News for hackers. Stuff that matters.
Re:Product Updates Based on Your Feedback by cm2187 on Wednesday September 26, 2018 @03:52AM (#18073709)
Won’t change my mind and will stick to Firefox after having switched because of this. First I don’t want to be logged in in my browser at all. Second, and probably more important, software is about trust. Even for an open source project, no one has the time to review millions of lines of code. So unfortunately one has to rely on what one believes is the behavior of the authors of the software. And what google did is to shatter that trust by sneaking that change discretely.
Re:Product Updates Based on Your Feedback by TekMol on Wednesday September 26, 2018 @04:36AM (#18073957)

    I don’t want to be logged in in my browser at all
Same here. Why does Chrome log you in in the first place?

I mean I know it from the companies perspective of course. They want to consolidate as much data about you as possible. And tie you into their ecosystem.

But what is the user facing benefit? Syncing your bookmarks across devices?

Re:Product Updates Based on Your Feedback by RossM on Wednesday September 26, 2018 @04:40AM (#18073974)
> But what is the user facing benefit?

Syncing bookmarks, recently opened tabs, passwords, autofill(?). These are genuine benefits when you're working with laptops, desktops, phones and tablets. Whether they're worth the cost of data mining is another matter of course.

Re:Product Updates Based on Your Feedback by TekMol on Wednesday September 26, 2018 @04:44AM (#18073997)

    These are genuine benefits when you're working
    with laptops, desktops, phones and tablets.
I work with all of these devices. Yet I don't want any of that syncing.

The thought that Google wants to send my 'recently opened tabs' to their servers makes me shudder. So they get the whole browsing history of every one of their users? Of all the pages that have nothing to do with them?

Same with passwords. So they have a gigantic database with all of their users passwords for all the services the users use? Even those totally unrelated to Google?

Re:Product Updates Based on Your Feedback by ajross on Wednesday September 26, 2018 @09:48AM (#18075869)
> I work with all of these devices. Yet I don't want any of that syncing.

So... you're happy that they're giving you the option to turn it off then, right? I mean, you appear to concede that someone users want this. You want the option to turn if off, which you're getting. That seems like good news.

Except your tone doesn't seem to match your logic.

FWIW: I use Firefox too. But... I mean come on folks. They messed up, they're fixing it. The obsession with hatred and flamage is getting a little out of control.

Re:Product Updates Based on Your Feedback by Ntrails on Wednesday September 26, 2018 @11:17AM (#18076807)
The issue is that trust breaches can't just be rolled back. You put people in a situation where they don't want to get caught out by the next change that the press doesn't pick up and/or you don't hear about.
Re:Product Updates Based on Your Feedback by nadahalli on Wednesday September 26, 2018 @05:14AM (#18074169)
It's possible that I want my passwords (of other sites) synced on all instances of Chrome across my devices, but I don't want Google to know these passwords (obviously). They have an "encrypt-passwords" feature for that.

https://support.google.com/chrome/answer/165139

Perhaps you have never visited passwords.google.com :-)

Re:Product Updates Based on Your Feedback by msiyer on Wednesday September 26, 2018 @08:12AM (#18075064)
The link says:

> Passphrases are optional. Your synced data is always protected by encryption when it's in transit.

Data is protected when in transit and passphrase is optional. How is this a good feature?

Re:Product Updates Based on Your Feedback by exatto on Thursday September 27, 2018 @10:04AM (#18084562)
The difference is whether or not Google can see your passwords.

When you use a passphrase, your data will presumably be encrypted with your passphrase and thus only be visible to you with knowledge of the passphrase. Not even Google could see the data while it would be stored on their servers.

Encryption during transit means that no bad actors like hackers, unscrupulous ISP's or overzealous governments can access your data _while_ it travels over the wires towards Google's servers but Google can still do what it wants with your data.

Re:Product Updates Based on Your Feedback by Lio on Wednesday September 26, 2018 @09:22AM (#18075624)
My question is why is that not on by default? Why would it ever be acceptable for Google to have unencrypted copies of your bank password for example?
Re:Product Updates Based on Your Feedback by rincebrain on Wednesday September 26, 2018 @11:33AM (#18076970)
I would assume it's the standard tradeoff - if you lose the key to the password DB (be it an actual cryptographic key or a password you synthesize it from), you lose access to the data, and some people are more interested in guaranteeing access to their data over avoiding storing it with an external entity.

(I work for Google but on nothing remotely related to this.)

Re:Product Updates Based on Your Feedback by r3bl on Wednesday September 26, 2018 @05:07AM (#18074127)
One advantage that wasn't mentioned is the ability to send a tab between devices.

I'm looking at something on my desktop, have to go somewhere, so I just send the tabs to my phone and continue consuming. If I forget to do so, I can also use the url bar to search through common history, so that I could enter a few words from the title and go back to that article.

That being said, I personally wouldn't trust Google to do this, so I use Firefox that I believe encrypts data client-side by default.

