News for hackers. Stuff that matters.
Re:Am I logged in or not? GDPR case study on the example of ... by tedivm on Monday September 24, 2018 @02:30PM (#18060083)
I don't understand why the Chrome team is picking this hill to die on- their team (managers and developers) are all over twitter and reddit trying to explain the privacy violations away as if the people upset about this are just not understanding what's going on.

I really expect this change to push a lot of people away from Chrome, and frankly I wouldn't be surprised if it started opening up more antitrust possibilities due to how they're using their browser to give their services special functionality others can't get.

Re:Am I logged in or not? GDPR case study on the example of ... by i2shar on Monday September 24, 2018 @09:23PM (#18062847)
It's about privacy and also about taking away functionality that worked all these years for me. At work we use Google Apps and I sign in as with my work address for Gmail, Calendar, Docs, Drive, etc. and am used to one click access to all these apps. But I like to sync my bookmarks, extensions and settings to my personal account - and that's it - I don't want to sign in to my personal Gmail, Docs, Drive in the browser. The new Chrome not only forces me to, but it now makes my personal account the primary one (/u/0 for Gmail) and forces me to go through several clicks for other apps to change accounts. And they didn't even ask before pushing this - one fine day Chrome auto updated and forced this feature on me and it took several days and a lot of signing out/in deleting cookies, posting on groups, etc. to figure out the flags workaround.

I know the following is not welcome on HN, but I have to vent somewhere folks that think this was a good idea are reading, so here it is: A big fuck you to Chrome for forcing this feature on us!

Re:Am I logged in or not? GDPR case study on the example of ... by grappler on Tuesday September 25, 2018 @08:36AM (#18065779)
Firefox with the "Multi-Account Containers" add-on is pretty great for managing multiple identities. Browser tabs get labels (with color-coded stripes) for which container they belong to.

I can ignore identity switchers provided by a site (google in this case) and just keep two gmail tabs, one for personal and one for work, open right next to one another. Firefox keeps each one sandboxed with its own session info like cookies etc.

Re:Am I logged in or not? GDPR case study on the example of ... by fandango on Tuesday September 25, 2018 @04:20AM (#18064483)
Just. use. Firefox.
Re:Am I logged in or not? GDPR case study on the example of ... by giancarlostoro on Tuesday September 25, 2018 @04:52AM (#18064596)
I'll never understand this hesitation to Firefox, some people will bring out why Firefox is evil yet Chrome is clearly not the lesser evil product. I started using Chrome when it first came out, and then I stopped using it when it didn't have adblocking. Then when it did have adblocking it was extremely limited (I kept seeing popups and other nuisances), this was when I got dispelled then about Google being an ad focused company and never went back. I only use Chrome / Chromium (on Linux) to test web dev projects across major browsers, and sometimes Stack Overflow if I'm testing on Chrome might as well, but it's nothing all that special.

My main browsing has always been done on Firefox which has sync much like Chrome does, but oh look it's encrypted, forgot my password? Too bad, they're going to nuke my data since they don't even know my password. As it should be. My browsing data being synched is cool but it's not that precious to me, and if it was I would just not forget my password.

Also if I need to use Google services I have a Google container, if I need to use Firefox, I have a Firefox container. Good luck containing Google or Firefox on Chrome that way, and the multiple account containers are amazing for testing multiple user roles on web development projects all on one browser with multiple taps opened.

Re:Am I logged in or not? GDPR case study on the example of ... by latexr on Tuesday September 25, 2018 @08:49AM (#18065857)
> I'll never understand this hesitation to Firefox

In my case, I don‘t switch to Firefox because they don’t support AppleScript and it’s a feature I use every day.

Less than an hour ago, on another HN thread, I saw another macOS user claiming they won’t switch to Firefox because it doesn’t support Keychain.

Every time there’s this conversation, I see a bunch of macOS users complaining about performance.

In sum, a bunch of users (particularly macOS users) don’t switch to Firefox because it plain sucks for their needs.

Re:Am I logged in or not? GDPR case study on the example of ... by propogandist on Tuesday September 25, 2018 @07:00AM (#18065212)
Be sure to turn off telemetry. Also, the other elements that can send browsing data to google, which are fortunately customizable in firefox.
Re:Am I logged in or not? GDPR case study on the example of ... by meko on Tuesday September 25, 2018 @03:01PM (#18069375)
People get set in their ways. We're not all web developers.
Re:Am I logged in or not? GDPR case study on the example of ... by daveheq on Monday September 24, 2018 @11:39PM (#18063396)
Not sure if this is a solution for you but you can have multiple Google account sessions in separate Chrome user sessions by clicking your user icon at the top then selecting to add people.
Re:Am I logged in or not? GDPR case study on the example of ... by hrktb on Tuesday September 25, 2018 @01:15AM (#18063778)
It becomes a game of “guess what user I’ll be logged in the next new window ?”

Chrome also doesn’t respect window order in the menu, so it’s just a pain to track when switching. My solution to that was to switch to Safari for personal use.

Re:Am I logged in or not? GDPR case study on the example of ... by hoffs on Tuesday September 25, 2018 @01:27AM (#18063815)
I have like 3 accounts added and it always used default account
Re:Am I logged in or not? GDPR case study on the example of ... by tjoff on Tuesday September 25, 2018 @05:48AM (#18064826)
What's a default account?
Re:Am I logged in or not? GDPR case study on the example of ... by james_pm on Monday September 24, 2018 @03:38PM (#18060735)
I had been using Chrome only for G Suite stuff (forced by my employer to maintain this account) and FF for everything else. This change resulted in the deletion of Chrome from my computer and a move to FF with Multi Account Containers set to segregate various services from each other.

I'm half thankful for the Chrome team doing this because it was just the push I needed to finally rid myself of Chrome once and for all.

I plan to do a clean re-install of the OS on my Mac as well to ensure that all vestiges of Google Chrome are indeed gone. I also took the opportunity to rid myself of Google Drive File Stream.

Re:Am I logged in or not? GDPR case study on the example of ... by adrianrocamora on Monday September 24, 2018 @08:02PM (#18062539)
FF with Multi Account Containers is heaven
Re:Am I logged in or not? GDPR case study on the example of ... by ObsoleteNerd on Monday September 24, 2018 @08:44PM (#18062702)
FF itself since Quantum has been heaven for me personally.

I've always used FF and Chrome, flipping back and forth as Chrome filled in where FF had issues and vice versa, but after a week or 2 on Quantum I just didn't need Chrome anymore and uninstalled it. Haven't regretted it once.

Re:Am I logged in or not? GDPR case study on the example of ... by reitanqild on Monday September 24, 2018 @11:20PM (#18063327)
If you have to deal withtheir web apps like me, please also report performance problems loud and clear when they affect non-Chrome browsers.
Re:Am I logged in or not? GDPR case study on the example of ... by mathw on Tuesday September 25, 2018 @03:53AM (#18064379)
The only thing that doesn't work for me at work with Firefox is some parts of our Google-powered meeting rooms. I can do videoconferencing just fine in Firefox, but I can't do screen sharing, even though Firefox seems to think screen sharing is enabled and working, only a black screen goes to the meeting room's projector.

Hopefully that'll be fixed soon...

Re:Am I logged in or not? GDPR case study on the example of ... by edoceo on Monday September 24, 2018 @11:36PM (#18063384)
I realise this is a low effort comment but...this username and this comment made me laugh and cry.

(also, I'm 90% FF now too)

Re:Am I logged in or not? GDPR case study on the example of ... by thirdsun on Tuesday September 25, 2018 @04:46AM (#18064573)
It is. One feature I'd like to see added is a separate history for every container.

Currently the global history is shared between all containers.

Re:Am I logged in or not? GDPR case study on the example of ... by giancarlostoro on Tuesday September 25, 2018 @04:56AM (#18064614)
This has been the one thing I've wanted since it was announced. It would make it a really powerful concept and maybe more plugins supporting container specifics. Like disabling / enabling features depending on the container you're under. I know some do, but if more did it would be amazing.
Re:Am I logged in or not? GDPR case study on the example of ... by nmridul on Tuesday September 25, 2018 @10:03AM (#18066359)
+1 for this.
Re:Am I logged in or not? GDPR case study on the example of ... by unicornporn on Tuesday September 25, 2018 @12:36AM (#18063638)
It would be if I could restrict a container to a certain domain[1]. However, as it functions now, my containers are easily polluted.

[1] https://github.com/mozilla/multi-account-containers/issues/8...

Re:Am I logged in or not? GDPR case study on the example of ... by explainplease on Monday September 24, 2018 @08:52PM (#18062729)
I wish Mozilla would give some kind of guarantee that they won't drop the feature, otherwise I don't feel like investing time into building a workflow around it is worthwhile. And it's sad that this is even an issue.
Re:Am I logged in or not? GDPR case study on the example of ... by eksemplar on Tuesday September 25, 2018 @01:17AM (#18063792)
We automated a process with RPA for a piece of software that was being replaced 6 months later.

You could look at it as silly, but in those 6 months it saved around 700 work hours after it had paid for its dev time.

