News for hackers. Stuff that matters.
Re:Am I logged in or not? GDPR case study on the example of ... by krisgenre on Monday September 24, 2018 @02:39PM (#18060177)
I personally know people who think they are signing into Chrome when they sign into google.com. Maybe the Chrome team is right about their larger user base?
Re:Am I logged in or not? GDPR case study on the example of ... by davb on Monday September 24, 2018 @03:26PM (#18060630)
They could support both use cases by popping up a dialog on sign-in to a Google web property:

"You're signing into Gmail. Would you like to link Chrome to [email protected]? This will enable automatic notifications in Gmail, sync passwords and web history, and also automatically log into other Google websites when you visit them".

"Yes / No / No, and don't ask again"

Re:Am I logged in or not? GDPR case study on the example of ... by hetspookjee on Monday September 24, 2018 @03:32PM (#18060687)
Excuse my cynism but the options would be:

"Yes / Ask again later"

Re:Am I logged in or not? GDPR case study on the example of ... by munk-a on Monday September 24, 2018 @03:39PM (#18060748)
You're on the right track but it'd probably be a modal popup with "Google is making things better by inventing foo and elevating bar to the height of technology, as part of this change we'll be cloudifying some technical data. [Accept and Continue?]" with a teensy tiny little x in the corner... possibly burying all these in a EULA update.
Re:Am I logged in or not? GDPR case study on the example of ... by mortenjorck on Monday September 24, 2018 @04:08PM (#18060975)
I’m thinking just a banner along the top of the viewport with “Dismiss” and “Learn more…” buttons. The latter pops up a window with a small gray “More options…” link at the bottom, which invokes a modal with the options “Continue signed in as Alice” and “Manage Profiles…”, the latter of which allows you to disable syncing while simultaneously deleting all your local bookmarks and browser history.
Re:Am I logged in or not? GDPR case study on the example of ... by buybackoff on Monday September 24, 2018 @06:36PM (#18062082)
These last couple of comments were probably some exaggerating pun... But after this story I was running privacy checkup, surprisingly found that my location history was on (after turning it off several times long before, which is a separate question why it turns on), turned it off again and then got 404 when trying to delete it. All this in a labyrinth of often circular links without much clue where the actual switch is.
Re:Am I logged in or not? GDPR case study on the example of ... by ethbro on Monday September 24, 2018 @07:08PM (#18062268)
(A year later) 'Over 90% of our users don't choose to turn these settings off. So we made on the default and removed the option.'

... We passed the point where dark UX patterns deserved the benefit of doubt a few years ago.

If it benefits the company, it's intentional.

Re:Am I logged in or not? GDPR case study on the example of ... by airstrike on Monday September 24, 2018 @07:34PM (#18062402)
This thread got progressively more accurate and more depressing at additional comment
Re:Am I logged in or not? GDPR case study on the example of ... by kevingrahl on Monday September 24, 2018 @04:10PM (#18060984)
Judging by all those post-GDPR popups I frequently receive the text would also contain some text like “by clicking ‘accept’ or ‘X’ you consent to XYZ.”

Theres almost never a true choice.

Re:Am I logged in or not? GDPR case study on the example of ... by thaumasiotes on Tuesday September 25, 2018 @03:59AM (#18064398)
You don't have to click on 'accept' or 'X'...
Re:Am I logged in or not? GDPR case study on the example of ... by kevingrahl on Tuesday September 25, 2018 @02:49PM (#18069260)
I see where you’re going but that’s just not practicable, isn’t it?
Re:Am I logged in or not? GDPR case study on the example of ... by thaumasiotes on Tuesday September 25, 2018 @05:49PM (#18070802)
Generally if the notification is getting in the way, I delete it from the DOM.
Re:Am I logged in or not? GDPR case study on the example of ... by zorpner on Monday September 24, 2018 @03:54PM (#18060877)
Given that the popup sitting in my Gmail window currently says

"Update now / Update in 1 week"

I think you're being a little optimistic.

Re:Am I logged in or not? GDPR case study on the example of ... by ceejayoz on Monday September 24, 2018 @03:52PM (#18060852)
Email harvesting on ecommerce sites have moved on from that to "Yes / I am an evil puppy hater and eat children for breakfast" sort of copy.
Re:Am I logged in or not? GDPR case study on the example of ... by comex on Monday September 24, 2018 @06:34PM (#18062070)
Yeah, except:

> This will enable automatic notifications in Gmail

> sync passwords and web history

Chrome 69 does not enable either of these things just by signing into Gmail. (Sync being a separate opt-in has been well discussed. I just tested notifications on a new profile: they're not automatically enabled, and if I try to enable them in Gmail settings, I still get the usual browser permissions dialog.)

