Convopage
See the entire conversation
I’m still annoyed that Chrome has gone to mandatory Google login — exactly the same way Android did (and has received enormous criticism for) — and people at Google are acting like they’re surprised people are upset.
702 replies and sub-replies as of Sep 23 2018
I mean it is, after all, Google’s browser and they can do whatever they want (modulo GDPR concerns). I just wish folks would acknowledge the difference.
I intend to die on this hill.
I do wish the mandatory login change to Chrome would get some more mainstream (tech) coverage.
I’m also annoyed at the people who say “it’s just all your browsing data so what’s the big deal?” It’s my *browsing data* that’s exactly why it’s a big deal!!!
There’s an entire class of browsing many folks will feel uncomfortable doing if their browser has a little icon in the window that says “Hi <User> I know this is you!” This is Human Behavior 101.
And sure, I’m talking about porn. But honestly, that’s probably the least of it. Political opinions. Mental health websites. Abortion clinic websites. Who would think forced identification is a good thing?
Also deeply fed up with people saying “Google et al. already track you around the web, so why is this a big deal?” First off: just because there are abusive practices on the web does not justify layering on the mother of all privacy abuses.
Secondly, people: there is a *reason* Google works so hard to encourage logins on Android and Chrome. And the obvious reason is that those platforms provide user data they *can’t get from their other sources*.
One last thing about this Google Chrome mandatory login policy. It completely makes hash out of the Chrome privacy policy.
The Chrome privacy policy (google.com/chrome/privacy/ ) articulates two separate “browser modes with different privacy properties. One is “basic” and the other is signed in”. Compare them.
The entire document can be summarized as a promise that if you aren’t logged in, data will only be stored locally, and if you *are* logged in, all bets are off. It’s pretty darn clear.
In the face of that kind of detail, it’s utterly bonkers to add a “security feature” that arbitrarily switches you from one mode into the other with no obvious notice or warning. It renders the entire document meaningless.
Why do you think they are doing this? Are they trying to prevent cookie theft? I wonder if it's possible to turn off DNS resolver when logged in.
Seems like they want to turn Chrome into an appliance OS over the top of whatever it's running on
I've switched to Opera recently. It's based on chromium so still an up to date browser but without the Google BS.
Plus the "VPN" in incognito mode isn't a true VPN it is useful for geoblocking.
Tried to log out of "Chrome", this also logs me out of Gmail. Damnit.
Try .@ProtonMail has everything you expect out of email plus security. I took the plug a few weeks ago. Never looking back. Google isn't playing by their own Moto.. don't be evil...
That solves the problem for my personal account, doesn't solve the problem for my corporate account.
Fortunately it has an easy solution: switch to another browser that respect the user.
I would agree with that, but Google Meet for instance does not work in my preferred browser, Safari.
100% agree. Plus, this reminds me that whatever data I think Google is collecting on me, they will eventually change it to collect more and I will probably find out about it on twitter. /cc @__apf__
I was also complaining a lot about Google.
There are other options for browsers: Firefox, Safari, Opera, Vivaldi. I also dont use my 14yo Google Account for now more than 6 months by switching to @FastMail.
Easier than I thought it would be.
Great thread. There comes a time in the lives of people and corps where any action to maintain power is the method and goal. This is when these antique incumbents need to be cast aside. This goes both for politic and tech
Use Firefox, @ublockorigin and @noscript and containers. And a vpn. Or Tor. Job done surely?
Is Tor still ridiculously slow?
It depends. But if you run a relay it helps :)
Gah. When did this happen? I downloaded the latest two days ago and didn’t have to login.
so you can't refuse anymore this data being collected? that doesn't sound very GDPR compliant
Thanks for sharing I never logged in chrome. That's a good start, but is this opt-out, or is chrome requesting explicit consent for all these before enabling it?
Thats last nail, i will better migrate on firefox and try to run my own sync server, than drowning more and more in this "cloudization" of quite sensitive personal data.
There is a setting, when logged in, to sync or not sync any of several categories of information, and to encrypt the information with a password that google says they don't have. So "can include" should be read as "can include, unless opted out", right?
What’s the guarantee that won’t change either?
I guess that's the rub. The privacy policy discloses that they "can" collect it, and does not refer to any ability to opt out. So when we see a setting that looks like an opt-out, how do we know the same information isn't also collected elsewhere in the system?
The new Firefox browser, incidentally, is really good, IMHO.
Been using Safari a lot lately and been pretty pleased to be honest.
Same Same
switch to Brave?
The problem: most people don’t understand the language used to describe this lot. Like the U.K. Govt using “it’s only metadata and your connection history that we collect, not the actual content” - Bury it in t&c’s and make it sound benign. It’s not.
No. Still U.K. - we await the revisions documentation to comply with EU mandate (due Nov?). I’ve had meetings with MPs on the ctte responsible and raised numerous concerns to have the metadata phrase used many times in defence of the act.
What we need is an app that will drive browsers to all sorts of sites to make the collected data useless.
Did Chrome actually remove the unique ID that was meant to track an installation?
Chrome to ditch unique ID, sort of
It's mostly sizzle and not a lot of steak, but Google plans to remove the unique ID that had been annoying data privacy advocates after the first update check.
download.cnet.com
I tell my browser-based app clients never to use Chrome, but they all do it anyway.
With the brave-core brave.com/download-dev dev channel release rolling to beta then stable channels, people should be able to switch from Chrome & keep their bookmarks, extensions, etc. Still working thru some of this in dev-channel rapid release. Early-adopter testers welcome.
Download Dev Builds of Brave | Brave Browser
The Brave browser is a fast, private and secure web browser for PC, Mac and mobile. Download now to enjoy a faster ad-free browsing experience that saves data and battery life by blocking tracking software.
brave.com
How do I stop Brave from forcing downloads of PDF files? I just want to open them.
Cc guys: it also doesn’t open flash calendars we use for scheduling that work on other browsers.
I wonder how it will affect government's getting access to this data?
Does this concern every country or just US?
... which is... logical and totally fine. (except for the forced login thing)
i use Vivaldi and am able to install Chrome extensions... is chromium based.
i think i only rock chrome if i wanna use google hangouts and that's just cause i think it works the smoothest in that broswer but I have ... ZERO evidence to support that feeling lol.
stupid move tho
Chrome doesn’t appear to be forcing me to log in (yet?)
So you have to login to browse? Do you have a link? Info seems to be scarce AFAICT
Would you consider Firefox as a permanent alternative?
and this is why i absolutely hated it when Signal tried to force Android users to download the app through the Play Store.
i get that you don't want to encourage users to install security apps from outside the app store, but it's harmful to actively try and prevent it :/
This is taking paranoia a little beyond the norm.
There is also this supercookie sent to all google websites by the browser. Clearly illegal all over Europe...
(But don't hold your breath, no national data authority is going to do anything quickly...)
I get your point but right now there's no alternative to Android. Don't get me started on that Librem BS. Apple, lets not comment on that garden. Ubuntu did try. Blackberry original OS? I could probably drop most Google services but what about youtube? I'm all for privacy...
But I need alternatives. This is from someone who enjoys reading about this stuff, now imagine people who really don't care about the topic. I think more education is necessary, including calling @Google on their bullshit.
i have a flip phone, not familiar with mobile OSes
for email i use gmx(free email server based in germany). i set up a custom autoreply on gmail letting those contacting me know of my new email
google is an advertising company
My guess is that Chrome will soon block third party cookies, so Google has to use other mean to track people on the web.
They already use a custom header for A/B testing: google.com/chrome/privacy… The header is set even when cookies are blocked (but not in Incognito mode).
Google Chrome Privacy Whitepaper
Google Chrome Privacy Whitepaper
google.com
All these comments about Chromium, here and at HN and /.. What’s so great about Chromium that Firefox or Brave can’t match? I’ve used Chrome for dev work, but I don’t understand the allegiance to the product. There are VERY viable alternatives. Some might say better.
I get what you're saying but you don't really *have* to log into the browser, in order to surf the web. As long as you don't log into a Google account (Google, GMail, YouTube, etc.), you're fine. Of course, I use neither them nor Chrome, so it's easy for me, I guess...
Firefox.
i really like trust the /security/ of chrome but don’t like this (at all). think i’ll just start using gmail/gdocs from firefox and everything else from chrome. pain but worth the overhead to me
s/like trust/like and trust/
I agree with you, it is atrocious design.
But I'm not upset about it because nobody is holding a gun to my head and making me use Chrome. Nor anyone else, anywhere, ever.
Chrome is an optional product. It is not a human right.
You're still right though.
Alternative explanation: users in the signed-in state have higher satisfaction with the product and are less likely to switch to other products (sync makes a browser "sticky").
I thought the obvious reason is that the vast majority of people want sync'd passwords/bookmarks/state across devices?
Alternatively, it's harder to phish you if you never expect to need to log in?
po-tay-toh, po-tah-toh
I’m heavily using Chrome for development, but for personal browsing my choice is Opera. Suprisingly don’t hear too many speaking about Opera why? Is it considered bad or insecure?
Even this bothers me. Upgraded to new iPhone - after installing maps and using it, Google abuses the URL Protocol to detect if apps are registered on a iOS device to send you an email saying "hey install our other stuff" - I never asked to be notified about this.
Apple changed the way the checks to see if other apps are registered, you MUST define in the app plist which app protocols you'll ask for - so Google has done that, just now they are abusing that to harass you to install their apps.
browser sync data is encrypted clientside, matthew.