Re:Am I logged in or not? GDPR case study on the example of ... by explainplease on Thursday September 27, 2018 @02:02AM (#18082371)
Sure, that makes sense for your business, because it saved money. For me, personally, I don't want spend time getting used to software that is likely to be taken away from me (i.e. forced obsolescence). That is a very frustrating experience. I'd rather use and build on software that I know is going to remain usable for a long time.
Re:Am I logged in or not? GDPR case study on the example of ... by tokyodude on Monday September 24, 2018 @11:47PM (#18063424)
so you can be logged into 2 google accounts at the same time? two facebook accounts? two twitter accounts? IIRC multi-account containers work by domain name so they don't handle this case. Multiple profiles do, something which Chrome handles well and Firefox handles poorly
Re:Am I logged in or not? GDPR case study on the example of ... by kbenson on Tuesday September 25, 2018 @12:19AM (#18063565)
Yes, you can. It's not as smooth as could be, but I am continuously logged into three separate Google accounts (one vanilla Gmail, two for separate G Suite businesses), and it works fine.

Each container can load any page. If you want to toggle the current domain to load in the current container, you can opt for that. Then, it will prompt you to switch to that container when you browse to that domain, and at that point you can opt to make it automatic. If you don't make it completely automatic, you can just choose to use the default container for that domain, or stick with the current container (or source container, if opening a new tab from some other container).

What would make this better would be to be able to flag a domain as openable in multiple containers, but have one be default, so I wouldn't have to decline switching to my personal Google container every time I clicked a link on an email in one of the G Suite accounts, as they redirect to a google landing page).

Re:Am I logged in or not? GDPR case study on the example of ... by rifung on Monday September 24, 2018 @06:47PM (#18062145)
I work at Google; opinions are my own.

> I don't understand why the Chrome team is picking this hill to die on- their team (managers and developers) are all over twitter and reddit trying to explain the privacy violations away as if the people upset about this are just not understanding what's going on.

My impression is that this is the new norm at Google. It happens with everything, internal or external. The sad reality is that most decisions will deeply upset at least some people, and those people likely don't have the context into the decisions but still complain loudly.

From my perspective what happens is that it doesn't matter whether a decision was a good or bad one, there will be people who complain (ESPECIALLY internally as Googlers can be very entitled) and so at some point you're just completely immune to this.

This is not helped by the fact that people externally often think Google is on some evil plan and speculate in wild ways which are completely wrong.

To give you an idea of how these things usually happen.. it goes something like this..

Someone finds a UX problem, and makes a plan to fix it. In this case I guess it's confusion among signed on accounts. Someone on the team probably raises some concerns, likely similar if not the exact ones being raised now, and they debate it but eventually they say well, the proportion of people who seem to care about this is only 0.1% of users (Because we are objective!).

Sadly, even though it's "only" 0.1% of users, those users are extremely negatively impacted in a way that's not really reflected by the small percentage, and 0.1% of a billion is still a considerable amount.

On the other hand, there are many other decisions which were released just fine and we would not be able to do anything if we were always afraid of negatively impacting some small proportion of users. To me this is a weakness of the attempt to have everything be objective and "measurable".

Let me state that I don't think this is good or even acceptable, but I'm definitely not smart enough to know how to solve this on a wider scale than my immediate team. However I hope this at least provides some insight into why these kinds of thing happen.

Re:Am I logged in or not? GDPR case study on the example of ... by kevingadd on Monday September 24, 2018 @07:28PM (#18062369)
'0.1% of a billion is still a considerable amount' is a very important observation, and one my colleagues at Google (before I left) rarely seemed to grasp. People think they can get away with a lot of cutting corners or lack of rigor in their engineering and design when mistakes can impact millions of people... our industry really isn't prepared for deploying products at this scale.
Re:Am I logged in or not? GDPR case study on the example of ... by RobertRoberts on Monday September 24, 2018 @10:58PM (#18063242)
>...people externally often think Google is on some evil plan...

The real bad guys don't ever think they are evil. (consider Al Capone, hero of the people)

Re:Am I logged in or not? GDPR case study on the example of ... by Nitramp on Tuesday September 25, 2018 @05:51AM (#18064846)
> >...people externally often think Google is on some evil plan...

> The real bad guys don't ever think they are evil.

At least seen from the inside, it's often funny (and sad) to see all kinds of crazy speculation about the greater evil goal of nefarious decisions made, all the while whatever is happening is usually a mixture of software bugs and incompetence on our side.

It's like a clown show, where the evil mastermind turns out to just be me incorrectly checking for a null value in some if condition, or my PM having no idea how to rationalize two features together.

I guess that comes with large corporation status, and a certain failure to communicate. Not sure if it's avoidable at all. It does teach you something about perception vs intent, I guess.

Re:Am I logged in or not? GDPR case study on the example of ... by pvorb on Tuesday September 25, 2018 @12:10AM (#18063523)
Yes. Acting evil is what makes you evil.
Re:Am I logged in or not? GDPR case study on the example of ... by kbenson on Tuesday September 25, 2018 @12:33AM (#18063625)
Then again, maybe we shouldn't be throwing around words like "evil", which we all know is hyperbole (even if invited hyperbole because of Google's own prior statements). Someone talks about Google being evil, and then other people push back because it's not really "evil", and they are both right, so neither ever gives an inch.

Sure, there's less impact when statements are less hyperbolic, but there's also less bikeshedding about the problem, so maybe something actually happens in the end.

Re:Am I logged in or not? GDPR case study on the example of ... by toxik on Tuesday September 25, 2018 @01:34AM (#18063848)
You said it yourself, Google’s raison d’etre in some ways into these markets was that they were not evil anticompetetive Microsoft. Today, they very much are. Arguably they were always this way, but dark patterns like this is a new low.

And no you don’t need to be North Korea to be evil. That is a meaningless comparison. Coincidentally Google has started working with regimes similar to NK; The PRC. Is that not evil?

Re:Am I logged in or not? GDPR case study on the example of ... by kbenson on Tuesday September 25, 2018 @01:58AM (#18063951)
> Coincidentally Google has started working with regimes similar to NK; The PRC. Is that not evil?

No, it's not, because evil is a negative ideal, but I don't think it actually exists in reality.

Even Hitler wasn't evil, he was insane, and the whole situation is a case study of what happens when people, regular people, are given an easy explanation for all their problems. Placing something in the category of "evil" is placing it apart from behavior that you expect normal people to be capable of, since I think most people thing the majority aren't evil. All that does is help us feel better at the expense of helping us be better.

Evil is for fairy tales, where things are black and white. Normal people rightly get defensive when called such, because the road to hell actually is paved with good intentions. Hyperbole isn't a useful way to communicate.

Sorry to go full Godwins on this, but if you can't pull out Hitler and Nazi's when talking about evil (even to counter the point), then when can you...

Re:Am I logged in or not? GDPR case study on the example of ... by Twisell on Tuesday September 25, 2018 @03:54AM (#18064383)
You just implied that Hitler was insane, a slang and disrespectful word for mentally ill people.

I can’t even start to consider that it’s an appropriate analogy so Godwin point is dully granted.

PS: If it please your mind regexp replace "evil" by "ill intentioned" in Google related threads. But don’t forget that it’s Google that originated this terminology in the first place with their moto "Don’t be evil"...

Re:Am I logged in or not? GDPR case study on the example of ... by eksemplar on Tuesday September 25, 2018 @01:23AM (#18063806)
Evil sort of loses it’s meaning when it’s thrown a google in a world where Pennsylvania just banned books that aren’t sold through their systems from prisons, where ICE kills children in concentration camps, and that’s talking domestic issues only.

I mean, if google is evil then what do you call North Korea? Super duper evil?

Re:Am I logged in or not? GDPR case study on the example of ... by pvorb on Tuesday September 25, 2018 @02:42AM (#18064125)
I was just referring to Google's own phrase: "Don't be evil."

Google is evil in the same way now, that Microsoft was back in the day.

Re:Am I logged in or not? GDPR case study on the example of ... by hulahoof on Tuesday September 25, 2018 @03:30AM (#18064281)
Tellingly, it was changed to "Do the right thing." after the alphabet split.
Re:Am I logged in or not? GDPR case study on the example of ... by reilly3000 on Tuesday September 25, 2018 @01:51AM (#18063916)
I'm glad you're here talking. This is hard to navigate as an employee. A company as large as Google must make it nearly impossible to anticipate every downstream effect it may have on seemingly unrelated areas of the business.

As an example in this case, I am an IT decision maker for a small group of people, I'm not that active on social media as a contributor, and losing an Apps subscription because of a browser auth decision could be one of those impacts. Its likely not, but if it were it would be impossible to understand in the aggregate, and of infinitesimal impact.

Be that as it may, user PII is now on the liability side of the ledger, and some businesses just haven't adapted to start operating like that is reality. Beyond financial hazard, the moral harm of a leak, the risk of telling the secrets of millions to the world (or a dangerous few) should be of grave concern. The best way to be trustworthy is to not know the secrets in the first place.

Bulk data collection doesn't affect 0.1% of users, that is the only group of people that understand enough to be concerned about. It affects everybody who signed up as a user. Their secrets and their safety are now in your hands.

This IS an engineering problem. I have full faith that with the right will, Google could figure out a way to offer web scale services to all manner of users and still deliver on its ambitions to deliver intelligent experiences with provable privacy at the heart of it. It probably involves data living at the edge; it probably involves renting datums from customers; it definitely involves a radical shift in business models.

Engineering a solution to a privacy-at-scale repository of human knowledge cannot happen without leadership that truly sees privacy as profit, at every level of the company.