> and also automatically log into other Google websites when you visit them.

...and this one would happen regardless of any browser involvement.

Re:Am I logged in or not? GDPR case study on the example of ... by breatheoften on Monday September 24, 2018 @07:27PM (#18062361)
I’m still not clear about how exactly this new feature is decoupled from sync. Where is the source of truth for the sync setting — is it in cloud or locally in every browser profile?

If I have chrome sync enabled in browser on desktop a, then login to gmail in chrome on desktop b — is the browser history on desktop b now synced ...?

Also curious whether sync implies that old browser history in desktop b is synced to my account or is it guaranteed to be the case that “only browser data collected while logged in” is eligible for being synced between devices ...?

Re:Am I logged in or not? GDPR case study on the example of ... by stefano on Monday September 24, 2018 @02:48PM (#18060257)
The question is, what about other sites? Do they also think they're signing into Chrome when logging into amazon.com?

Google services are getting preferential treatment over the rest of the web on a browser with a market share big enough to be subject to an anti trust case. Vestager must be licking her lips right now...

Re:Am I logged in or not? GDPR case study on the example of ... by mehrdadn on Monday September 24, 2018 @02:44PM (#18060217)
I expect this is the case... I know I myself was thinking a few months ago why Chrome doesn't have the ability to keep the logins in sync. However, why in the world did they enable this by default for people who didn't want their browser to do anything with their Google accounts? It would make sense to keep them in sync when users request to connect their browsers to their accounts, but not when people don't want the two to be connected at all.
Re:Am I logged in or not? GDPR case study on the example of ... by dantheman on Monday September 24, 2018 @03:26PM (#18060624)
Because almost every user in the world wants it connected.
Re:Am I logged in or not? GDPR case study on the example of ... by sea6ear on Monday September 24, 2018 @06:36PM (#18062081)
I've been in at least 2 corporate positions where there were strong reasons to separate your personal environment and your professional environment.

I do not want synced browsers between my two environments.

This change makes it inordinately difficult to maintain that separation while utilizing other parts of the google ecosystem.

Re:Am I logged in or not? GDPR case study on the example of ... by tokyodude on Monday September 24, 2018 @07:34PM (#18062404)
I use two profiles for that.
Re:Am I logged in or not? GDPR case study on the example of ... by Aeolun on Monday September 24, 2018 @07:15PM (#18062307)
I don’t doubt that the Chrome team is right about the problem the majority of their users are facing. It’s just that those users are also unaware of the privacy implications, and supplanting a bad problem with a worse one ain’t a fix.
Re:Am I logged in or not? GDPR case study on the example of ... by grey-area on Monday September 24, 2018 @06:04PM (#18061880)
Maybe the Chrome team is right about their larger user base?

Maybe the Chrome team was wrong to introduce signing in to a browser at all?

Re:Am I logged in or not? GDPR case study on the example of ... by merb on Monday September 24, 2018 @06:56PM (#18062196)
> Maybe the Chrome team was wrong to introduce signing in to a browser at all?

maybe, but that would mean that all browser vendors did it wrong. (including mozilla)

Re:Am I logged in or not? GDPR case study on the example of ... by CrazyPyroLinux on Monday September 24, 2018 @08:09PM (#18062573)
> but that would mean that all browser vendors did it wrong. (including mozilla)

I think that's the case, and Mozilla is one of all your friends who are jumping off the proverbial bridge. (Posted from FF, not signed-in.)

Re:Am I logged in or not? GDPR case study on the example of ... by grey-area on Tuesday September 25, 2018 @01:31AM (#18063831)
Safari doesn't do this (it's part of iCloud, which syncs all docs, not just Safari), and Mozilla doesn't tie signing in to website signing in. I do think this is quantitatively different, esp. considering Google's near monopoly on email accounts.

They are tying website login to browser login, with the intent of merging the two - that's the problem.

To users are Google who are fully invested in that corp having total control of their online life, this fuss will seem quaint and odd, but I do think it will have serious implications long term - people are turning away from search too for similar reasons - abuse your monopoly enough and people will actively seek out other options.

Re:Am I logged in or not? GDPR case study on the example of ... by rifung on Monday September 24, 2018 @06:50PM (#18062161)
I imagine most people want their bookmarks/history/extensions/settings synced..
Re:Am I logged in or not? GDPR case study on the example of ... by stedaniels on Tuesday September 25, 2018 @05:09AM (#18064657)
Most people have no idea you can even log into Chrome.