If you go out of your way set an optional passphrase, some or all of your data will optionally be encrypted.
Think about the alternative. If I didn’t set a passphrase, what key would it be encrypted under?
oh, this is also changed recently then. it used to encrypt it with your sign-in passphrase. :(
(which of course has its own set of problems)
loss of privacy is a slow bleed out. the very young will mind even less as they will have never experienced actual privacy. keep this conversation going #EFF
That’s a common theme these days. Just came from a debate on Trump’s human rights abuses where a guy said unironically “he didn’t kill 6 million Jews.”
Google and Facebook?
I‘m not sure where this sentiment comes from. What‘s wrong with Fx security? Serious question.
In recent memory, just off the top of my head there's this: marc.info/?l=openbsd-mis…
There‘s a lot „I think“ and „I doubt“ and I‘m confident Theo does not have the full picture of what‘s going on (it‘s a biiig project). Firstly, security story is slightly differing on different OS so what may be true on BSD is wrong on Win, Mac, and/or Linux.
2nd, there‘s more than OS-level security measures. One ex. is, when IE/Chrome went multi-process (MP), @firefox was doing compartmentalization (name iirc) gaining similar sec w/o needing MP overhead. Reason was compat, among others. Since e10s, Fx has additional MP & sandboxing.
Thirdly, sec is a neverending story and multiple in-depth security features are in active development, e.g. sandboxing extended and process capabilities dropped over last years + it’s still worked on, with each release gaining more security. A lot is happening below the surface.
Finally, there is no absolute measure in security. One ex. Theo notes is in Fx but n/a in Chrome. Bottom line: There‘s things to improve in all browsers. Where one browser is better the other is worse, and one browser uses OS features (preferred) the other doesn‘t (not insecure).
... domestic violence sites, child protection sites, legal services...
The Google people I know who work on Chrome are all excellent folks. The fact that they view this login change as NBD indicates to me that they made a miscalculation (which hopefully they’ll address) or they were very successfully played by corporate management.
Beyond the technical discussion at hand, I do appreciate this perspective Matthew.
The single most tiring part of being at Google is that so many people jump _immediately_ from "A decision occurred which I don't like or don't understand" to "Well obviously they're evil now."
I reserve the right to mistrust Google upper management. But the regular Google employees are generally great people. When it comes to decisions that affect privacy or security, we outsiders can give them leverage with management by having a huge and well-earned freak out.
If you distrust Google for privacy, don't you use separate profiles for GMail and the rest of web even before this change? This is what I do. In such a mode there is no impact from this change. Signed in and sync status is per profile and it is easy to have separate ones.
And I'm asking as a general question, not trying to defend any feature or decision, since I'm very curious why folks who distrust Google for privacy use single browser profile.
Good privacy should be and needs to be the default. Power users and vigilantes have plenty of ways to protect themselves and always will. That’s not the issue. The question is, are we changing defaults for the better or for the worse?
It’s fascinating (and sad) to me that while Safari and Firefox move in the direction of better privacy by default, Chrome is moving in the opposite direction.
I purposely didn't want to discuss the new behavior, I wanted to understand Matthew's set up before this change.
You nailed it right at the end there: the question is whether we are changing defaults for better or worse. The Chrome team clearly thought they were changing defaults for the better for the vast majority of users, as their answers convey.
I think the simplest explanation, rather than all the Google developers suddenly decided to become evil, is that this is a really hard Balancing Act and they moved the notch in a good direction for lots of users but unintentionally in an undesired direction for others.
What do you see as the benefit(s) for the many users? (Honest question)
Frequently, closely related users (spouses, roommates, etc) will sign into Gmail or other services not realizing their SO is signed into the browser, and then their data may mix under one account because of sync.
This eliminates that common confusion.
But why does signing in to a web app sign you in to a browser? Isn’t that the problem, rather than people not *realizing* they did that?
Ask people on the street what a browser is.
Should we expect a Microsoft web app login to sign the user into Edge and an Edge sync signin to sign the user into all Microsoft web apps?
Logging into Windows 10 with your MSA provides SSO for Edge and apps.
When you say apps, do you mean web apps? I.e. you log in to Win10 with MSA and Microsoft auth cookies are injected into Edge?
Exactly that.
Are those cookies strict SameSite? Or do they include user identity when Microsoft is 3rd-party on other websites?
Fascinating question, I haven't yet looked. Given that SameSite support is newish for Edge, may have an opportunity here.
huh at this point it's more like signing into an OS than a browser :D
Signed in users have higher satisfaction and are less likely to get phished.
Do you mean signed in to Chrome sync or Google web apps? Was there a problem in signing in before this change? Or in staying signed in?
There are benefits (to the user, and to Google) to enabling Sync.
There was/is user confusion about what being signed into the browser means wrt the content area. This change simplifies that.
And yes, it probably increases the odds that the user successfully enables sync.
To be clear, I do not tap into the "Google engineers have turned evil" narrative. On the contrary, I think they feel the tension and worry about these things too. They are the people I hope will change Chrome's direction and join us to make privacy on the web the default.
Or in the alternative, someone is trying to make their next career breakthrough on the strength of some standout metric boost on browser account login engagement...
If you distrust Google for privacy and you use Chrome and GMail, there's a strong case that you don't distrust Google for privacy.
concern is with respect to the trend
Agree completely with you on this one. I do want to use Chrome without having to log in to any Google account. Other times I have multiple accounts I need to use at the same time. Let me choose please @Google
i think you are overreacting. the confusion from having different login states for browser and web apps is a big deal and this was a needed fix. for the tiny fraction that cares about this stuff, just login to gmail in an incognito window.
Did you try @firefox with multiaccount container addon yet? Works great for this use case.
But your argument is entirely non-technical. Even if Chrome works the way @__apf__ says it does and this has no privacy impact, you’re bothered by the UX.
Yes, users react to UX more than actuality. But is that good? Can’t you (CS Prof) help them identify which risks are real?
I’m annoyed that this argument is *entirely* about perception. Yes, UX matters, but so does reality. If this has no privacy impact, can google improve the UX to clarify that? Or must product design always follow user assumptions?
Security UX is hard, but that users (understandably) misperceive a zero-privacy-risk change as being invasive is a UX fail, not an invalidation of the entire idea.
that's disturbingly similar with to dragonfly's strategy to ban anonymity
Google's rumored 'Dragonfly' search prototype tied data to phone numbers
While Google employees push back against and lawmakers ask questions about a rumored version of its search engine for China -- with censorship and blacklists fo...
engadget.com
For instance, this is a really low-key way of describing something dystopian support.google.com/google-ads/ans…
I wonder what is the difference between the "I've just realized that corporations may be left-wing so now I want privacy" guys and the "No way, if the left wants privacy then I want the exact opposite" guys. Is it just the difference between conservatives and fascists?
Or then there's just the open partisanship, excluding people from a platform because they want the other "side" to lose. Twitter and Facebook for instance, which should be dismantled.
James Woods Suspended From Twitter Over Satirical Meme That Could "Impact An Election"
Nu-males are apparently quite gullible...
zerohedge.com
I'm not sure if this really tells me anything. I already know about the conservative gibberish and the tortuous attempts at distinguishing between theirside "open partisanship" and ourside "open partisanship."
But why did you choose this position instead of the other one? Are you just bouncing around at random and these are the ideas that happened to stick? Do you have a principle? Did this seem like a politically more effective thing to pretend to believe to own the libs?
The first of the two positions that I was talking about earlier. (And who in the world thought that Google's neoliberal politics were not in the open? It's not their fault if you fell for that "virtue signalling" theory where everyone was supposed to be secretly conservative.)
Hang on, I mean "signaling" with one "l." Sorry, the last person who yelled it at me was Australian or something.
Right, my fault for asking, obviously your position on that issue is not going to be any more consistent than anything else you say. And of course you didn't answer any of the questions. Oh, well.
Actually, here's another question that I'd like the answer to. In the mid-2000s, conservatives and right-leaning libertarians started writing politically insulated, unconvincing arguments. The obvious problems that I see with the argument don't even seem to have occurred to them.
And whether they agree or not, if they want to convince me, they had better at least think about my objections so they can refute them. So they are failing. How and why did they start failing? What was different before?
Feel free to respond to this with a post complaining about Google like your brain doesn't work.
Do you actually use real information? They can collect all they want from me. All they got is a John Doe with some usage patterns.
They still use your patterns to feed their algorithms to better draw conclusions about other people.
At least there is still an icon, I guess >.>
given how rigorous Chrome's human factors research usually is, I'm guessing they've already determined that losing a few paranoid privacy whackos like you (and me) is outweighed by the benefits they get from having everyone under the "logged in" part of their privacy policy.
Xackly
That’s why you have many browsers to choose from.
I have nothing to hide. That said, I also have nothing I wish to share....
I'm pretty sure if you care about your data, you're not too likely to be using #Chrome in the first place. Use @brave @opera @yandexbrowser…
Then use a browser that don't give you the same mandatory login. You see it as a browser, @Google serves it as a browser service. To make that service work, you need to log in. There are plenty of alternatives.
Do you think Opera is safe to use despite Chinese ownership?
I wouldn't use Opera now.
Banks have told me no, but just based on risk assessment not evidence
It’s amazing, the radio silence on this. @karaswisher
The brave browser also allows for private tab Tor connections
Sure thing, no YouTube for you! :-p
Seems like @stshank's beat. Agree it's troubling.
sorry to disturb.
...I can't even find a mention of this on Google News!?