Re:Am I logged in or not? GDPR case study on the example of ... by CaptainZapp on Tuesday September 25, 2018 @01:42AM (#18063881)
I think that any decision, which impacts user privacy in any way, shape or form should be especially carefully vetted.

Unfortunately, and with a long list of "accidental" blunders Google is long beyond the point of deniable plausability.

Re:Am I logged in or not? GDPR case study on the example of ... by bad_user on Tuesday September 25, 2018 @12:50AM (#18063685)
I’m very sympathetic to your situation, delivering software that’s this popular can’t be easy however in this case it’s really not that hard ...

When I’m doubt, Google should err on the side of privacy.

That’s the safe way to go. And in this case you can clearly see that some people will freak out if their browser syncs their history to the wrong identity or that it syncs at all.

Re:Am I logged in or not? GDPR case study on the example of ... by wickedwiesel on Tuesday September 25, 2018 @04:43AM (#18064558)
As you probably know, Google does have quite clear policies on the matter.[0]

You and your colleagues could raise that these are there for a reason, approved by senior management, and there to help you respect your users' rights.

I like the sound of "Applications that affect or change your user experience should make clear they are the reason for those changes." or "It should be clear to you when you are installing or enabling software on your computer and you should have the ability to say no." or "We believe you should be asked explicitly for your permission in a manner that is obvious and clearly states what information will be collected or transmitted."

All of these sound relevant to the grievance of the OP.

[0]: https://www.google.com/intl/en/about/software-principles.htm...

Re:Am I logged in or not? GDPR case study on the example of ... by tumetab1 on Tuesday September 25, 2018 @06:04AM (#18064902)
Thanks for that insight, it makes sense.

Big corporations usually pick some good rule of thumb (use data based decisions) and pervert it until it's a blind rule.

Now I can see some understand some of Google bad decisions, sentiment and grudges aren't easy to measure. I can find some aspect of a google product annoying but not bother me much. Still, annoying thinks add up and most users, like 99,9% users don't write complains publicly so they can't never tell. It's also harder to account for network effects like the family geek stop caring about chrome and moved the whole family and friends to firefox.

An estimated negative impact in 0,1% can really mean last push for 1% of users. Add several episodes like this and you can destroy a company.

Re:Am I logged in or not? GDPR case study on the example of ... by quickben on Monday September 24, 2018 @07:37PM (#18062413)
Use checkboxes?
Re:Am I logged in or not? GDPR case study on the example of ... by Tracist on Monday September 24, 2018 @07:59PM (#18062518)
When you have a checkbox for every possible customisation option, you end up with a commercial airliner cockpit - hundreds of flashing lights and switches, that you need a comprehensive manual and years of experience to properly operate.
Re:Am I logged in or not? GDPR case study on the example of ... by screaminghawk on Monday September 24, 2018 @08:32PM (#18062653)
Or you end up with `about:config`. Doesn't solve the impossible to comprehend everything problem, but it still gives people to option.
Re:Am I logged in or not? GDPR case study on the example of ... by pilif on Tuesday September 25, 2018 @12:06AM (#18063502)
And then you end up with people complaining about bloat because the browser contains code for every possible state of all these settings.
Re:Am I logged in or not? GDPR case study on the example of ... by snaky on Tuesday September 25, 2018 @12:17AM (#18063558)
It's clearly not the case when the checkbox you adding is an option to turn off some feature enabled by default.

No, not the feature all other components do need so much you have to work around by adding another zillion lines of code in other places of your program to deal with the case it turned off.

Re:Am I logged in or not? GDPR case study on the example of ... by reitanqild on Monday September 24, 2018 @11:16PM (#18063318)
Spoken like a true modern ux designer ;-)

I won't say you cannot make toys but I'd be happy if ux designers everywhere could take a break and stop dumbing down working applications, thanks.

PS: they don't need to be flashing.

Re:Am I logged in or not? GDPR case study on the example of ... by TeMPOraL on Tuesday September 25, 2018 @12:57AM (#18063713)
> PS: they don't need to be flashing.

In fact, in modern aircraft, they're not flashing. The trend today is to not light a light unless it's important to pay attention to it. It's called "dark cockpit".

Re:Am I logged in or not? GDPR case study on the example of ... by snaky on Monday September 24, 2018 @10:37PM (#18063144)
Windows have a registry, Firefox - about:config, Linux - kconfig and sysfs. You don't need to make it Boeing way, but you need it.
Re:Am I logged in or not? GDPR case study on the example of ... by edoceo on Monday September 24, 2018 @11:39PM (#18063395)
Airplane control are complex and require training for many valid reasons. The cluster is actually a great study in UX design.

Also, it's Boeing or I'm not going.

Re:Am I logged in or not? GDPR case study on the example of ... by snaky on Tuesday September 25, 2018 @12:06AM (#18063501)
> The cluster is actually a great study in UX design.

Agreed. But it's UX design for power users clearly.

But I was talking about the way to combine 'a regular users UX' with a ton of options you need for power users. The vast majority of the people who have Ubuntu on their laptops never recompile the kernel or even know about sysfs, the vast majority of the Windows and Office users never touch the registry editor - but removing them would be a huge mistake.

Re:Am I logged in or not? GDPR case study on the example of ... by edoceo on Tuesday September 25, 2018 @12:30AM (#18063616)
Agreed
Re:Am I logged in or not? GDPR case study on the example of ... by eudora on Monday September 24, 2018 @09:18PM (#18062826)
So make an advanced options screen divided into categories.

It's not hard.

And you don't have to do every possible customisation options, just the ones that people are enraged about.

Re:Am I logged in or not? GDPR case study on the example of ... by pvorb on Tuesday September 25, 2018 @12:12AM (#18063536)
This is hard to do as an afterthought. I bet Firefox had it from the start.
Re:Am I logged in or not? GDPR case study on the example of ... by hrktb on Tuesday September 25, 2018 @01:35AM (#18063853)
I wonder if we’re not already at this point though, and it might not be a bad thing.

Not everyone uses a browser the same, but a decent part of people here will spend their working life in the browser. I think for people here it won’t be rare to have dozen of windows with each dozen of tabs, some logged in different acconts within the site they show, some in incognito, some with in developer mode.

Even with just the browser filling multiple windows worth of buttons and stuff to interact with is easy, without even going to hidden preferences and configs.

I’d argue in complexity level we’re already on par with a airliner cockpit, it’s our job to deal with that, and we do it professionaly for years. Of course not everyone needs that complexity, but at least we do.

What I am getting at is, I think we should accept we’re not a t the point where it is simple anymore, embrace the complexity and give tools to effectively manage it.

Airliner cockpit are so because it’s efficient to have individual switches to important action and state indicators. We shouldn’t shy away from showing important info in the interface just because we’d end up with more stuff. Having it hidden can be a worse tradeoff.

Re:Am I logged in or not? GDPR case study on the example of ... by brokenmachine on Tuesday September 25, 2018 @02:19AM (#18064029)
The problem is that you're in the 0.001% of people who want their software complicated like an airline cockpit.

Most people don't give a shit, they just want to check their gmail and couldn't care less. They don't even read the alert boxes that do pop up. They just click almost anything blindly.

As a result, companies get away with dark patterns and privacy-compromising changes like this.

I'm somewhere in the middle. I don't want airline-cockpit controls, but I do want the ability to not sync to the cloud/NSA if I want.

I also don't want to be tricked into syncing by some dark pattern silent update that makes an ambiguous clickbox that doesn't clearly say what the privacy implications are either.

Re:Am I logged in or not? GDPR case study on the example of ... by hrktb on Tuesday September 25, 2018 @02:47AM (#18064142)
Yes, I think the middle ground will be the majority. All the more so actual “casual” users that want stuff that “just work” will use their phone or tablet, or the default browser already installed and is good enough.

Chromebooks are in an interesting position, with a chance to have newer users. But then they will literally live their life in the browser.

In that sense, Chrome users are already set apart I think.

Re:Am I logged in or not? GDPR case study on the example of ... by beenBoutIT on Monday September 24, 2018 @08:36PM (#18062668)
I'm convinced that most users would prefer having zero options or checkboxes.
Re:Am I logged in or not? GDPR case study on the example of ... by TeMPOraL on Tuesday September 25, 2018 @12:55AM (#18063709)
Yes, they would prefer the software to always be perfectly tuned to them, even as they change their own... preferences.
Re:Am I logged in or not? GDPR case study on the example of ... by gcb0 on Monday September 24, 2018 @10:03PM (#18063012)
that's a huge silly fallacy.

if you are operating something as complex and dangerous, you need the Comercial airliner cockpit! it's that way for a reason! or would you rather board a 747 with a huge colorful button "fly" and another "land"?

if you have something like a browser, that is your last line of defense accessing online banking etc, you need to see into the miriad of options. if you just browse facebook, use the default and be happy. Knowing about:config shouldn't be a gate keeper to anything! going to settings then advanced should be more than enough to communicate the concept of advanced options. anything different you are just being an entitled , incompetent UX designer.

about:config is lazy, but get some of the job done. your oh-so-perfect two options google chrome setting page, is lazy and useless.

Re:Am I logged in or not? GDPR case study on the example of ... by eudora on Monday September 24, 2018 @09:17PM (#18062821)
Oh man, this always Madden's me when a company takes away some option in the name of simplifying for the majority of users.

Put it on a screen called advanced options or something, even about:config, and let us decide!