Re:Product Updates Based on Your Feedback by acct1771 on Friday September 28, 2018 @08:17AM (#18092720)
Your use of the word "consuming" definitely solidified the idea that I'm all set without these features, I don't miss them that much.
Re:Product Updates Based on Your Feedback by shawnz on Wednesday September 26, 2018 @05:29AM (#18074240)
> The thought that Google wants to send my 'recently opened tabs' to their servers makes me shudder. So they get the whole browsing history of every one of their users?

They claim sync data is end-to-end encrypted. However they would already have your browsing history if you have address bar suggestions enabled.

Re:Product Updates Based on Your Feedback by JetSpiegel on Wednesday September 26, 2018 @06:21AM (#18074481)
Chrome is not really a web browser, it is a part of the Google crawling machine.

Distributed, and it pays for itself using AdSense.

Re:Product Updates Based on Your Feedback by maxerickson on Wednesday September 26, 2018 @08:53AM (#18075403)
What if other people do want it?
Re:Product Updates Based on Your Feedback by dredmorbius on Wednesday September 26, 2018 @03:19PM (#18079334)
Beware the The Tyranny of the Minimum Viable User:

https://old.reddit.com/r/dredmorbius/comments/69wk8y/the_tyr...

Re:Product Updates Based on Your Feedback by maxerickson on Wednesday September 26, 2018 @04:13PM (#18079811)
Hilariously, that WOT doesn't address my point.

Here's one way: there's not a singular axis that users wanting sync and users not wanting sync can be placed on and compared.

The other poster expressed how the feature sucked for their purposes. But the feature wasn't made to punish them, it was made after evaluating the preferences of many users, which is what my question is getting at.

Re:Product Updates Based on Your Feedback by dredmorbius on Thursday September 27, 2018 @02:16AM (#18082419)
Features can introduce risks in various ways. I discovered this long ago through a software vendor's annual feature request solicitation, in which I learned to be ware of what others ask for: you may get it.

Specifically as to sync: I would love to be able to sync certain elements of browser state between my systems.

Not between one of my systems, some arbitrary third party of questionable trust and intentions, and another of my systems. But directly between my systems.

Google actively thwart this.

A feature of most early browsers was the ability to save bookmarks to a file, and import that elsewhere. By slight extension, a browser session or tab state can be saved, either directly, or as bookmarks.

Chrome does not do this, either at all, or on all platforms. It's most resistant to this on the consumption-only platform of Android.

This has been a major point of frustration to me for a year and a half as I've been wanting to dump user state from one system to another, without Google intermediating that exchange for me. I've found no means of accomplishing this.

That is one element of the tyranny of the minimum viable user, as well as of Google cattle-prodding its users into the feed chutes.

Re:Product Updates Based on Your Feedback by titel on Wednesday September 26, 2018 @06:14AM (#18074457)
They already have most of your browsing history simply by having you logged into your Gmail and browsing the sites having Google Analytics installed (which is most of the sites on the internet these days).
Re:Product Updates Based on Your Feedback by 0x0 on Wednesday September 26, 2018 @06:23AM (#18074490)
Some of us don't use the gmail web interface (opting for IMAP or a different provider instead), and use an ad blocker to take of analytics.
Re:Product Updates Based on Your Feedback by emondi on Wednesday September 26, 2018 @08:27AM (#18075190)
I do the same but sometimes I get email from google telling that I should disable access to those unsafe apps.
Re:Product Updates Based on Your Feedback by rakoo on Wednesday September 26, 2018 @07:10AM (#18074701)
Ironically, from the article itself, this automatic sign in will not turn sync on automatically. This is probably the most confusing decision that can be.
Re:Product Updates Based on Your Feedback by aasasd on Wednesday September 26, 2018 @05:40AM (#18074298)
There is, or at least was, a notable feature that synced data can be encrypted with a separate password, client-side. I can't vouch for its strength, but it's there.
Re:Product Updates Based on Your Feedback by bayindirh on Wednesday September 26, 2018 @07:02AM (#18074654)
While I understand and agree that they're benefits for the user, its interpretation and decision shall be made by the users themselves.

If the company supplying these features are forcefully making these decisions on behalf of me, I can assume that there are other intentions and motivations for providing these services to me for "free".

Re:Product Updates Based on Your Feedback by spondyl on Wednesday September 26, 2018 @06:23AM (#18074491)
That "Save this login" stuff in Chrome drives me up the wall. I understand you can disable it under Settings (and I do) but I see it on other people's computer too and I feel a bit of me die inside when they click "Save login" just to make it go away.
Re:Product Updates Based on Your Feedback by srazzaque on Wednesday September 26, 2018 @07:02AM (#18074652)
Completely agree. It's ironic that users who click "remember my password" are 10x more likely to forget their password.

The next step in this equation is even more frustrating - people who's default workflow to signing in is to click 'I forgot my password', and proceed through those steps to instil a new password. And then the cycle continues.