Simple: move to Firefox
What do you mean by "mandatory"? On my work laptop, I use Chrome and never log in to any Google services. Should I expect this to stop working after next update?
This would not normally be my beat but I'm on holiday. I've alerted the boss.
So is this coming to Chromium?
You have my sword!
And my bow
What about chromium?
You’re not alone on the hill.
I agree with you that it is very stupid.
All things converge back to Kerberos & Single Sign On like what I do for my users in an Active Directory domain. Users don't like signing in all the time; too much friction.
I think we're on the same hill?
A hill worth dying on. It’s outrageous.
the desktop version of Brave is less secure than Chrome (it is based on Electron)
Brave is centralised, may as well be google really (thats a bit extreme but I like to be big picture).
In what sense is it centralised? It's a FLOSS project you get as binary. What do you mean by "centralised" in this context? Do you see BAT as being centralised?
If the Brave corp disapear then ads stop being served and $BAT goes to zero. The browser will keep working but its just any other browser with an adblocker built in. Their Sybil resistance (something bitcoin requires massive PoW for) depends on secret non-FLOSS algo they run.
The S resistance depends on the BAT algorythm. That is public, right? What is non-FLOSS about it? Is anything Brave-related proprietary? Sorry for all the questions :D
BAT gets paid to users according to amount of time they look at (“pay attention”) to an ad. “Attention” can trivially be simulated by a botnet which would then drain payers wallets into the attacker’s wallet. Brave servers run an algo to guess what attention is fake.
Ps, good questions - keep ‘em coming!
You asked for it! :D So my Brave history is not stored on the blockchain, right? There is some proof that I gave attention on the blockchain, but not the actual attention item. How does that work? Who stores my actual anonimized history and who can verify it?
It looks to me like BAT is Flattr with Blockchain magic sprinkled on top, not like a fully decentralised and anonymized Flattr implementation. Am I right?
BAT people keep talking about off the chain transactions and I really don't get how that works. Is the off-the-chain stuff also decentralised? is it centralised? is it floss? how can I trust it?
I dont exactly bump every day into a blockchain consultant that studied BAT :D
Just looked up Flattr, yes seems along v similar lines.
Off-chain txs can be decentralised (see Lightning Network amd Raiden) or centralised (Brave, Coin exchanges).
I’m not against the Brave model I just dont see a huge amount of value in it and certainly not in the same category as cryptocurrency. Its like a supermarket points scheme bit for some reason trades on the open market. @maidsafe is where I pin my hopes for this sector (& more).
Brave only uses blockchain (ethereum) to carry their token BAT, the rest of their infrastructure is traditional client-server stuff, so no attention records etc stored on a ‘chain. ‘Proof’ of attention is by means of an interaction between client and server (thus easy to spoof).
Guys, guys, beakerbrowser.com : a new peer-to-peer browser for a Web where users control their data and websites are hosted locally. @BeakerBrowser uses datprotocol.com It's the Web you know and love, but instead of HTTP, websites and files are transported with Dat.
Yes, this is more like it. MaidSafe have used beaker as part of their stack even.
I'll join you in that... and happy to keep you apprised of how my complaint to Keith Enright (Google Chief Privacy Officer/formal DPO for the purposes of GDPR) as well as German and Irish Data Protection Supervisory Authorities is going; ditto complaint to EU Commissioner for
Competition @vestager is going (writing this one atm).
The fact people at Google seem not to get the problem is frankly baffling to me.
(No comment)
Switch to Vivaldi or Firefox
Obviously, but wanted to make you aware of this travesty. :/
I am reading all this on a Chromebook. So I won't comment ...
Hey, I have a Chromebook, too, but there I actively make that choice and the whole system works that way. You don't agree binding the normal desktop browser to the service account is... bad?
better to just use Ubuntu, period
Is chromium still viable?
I'll join you.
Cue Metallica - For Whom the Bell Tolls
For Whom The Bell Tolls
Provided to YouTube by Audiam (Label) For Whom The Bell Tolls · Metallica Ride The Lightning ℗ Blackened Recordings Released on: 1984-07-27 Auto-generated by...
youtube.com
I'm there with you. There's a difference in (my) intent between logging into Gmail using Chrome and logging into Chrome for browsing purposes. The first (Gmail) does not imply the second and I should explicitly be able to make that choice.
I don't think the Big G has a black ops team yet. You're safe for the moment.
Google has gone full Napoleon.
Been using Brave for a while, idk seems okay claims it's saving me time and tor
the desktop version of Brave is less secure than Chrome (it is based on Electron)
Figured too good to be true fml
Brave 1.0 switches to Chromium (like the Android version), so you ought to be fine with that when it is released
Desktop Brave is useless - Chromium with UBO installed is far more secure and better at blocking ads and other malicious content. Mobile Brave is only useful because mobile Chrome lacks support for extensions and mobile Firefox is unusably slow.
haha, that's the same reason i use Brave on Android :)
i use Firefox on my laptop, but it consumes the entirety of my 1GB RAM on my phone :(
Not just memory - mobile Firefox lags and glitches horribly (temporary low-res views scaled up, tearing that lasts >1 sec before update, ...) on basic scrolling in Twitter. Something is badly wrong with their rendering and input handling processes...
Never had any issues. Upgrade from flip phone maybe?
4GB, 8 core, doesn't flip.
Please file bugs with your hardware configuration on bugzilla.mozilla.org. You can help to solve this issue!
Bugzilla Main Page
(no description)
bugzilla.mozilla.org
Get a new phone. Android 8.1 Oreo here w 3GB RAM, and between Chrome and the OS I often have 1GB to 800 MB left for running apps. Seriously, you can't use Android + a web browser with just 1GB of RAM nowadays. 2GB is barely enough.
you totally can, because i do.
to load static pages and ocassional googling, yes. Try having several simultaneous AJAX apps..
Curious what you folks think of SRWare Iron.
Got any evidence we miss blocking stuff uBO blocks? ICYMI, news on “more secure” front end (we use same chromium back end as stable Chrome): twitter.com/brendaneich/st…
Brave-core is same code as Chrome, shares blocklists/rules with uBO but in C++ code not JS, adds further defenses.
We forked Electron long ago as Muon to fix things, but now we are (dev channel self-updating builds out at brave.com/download-dev) rebasing on chromium front end & dropping Muon. All extensions work, no Google accounts or sync. Brave sync coming soon encrypts w/ user secret key.
Download Dev Builds of Brave | Brave Browser
The Brave browser is a fast, private and secure web browser for PC, Mac and mobile. Download now to enjoy a faster ad-free browsing experience that saves data and battery life by blocking tracking software.
brave.com
Twitter and Facebook ads, for one.
I never see any ads in either with desktop Firefox and UBO. With mobile Brave they're both full of "promoted" posts.
does uBlock in Firefox block promoted posts on *mobile* Twitter?
Indeed, it doesn't seem to in mobile view, but it does seem to with "request desktop site" for mobile[.]twitter[.]com.
Brave permits 1st party ads and promotions. Promoted posts w/in Twitter, FB ads w/in FB, Reddit ads w/in Reddit are permitted under our current default blocking rules. Future releases will allow for users to block those ads as well, if users choose to do so.
If publishers run 3rd party tracking in a 1st party ad, we block the 3P request.
If a publisher uses Google Analytics or Google Tag Manager, we block those requests.
We'll investigate the report here, but I wanted to provide context around our blocking.
Additionally, "desktop brave is useless v uBO with Chrome" is false.
Brave includes, by default:
Https everywhere
Ad blocking
Tracking protection
3P fingerprinting protection
Also:
-Gutted Google "phone home"
-Tor in private tabs.
-Integrated opt-in utility token platform.
Also:
Cryptojacking protection (default)
If you want to just block things, that's one course.
If you want to block the problems and be part of a movement toward authentic user consent that doesn't leave content creators and publishers in the cold, then we're here.
Comparisons, to other browsers and extensions are always going to be there, but we are aiming higher by creating a viable, mainstream-friendly alternative for a free web where creators earn, without the user's privacy invasion being a "cost of doing business."
We're not throwing abstract vaporware unicorn white paper hopes out there for debate, either.
Consistent execution:
- Zero-knowledge publisher contributions in wild since Sep 2016.
- Integrated utility token since Oct 2017.
- Over $2M USD in rev to publishers in 2018.
Not trying to get into lists, but w/ "no better than chrome+extension", context seems appropriate. We take privacy seriously. We take publisher concerns seriously. We are tired of the BS that has become the surveillance based monetization model. We aim to prove w/a better model.
Something else to mention: ongoing research to automate exception management, protect against bounce trackers, and minimize false positives in blocking. We are working to minimize the burden on users of today's ad/tracker-blockers. brave.com/brave-proposes…
Understanding Redirection-Based Tracking | Brave Browser
(no description)
brave.com
Is providing random info to trackers and saturate them with noise a good approach? Just blocking them doesn’t seem to work
No, if you load 3rd party scripts, you're already tracked and also you take a big performance (network=radio/battery, memory, page load) hit.
Sending noise back runs real risks of being labeled ad fraud, which affects not just you: it's how Google justified banning Ad Nauseam.
Why do you say tracking protection does not work? It definitely works, and while there are many ways to track, the point is to raise the cost of tracking high enough that other, better paths forward -- inculding @AttentionToken -- thereby win.
Because you then have to deal with the blocker blockers and a so on. It’s an endless arm race.