That is, if you're really not just manipulating your users.

Re:Am I logged in or not? GDPR case study on the example of ... by Zarel on Monday September 24, 2018 @11:01PM (#18063260)
I mean, this _is_ on the advanced options screen. It's in chrome://flags/#account-consistency
Re:Am I logged in or not? GDPR case study on the example of ... by eudora on Tuesday September 25, 2018 @12:09AM (#18063521)
So it is

But will it be there forever?

Some other post on HN on this topic implied these options tend to vanish over time. (I'm not sure if they so or don't)

Re:Am I logged in or not? GDPR case study on the example of ... by 0x54D5 on Monday September 24, 2018 @07:40PM (#18062431)
That 0.1% doesn't take into account hours spent using the actual app. Power users tend to spend all day in a browser whereas a typical grandma might look at it for 15 minutes and close it. Meanwhile people who have multiple Google accounts and who spend literally all day in the browser are the ones that get the short end of the stick? That makes zero sense and it's why people are starting to hate Google just like any other corporation that makes decisions by committee. There should have been a product owner on the browser team that said "No this is a browser. Not an extension of GSuite."

The total indifference to people's valid use cases is what really grinds my gears.

Chrome is still the only browser that ruins my UX by putting a profile picker into the title bar. A place it has no business being. I literally made a patch and compiled my own version of Chromium for a while to get rid of it. https://github.com/hparadiz/chromium-disable-profile-button-...

I'm so tired of the arrogance. Chrome used to be a beautiful simplistic browser. Now it's just bloat. I'm done. Get off my computer. You guys had your chance and blew it.

Re:Am I logged in or not? GDPR case study on the example of ... by zbentley on Monday September 24, 2018 @10:04PM (#18063020)
If all the power users leave, the app makers do not care. If all the typical grandmas leave, their margins are significantly impacted.

You can figure out the rest.

That’s not a problem or an indictment. Just an observation of how systems work st scale.

Re:Am I logged in or not? GDPR case study on the example of ... by TheKarateKid on Monday September 24, 2018 @10:24PM (#18063092)
How do you think Firefox and Chrome overthrew IE? The power users (us) who set up and fix everyone else's computers spent years telling others why IE is terrible and installed a different browser, and it slowly but surely worked (along with strong developer and media/press support).
Re:Am I logged in or not? GDPR case study on the example of ... by snaky on Monday September 24, 2018 @10:32PM (#18063119)
That's very short term focused observation though. Power users are influencers. When power users leave - especially being annoyed and angry - they start to actively advise against the product left and right, to the regular users and to other power users.
Re:Am I logged in or not? GDPR case study on the example of ... by TeMPOraL on Tuesday September 25, 2018 @01:01AM (#18063726)
But that's unfortunately how this works. I think people forget market players can, and are, self-destructive, when short-term profits interfere with long-term survival.

It's also part of the reason for the pace of the industry. You pump out as much money as you can from some space, and then move on to focus on the next thing.

Re:Am I logged in or not? GDPR case study on the example of ... by zlotnydiev on Monday September 24, 2018 @08:02PM (#18062538)
Why would they repeat the Google+ linked accounts nightmare though? I never wanted a fucking chrome account, and linking my business and private accounts is the stupidest thing you idiots could have done.

I never wanted my youtube account tied to my business email.

Re:Am I logged in or not? GDPR case study on the example of ... by dang on Monday September 24, 2018 @11:45PM (#18063413)
> the stupidest thing you idiots could have done

Would you please read the site guidelines and follow them when commenting here?

https://news.ycombinator.com/newsguidelines.html

Re:Am I logged in or not? GDPR case study on the example of ... by zlotnydiev on Tuesday September 25, 2018 @10:04PM (#18072117)
Those guidelines were followed. Given the chance I would say that to their faces.
Re:Am I logged in or not? GDPR case study on the example of ... by dang on Wednesday September 26, 2018 @04:32AM (#18073931)
Between this and https://news.ycombinator.com/item?id=18072106 it seems clear that you don't want to use HN as intended, so I've banned this account.

If you don't want to be banned, you're welcome to email [email protected] and give us reason to believe that you'll follow the rules in the future.

Re:Am I logged in or not? GDPR case study on the example of ... by autocorr on Tuesday September 25, 2018 @03:51AM (#18064369)
Or before that, Google Buzz! The opt-out social network which nobody asked for that automatically shared your contacts.
Re:Am I logged in or not? GDPR case study on the example of ... by tyingq on Monday September 24, 2018 @06:36PM (#18062080)
"I don't understand why the Chrome team is picking this hill to die on"

Years of double digit percentage revenue growth sets lofty stockholder expectations.

All the low lying fruit to sustain that trajectory is gone. So, anything (AMP, this, etc) that might boost their targeting ability or impressions is important for them.

Re:Am I logged in or not? GDPR case study on the example of ... by billions on Tuesday September 25, 2018 @01:35AM (#18063854)
This. Google's carrot stick is the privacy yard.
Re:Am I logged in or not? GDPR case study on the example of ... by Analemma_ on Monday September 24, 2018 @02:37PM (#18060150)
> I don’t understand why the Chrome team is picking this hill to die on

Because they’re not “dying on a hill” at all, because nobody cares. Nobody outside Hacker News and Twitter infosec people only followed by other Twitter infosec people cares about this.

> I really expect this change to push a lot of people away from chrome

Care to bet on that? Because I would happily take the opposite side of that bet. I think the feature will stay and after a few months we will see absolutely no change in Chrome’s usage statistics.

Re:Am I logged in or not? GDPR case study on the example of ... by noja on Monday September 24, 2018 @02:45PM (#18060224)
> because nobody cares

A lot of people do not understand, but we do, we're the techies. It's our job to understand.

Don't mistake people not understanding for not caring.

Once people understand, they care.

Re:Am I logged in or not? GDPR case study on the example of ... by zelon88 on Monday September 24, 2018 @04:07PM (#18060959)
It's the early adopters who breed the late adopters. If we all stop using Chrome, and thus stop recommending it to our friends/co-workers they will stop using it too. I've personally turned dozens of people away from IE towards Chrome. Now I'll turn dozens of people away from Chrome towards Firefox. Also, I'm also IT and I'm now phasing out Chrome on my company workstations and phasing in Firefox. It will take time as it's low on my list of priorities, but every workstation I touch I'll take the time to scrub free from Chrome and setup FF. There's 30x users right there.
Re:Am I logged in or not? GDPR case study on the example of ... by throwawaymath on Monday September 24, 2018 @03:27PM (#18060636)
> Don't mistake people not understanding for not caring.

Once people understand, they care.

Conversely, don't mistake people not caring for not understanding. Many people both understand and don't care. Reasonable people can disagree about how their personal data should be monetized.

Re:Am I logged in or not? GDPR case study on the example of ... by jonbronson on Monday September 24, 2018 @02:51PM (#18060284)
This can't be overstated. The update did not even mention this feature change, making it even more difficult for non-techies to know something has changed, and what it means.
Re:Am I logged in or not? GDPR case study on the example of ... by amdelamar on Monday September 24, 2018 @03:16PM (#18060524)
Yeah, but my parents _understand_ Facebook collects/sells their data. But they don't _care_ enough to stop using Facebook.
Re:Am I logged in or not? GDPR case study on the example of ... by reificator on Monday September 24, 2018 @03:38PM (#18060736)
They may understand it on a superficial level, but do they understand it on a practical one?

Everyone "understands" that Facebook collects user data. It's the contextual understanding that makes techies uneasy.

Re:Am I logged in or not? GDPR case study on the example of ... by throwawaymath on Monday September 24, 2018 @03:51PM (#18060837)
What you're saying is a pretty condescending way to treat other people's opinions. You're essentially questioning whether or not they really understand (complete with scare quotes) if they don't share your opinion.

It's not the "contextual understanding" - or any kind of understanding - that makes some techies uneasy. It's their own opinions and personal comfortability with regard to data monetization. Many people understand their data is monetized in myriad ways and fully don't care. Asking if they actually understand is only going to patronize them.

Re:Am I logged in or not? GDPR case study on the example of ... by reificator on Monday September 24, 2018 @05:46PM (#18061738)
I get where you're coming from, but it applies to me equally in plenty of other domains.

There are countless things I understand the basics of but am not an expert in. That's why we specialize, because we can't be experts in everything all the time.

I don't mean it to be condescending, I mean to express that I can know that stars are powered by nuclear reactions and yet not have a firm grasp of what that really entails.

Most people, including myself, have a shallow understanding of a lot of things, and a deep understanding of very few things relatively speaking.

Re:Am I logged in or not? GDPR case study on the example of ... by Aeolun on Monday September 24, 2018 @07:26PM (#18062358)
And yet, given a parallel into what is happening as if it were a different company ‘e.g. would you be fine with our man standing outside your house and observing your every movement as a condition of service’, most of these people that ‘understand’ switch to WTF?! No! If you then ask them to stop using Chrome or Facebook it’s suddenly ‘different’.

The only thing that’s different is that they can remain blissfully unaware of it.

Re:Am I logged in or not? GDPR case study on the example of ... by ddingus on Monday September 24, 2018 @04:07PM (#18060964)
Actually, they are questioning whether understanding makes sense, given people are unaware, uninformed.

The answer on all that is advocacy.

They may still not care, and that is fine. At least it is with eyes wide open.

Professionals do that sort of thing. It is consideration, not condescension.

