Example Use Case: I was contacted by my poor old mother recently who said that she was logged into "The Google" but was seeing the wrong emails! She was horribly confused.

What had happened was that my sister had checked her email on my mothers computer and forgot to log out. My mother was logged into Chrome (as it correctly said on the top right of the browser) but didn't understand that logging in/out of Gmail was a different thing.

To blame non technical users for being confused here is unfair at the least. And I'm sure there are millions of them with the same problem.

A technical user who cares about privacy can:

- not log into Google and use an external email client for Gmail

- use Gmail in incognito

- disable Chrome auto log in via the preferences (although I haven't tried this myself some people say it works, although I've seen conflicting info about if this works in future versions of Chrome).

- use Firefox (but if you are still using Gmail I'm rolling my eyes here)

I personally don't think it is too evil that Google cares more about people like my mother than advanced privacy conscious technical users.

Also I can't see how auto syncing ones account with Chrome really damages privacy any more than what is there now? If you are logged into Gmail they have your cookies while you browse the web anyway. If you privacy conscious enough that you log out of Gmail every time you are done, fair enough, but I would suggest not using Gmail at all in that case.

But most importantly I'd like to hear a better engineering solution for people like my mother?

Rubbish.

What's confusing is having a zillion usernames and passwords for every site on the internet, and "doing it right" (which only a tiny percentage do) requires installing password manager extensions in your browser. In practice billions of users use the same insecure password everywhere including their banks.

You may or may not like the implications of centralizing authentication to a few players, but it is a massive improvement in security and usability over what we have now.

I am quite happy with this change, and hope to see "log into chrome" as the equivalent of "log into all websites that use google auth". It will simplify not only my own life, but all of my customers' lives (my B2B SaaS service uses Google auth).

The problem is that users are confused by the fact that "logging into your browser is not the same as logging into all the sites you use". You can literally sign into chrome with one google account and then sign into google with a totally different google account. Futhermore chrome has different "people" (browsing profiles) which confuses them even more; there's three different things that look vaguely like identity here.

You think this is just fine, Mr. Oauth, but I guarantee you it's a giant mess for the 99.9% of humans who have no idea what oauth is.

Chrome usability would be significantly improved by collapsing "logged into chrome" and "logged into google" into a single thing.

People don't need to understand oauth to use it.

(and before you pull that one again - I am supporting technically-illiterate people quite often)

I should also mention, there's another place it gets used - in Chrome extensions. That should use the same identity.

Google login then becomes one reasonable choice for "log into the internet". Right now it's too fractured to be a coherent identity.

That's actually good use case for the browser login feature. (when one is using some google-acc-connected extension)

But for ordinary users I don't think this solution would work flawlessly, because it is different than ones before (and users learn new things slowly).

However if that would be the actual implementation (force logging everywhere into the same acc) I agree it would be simpler for end-users. But it is not, therefore original point (browser login is confusing people) still stands. And therefore teaching users to rely on it does not seem like a good idea.

That should be OS level. The fact that the OS does not provide good, lightweight ways for mortal users to whip up additional user-accounts for guests and family-members without breaking a lot of things should not mean that Google makes their own into the browser and adds yet-another-layer-of-login.

I log into things from my apple laptop, my android phone, and occasionally from a chromebook I have lying around. Credentials shouldn't be tied to one OS or one OS maker. I'm happier with authentication baked into Chrome, which straddles all three.

Sounds like not having to be logged into your web browser would be a good start, then you'r mother wouldn't have been confused between being logged into chrome and logged into gmail. This is a problem google created in the first place and now you're giving them credit for fixing it.

> I personally don't think it is too evil that Google cares more about people like my mother than advanced privacy conscious technical users.

They care about her so they can harvest her data and manipulate her.

Given Google's size and power it's irresponsible for them to not do so.

And given that there are really smart people working for Google, including a whole department working on analyzing the threats and preserving user privacy, I won't believe for a second that nobody thought of this. Which may mean that they don't care, even if they did once. And again, given their size, their power, their potential for harm, that's not OK. With great power comes great responsibility, bla, bla.

So I'm not buying that.

Also, now that the shit has hit the fan, lets see what they do in response. Probably nothing ;-)

Both read to me immediately like high octane, weapons grade, 200 proof naiveté.

"Everyone at UPS, for anything they do, should ask a simple question on any proposal ... how does this impact bicycle couriers?"

"Everyone at Amazon, for anything they do, should ask a simple quesiton on any proposal ... how does this impact local mom and pop general stores?"

The organization you're talking about is diametrically configured to oppose the thing you're saying they should be mindful of. I just don't even know how it's a thing you can imagine is possible in this world.

This comment reads to me like someone saying. "When anyone in the world is about to shoot another person, they should stop.. think about what they're doing and then _not_ shoot them. This would reduce the number of shootings dramatically."

I uh.. atleast to some degree agree with all the above things.. despite that, there's a whole axis of maximum confused exasperation I feel reading about them.

I don't see how any of those is analogous the parent's suggestion. Privacy is not a business rival to Google (as Amazon to small shops or UPS to bike couriers).

True, the attribute privacy hurts one of Google's profit channels; but then, it also makes the product less attractive [1] to the users it needs and exposes it to legal liability, or may leak information that hurts users and hurts profitability in other ways. Even if Google benefits from loss of privacy in some respects, it is hurt in other ways by not consistently, predictably enforcing privacy boundaries.