No, that's false analogically (arms races can & do end, not always well, but they end) and also because browsers define ground truth for remote scripts. See motherboard.vice.com/en_us/article/…. Long before such an apocalypse, better tech such as @AttentionToken will rise to replace bad tech.
Princeton’s Ad-Blocking Superweapon May Put an End to the Ad-Blocking Arms Race
An ad blocker that uses computer vision appears to be the most powerful ever devised and can evade all known anti ad blockers.
motherboard.vice.com
A massive network of fake clicking sounds like the right way to destroy adtech.
Sad to say, those networks exist. >= $16.2B taken last year in US from $80B+ gross spend. You have to realize how co-dependent the whole ecosystem is, from Google down. Marking fraud to 0 could hit G bottom line by at least $9.6B. No one wants this, everyone takes fees for fraud.
I sure as hell want this.
I do too, rhetorical device aside. "No one" means the vested interests, starting with Google and Facebook. In spite of protests to the contrary, and I'm sure sincere intentions among some of their employees. The bottom line hit would trash the stock price.
It would be a beautiful way ro to about it, but unfortunately the problem is larger than clicks and noise.
Data Management Platforms will track different parameters from the noise and will ultimately find out more about the people that are adding the noise.
It's easy to filter out noise, indeed. The NHT (Non-Human Traffic) problem is much more sophisticated now: fake and convincing clicks, mouse moves, even some mobile device motion-sensor fraud.
If that's the case then real clicks from browsers with any degree of tracking protection wouldn't get counted...
Let it be trashed. I lost all interest in the continued existence or success of Google when they failed to use their power to vehemently oppose this administration, cementing their decision to drop "Don't Be Evil".
The way to do that is to block diligently. The auto-login-to-browser from logged-into-gmail state change is a "tell" -- they are getting squeezed by GDPR and to some extent ad/tracker blocking (660M+ users w/w). Keep the pressure up and rising.
Adding noise will result in these companies standing up newer, more invasive tracking, which is already happening as a result.
If you want to destroy ad tech, stop feeding Google's browser with your data.
Google is half of the ad tech duopoly.
half or more like 60%.
And increasingly important to throw Amazon into the mix...
Maybe you’re right and we have to go for the head of the Hydra. But there’s #FB too...
There are many trackers, from huge to tiny. We block lots and so do other solid blockers such as uBO. Gird thyself.
Are 3rd party scripts a part of browser add ons?
Don't load & give fake info to trackers you encounter. Share them p2p with an army of users who will automatically fake view & click them.
You have to load them to share them; these scripts use fingerprinting as well as cookies/equiv. to track users. If you build bots to browser and collect (we do), you'll find it costly to perform ad fraud. @WhiteOps busted MethBot doing $3-5M day by fooling ad buyers into paying.
MethBot used cloud infra (in at least Texas and Amsterdam), fake pub sites, fake headless browser users. It fooled the anti-fraud pixels/scripts bundled with ads to attempt to prove humans viewed/clicked. Impressive work, big cap-ex -- but fraud take was bigger and made profit.
whiteops.com/methbot has details but (of course) leaves out which ad exchanges were (unintentionally) collaborating with MethBot for a fee. The ad "buy side" is CMOs who have to spend budgets, can blame weather, salespeople, tech on low sales. Fee takers loot this gross spend.
The Methbot Operation
Uncovering the largest ad fraud operation ever
whiteops.com
Estimates say Google and FB take 90% of gross spend, and almost all incremental spend. Say G takes 60%. If 20% is fraud per @acfou and uniformly distributed, $80B * .6 * .2 = $9.6B fraud-fees. No one wants this to go away.
(Almost no one -- we do, and woke publishers do as they get screwed by fake pub ad fraud and "re-brokering".)
Now, to your point: if you can fund a similar-scale operation & not get busted, would you really stop ad tech? Or would you rather just help fee takers loot CMO budgets?
The idea that G is slurping up 90% of ad revenue is obscene. It’s a huge disruption in the ad industry & makes it impossible for those trying to make independent ad sales. But to me, the bigger issue seems to be if you’re not a G approved publisher, search ignores you.
Not 90 but > 50%.
Both are valid points.
Google search has become more and more of a pay-to-play member's only club.
I'm not clear on the mechanism here. I have a site ranked first above the "dot com" for its search term, with absolutely no SEO. But plenty of old non-commercial content has gone completely unlisted from Google.
Example: A decade ago, a small business could stretch a $100 adwords buy to last up to 60 days by tweaking rank & search term and get results. Thanks to the G stranglehold, small advertisers can easily spend $100 a day without a single new customer.
Sorry, but are those fraud fees you mention? Looks like the stew is thicker and stinkier than I thought
The fees take from the gross spend, at each gross-to-net hop in the "Lumascape", yes. Hence the term "take rate". Intermediaries lie about fees by understating gross they receive, and stiff downstream payees. It's a rotten system that needs re-intermediation via users/browsers.
It's only fraud and only costly if you have to deliver the fake clicks to parties you want to benefit. If you just want to burn the whole ecosystem to the ground it's less complex.
This is not how click fraud is accounted for.
Specifically, if you do not work to fake humans well, then current anti-fraud tech used in ad-tech to discount "non-human traffic" has it easy. So you end up having to build stuff on par w/ MethBot, even if you do not defraud publisher revenue shares. And fee-takers still profit.
Just run visits to random sites found by peers in sandboxes, click some ads, then don't repeat on same ad networks for a good while. Utilize massive distributed effort. Optimize use of CGN IP addresses where ad network can't identify multiple fakes from same IP as same client.
See my more recent replies.
Would it make sense to run the browser in a container with a “fake” environment that gets rest on every session? There must be a way to load their dbs with crap making them worthless...
You can do this but it'll cost you. Most users want faster browsing and longer battery life, not the opposites. Sideways link:
The way to do that is to block diligently. The auto-login-to-browser from logged-into-gmail state change is a "tell" -- they are getting squeezed by GDPR and to some extent ad/tracker blocking (660M+ users w/w). Keep the pressure up and rising.
Some of our folks use @QubesOS and so isolate browsers very well. This is not going mainstream soon (don't shoot the messenger).
Aside from Tor in private tabs, which of these do you claim UBO lacks?
AFAIK and please correct if wrong, uBO (which we admire & learn from) does not include HTTPS Everywhere (Privacy Badger does).
From github.com/gorhill/uBlock… it looks like uBO does not stop fingerprinting -- again, corrections welcome.
Suggestion: Canvas Defender · Issue #1696 · gorhill/uBlock
Add to ublock the same functionality that canvas defender has [Important to read] https://multiloginapp.com/how-canvas-fingerprint-blockers-make-you-easily-trackable/ https://multiloginapp.com/canv...
github.com
We also:
- love bug reports and GH issues.
- appreciate and welcome being called out on suspicion.
- enjoy these types of threads.
- have a security bounty program, & welcome participation.
- see the web as a big place w/ a lot of options; high respect for uBO & others.
Promoted tweets generally miss the mark for me too.
Yeah, we will add options for first party ads — but so long as we block any tracking capability they have, we try to let pure first party content alone. Fine line in certain cases, and users always have right to block, so we will enable. Thanks for the info.
I think "first party" gets hazy when the actual site you're trying to use is an advertising business and you are their product. I would not object to first-party, tracking-free ads on a news site...
But Twitter or Facebook or Google is very different. They're just big enough to do 3rd-party ads in-house as "1st-party content".
Agree in general. Turns out Google search ads in Brave are cleanest things on the page (organic links track which you clicked; harder to block this tracking, too).
We forked Electron long ago as Muon to fix things, but now we are (dev channel self-updating builds out at brave.com/download-dev) rebasing on chromium front end & dropping Muon. All extensions work, no Google accounts or sync. Brave sync coming soon encrypts w/ user secret key.
Download Dev Builds of Brave | Brave Browser
The Brave browser is a fast, private and secure web browser for PC, Mac and mobile. Download now to enjoy a faster ad-free browsing experience that saves data and battery life by blocking tracking software.
brave.com
How is sending a combination of your identity and your browsing history to Google secure?
ok, enjoy remote code execution vulnerabilities then? i didn't say that you had to use Chrome :/
I’m not saying Brave is good. I’m saying that calling Chromo “secure” makes no sense
Chrome is an incredibly secure browser (e.g. sandboxing)
that's tangential to whether it sends all your data to Google
I think your focus is overly narrow/technical and doesn’t take the user into account. For one thing, are we really saying that there’ll be no data breach or misuse of identity+browsing? For another, Google blowing away its privacy policy doesn’t give me a sense of security either
We forked Electron long ago as Muon to fix things, but now we are (dev channel self-updating builds out at brave.com/download-dev) rebasing on chromium front end & dropping Muon. All extensions work, no Google accounts or sync. Brave sync coming soon encrypts w/ user secret key.
Download Dev Builds of Brave | Brave Browser
The Brave browser is a fast, private and secure web browser for PC, Mac and mobile. Download now to enjoy a faster ad-free browsing experience that saves data and battery life by blocking tracking software.
brave.com
Argon2 > bcrypt ;)
We need Tor in mobile too!
Love the work you're doing at @brave! Please free us web users from the surveillance cesspool 😵
I’d love @brave more if they could speak Yubikey.
Other’s that, I definitely try to use it whenever possible.
Also add in their “we want to do away with url” nonsense. The chrome team is very full of confidence in everything they do is right.
The URL thing is at least arguable. The decision to force logins (for non-logged in users) doesn’t even have a reasonable justification.