Re:Am I logged in or not? GDPR case study on the example of ... by rifung on Monday September 24, 2018 @06:20PM (#18061978)
I mean I'm a "techie" and I think I understand. I still don't care..
Re:Am I logged in or not? GDPR case study on the example of ... by reificator on Monday September 24, 2018 @06:27PM (#18062023)
Didn't say you had to...
Re:Am I logged in or not? GDPR case study on the example of ... by rifung on Monday September 24, 2018 @07:09PM (#18062277)
Earlier comment said "Once people understand, they care."

Your comment basically implied "maybe they don't really understand which is why they don't care".

So I am refuting the original statement because I presumably do understand, and I still don't care.

Re:Am I logged in or not? GDPR case study on the example of ... by propogandist on Tuesday September 25, 2018 @07:31AM (#18065358)
It seems he's employed by Google
Re:Am I logged in or not? GDPR case study on the example of ... by rifung on Tuesday September 25, 2018 @12:50PM (#18068038)
What does that have to do with my opinion about not being concerned about my Facebook use..?
Re:Am I logged in or not? GDPR case study on the example of ... by ionised on Wednesday September 26, 2018 @10:39AM (#18076389)
“It is difficult to get a man to understand something, when his salary depends on his not understanding it.”
Re:Am I logged in or not? GDPR case study on the example of ... by rifung on Thursday September 27, 2018 @02:34PM (#18087384)
I started using FB well before I joined Google =]
Re:Am I logged in or not? GDPR case study on the example of ... by JoshMnem on Monday September 24, 2018 @03:28PM (#18060646)
Most people incorrectly think along the lines of "they have all my data already, so there's nothing I can do." Most probably also believe that many of the things that are going on are illegal and that someone is watching out for their interests. If they really understood the consequences of the data collection on a deeper level, most people wouldn't agree to it.
Re:Am I logged in or not? GDPR case study on the example of ... by inetknght on Monday September 24, 2018 @08:37PM (#18062675)
I can confirm: there are a lot of things that friends, coworkers, and family all think are illegal and yet when I tell them to call law enforcement, they then ask "but who do I call?" followed by "I can't afford to hire a lawyer"

They know what's happening is wrong. They don't know how to stop it. But they do still need to browse the web.

Re:Am I logged in or not? GDPR case study on the example of ... by nicky0 on Monday September 24, 2018 @03:26PM (#18060626)
I understand, and I don't care.
Re:Am I logged in or not? GDPR case study on the example of ... by kryogen1c on Monday September 24, 2018 @03:13PM (#18060509)
I'm typically out of touch with normal people so I'm probably proving your point, but this has pushed me off chrome and Google.

Ive always loved google. Installed chrome when it was released. I'm writing this from a pixel 2 XL because I broke my pixel 1 XL. I've had a Gmail account almost since it's been possible (I have my [email protected]). I now use firefox. I don't know what mail I'll switch to, and I can't bring myself to an iPhone, but I'm leaving.

Google's increasing anti-user posture is enough, personified by the removal of their slogan "don't be evil". Legal move though it surely was, it's all too fitting.

Goodbye Google - you broke my heart.

Re:Am I logged in or not? GDPR case study on the example of ... by jkaplowitz on Monday September 24, 2018 @04:16PM (#18061032)
I respect your feelings, but with respect to one of the factual details you listed: the "don't be evil" slogan never got removed from Google's Code of Conduct.

That document has been reworded and the slogan is now at the end, but it's been there continuously. While I agree it's more of a passing mention than in the old wording, the end is one of the most prominent placements possible for such a statement other than the beginning.

The common Internet belief that they removed this came from the Code of Conduct of Google's new parent company Alphabet, which says "Do the right thing" instead, combined with the subsequent rewording. But Google's still applies to Google as well.

Re:Am I logged in or not? GDPR case study on the example of ... by kryogen1c on Monday September 24, 2018 @05:53PM (#18061789)
Oh thank you!

I'm thoroughly embarrassed to have regurgitated internet gossip without reading the source material.

However, as you mentioned, I stand by my sentiment. Google has clearly telegraphed their desire to put making money over users privacy and security (my definition of security being safe from Google, whereas Google's is safe from everyone BUT google)

To attack this issue from Google's side, the targeted ads I receive are straight garbage. The ads I get on my Google YouTube account from my signed in chrome Google account on my signed in Google phone are not in the least bit relevant to me or my interests. I don't use ad blockers of any kind. If I have to watch the ad about Dr. Gunter zolof solving Carmichael's toshent conjecture one more time, my phone might suffer an "accident" and I will take that opportunity to switch to a different provider (ANGRY SIDE RANT: I haven't watched that ad to completion or clicked on it a _single_ time. Stop showing it to me. 50 times. Consecutively)

Re:Am I logged in or not? GDPR case study on the example of ... by scrollaway on Monday September 24, 2018 @08:15PM (#18062600)
> I don't know what mail I'll switch to

Hop on https://www.gandi.net/, choose a domain name that looks professional (such as mylastname.me or some other clever variation) and never have to ask that question again.

If you ever want to go back to gmail, bring in your domain with gsuite (https://gsuite.google.com/).

As for an alternative UI&host recommendation, go for fastmail: https://www.fastmail.com/

Re:Am I logged in or not? GDPR case study on the example of ... by manigandham on Monday September 24, 2018 @09:01PM (#18062772)
> personified by the removal of their slogan "don't be evil"

It's always interesting to see how the most technical users seem to take such an irrelevant vague throwaway marketing line so seriously.

It's also still in the code of conduct but now moved to the end so it was never actually removed from anything anyway, if it actually matters.

Re:Am I logged in or not? GDPR case study on the example of ... by netwanderer2 on Monday September 24, 2018 @05:29PM (#18061621)
I had the same mindset as yours perhaps a year or two ago, until I realized a couple of things that completely changed my mind. This is a little off the main topic but you see, when it comes to privacy, we like to think that we have it in our control but in fact we don't. As Snowden has proven, what the NSA is doing is far worse than Google. You just don't know it because it's completely hidden and sealed off from the public. But why do they have to conduct such extreme level of data mining you ask? Well, we are not living in manufacturing age anymore, that was maybe 40-50 years ago, we are living in an information age now. Everybody agrees that information is the new oil or the new currency. For the United States to continue being the leader of the world, it would be absolutely foolish for anyone to think that they don't have a complete and total full control of this key component.

The public needs to start changing their mindsets and begins to accept that all information in your private life is being recorded. The only important aspect that needs to be questioned is to what extend the data is going to be used. Are some companies not going to hire you simply because of something you did in your private life three years ago that they may not agree with? That would be unacceptable to me as it would definitely cross the line. It is what I consider similar to the "social credit" system being implemented in China, in which everyone is under surveillance at all times and given scores for activities such as grocery shopping. There are always two sides of the extremes, and the balance we should strive for is somewhere in the middle.

It's impossible to ask U.S companies like Google not to conduct data mining on their users. How do you expect them to compete with companies in other countries that monitor their users 24/7 and have access to larger and more accurate data? In the age of information and artificial intelligent, those companies will win the battles simply because they will have better insights that Google won't ever have. Companies in the West cannot readily admit what they're doing because the public mindset is not yet ready for this change. It's too drastic and against many values we have been familiar with our entire life. But our world is changing very quickly, it is not the same world as before, it's understandably very difficult for most people to wrap their head around this but we need to update our mindsets even if that means changing our values. Companies like Google cannot disclose what they do because of public backlash they will receive. If people are just going to switch to another company, all their investments will have been lost, and the next company will be forced to do the same anyway. Google's recent move was probably the best way to test out public water, and it is already not looking very good. I don't know if governments from the West will ever be able to crack this issue.

Re:Am I logged in or not? GDPR case study on the example of ... by p1necone on Monday September 24, 2018 @05:55PM (#18061807)
What? I should just ignore Googles harvesting of my data because "everyone does it"? That's ridiculous.

Also, why do companies need to "compete"? There's no reason that core software like internet browsers or operating systems need to be commercial in the first place. I will happily continue using Firefox.

Re:Am I logged in or not? GDPR case study on the example of ... by netwanderer2 on Tuesday September 25, 2018 @11:57AM (#18067481)
I understand your logic and I fully agree because I was on your side. If there really is a choice nobody would want it to be this way. Unfortunately our current world is not a utopia.

Let me give an example, suppose no countries on earth had nuclear weapons. We all know how deadly and devastating its effects can be to humankind. Let's say initially all nations agreed that it's bad for all of us and nobody should pursue it. However, if ONE country broke the contract and started developing nuclear weapons on their own. Do you think the remaining countries can afford to stay at their same positions and not start developing it too? Once someone starts doing it, all bets are off! You can apply the same logic to any unethical technological experiment, such as cloning human. Google really had no choice, if they don't adapt they will be out of the game within the next 10 years.

Re:Am I logged in or not? GDPR case study on the example of ... by mistrial9 on Monday September 24, 2018 @06:49PM (#18062157)
please note the announcement of the French 'security OS'

https://news.ycombinator.com/item?id=18031201

Re:Am I logged in or not? GDPR case study on the example of ... by allenz on Monday September 24, 2018 @04:01PM (#18060925)
But the tech-savvy community has influence. We set up computers for our friends and families. We write IT policies. We are web developers, tech reporters, and more.