Neither is true for Amazon vs mom-and-pop or UPS vs independent bike couriers.

Lumping them together is unfair and only communicates "there exists a superficial similarity to an argument that's stupid".

[1] I get it, "if you're not paying, you're not the customer..." My point should be clear though.

Data about A is the fuel for the machines that allow them to provide value for group B. I removed the indirection in my metaphors to try and communicate how the "consciousness" of a large company views the assertion. If you view google as a sentient entity, it looks upon comments like the GP as though they're coming from children.

I could've added more parity by replacing the business rivals with the words "decentralization" on all of my examples, but I think it muddies the message for no gain.

"Google should think about what it's doing to people's privacy!" sounds naive to me because google does exactly this! The levy of google's smartest are constantly trying to find ways to gather more data, or infer more things from the data they've got.

Privacy is more of a business rival to google than any other company. Alexa, Google Assistant, Siri -- they're all just new pump jacks.

Really, the whole concept of the parent shows a lot of naiveté I didn't even address. 7/10 engineers on a floor agreeing not to take the "mind control plebs" ticket doesn't do a thing when there's enough people to complete it anyways. Your gesture didn't do anything.

Publicly martyring your career for your idealism DOES add a nugget of fuel to society's awareness and opinions about the thing, but I suspect the issue is just too oblique right now for that fire to get started.

Off topic, but I have a sneaking suspicion that Facebook / Google are >100 years ahead of everyone else in sociology. At some point the code's just cracked, and taking away the keys doesn't do anything but deepen the moat around Facebook / Google.

If those companies are ever defeated in war, I suspect that their contribution to society will be similar to Unit 731, Ahnenerbe, or any of number the other non consensual human experimentation throughout the years. We'll tut tut about the unethical mongrels while telepathically scheduling the chores of our vat grown slaves made possible by the abuses of this era.

Or maybe engineers will just agree to stop sometime soon and that'll be that!

True. That's precisely why engineering ethics is our last hope.

Industries are regulated because they don't naturally do what society wants. Regulation changes their incentives and behavior to make that happen.

A leopard can't change its spots and an ad-tech company is never going to design their products with preserving privacy first, because they can't [1]. It's like a body rejecting an organ transplant.

[1] https://en.wikipedia.org/wiki/Privacy_by_design

It's at this point I am tempted to unpack what precipice we're about to go over when our last hope disappoints. Instead i'll stop on an optimistic note: everything is terrible and nothing matters, but humans will keep doing human stuff for as long as we can. By some measures things will continuously improve and by some others we'll regress and retry old tyrannies under new epochs. The ebb and flow can't be arrested by unity while we all hate each other like we do.

Fortunately, we'll only keep on hating each other until we get something else we hate even more. Make no mistake, some day we'll all come together to hate something else again. The unity of action that'll afford will allow us to do some pretty remarkable things. Hopefully the thing we all hate together actually deserves it this time. It doesn't always work that way ;(

As another comment stated, direct governance in the form of regulation is the appropriate tool for this problem. Other options, especially hoping for an application of a particular ethical framework, is dreams.

This to me is the social contract that binds our relationship as consumers with these companies.

If I cannot trust them, it means I can no longer recommend Google. And I already stopped recommending Google's products a while ago. What changed now is that ... I'm actively recommending against them to everyone I know and that is using a Google product that I happen to notice.

Of course, I'm a single individual, I can only influence my friends and my Twitter followers maybe, and I'm sure most of the time I'm preaching to the choir.

But I felt that way when I was recommending against Microsoft, since 2005. And guess what, enough people started to do it and it started eroding on their influence and market share, coupled with their own blunders of course, the classic "inovator's dilemma".

And as a datapoint, I think one of the primary reasons for why Windows Phone was a failure was because developers rejected it, due to it coming from Microsoft. Now you can talk all you want about market share, monetization and tell people that developers go where the money is, but I remember people hacking for Android phones ever since they hit the market and it took a really long time for Android to become barely profitable for app developers (it still isn't actually), not to mention a worse experience compared with Apple's APIs, yet developers embraced Android. Thus that lost sex appeal and trust that Microsoft had back in the days of Windows 95 was lost and they still haven't recovered, which prevented them from getting a foothold in a market that really matters for their future.

Nowadays Microsoft is doing fine, but they had to make some drastic changes to regain the lost trust, as they were going downhill, even if it wasn't necessaril and please notice that in spite of their best efforts, they still haven't regained that trust. Notice what happened when they acquired GitHub. Not the kind of reaction you expect when you buy something for 7.5 billion. Although I'm sure people will get over it soon, if they don't screw it, like they screwed Skype that is.

So you know ... I might be idealistic, my colleagues too, but judging by HN's reaction and the reaction of people I follow on Twitter, to me it's clear Google's image has changed and it does matter because we can influence their future.

Companies can choose to not care. But that's how they eventually become irrelevant.

Can you answer this for me?

Given the scenario - when you clear cookies all cookies are cleared but new cookies for google services are set again, what is the privacy concern for end users?

Maybe it's even more important to ask "how does this impact the user privacy for those that don't care?"

Because that group appears to be the majority...

I remember the five billion dollar fine sourced out of GDPR, but is that ever actually initiated or part of an ongoing power play?

Answer: no way in hell. Legal most assuredly signed off; Google decided they have no liability, formally.