Maybe - but google doesn’t get to make that decision for the internet. It is just more of the “we are big, try and stop us” attitude that is part of this. It isn’t good for users. They’ve done good security stuff, but privacy is atrocious.
(No comment)
So how do I know which site I’m on? Check the certificate and refuse to visit sites without https?
They may well be following Safari’s lead on that one. Safari has been hiding most of the URL for years and fans don’t seem to care
Safari seems to be thought out. ie they show the host and toss away irrelevant bits so scammers can’t have long subdomains to appear to be “google dot com” - even dropping EV displaying the company name in favor of the host name.
I'm surprised I haven't seen more people complaining.
I wish some reporters would cover it.
Any reporters in particular?
All of you guys :)
(No comment)
Maybe most people who care about privacy don't use Chrome in the first place, so they didn't even notice... 🙃
So many people don't know/understand the implications. "I never thought about my health insurance going up because they have proof I only search for recipes that are not 100% healthy"
Or they feel the "compelling feature(s)" are worth the *possible* risk. Because there is "no proof they are doing such things" they ignore this issue.
I always felt Chrome's discrete user functionality was silly, why not just leverage the OS' ability to switch users, no one was asking for multi-user browsers, but people seem to like it.
It's another example to me of how the browser has become an OS of its own
Well, lots of people seem to think that webpages should be programs that show content as a side effect, and not content that has a little bit of markup....
I don't know that I'd agree there's been conscious thought about taking browser in that direction. Seems to me market goes where resistance is least, and that, for a variety of reasons is browser.
But I agree that's destination. And it's woefully unprepared. All JS unsigned
I think it is deliberate, at least by the people who see users as the product, and not the customer.
To these people, content is the lure, not the purpose, so code signing doesn’t help.
Well both conditions can be true I suppose. The browser offers the least resistance development environment just like https over port 443 offered least resistance to secure transport of applications/content. So the market used that to mine the product which is us.
Always we take the broad and easy path, ‘tis true.
I use that functionality quite a bit to interact with non-Google environments in which I interact with multiple accounts (such as AWS)
If you've got questions about Firefox's security architecture or details, feel free to reach out. :)
Or for that matter, same offer - Tor Browser :)
(Possibly sensitive)
Yes, DOH is not on by default.
the blog post says "yet", does that imply that it will be turned on by default at some point in the future?
It's possible I'm sure, but there's no decision made about it as far as I know. We're aware of the sensitivity around this so I'm sure anything we do will be done loudly and keep users informed.
thanks, i'd be extremely disappointed to wake up one day and realize my browser was disregarding my decisions about which dns servers to query.
(btw, do you know why firefox/chrome implement the padding extension for client hellos?)
Not assertively, but isn't that the only way to pad the encrypted part of the handshake?
Hi, does Firefox still accept Third-Party-Cookies as the default setting?
Think of it as adding "yo FYI you're currently logged in to Gmail" in the corner of the browser window. That's what the feature does. It's different from the feature you seem to be talking about which we call sync, that has privacy implications.
Adrienne can enterprise users turn the feature off? Or is it off by default w/enterprise MSI?
We in the enterprise have other methods for that😈
I just don't want users who choose not to use Gmail to be forced to sign in if they do like Chrome
If you don't use Gmail, nothing changes.
Are you saying that if Sync is disabled AND User is logged into Gmail/Google, that Chrome isn’t now pinning identity to your entire browsing session?
Tying my browsing history to an identity *implicitly* has privacy implications, even if I somehow avoid the option that uploads this data to Google.
But they did that anyway, they now just show it in the browser?!
What are you referring to. Google site cookies?
I don't understand how this is tying browsing history to identity if it's just a visual indication of login status. That's just "is there a valid session cookie"
But that’s not what it is. It is quite literally an authenticated relationship between the browser software and Google. I can’t speak to the details but I’m sure there is at least an occasional authentication dance, or there will be in the future.
Adrienne is saying “as long as you don’t turn on the ‘upload all my stuff to Google’ features, this relationship is not practically much different to the user than a Google login cookie with an added visual notification feature.”
But she’s not saying the two ideas are literally equivalent. If it were literally equivalent then it would not be possible for me to accidentally touch the “sync” button and have my data on Google’s servers. This is a real browser login with whatever implications that has.
The problem is that once the browser logs in, a bunch of machinery I don’t fully understand (and even the Chrome security devs admit to not fully understanding) may turn on. Adrienne is saying that she’s confident that won’t include data upload: for now.
And these things may be different even now. Consider:
1. Using a browser with sync off
2. At a later point, turning sync on
Does my history from time period (1) get uploaded to Google during time period (2)? The Chrome privacy policy is ambiguous for “signed in mode”.
Sorry to rant at you. I just think the Chrome devs are underplaying a major change, and their answers don’t seem to properly reflect the magnitude of this change.
Isn't chrome open source? Why don't you spin one up for yourself?
Google products (all of em) provide me convenience so I use it knowing, of course they will store my data to provide me with better exp.
I understand what I am signing up for. Guess GitHub if u don't want it.
Looking at the source can only tell you how it works now, not how it will work a few versions later.
+, there's no way to turn off autoupdate, is there? IIRC there used to be a way in the past, then somehow every1 got pushed updates anyways!
1. Not all parts of Chrome are OSS.
2. Did you ever try to compile Chromium?!
3. "We can do whatever we want, compile it yourself" is not a valid approach when the vendor have almost complete dominance over the market.
You're fine. I generally find Google to be good at protecting privacy and give them the benefit of the doubt (and use Chrome Sync anyway) but it's important for there to be people calling them out and keeping them honest.
They'll invariably keep changing it to make it worse, it's about the velocity here as well
I use Chrome exclusively (tweet this week👇). This change can be a dealbreaker, same reason I stick to iPhones. Breaks trust, wastes time going over implications.
Yep, I know, that's exactly why I want to use it. But it was a dealbreaker for tab explosions. The web and use cases evolve fast; Firefox, Safari, even Edge have amazing tech; only Chrome can I trust with workflows over time.
I always clear browsing data from the beginning of time before logging in
So are you saying that the privacy setting in my Google account to specifically NOT include Chrome history is bullshit? And are you also saying that they are not encrypting sync data? If not I’m not getting the beef here (not a reg Chrome use anyhow)
Neither of these things is being claimed here. OP wants his browser to be a dumb web portal and be able to log into other Google services without logging into Chrome.
FWIW I also don't get this.
There’s also zero chance that google isn’t doing this “cosmetic” change now as a half step towards enabling sync later with less outrage.
Not calling anyone fascist, but that literally fascism 101, which we’ve been getting a master class on anyways.
Since when not understanding a bunch of machinery has forced anyone to abandon HTTPS being stuffed down our throats?
The problem is that once the browser logs in, a bunch of machinery I don’t fully understand (and even the Chrome security devs admit to not fully understanding) may turn on. Adrienne is saying that she’s confident that won’t include data upload: for now.
Ummm...https is a good thing, in all cases, full stop
Yeah. No, it's not. Many cases where https interferes with legitimate functions and redirect-to-https acts to restrict access unnecessarily.
Among other things, it certainly gives them the ability to infer close personal relationships where a single Chrome install is used by multiple parties...
They are saying they aren't doing telemetry with this, just giving you an icon that says you're logged into Google services. The opt-outs for sending telemetry data are separate. That's what would give them the ability to do what you are describing.
They don't necessarily have to track your browser history from your machine. Think about how far Google's reach is and how many sites use Google Analytics.
Now pair that with a verifiable token from the browser that connects to those sites and the dots are easier to connect.
Well, did you also realise that they're sending your browsing history to Google while you're logged in?
If you look up just a few tweets in this thread, you've got a manager on the Chrome team saying that's false.
I was pretty surprised when I checked the history Google has about me and noticed that the other day.
That doesn't mean this feature is at all related to that.
I think it does.
Sounds like I should not merely avoid Chrome but delete it from my machine. Gawd knows what it’s doing.
is it still true that google sees nothing when using a passphrase for my sync data? btw I feel like you've really jumped the shark this time, I had enough of this surveillance shit
I never pressed the sync button, yet my browsing history was uploaded to Google.
If that's really all it is, this is a big UX fail - that's not what it looks like. Bad UX erodes trust in privacy properties of a system even by just making it *look like* a violation is happening.
But that's not what logging into Chrome previously meant, so why use this indicator in a wildly different way? A user shouldn't have to look at her picture and say, "wait, am I *really* logged into Chrome or just kinda logged into Chrome?"
...I know that Google's pretty non-NT in ranks, but soon enough you guys are gonna realize that perception is reality the same way Facebook did.
It's not a tech issue. It's a trust/perception issue, and you guys are gonna have to learn to respond to such things w/ comprehension.
This so this. I work in tech, I have a very decent grasp of security for a non-infosec specialist. I have no time or inclination for minutae of what it is, "no change if you don't use Google services"? WHAT?? 😱
I go by perception+infosec ppl. Facebook lost trust way before 2017.
I like chrome. I don't use gmail. Is it back to firefox for me then?
If you don't use Gmail, nothing changes.
So you don't have to log in?
No, you don't.
So you and matt are saying very different things here. Fyi, I use Chromium for things like Twitter, so I'm not sure what my daily use would give me insight to.
We’re saying the same thing. If you log into a Google property, Chrome will become logged in — even if you didn’t want Chrome logged in.
The only way to avoid this is literally never to enter a Google password into any part of the browser.
Oh! I see! I misunderstood your first tweet to be Chrome required you to log into a google account, the way Android does.