At least for me, Google's behavior means that I can no longer recommend Chrome.

Re:Am I logged in or not? GDPR case study on the example of ... by adtac on Monday September 24, 2018 @04:14PM (#18061017)
I can't imagine the impact is significant even if we consider two degrees of acquaintances (you tell someone to not use Chrome and they tell someone else).
Re:Am I logged in or not? GDPR case study on the example of ... by Kim_Bruning on Monday September 24, 2018 @06:32PM (#18062048)
That would be very depressing if true.

Fortunately it's not. On average people are only about 6 degrees apart, so in reality a relatively small number of people can get a surprisingly large amount of coverage in a frighteningly short amount of time, should they choose to apply themselves.

https://en.wikipedia.org/wiki/Six_degrees_of_separation

Re:Am I logged in or not? GDPR case study on the example of ... by allenz on Monday September 24, 2018 @05:11PM (#18061497)
The world is very small, and privacy is a mainstream concern these days. The impact of one story or one action is limited, but in the end, users do get their say. Otherwise, we would still be using Internet Explorer.
Re:Am I logged in or not? GDPR case study on the example of ... by redm on Monday September 24, 2018 @02:45PM (#18060226)
Maybe not in a few months, but things like this are funny. People who were looking for a reason to leave Chrome may use this to justify it, and while it may be a small audience, small audiences can be trendsetters, especially if they are passionate.

Much like the slide from IE and FireFox to Chrome, by the time Mozilla and Microsoft reacted, it was already too late. Time will tell if this is the start of such a momentum flip or if it's just another blip.

Re:Am I logged in or not? GDPR case study on the example of ... by stefano on Monday September 24, 2018 @02:50PM (#18060278)
Part of Chrome rise to success was, on top of its (at the time) superior performance, the massive marketing from the biggest advertising company in the world.
Re:Am I logged in or not? GDPR case study on the example of ... by fjsolwmv on Monday September 24, 2018 @03:42PM (#18060768)
10+ years ago, techies were the trendsetters in computer technology, because computers were hard to use.

Now computers are easy to use, and the massmarket does not need to rely on techies for guidance, and non -techies can be early adopters. The general public relies on mainstream popular culture / fashion influencers.

Re:Am I logged in or not? GDPR case study on the example of ... by Consultant32452 on Monday September 24, 2018 @03:52PM (#18060854)
I would take a small bet. We're the trend-setters in technology. We're the ones who got everyone on Chrome to begin with. Otherwise they'd still be on IE. If all the tech people abandon Chrome, they will start recommending FF or IE again and discourage Chrome use. The impact is slow, but it is significant.
Re:Am I logged in or not? GDPR case study on the example of ... by richjdsmith on Monday September 24, 2018 @04:58PM (#18061404)
Yep. Technology evangelists tend also to be early adopters. If they all jump ship, the masses will follow. Slowly, but surely.
Re:Am I logged in or not? GDPR case study on the example of ... by schizoidboy on Monday September 24, 2018 @06:43PM (#18062119)
See my other comment in response to the parent - I hope neither of you were being sarcastic and that a bet is worked out.
Re:Am I logged in or not? GDPR case study on the example of ... by drusepth on Monday September 24, 2018 @02:47PM (#18060253)
>Because they’re not “dying on a hill” at all, because nobody cares. Nobody outside Hacker News and Twitter infosec people only followed by other Twitter infosec people cares about this.

Ever since I updated to 69 I've been absolutely loving it. The most noticeable improvement is it feeling incredibly faster, but as someone who's been using 4-5 profiles on Chrome for over a year the new user management stuff just feels so much more intuitive/integrated.

I was super surprised to see people complaining about it on HN this morning, and I'm still not entirely sure what the problem is. FWIW, I also severely disagree with a lot of the implementations of GDPR, so maybe I'm just not the audience who cares here. To me, this update has been nothing but improvements so far.

Re:Am I logged in or not? GDPR case study on the example of ... by user812 on Monday September 24, 2018 @03:52PM (#18060847)
I wrote elsewhere that Chrome 69 marks a big change for the browser world.

Chrome 69 is simply the best. Not for me, but for the average user. The reading and work flow is incredible for casual browsing.

The negative reaction on HN is understandable, but it's not relevant for most people.

The goal of Google is merging the user experience of Android, Chrome, Google search and personal Google accounts into one, and it will get increasingly difficult for users to get out of this ecosystem.

Re:Am I logged in or not? GDPR case study on the example of ... by paavoova on Monday September 24, 2018 @05:23PM (#18061579)
I find this reality highly disturbing, but, as you mention, the average user is impartial if not completely ignorant. I think Google is very clearly exploiting both its monopoly and this end-user ignorance to centralize and control all aspects of the web and user devices. It's not far-fetched to consider that soon there will be no OS on the PC, but rather just Chrome as an interface to everything Google and the web. And so controversy like this is momentary and seen only in a vocal minority, quickly forgotten. Just a couple months ago, Chrome was found to be scanning user files for malware - this was quickly forgotten, probably even by the very same vocal people discussing Chrome on HN today. At this point, it's almost faux outrage.
Re:Am I logged in or not? GDPR case study on the example of ... by p1necone on Monday September 24, 2018 @06:42PM (#18062112)
Once upon a time "nobody cared" that IE was trash either, now look what's happened - and that was preinstalled on the OS.
Re:Am I logged in or not? GDPR case study on the example of ... by signal11 on Monday September 24, 2018 @08:30PM (#18062648)
A lot more "lay users" will care when random sites they visit start picking up their Google identity and showing it in the web page, all because the user signed into the browser. This is what it looks like: https://imgur.com/a/nFvxI0U

Assuming this isn't fixed, the ick factor of being in-your-face followed across the web will be quite strong, I think.

Re:Am I logged in or not? GDPR case study on the example of ... by schizoidboy on Monday September 24, 2018 @06:42PM (#18062113)
Just a small meta-point that betting is a great way for both sides of a debate to tone down rhetoric, engage in dialogue, and discuss objective terms or processes for evaluating a disagreement. It looks like another commenter is taking you up on the bet and I hope neither of you were being sarcastic, because I think betting isn't something to joke about but a wonderful tool that we don't use often enough.
Re:Am I logged in or not? GDPR case study on the example of ... by Nursie on Monday September 24, 2018 @02:39PM (#18060175)
Sad but true. People don't care about this stuff, in general.
Re:Am I logged in or not? GDPR case study on the example of ... by Spivak on Monday September 24, 2018 @03:24PM (#18060593)
Why would they? Who outside our paranoid bubble is doing anything other than being signed into their accounts all the time?
Re:Am I logged in or not? GDPR case study on the example of ... by baq on Monday September 24, 2018 @02:46PM (#18060246)
this means that the voice of those who care will be loud and clear, because those who don't care stay quiet. a top 30 post on HN makes a difference.
Re:Am I logged in or not? GDPR case study on the example of ... by bogomipz on Monday September 24, 2018 @05:04PM (#18061454)
>"Because they’re not “dying on a hill” at all, because nobody cares."

You are conflating "don't understand" and "don't care." Those are not the same things at all. This conflation seems to be a stable of Big Tech now where matters of privacy are concerned.

>"Nobody outside Hacker News and Twitter infosec people only followed by other Twitter infosec people cares about this."

Awareness of issues and a dialogue concerning them generally starts with people have domain-specific knowledge. The idea that this somehow detracts from an issue's importance is absurd.

Re:Am I logged in or not? GDPR case study on the example of ... by krisgenre on Monday September 24, 2018 @02:39PM (#18060177)
I personally know people who think they are signing into Chrome when they sign into google.com. Maybe the Chrome team is right about their larger user base?
Re:Am I logged in or not? GDPR case study on the example of ... by davb on Monday September 24, 2018 @03:26PM (#18060630)
They could support both use cases by popping up a dialog on sign-in to a Google web property:

"You're signing into Gmail. Would you like to link Chrome to [email protected]? This will enable automatic notifications in Gmail, sync passwords and web history, and also automatically log into other Google websites when you visit them".

"Yes / No / No, and don't ask again"

Re:Am I logged in or not? GDPR case study on the example of ... by hetspookjee on Monday September 24, 2018 @03:32PM (#18060687)
Excuse my cynism but the options would be:

"Yes / Ask again later"

Re:Am I logged in or not? GDPR case study on the example of ... by munk-a on Monday September 24, 2018 @03:39PM (#18060748)
You're on the right track but it'd probably be a modal popup with "Google is making things better by inventing foo and elevating bar to the height of technology, as part of this change we'll be cloudifying some technical data. [Accept and Continue?]" with a teensy tiny little x in the corner... possibly burying all these in a EULA update.
Re:Am I logged in or not? GDPR case study on the example of ... by mortenjorck on Monday September 24, 2018 @04:08PM (#18060975)
I’m thinking just a banner along the top of the viewport with “Dismiss” and “Learn more…” buttons. The latter pops up a window with a small gray “More options…” link at the bottom, which invokes a modal with the options “Continue signed in as Alice” and “Manage Profiles…”, the latter of which allows you to disable syncing while simultaneously deleting all your local bookmarks and browser history.
Re:Am I logged in or not? GDPR case study on the example of ... by buybackoff on Monday September 24, 2018 @06:36PM (#18062082)
These last couple of comments were probably some exaggerating pun... But after this story I was running privacy checkup, surprisingly found that my location history was on (after turning it off several times long before, which is a separate question why it turns on), turned it off again and then got 404 when trying to delete it. All this in a labyrinth of often circular links without much clue where the actual switch is.
Re:Am I logged in or not? GDPR case study on the example of ... by ethbro on Monday September 24, 2018 @07:08PM (#18062268)
(A year later) 'Over 90% of our users don't choose to turn these settings off. So we made on the default and removed the option.'

