitted.

I think you forget that in it's time IE was massively innovative. It was IE who added XMLHttpRequest and invented AJAX.

They did it by ironic accident. Bill Gates wanted their browser to be the best, but also wanted it not good enough to replace desktop apps. However the right hand didn't know what the left hand was doing. The Outlook team was told to make a web version. They got the IE team to add XMLHttpRequest for their use, everyone implemented what they needed to, then went home and forgot about it. Then Google recognized what th…

Gmail was not even close the the first Ajax based email not by MS. Oddpost which later became Yahoo mail (Yahoo bought them to upgrade their mail) preceded Gmail by a few years.

https://en.m.wikipedia.org/wiki/Oddpost

Re: Am I logged in or not? GDPR case study on the example of Chrome browser change

#334

https://twitter.com/__apf__/status/1044109898013765632 > My teammates made this change to prevent surprises in a shared device scenario. In the past, people would sometimes sign out of the content area and think that meant they were no longer signed into Chrome, which could cause problems on a shared device I can see why there is pushback against this, but the issue described above is also understandable. There are v…

If that’s the explanation, the solution is to logout the browser when the user logs out of a google service. That would follow the users expectation (based on their observation). Logging the user into the browser, on the other hand, is not directly related. And potentially unexpected for the user. They could have had one without the other.

[deleted]

Re: Am I logged in or not? GDPR case study on the example of Chrome browser change

#335
Imagine if Google open-sourced their sync server as Mozilla has [1]. If you could simply specify your own sync server, I suspect a lot of the louder privacy complaints related to sync would disappear.

(Obviously Google would never do this.)

[1] https://github.com/mozilla-services/syncserver/

Re: Am I logged in or not? GDPR case study on the example of Chrome browser change

#336
post #296
post #252

Earlier quoted context omitted.

Yeah I directly quoted from the privacy statement and the line I quoted is still there. Seriously though, searched for "signed in" (like, ctrl-f). There's an epic ton of things that they are allowed to do for signed in accounts versus normal browsing even with sync disabled. These are all directly quoted from the privacy policy and do not require syncing to be enabled- * If you are signed in to a Google site or signe…

> * If you are signed in to a Google site or signed in to Chrome and Google is your default search engine, searches you perform using the address bar in Chrome are stored in your Google account. Note the "or". If you're signed into Google and you do a Google search, that's stored in your account by default. The only reason signing into Chrome is relevant is that that also signs you into Google. > * Payments. If you a…

I don't think you're parsing that first one correctly. Here it is with one of the two principles removed-

> > * If you are signed in to Chrome and Google is your default search engine, searches you perform using the address bar in Chrome are stored in your Google account.

If you are signed into the browser but aren't signed into Google this states it will still save your search query.

Re: Am I logged in or not? GDPR case study on the example of Chrome browser change

#337
post #295

Earlier quoted context omitted.

I work at Google; opinions are my own. > I don't understand why the Chrome team is picking this hill to die on- their team (managers and developers) are all over twitter and reddit trying to explain the privacy violations away as if the people upset about this are just not understanding what's going on. My impression is that this is the new norm at Google. It happens with everything, internal or external. The sad rea…

Use checkboxes?

When you have a checkbox for every possible customisation option, you end up with a commercial airliner cockpit - hundreds of flashing lights and switches, that you need a comprehensive manual and years of experience to properly operate.

Re: Am I logged in or not? GDPR case study on the example of Chrome browser change

#338

I'm still not clear about what the actual change in behavior even is - seeing some statements on Twitter from someone on the dev team, it sounded to me like there isn't actually any difference, just a UI change to show which Gmail account is currently logged into. If that's really all it is, I don't really get what people are upset about. Specifically, if there's no additional data being stored connected to your acco…

I work at Google, but all statements/opinions are my own. My understanding is that there were two changes: 1. General responsibility for authenticating to Google services has been moved to Chrome, and being logged into Google is equivalent to being logged into Chrome. If sync is set up, logging back into Google also fixes your sync session, if it was broken (common — the warning in the toolbar is easy to ignore). 2.…

That's just a diplomatic way of saying "so what if we logged you in". Well you don't understand how distrustful people are of Google these days, especially power users. I wouldn't give a byte of information about me to Google if I don't have to.

Re: Am I logged in or not? GDPR case study on the example of Chrome browser change

#339

I'm still not clear about what the actual change in behavior even is - seeing some statements on Twitter from someone on the dev team, it sounded to me like there isn't actually any difference, just a UI change to show which Gmail account is currently logged into. If that's really all it is, I don't really get what people are upset about. Specifically, if there's no additional data being stored connected to your acco…

I work at Google, but all statements/opinions are my own. My understanding is that there were two changes: 1. General responsibility for authenticating to Google services has been moved to Chrome, and being logged into Google is equivalent to being logged into Chrome. If sync is set up, logging back into Google also fixes your sync session, if it was broken (common — the warning in the toolbar is easy to ignore). 2.…

> It raises a question for both users and browser vendors: What does it mean to be logged into a web browser?

And who - exactly - ever asked for the ability to "log into a web browser"? And what benefits are there for the user?

There would be zero confusion about "Am I logged in to Google or logged in to Chrome?" without the unwanted and unexpected existence of a "logged in to a web browser" status.

This is privacy disaster over a feature nobody wants. Except for the people who actively profit from privacy disasters...

Re: Am I logged in or not? GDPR case study on the example of Chrome browser change

#340
> According to Google Chrome privacy policy “signed-in Chrome mode” works differently than the basic (non-signed) mode. Accordingly “your personal browsing data is saved on Google's servers and synced with your account. This type of information can include: Browsing history, Bookmarks, Tabs, Passwords and Autofill information, Other browser settings, like installed extensions”

> In line with privacy policy, this could be the case. However, data synchronisation appears not to happen by default in practice (as also confirmed here). It seems this behavior is not accounted by the privacy policy, which means either the policy is obsolete (and needs to be updated, which suggests potential issues in the internal privacy program, and possibly the priorities), or the mechanic may be subject to change in future.

It may have been updated in the last few hours, but right now, the privacy policy clearly specifies that that section is for the "Signed-in, Synced Chrome mode", and that "Sync is only enabled if you choose". Just signing in does not automatically enable sync.

Post reply on HN