Is this a new behavior or just sufacing an old behavior?
It’s a new behavior AFAIK. It seems to me like they’ve adopted this as a softer version of mandatory login, in the expectation that most Chrome users use Google accounts at least occasionally.
In this case even one Google login, maybe by a friend borrowing your laptop, will leave Chrome indefinitely in a logged in state, I think.
Once you log out of Gmail, the browser logs out.
That's why I don't use Chrome. It's not that hard to not use.
Think back to firefox for me.
So if you sign out of GMail, your browser *stops* syncing, even if you want to continue to sync browsing history? How does this interact with passphrase-encrypted sync?
my Google and sync passwords are different. and now chrome says it's "Paused". i wondered what changed. looks like this new behavior did that.
That's "great". I use strong passwords for nearly everything, but now if I want to keep my desktop browser syncing, I have to either stay logged in to GMail, or memorize my sync password to avoid repeated lookups.
I know there's a feature for logging in to & switching between multiple Google accounts in the "web" area of the browser. I guess Chrome needs to handle the same complexity without data loss somehow. Forcing logins (vs a forced log-out) seems like the worst option.
Wait, you're saying that the Web login status and the browser login status are systematically in sync?
that seems like the idea; users don’t know the difference between “logged into gmail” and “logged in to chrome”
tbh i was recently surprised it DIDNT work this way... glad it is fixed
So the idea is that Chrome is treating Google Web properties preferentially, in the same way that Google Web properties are made to work just with Chrome. I guess it is a good time to milk the Trump administration's lack of interest in antitrust issues for all it's worth.
Lol and that's exactly why i don't use chrome. Why should it log me in that way? If I'm logged in, i know i am, if not I'll log out. It's not a friendly feature, it's deceptive, yur not just logged into gmail. your logged into everything Google.
Strange that google would do something silly like this, when already battling perception about privacy intrusion. What is the benefit for the user by tying the gmail login to the chrome browser automatically?
One of the things I've appreciated about Chrome is that the team limits the special casing that's done for G sites. Often a driving use case, but they keep their eyes on the whole web.
This is the first case AFAIK of explicitly handling G differently. Dangerous line to cross.
adrienne, is there a chrome://flags setting that can be used to turn this behavior off?
thanks. unless i'm missing something, this no longer is respected in chrome canary (71).
i've set as shown, cleared all data and restarted browser, but as soon as i login to gmail i immediately see that easy/lower friction "sync as patrick" button in chrome://settings.
Interesting. same here.
Wait hold on. Back up. Browser logs out of what? I didn't consent to the browser logging into anything at all. I only logged in to a web site
What is the browser logging into? What kind of data are you collecting as a result of the "browser" being "logged in"? Why did you not notify me that you were "logging me in" to this additional service
It synchronizes stored passwords, bookmarks, browser history, etc. to "the cloud".
WAIT, ARE YOU SERIOUS
Is it actually the case I log into an email client and Google starts *stealing my browser history and uploading it to them*???
as far as I can see: yes
No, you have an extra step to consent to be syncing to Google (this didn't change)
What is the result of the browser having "logged in" as apf describes above, what is "the browser" "logged in" to, and what kinds of data are sent to Google as a result of "logging in"?
It will reuse your Gmail credentials _in case_ you want to sync, but as I said, simply signing in to Gmail doesn't start syncing anything to Google.
Okay then what does it mean that the browser is "logged in"? And why were we not notified we had been "logged in" to something additional besides the Google website network? I should not be finding about this from vague statements from GOOG employees in a Twitter thread
The browser is logged in to your google account, not something else. It shows your google profile picture on top right when you're logged in.
Why is the browser logged into my Google account? I didn't consent to that
Pretty sure it asked me to log in to my Google account last time I installed Chrome on a fresh installation. I haven't done a fresh installation for a while, so I have no idea if that's changed.
Easy way around this whole mess use a different browser. @firefox is a good start 😎
From what I can tell, if you don't enable sync, being "logged in" to the browser "only" offers to let you log in to Google services without entering your password & use things like the Chrome Hangouts extension (etc).
They make it really easy to enable by mistake though. There's no "I don't want to enable sync" button.
I'm sure the team wouldn't want to have people enabling by mistake; I'll share your suggestion with them ("never sync" option).
they say above and in separate threads that sync requires a separate opt-in, but I'm not sure exactly what actions *are* on by default
I don't know or care what "sync" is— why are they uploading my data?
How long has this been going on? How much of my data has Google already stolen?
This is the latest update, so this is 2 weeks old. The chrome engineer in the first reply upthread is saying that sync is the thing that uploads your sessions / passwords / etc. and that doesn't get automatically enabled by this.
They've said elsewhere that this is a solution to their most common password leaks between different google accounts, but I feel like they could also solve that by just signing chrome out if you sign a different account into google, rather than signing the other account in.
I have to do some more testing... but I think I found another reason to avoid chrome even more now ;)
this is not the case.
Think of it as adding "yo FYI you're currently logged in to Gmail" in the corner of the browser window. That's what the feature does. It's different from the feature you seem to be talking about which we call sync, that has privacy implications.
These are two different things (still).
1. Being logged into one or more Google accounts in your browser session. This is an old behavior. If you log into Gmail and then go to Maps, for example, you're still logged in so any appointment locations you have in Calendar show up.
2. Logging into the browser itself, which allows you to sync credit cards, passwords, bookmarks, etc. across your devices. This is an optional step and you do not have to do it, ever (I didn't for a long time).
The useful thing about it is that you can create multiple profiles, some of which sync with different Google accounts and some of which do not. Guest and Incognito are in a lot of ways just profiles that don't log into anything.
I have a personal profile, which syncs to my main account but is logged into gmail/Google for both of my personal accounts. I have a work profile which syncs and is logged into google.com. And I have a Chromium profile for chromium.org.
The Chromium Projects
Home of the Chromium Open Source Project
chromium.org
All of them use different themes and have different bookmarks, etc. so I can tell them apart. I'll also drop out to a Guest profile for testing or when I don't want to be logged into anything (but don't necessarily want Incognito).
So can you guarantee to me that if I log into Gmail, the behavior of Chrome does not change other than displaying the current contents of the Google website-login cookie in the drop-down menu?
I open Chrome, I open several non-Google sites, I close Chrome, no difference from if I were not logged in to Gmail (other than possibly being tracked by Google advertising network cookies on those non-Google sites?)
I think a better way of looking at this is that a browser can be logged into multiple Google sessions. Previously, unless you were on a Google site, you had no indication you were still logged in or which account was primary. Now we show you.
Syncing your browser is a separate step which specifically syncs browser-specific stuff across devices, and you are never opted into that.
So there are two separate things here. One, I am logged in to Gmail/Google/the general Google network using cookies. Two, my *browser*, the application, is "logged in to Google", there is some connection between my browser and my Google account above and beyond cookies sent
The second concerns me because it creates the potential for account-linked communication with Google even when I am not visiting Google websites. I didn't consent to that in any way.
I do not know how Google ads and services on non-Google sites interact with your current Google session.
I am attempting to distinguish between actions taken by websites (possibly based on cookies, js storage etc provided by the browser) and actions taken by the browser itself, ie, the .app
I do not work on that part of the browser but my understanding is that unless you are logged into the browser, you get the same experience you would on any other browser (minus our awesome browser UI of course).
Testing in a fresh Chrome Canary install, logging into GMail put my Google avatar into the browser bar, but did not actually sign me into the browser (syncing) itself.
but that way of looking at it rather leaves out people who don't want to be logged in at all
Then don't log in?
We’re saying the same thing. If you log into a Google property, Chrome will become logged in — even if you didn’t want Chrome logged in.
The only way to avoid this is literally never to enter a Google password into any part of the browser.
No.
You choose whether to log into Google accounts and whether to sync your browser.
so you're saying I'm misunderstanding @matthew_d_green (or he is)? I'm going from the thread he did yesterday and today about the new behavior
With all due respect to M. Green, he does not work at Google.
sure; I'm just trying to understand from what he's reporting and the replies he's getting
because when the *browser* rather than the site shows login status, I too would assume it's the *browser* status shown so that sounds like not a good UI presentation
Think of it as adding "yo FYI you're currently logged in to Gmail" in the corner of the browser window. That's what the feature does. It's different from the feature you seem to be talking about which we call sync, that has privacy implications.
I'm bringing that up internally.
👍 I'm glad to hear the two things are still separate, the UI crossing the streams makes it easy to assume they're not
How do I tell if I am "logged in"?
I had thought this mysterious, creepy box that appeared in the menu recently was an *offer* to log in. Does this mean I am *already* logged in, and it is offering to enable additional services to me, a logged in user?
I didn't work on that UI. I can bring it up at work on Monday.
Clearly it's not clear to you so that's an indication we might want to explore how we're presenting the information.
It concerned me when it went up since it was not, and still is not, clear to me what it meant,, and I'm afraid I'll click on it by accident at some point (I use this menu often) and accidentally enable features I did not want to
Previously (and in my Android version of Chrome) there was a clearly labeled "Log In" button, which made me feel secure because it meant I knew I was not logged in. I now see neither "Log In" nor "Log Out" and am in an unclear state.
The drop-down only appears if you are not syncing, so you're not syncing.
I don't like that the button can't be dismissed. I'll ask about that.
I've started an internal discussion. Also fee free to file a bug or feature request at chromium.org.