... We passed the point where dark UX patterns deserved the benefit of doubt a few years ago.

If it benefits the company, it's intentional.

Re:Am I logged in or not? GDPR case study on the example of ... by airstrike on Monday September 24, 2018 @07:34PM (#18062402)
This thread got progressively more accurate and more depressing at additional comment
Re:Am I logged in or not? GDPR case study on the example of ... by kevingrahl on Monday September 24, 2018 @04:10PM (#18060984)
Judging by all those post-GDPR popups I frequently receive the text would also contain some text like “by clicking ‘accept’ or ‘X’ you consent to XYZ.”

Theres almost never a true choice.

Re:Am I logged in or not? GDPR case study on the example of ... by thaumasiotes on Tuesday September 25, 2018 @03:59AM (#18064398)
You don't have to click on 'accept' or 'X'...
Re:Am I logged in or not? GDPR case study on the example of ... by kevingrahl on Tuesday September 25, 2018 @02:49PM (#18069260)
I see where you’re going but that’s just not practicable, isn’t it?
Re:Am I logged in or not? GDPR case study on the example of ... by thaumasiotes on Tuesday September 25, 2018 @05:49PM (#18070802)
Generally if the notification is getting in the way, I delete it from the DOM.
Re:Am I logged in or not? GDPR case study on the example of ... by zorpner on Monday September 24, 2018 @03:54PM (#18060877)
Given that the popup sitting in my Gmail window currently says

"Update now / Update in 1 week"

I think you're being a little optimistic.

Re:Am I logged in or not? GDPR case study on the example of ... by ceejayoz on Monday September 24, 2018 @03:52PM (#18060852)
Email harvesting on ecommerce sites have moved on from that to "Yes / I am an evil puppy hater and eat children for breakfast" sort of copy.
Re:Am I logged in or not? GDPR case study on the example of ... by comex on Monday September 24, 2018 @06:34PM (#18062070)
Yeah, except:

> This will enable automatic notifications in Gmail

> sync passwords and web history

Chrome 69 does not enable either of these things just by signing into Gmail. (Sync being a separate opt-in has been well discussed. I just tested notifications on a new profile: they're not automatically enabled, and if I try to enable them in Gmail settings, I still get the usual browser permissions dialog.)

> and also automatically log into other Google websites when you visit them.

...and this one would happen regardless of any browser involvement.

Re:Am I logged in or not? GDPR case study on the example of ... by breatheoften on Monday September 24, 2018 @07:27PM (#18062361)
I’m still not clear about how exactly this new feature is decoupled from sync. Where is the source of truth for the sync setting — is it in cloud or locally in every browser profile?

If I have chrome sync enabled in browser on desktop a, then login to gmail in chrome on desktop b — is the browser history on desktop b now synced ...?

Also curious whether sync implies that old browser history in desktop b is synced to my account or is it guaranteed to be the case that “only browser data collected while logged in” is eligible for being synced between devices ...?

Re:Am I logged in or not? GDPR case study on the example of ... by stefano on Monday September 24, 2018 @02:48PM (#18060257)
The question is, what about other sites? Do they also think they're signing into Chrome when logging into amazon.com?

Google services are getting preferential treatment over the rest of the web on a browser with a market share big enough to be subject to an anti trust case. Vestager must be licking her lips right now...

Re:Am I logged in or not? GDPR case study on the example of ... by mehrdadn on Monday September 24, 2018 @02:44PM (#18060217)
I expect this is the case... I know I myself was thinking a few months ago why Chrome doesn't have the ability to keep the logins in sync. However, why in the world did they enable this by default for people who didn't want their browser to do anything with their Google accounts? It would make sense to keep them in sync when users request to connect their browsers to their accounts, but not when people don't want the two to be connected at all.
Re:Am I logged in or not? GDPR case study on the example of ... by dantheman on Monday September 24, 2018 @03:26PM (#18060624)
Because almost every user in the world wants it connected.
Re:Am I logged in or not? GDPR case study on the example of ... by sea6ear on Monday September 24, 2018 @06:36PM (#18062081)
I've been in at least 2 corporate positions where there were strong reasons to separate your personal environment and your professional environment.

I do not want synced browsers between my two environments.

This change makes it inordinately difficult to maintain that separation while utilizing other parts of the google ecosystem.

Re:Am I logged in or not? GDPR case study on the example of ... by tokyodude on Monday September 24, 2018 @07:34PM (#18062404)
I use two profiles for that.
Re:Am I logged in or not? GDPR case study on the example of ... by Aeolun on Monday September 24, 2018 @07:15PM (#18062307)
I don’t doubt that the Chrome team is right about the problem the majority of their users are facing. It’s just that those users are also unaware of the privacy implications, and supplanting a bad problem with a worse one ain’t a fix.
Re:Am I logged in or not? GDPR case study on the example of ... by grey-area on Monday September 24, 2018 @06:04PM (#18061880)
Maybe the Chrome team is right about their larger user base?

Maybe the Chrome team was wrong to introduce signing in to a browser at all?

Re:Am I logged in or not? GDPR case study on the example of ... by merb on Monday September 24, 2018 @06:56PM (#18062196)
> Maybe the Chrome team was wrong to introduce signing in to a browser at all?

maybe, but that would mean that all browser vendors did it wrong. (including mozilla)

Re:Am I logged in or not? GDPR case study on the example of ... by CrazyPyroLinux on Monday September 24, 2018 @08:09PM (#18062573)
> but that would mean that all browser vendors did it wrong. (including mozilla)

I think that's the case, and Mozilla is one of all your friends who are jumping off the proverbial bridge. (Posted from FF, not signed-in.)

Re:Am I logged in or not? GDPR case study on the example of ... by grey-area on Tuesday September 25, 2018 @01:31AM (#18063831)
Safari doesn't do this (it's part of iCloud, which syncs all docs, not just Safari), and Mozilla doesn't tie signing in to website signing in. I do think this is quantitatively different, esp. considering Google's near monopoly on email accounts.

They are tying website login to browser login, with the intent of merging the two - that's the problem.

To users are Google who are fully invested in that corp having total control of their online life, this fuss will seem quaint and odd, but I do think it will have serious implications long term - people are turning away from search too for similar reasons - abuse your monopoly enough and people will actively seek out other options.

Re:Am I logged in or not? GDPR case study on the example of ... by rifung on Monday September 24, 2018 @06:50PM (#18062161)
I imagine most people want their bookmarks/history/extensions/settings synced..
Re:Am I logged in or not? GDPR case study on the example of ... by stedaniels on Tuesday September 25, 2018 @05:09AM (#18064657)
Most people have no idea you can even log into Chrome.
Re:Am I logged in or not? GDPR case study on the example of ... by heywot on Monday September 24, 2018 @03:28PM (#18060644)
I've been considering switching over to Firefox after being a day-one adopter of Chrome and this helped become a tipping point to get me to switch over. Though, full disclosure: I've been working to limit Google services in my day-to-day life (Maps, Gmail, and now Chrome) in the last couple of months over privacy concerns.
Re:Am I logged in or not? GDPR case study on the example of ... by irrational on Monday September 24, 2018 @03:31PM (#18060678)
I've been using Firefox for quite awhile as my primary browser. I'm now to the point that I only use Chrome for checking websites I'm working on. I've had no complaints about Firefox. For me it is fast and stable.
Re:Am I logged in or not? GDPR case study on the example of ... by Lio on Tuesday September 25, 2018 @03:00AM (#18064195)
Does Firefox work with Gooogle Hangouts/Meet/“whatever it’s called now”?

I know they were working on removing the need for plugins in other browsers. Ut last time I checked it was still a bit iffy.

This is what’s keeping Chrom(e|ium) installed on my machines right now. (I have a customer that uses it extensively).

If Hangouts works in Firefox I think I'll uninstall Chrome.

Re:Am I logged in or not? GDPR case study on the example of ... by Lio on Tuesday September 25, 2018 @05:59AM (#18064886)
To answer my own question, yes Hangouts does work fine in Firefox. Not tried screen sharing yet but video calls work for me.
Re:Am I logged in or not? GDPR case study on the example of ... by Lio on Tuesday September 25, 2018 @08:13AM (#18065612)
Nope. To expand my answer, only certain versions of Hangouts work with Firefox, sigh.
Re:Am I logged in or not? GDPR case study on the example of ... by richjdsmith on Monday September 24, 2018 @04:54PM (#18061361)
I made the tentative switch last fall to try out their much touted Quantum when it was newly released. A year later and I haven't looked back.
Re:Am I logged in or not? GDPR case study on the example of ... by Kostchei on Monday September 24, 2018 @07:47PM (#18062468)
After reading a little I randomly plonked on Brave. Selfishly, I wanted to know if our stuff worked on it- encryption, chunking etc. To my joy, it does and.... Brave is pretty cool. Converted.

I have noticed Xero doesn't work on Brave. Not my product so not so concerned but I'm going to investigate to see what Xero is doing that we are not. ie why my dev's stuff works and xero's does not.

Re:Am I logged in or not? GDPR case study on the example of ... by opmac on Monday September 24, 2018 @03:35PM (#18060717)
Same, I just made the switch today because of this change. We'll see how it pans out.
Re:Am I logged in or not? GDPR case study on the example of ... by untog on Monday September 24, 2018 @11:12PM (#18063303)
> I really expect this change to push a lot of people away from Chrome

Agree with you up until this point. The vast, vast majority of people won't even notice this has happened, or really care much.

Anecdotal of course, but I haven't heard a single complaint among my non-tech friends, and I'm usually the first person they talk to about this stuff (because I'm "in tech"). I also believe Google when they say this change results in a lot less confusion from users (and just so happens to be a strategic benefit for Google, too...)

Re:Am I logged in or not? GDPR case study on the example of ... by ljm on Monday September 24, 2018 @02:42PM (#18060200)
Not that I want to advocate for Google, but I imagine you could create a Firefox extension that works something like that into Firefox's sync mechanism. It sounds like they're scanning a cookie and then using that to change some other aspect of the browser; unless they've also added some stuff that only Chrome could recognise and work with.

Now I've done making an excuse for it, I think it's a shame that Microsoft fucked up so bad with IE that both Edge and Safari face an uphill struggle. They're both pretty decent browsers that are kind to your battery and aren't bloated with features you're unlikely to ever use.

The extension support is fairly poor for both but at the same time, that's not exactly a bad thing. You browse the web with them and that's more or less it.

Re:Am I logged in or not? GDPR case study on the example of ... by frenchy on Monday September 24, 2018 @03:04PM (#18060422)
> I imagine you could create a Firefox extension that works something like that into Firefox's sync mechanism.

Being able to make something with an extension have having a behavior turned on by default in the browser are very different things.

Re:Am I logged in or not? GDPR case study on the example of ... by hysan on Monday September 24, 2018 @06:23PM (#18061994)
I’d like to do more in-depth research into this first, but my theory is that this move is innately tied to Google’s foray back into China.
Re:Am I logged in or not? GDPR case study on the example of ... by gruez on Monday September 24, 2018 @03:08PM (#18060449)
>I don't understand why the Chrome team is picking this hill to die on- their team (managers and developers) are all over twitter and reddit trying to explain the privacy violations away as if the people upset about this are just not understanding what's going on.

link to said threads?

Re:Am I logged in or not? GDPR case study on the example of ... by SmellyGhost on Monday September 24, 2018 @03:25PM (#18060606)
Re:Am I logged in or not? GDPR case study on the example of ... by ewjordan on Monday September 24, 2018 @07:04PM (#18062243)
Yeah...and that thread says that the change is basically nothing, just a UI indicator:

> Q: I don’t get, though — if you’re signed in to the browser but sync is off, then what does it mean to be signed in to the browser? What does it do besides sync?

> A: Not much, you can think of it like a Gmail login state indicator.

If that's fully the case, then there's nothing to see here and people are freaking out over nothing. Am I missing an important element here, other than that people don't trust Google?

Re:Am I logged in or not? GDPR case study on the example of ... by signal11 on Monday September 24, 2018 @08:22PM (#18062621)
@__apf__ is being slightly disingenuous when she says "Not much ... like a Gmail login state indicator." Google logins are used across the web by a lot of sites. For instance here's what happens when you visit an Indian financial paper, the Economic Times, using Chrome 69: https://imgur.com/a/nFvxI0U (some personal info has been blurred out).

I almost never visit the Economic Times, and I certainly never log in, but now it gets a chance to log me in using my 'real' identity, and there's even a popup to nudge me in that direction. Any site that implements Google Logins can do this, as far as I can tell. I'm pretty sure most people who chose to enable browser sync in Chrome didn't opt for this.

I think the Chrome team really screwed up on this by not considering how Google IDs are used across the web. And for what? The rather marginal scenario of eliminating confusion in shared-browser situations?

Or they knew the full implications and did it anyway, which is even more disturbing.

Re:Am I logged in or not? GDPR case study on the example of ... by grey-area on Tuesday September 25, 2018 @01:38AM (#18063860)
It all makes sense if the end goal is for the browser to push google login across the web, and make google accounts the preferred way to log in to websites. In that case they're doing you a favour, it's all in your best interests, as well as Google's of course. [/sarcasm]

I simply don't trust a single corporation that much.

Re:Am I logged in or not? GDPR case study on the example of ... by torstenvl on Tuesday September 25, 2018 @02:17AM (#18064021)
They are not doing me a favor. Software companies need to stop believing their own paternalistic propaganda. Nobody at Google is in a position to determine whether they are doing me a favor or not.
Re:Am I logged in or not? GDPR case study on the example of ... by grey-area on Tuesday September 25, 2018 @02:38AM (#18064110)
It was sarcasm, this is how the google workers rationalise this to themselves (see other posts on this thread).
Re:Am I logged in or not? GDPR case study on the example of ... by torstenvl on Tuesday September 25, 2018 @10:15AM (#18066444)
Sorry, my mistake.
Re:Am I logged in or not? GDPR case study on the example of ... by tedivm on Monday September 24, 2018 @08:05PM (#18062556)
It's not the case though. Google's privacy policy has two different "modes" for Chrome, one for being logged in and one for being logged out. By tricking people into logging in without their consent they are also tricking people into allowing that extra data to be collected.

Their current argument is that they aren't actually collecting that data- just getting permission to- but that's kind of sketchy and still leaves them open to other changes that do start collecting things.

The other big issue people have with this is that the use case they're talking about- accidentally logging into a site and not logging out- is an issue with all websites, not just Google. Adding a UI for Google services explicitly is something only Google could do, which makes their browser less "neutral". This is why people keep bringing up antitrust. By taking advantage of their monopoly to further entrench that monopoly they are breaking the trust of their users.

Re:Am I logged in or not? GDPR case study on the example of ... by Zarel on Monday September 24, 2018 @11:08PM (#18063288)
You're misreading the privacy policy. Google's privacy policy has two modes, one for sync on, and one for sync off. Logging into Chrome does not turn sync on, so you can be logged into Chrome and still covered by the "basic" privacy policy.

They aren't actually collecting that data because you haven't turned sync on.

Re:Am I logged in or not? GDPR case study on the example of ... by ntp85 on Tuesday September 25, 2018 @07:29AM (#18065338)
Yeah, well, but what keeps them from silently changing that, seeing that users are already logged in? The UI for the sync preferences is sketchy at best as it is right now and you're basically just one misclick away from handing all your browsing data over to Google.
Re:Am I logged in or not? GDPR case study on the example of ... by colordrops on Monday September 24, 2018 @07:33PM (#18062393)
It's almost a certainty that they will continue down the slippery slope and start syncing data automatically in a future update. That sort of change has happened several times, so there is precedent.
Re:Am I logged in or not? GDPR case study on the example of ... by visarga on Tuesday September 25, 2018 @02:26AM (#18064058)
But can't you protect your synced data with a passphrase?
Re:Am I logged in or not? GDPR case study on the example of ... by ntp85 on Wednesday September 26, 2018 @03:49AM (#18073686)
According to the Chrome privacy policy the synced data is inaccessible to Google if it is encrypted with a passphrase, even though this encryption seems to be weak: https://palant.de/2018/03/13/can-chrome-sync-or-firefox-sync...
Re:Am I logged in or not? GDPR case study on the example of ... by 3K7m7bUZyWA1KCD on Monday September 24, 2018 @04:03PM (#18060933)
Reducing their userbase is exactly their aim. They are doing that the only way possible that won't bat an eye. Firefox has to grow so that chrome is no longer considered a monopoly.
Re:Am I logged in or not? GDPR case study on the example of ... by adtac on Monday September 24, 2018 @04:11PM (#18060995)
Well they could start by removing the nag box on their home page asking non-Chrome users to switch to Chrome.
Re:Am I logged in or not? GDPR case study on the example of ... by joelx on Thursday September 27, 2018 @04:39AM (#18082914)
I believe there is a purposeful propaganda war being directed against Google and Facebook here on HN and elsewhere in the media. I am not sure who is behind it, but my best guess would be Russia or China as they would have interest in this. Most of these posts against them are very flimsy, but they get huge upvotes.
Re:Am I logged in or not? GDPR case study on the example of ... by rhizome on Monday September 24, 2018 @04:29PM (#18061127)
Because they have business requirements that depend on people using this feature.
Re:Am I logged in or not? GDPR case study on the example of ... by flukus on Monday September 24, 2018 @09:22PM (#18062839)
> I don't understand why the Chrome team is picking this hill to die on- their team

Really? That one is easy to understand. Google is a malware company and anyone that cares about privacy wouldn't work there in the first place.

Re:Am I logged in or not? GDPR case study on the example of ... by caiob on Monday September 24, 2018 @02:35PM (#18060128)
> their team (managers and developers) are all over twitter and reddit trying to explain the privacy violations away

That's literally their jobs as Chrome evangelists. They're just doing what they're told.

Re:Am I logged in or not? GDPR case study on the example of ... by jenscow on Monday September 24, 2018 @05:41PM (#18061709)
Because a lot of it is FUD.

I've never signed into Chrome, but I am able to access 2 Google accounts... and Chrome still shows me the "Sign into Chrome" option.

Version 69.0.3497.100 (Official Build) (64-bit)

(I normally just use Chrome for development)