The Chromium Projects
Home of the Chromium Open Source Project
chromium.org
Thanks
I guess the thing is it seems to me that there are many features associated with a logged-in browser, of which syncing is only one
So okay, you're not syncing— what *are* you doing? I have literally no idea how to find out what
The privacy group employee in the other thread seemed to be saying all it does is sniff your google.com cookie and display that name, but also said other things that seemed more ambiguous, and also a comment on twitter is not a policy statement
That is my understanding as well. The guy who did the toolbar icon thingy reports to me. I'll ask him 😀
Thanks for clarifying. So, if I log into Gmail, does my subsequent browsing history get synced to my google account ? (though I am not logged into the browser)
I'm pretty sure it does not. However, ads and Google services may still get information about where you are browsing.
Doesn’t everyone (Twitter, Facebook, ...) do that?
By the way — is one work around multiple identities? You have one logged into Google and you mostly browse from one where you don’t log in?
One workaround would be to setup a sync password on your Google accounts(s). If you login to a Gmail account the browser is then not able to log in using the same password 🙂
I'm on Chrome 69, and an interesting thing is that it's using the avatar from my 0 gmail account, but isn't actually showing me as logged-in.
("0 gmail account" being the one at mail.google.com/mail/u/0, as opposed to the one at mail.google.com/mail/u/1 or any other number. They're numbered sequentially based on the order you logged into google.com with in the browser.)
Here's what it looks like in Chrome 69 with chrome://flags/#top-chrome-md set to "Normal": note that the icon does *not* use the Gmail avatar.
Ehat does "chrome is logged in" even mean? That theres a cookie and an indicator of that cookie? Seems no different from before.
To be sure, is this phenomenon limited to only Gmail logins, or would this apply to any Google Apps (Drive, Docs, Meet, Picasa, etc etc)? Sure, we log in with a Gmail email address, but I'm pretty sure it's all connected. Everything in the Gsuite at least.
Even if they said it was limited to Gmail only (which would be bad enough) would you accept that as a long-term customer promise?
Nope nope nope.
You can still move to Firefox, chromium or other Free Software browsers.
It certainly is presented as more than that, which I think is the point @matthew_d_green is making. Putting my own face into a persistent top-level (IA-wise) part of the UI strongly implies that a remote account is tied to everything happening in that window.
To be fair being logged into every Google service has been true for a while.
I don't want a YouTube account. I had to either keep logging out of Gmail/Photos/Drive which I use and pay for, or just give in. I gave in.
if that's all what this is, what exactly is the benefit to the user in knowing they are logged into another Google service in a different window?
But looks like there is a new feature called "“Activity and interactions” link your browser history to your account even if sync is of: google.com/chrome/privacy…
This one also has privacy implications.
So if you sign into any Google service in Chrome, the browser also logs in and then the URL of every single page you visit on any website is sent to Google. Wow
If browser is logged into Alice's account and Bob uses it to log into his gmail, previously was the confusion that B's gmail activities get sync'd to A's browser history? B logging into via her computer is giving away his credentials anyway. A's gmail bookmarks opening B's mail?
So, what if I have a different Google acc for gmail and browser sync/android devices? Securitywise, this seems like a good idea.
wow. i want to know where you do security so i can stay far, far away. there is nothing good about google uploading everything you do to the "cloud". you should ask for a security job where i am contracted right now, sounds like you would be a good fit.
I don't understand. If it does that and nothing else, what on earth is the point of it? I'm not senile. I know if I'm logged in to gmail. Can you guarantee it won't start doing something worse in the next release?
You have yet to comment on the fact that you're forcing a different privacy policy onto people witj this change. You're also destroying people's trust. Once this gets picked up by media (and it will be) this is going to explode on reddit.
Doesn't @Google record my data for "making" "services" "better"? Google must warn us for their products explicitly.
not wanna troll you but I switched from GBoard to a 3rd party keyboard app(which I installed from play store) & android showed me:
@matthew_d_green, have a take.
That's not all the feature does. You’re adding hooks into Chrome to circumvent security/privacy features for Google products. One click can now upload a lifetime of personal data, ruining the lives and livelihoods of at-risk users - it’s unexpected and harmful by design.
Gonna side with Matt here, this is infuriating. I have many gmail accounts (work, home, etc) and only one has chrome sync enabled (obviously!).
Ive been going nuts trying to figure out why Sync has constantly been turning itself off!!
This is a misfeature, please reconsider.
You might want to try multi-profile.
Yeah, then i get to figure out why my work bookmarks are missing in my home profile and sweet jesus this is way more complexity than i wanted
It also sounds like it would make goofing off at work much more difficult
I'm not sure what you want. You do want your home and work to be mixed together?
I mean, thats basically my life
Just to be clear, i realized about 2 tweets ago that i'm mostly being old and cranky and resistant to change, and its mostly rationally indefensible
I recently demanded that I get off my own lawn, so I know the feeling
Why precisely does the browser specially get logged in when one logs into a google property? What’s special about google sites that the browser should have special behavior exclusive to them?
The point is being forced to login. Not the skin of convenience one less click gives u to access gmail
No surprise u don't get ur users!
regarding the change of behaviour, I've just filled a bug, since it breaks my workflow and opens a security issue
bugs.chromium.org/p/chromium/iss…
what was the last unfucked version of chrome? and yes, this is why i disable autoupdate and only manually update chrome; stunts like this from google or the "oh it broke, just hang out until we figure that out"
some of us use browsers to get our own jobs done. we're not there to be alpha testers or sources of ad data to resell.
Why not switch to another browser?
i am stuck using firefox, chrome and safari due to the incredible array of badly done websites that aren't compatible with all browsers... and using even more esoteric browsers just gets you the "gee, just use chrome" when it doesn't work
"just use another browser" without finding out my issue is about as useful a reply...
It was a genuine question since it seemed you were fed up with the issues. Your answer could very well have been „I can‘t“. I‘m interested to learn about your constraints.
i'm not fed up. i'm resigned to crappy web sites. what annoys me are browser developers making coercive changes that users obviously hate and object to because developers think they can. and mostly they can. and it sucks.
browser developers see the browser as the purpose. they've totally lost sight that browsers are supposed to be a tool for users to do things, not just use the browser as an end in itself.
Then choose a browser where you as a user have leverage. There‘s also options which allow customization. You can keep complaining or take action, either way.
you are naive. i have been fighting with and customizing browsers since mosaic. i have been a working professional for a decade before the WWW even existed. users don't have leverage. changing browsers won't make google less evil.
Sticking with Google services/Chrome will do the opposite, you allow Google to believe they can do whatever they want to without consequences (same for „lazy web devs“). Individual has little leverage obviously, but raise your voice and find others to follow your example.
i don't get to choose. the web site chooses and if i need that site/service, i'm stuck. i don't have time to tilt at windmills. i work for a living. if you don't get that, we have nothing more to discuss.
I certainly get that, being in an industry which is always a decade behind yesterday‘s technology (at least for anything that‘s related to computing). Luckily, there‘s almost always a choice in the webdev industry, so I‘m wondering what tools u‘re stuck with that u can‘t switch?
When you encounter broken websites, please report them at webcompat.com and help get them fixed. I understand it sucks but sth needs to be done. Out of curiosity, can you name examples? I have (almost) zero issues day-to-day.
you must lead a blessed life if you don't keep hitting crappy websites. and it's not my job to fix them, nor to live with bleeding edge browser features because web devs are bored and need to change things. browsers are a tool, not a lifestyle.
I understand and fully concur. Though just complaining unspecifically on Twitter will not change anything. If you report, someone will take care, and it‘ll only take you a few minutes, max.
I can’t get over how ChromeOS makes you log in with your Google password which means you have to weaken it for typability. Should set a local device password once associated instead. Local access and remote access are totally different threat models.
users don’t know the difference between “google chromebook password” and “google chrome browser password” and “google gmail password” sorry handwaving will not change this. most users’ google passwords are already memorized and typable.
I'm not sure how long they've had it, but I use a device PIN on my Chromebook just like on Windows 10. Might be some cases when I still need to type my password, though
See also: their boneheaded URL UI changes, with zero community input.
(They're either completely disconnected from broader society, or they know perfectly well what they're doing and they just don't care. I don't see any other explanations at this point.)
Google is an enormous monopoly. So of course they can do what they want.
I stopped using Chrome at work due to this, with having to edit URLs for testing / etc. Just annoying af
What about chromium? Does it require this too? If not maybe an alternative...
You could go to Brave.
Maybe this is one of the reasons why google removed the "don't be evil" clause...
Google Removes 'Don't Be Evil' Clause From Its Code of Conduct
Google’s unofficial motto has long been the simple phrase “don’t be evil.” But that’s over, according to the code of conduct that Google distributes to its employees. The phrase was removed sometime in late April or early May, archives hosted by the Wayback Machine show.
gizmodo.com
I share your exact same view. Don't want to constantly feel that Google is watching your actions.browser syn and gmail login should be different entities.anyways found a work around using flags. twitter.com/VaibhavSharma_…
if you are having a problem with Chrome,where signing out from gmail also signs you out from Chrome Sync the here's the solution:
1. Navigate to chrome://flags in the URL bar
2. Search for "account consistency" at the top of the page
3. Disable
4. Relaunch. Problem solved.
Workarounds aren’t the right solution.
Correct but at least you get to enjoy the old state till they completely remove it. Anyways I'll stand with you in this fight.
The 'right solution' is to choose another browser, if you will.
Sadly, there are actually web apps that require and design for Chrome.
Be part of the resistance and point out to the developers when a website does not work in your browser. That‘s the only way to change that situation. Even if that means migrating to another service. We must stop the next IE6.
The best workaround is to use Firefox instead. It has become a better browser over the past few months. Leaner, faster, and better privacy than Chrome.
Is the "Accept Third Party Cookies" in Firefox still set to "Yes" in the default settings?
Yes because it breaks some pages if disabled, and @mozilla is not yet willing to take the risk to change it. I’ve used „only visited“ w/o issues. But see twitter.com/asadotzler/sta…, section „Removing cross-site tracking“ for related built-in solution that you may find interesting.
When pop-ups got out of control in the early '00s Firefox took a stand and killed them all dead. Now Firefox is taking a stand against tracking on the web because it too has gotten out of control. More here:
Changing Our Approach to Anti-tracking – Future Releases
In the near future, Firefox will -- by default -- protect users by blocking tracking while also offering a clear set of controls to give our users more choice over what information they share with sites.
blog.mozilla.org
Ledger doesn't work in Firefox :-(
Chromium?
Not using Chrome is a viable solution. If we stopped dipping into their monopoly then they wouldn't think they can get away with it.
it's a post-911 world lol
The terrorists won, then.
"they hate our freedom"
I agree with this thread, but if you're into personal privacy, Google should not be on your list of solution providers.
Why is that? Nobody seems to be providing any proof of anything nefarious. And if I pay Google for email (which I used to), are you saying theyre snooping? That would be quite a thing if they were.
Don't worry, it's all legal.
(Wether the law is designed to protect *your* best interests or theirs is an entirely different matter.)
This response makes absolutely no sense at all. I get you're trying to be funny but I'm serious. I keep hearing all this shit about how nobody should use Google. I paid for G Suite like any other business would. I'd love to see some real proof of anything sneaky.
If you think I'm trying to be funny you are not "getting it" at all. Not by a long shot. I'm dead serious.
Proof,you want? It's fairly easy to avoid leaving any trace if you have enough power.
Now,I'd like to ask you a simple question:do you believe in power?
Yes or no,please.
I noticed this first many months ago, when the login was optional but aggressively pushed.
Now we use Chrome for Gmail, and Firefox for pretty much everything else.
Isn't Edge also tied directly to one's Microsoft account in this way?
You can sign out of Edge
Is there any documentation about what browser data gets collected and associated with my Google account? Does it still get collected if I do not click "sync"?
The most important aspect of your rant is the higher abstract point about privacy. Millennials & younger have accepted, and even celebrated, their loss of privacy. This combined with their disdain for older generations is how history repeats itself. #goodluckeveryone!
Brave browser is much faster than chrome.
Chrome is for google apps only. Mandatory Login is a reminder. For general browsing? Firefox.
I completely agree; I wont use it. I have the right to my privacy regardless of the website. I’m not required to login on Safari, only when I need an Apple service. I refuse to use the latest Chrome.
Google is a dirty word in my house. There is no Chrome, no Android, and all of their services and related providers (DoubleClick, etc) are blocked in the browser and router. Even YouTube is restricted. F Google
It's because despite the fact it's incredibly illegal everywhere else, Google is treating the planet like it is China, and keeping track of ALL of their users information. That way it's a simple matter of cajoling, bribing the rest of the world's law-makers into making it legal.
Try @brave browser if you value privacy
I tried Brave and it was a terrible experience. It did not inspire confidence.
There's that, and their recent unilateral attempt to eliminate "www" from URL's, and their SEO suppository called AMP that they tried to force on the market.....their arrogance is staggering.
Do you think it's tied to Google's prototype China search engine that would require login? Seems like quite a coincidence.
I embraced the darkness, I just use edge.
Simple solution. Never use Chrome.
Just stop using #Google services/apps
There are tons of alternative tools which not invade your privacy
To name a few @TutanotaTeam @ProtonMail @DuckDuckGo @StartPageSearch @StandardNotes
Enter Brave
Safari is a beautiful browser. Just saying ;)
Chromium also?
Where? How? Mine isn’t logged in but I’m using it. How does this manifest?
I've been happy using the Duck Duck Go browser on my Pixel phone.
*whispers* Chromium
for the rescue.
Android can be run without any Google services (with a custom ROM). Chromium doesn't require Google login and is the open source code behind Chrome. 🤷♂️
It also appears to log you into the *first* google account that you authenticate. This makes it tricky for dual use systems (work & home). Not obvious where your browsing history ends up.
Try Firefox with Multiaccount Container Addon. Works great for that use case!
So wait, are you saying on the latest Chrome version I have to be logged in with a Google account in order to use the browser??
Dropping Chrome for home use because of this.
Switch to @firefox 😎
Stop using Chrome...problem solved.
Hmm...so was wondering whether this might be due to enterprise settings...?
support.google.com/chrome/a/answe…
But maybe you mean the OS
(No comment)
I use for browser mostly,but it is slow and videos are slow. I use a paid vpn service and chrome for other things, what is a better more private browser to replace chrome with?
Dont forget mandatory updates now as well. :/
I actually pay for gdrive and you bet I would pay for their services IF @Google made such move. But with paid stuff Google would have to drop all data mining and they don't want that.
Google thrives off of your data. Without it, they wouldn’t be google. Probably couldn’t pay them enough to not use your data. Even their paid cloud service use your data.
there is a reason I have a de-googled android phone running microg - #google went way beyond my comfort zone several years ago and now they are dead to me
Is there any evidence that this change either causes google to collect more browsing data about you via chrome or enables greater collection in the future?
Bravo browser ftw
Did they not learn anything from trying to force google+ onto YouTube?
here we go
Might this have something to do with Chromium browser suddenly giving me the error "sync is not working" all the time? Still works, though. Might have to consider switching back to Firefox.
Just today my mother “disavowed” Chrome because you have to login (to sync) which logs you into Gmail. Unlike FF (which is its own acct) which she has been using and says will use 100% now. By logging into Chrome for Syncing your email is open at the same time. She hates that.
adding this to the reasons i've never downloaded chrome...
Just don’t use google chrome
Chrome is malware these days, like the browser it replaced. I’m on Opera or Firefox
What about chromium?
Don’t worry I am working on a solution. We have skunkworks at @Tesla and the best devs in world.
wait, what happened exactly?
Start using Brave browser and search with DuckDuckGo. You will be free of Google and you will never look back
Switch to a browser that actually cares about the web like Firefox, or that truly care about privacy, like Firefox (or even Safari!)
Just don't use chrome
Wow, this really sucks, but I do want to mention that if you use a passphrase to encrypt your synced data Google claims they have no ability to view it and it will remain private. I truly hope they still honor this promise.
My 50th Google sock puppet. Used for browsing. 😐
no way, i haven't checked that out yet.
Try Chromium. It’s exactly like Chrome, but without all the tracking and other nonsense like this.
Linux users are probably already using the Chromium, but are there stable builds of Chromium available for Windows or OSX users?
Wondering implications for #BCEd #Chromebooks. In BC #FIPPA legal requirement schools can’t require students to share personal info external to Canada—need consent. Would have to provide alias—so far, anecdotal reports of requesting aliases are-schools dragging feet.
Switch to Opera
what is Chrome team's response?
Just use Firefox. Problem solved.
Use chromium then?
I concur! Google needs to be more transparent in regards to this change - #imswitchingtoedge
What about to use chromium or iridium if you are chrome fan or even firefox if not? Nobody is pressing you to use Google's evil browser...
It's got me reconsidering setting up Sync on Chrome, I'd go for a private system with Chromium but bugs.chromium.org/p/chromium/iss… shows Google is uninterested in even exposing a setting to redirect sync locations.
Google insistson knowing who you are at all times-gross violation of privacy, 4th amendment to our Constitution-separates US from China.
Wow I didn't realize this. I noticed the update but didn't know this was part of it.
I agree with what you are saying. But you have choices like Firefox. In any case, do you prefer Google or Apple or your ISP or Microsoft or your search engine knowing everything about your browsing history? Nothing is free.
Another reason to try out @brave. I've found their Android browser to be a much better experience than both chrome and Firefox. I still jump back and forth on desktop depending on use case.
You’re howling at the moon here, fella.
Is this mobile or desktop? Download Firefox, either way. I personally don't use Chrome, and am about to pull out of Gmail re:Dragonfly.
You do realize Apple’s Safari browser provides greater user privacy features, yes? Mobile and desktop.
Is there an announcement of this change? Because I can't find that they require sign in to use their service.
Hey @Apple, how’s the work on improving Apple Maps, so I can finally delete Google Maps from my phone?
When did this go into effect? Where can I learn more about this? Precious little information out there...
I just switched to firefox this month for this reason. And I went through the test computers and phones on our office and replaced with firefox as well. And on 2 new vr backpacks I borrowed did the same. I'm done with this shyte. I'm getting out of the Google mill
It's good to voice your concerns of changing technologies. Also good competition exists because there's a few other browsers out there that don't require mandatory log in that you can use.
Are you new here? News flash: Google is an ad company.
Others may have mentioned this but in the history of browsers once one gets a commanding share of the market they become arrogant. (Think Internet Explorer in the early Naughts.) Perhaps it is time to switch to Firefox Quantum. Works on most platforms. #firefox
Switched to Firefox last year. Main reason for performance but this is another validation
Congratulation all meak and lazy internet users who despise open software. Your weight will create a surveillance society nobody wants.
#Firefox
RIP Chrome 2018
create a fake account buy a burner sim
I think the issue there is it then becomes a real account as the data builds up