Re:Product Updates Based on Your Feedback by wild_preference on Wednesday September 26, 2018 @07:29AM (#18074790)
> It's ironic that users who click "remember my password" are 10x more likely to forget their password.

How is that ironic? People who can't remember their password would have the most reason to let an external apparatus save it for them.

Re:Product Updates Based on Your Feedback by srazzaque on Wednesday September 26, 2018 @07:49AM (#18074908)
People who can't remember their password often forget it due to having used that feature. Forcing yourself to type a password in over and over will pretty quickly encode it into muscle memory.
Re:Product Updates Based on Your Feedback by bun_at_work on Wednesday September 26, 2018 @08:04AM (#18075014)
This is a little ridiculous. Do you think there is no value in password managers? It's almost certainly better to have many complex passwords managed for you and only one strong password to protect them all, than to remember the same few passwords used across many accounts, decreasing the overall security of those accounts.

I understand healthy skepticism of Google, but essentially claiming password managers (which is what this feature is) are bad, for the sake of criticizing Google, is bad.

Re:Product Updates Based on Your Feedback by srazzaque on Wednesday September 26, 2018 @10:46AM (#18076452)
I think you've misunderstood me. I'm not criticising Google here. I just dislike any tool that encourages people to unintentionally forget passwords for the sake of "getting this annoying prompt out of my way". This can be a "remember me" on a website's own page, or a browser feature.

A good password manager is a great tool and more secure than a few simple memorable passwords. But when I use it, I'm making a conscious trade-off between memorable passwords and secure ones, but usually I'll at least need to memorise a master.

I'm fact just thinking about it - if Chrome's signin affinity is turned on, and I have chosen "remember me", AND I use the password manager, isn't that effectively equivalent to having your entire password manager with a "remember me"?

Re:Product Updates Based on Your Feedback by KumarAseem on Wednesday September 26, 2018 @06:53AM (#18074609)
Out of the total population of the chrome users, how many really use more than 1 computer? These benefits may apply only for few users, probably in single percentage figures, which does not justify pushing it down the throats of everyone.
Re:Product Updates Based on Your Feedback by evan_ on Wednesday September 26, 2018 @07:51AM (#18074929)
It’s pretty common for people to have a “work” computer and a “home” computer.
Re:Product Updates Based on Your Feedback by aryamaan on Wednesday September 26, 2018 @08:42AM (#18075317)
And also most of android population use chrome.
Re:Product Updates Based on Your Feedback by kroltan on Wednesday September 26, 2018 @08:19AM (#18075107)
And that's probably one of the situations where you would precisely _not_ want synchronization. Now not only Google but your employer has access to your complete browsing history!
Re:Product Updates Based on Your Feedback by dredmorbius on Wednesday September 26, 2018 @03:26PM (#18079388)
And exceptionally useful to put an unbreachable firewall between work and personal devices.
Re:Product Updates Based on Your Feedback by kbenson on Wednesday September 26, 2018 @10:58AM (#18076594)
I think the majority of cases where it's helpful is between some traditional computing device, such as a laptop or desktop, and a mobile device such as a smart phone or small tablet. I think that's actually a fairly large amount of people.

That's also one of the situations it's most useful in, as having your saved passwords already present on your phone when you try to log into a site you generally don't from your phone is extremely helpful.

Re:Product Updates Based on Your Feedback by thug on Wednesday September 26, 2018 @07:09AM (#18074700)
Well, most people. I use it to sync between laptop, tablet and smartphone.
Re:Product Updates Based on Your Feedback by Aaargh20318 on Wednesday September 26, 2018 @07:05AM (#18074668)
IMO syncing the state of your user account between devices is the responsibility of the OS, not the browser.
Re:Product Updates Based on Your Feedback by crysin on Wednesday September 26, 2018 @11:23AM (#18076862)
Well unfortunately Microsoft and Apple don't appear to be working on a account sync feature at the moment so Chrome offering synchronization between my Windows, Mac, and iPhone is the next best thing for me, personally. I like having my bookmarks and history shared between my devices.
Re:Product Updates Based on Your Feedback by icebraining on Wednesday September 26, 2018 @08:10AM (#18075053)
How would that work between my laptop and phone?
Re:Product Updates Based on Your Feedback by cf_ on Wednesday September 26, 2018 @04:59AM (#18074078)
I would assume this is to compete with Apple's offerings (after all Apple doesn't just sign you into the browser, but into the OS nowadays). Apart from Chrome OS, Google doesn't have any other way to offer similar (tab-syncing, etc) functionality and signing you into their own browser is the closest they can get.
Re:Product Updates Based on Your Feedback by mda on Wednesday September 26, 2018 @09:33AM (#18075716)
Syncing almost everything across devices. Super useful.
Re:Product Updates Based on Your Feedback by chippy on Wednesday September 26, 2018 @06:36AM (#18074546)
They want to be the next AOL browser internet appliance. It's called Chrome OS
Re:Product Updates Based on Your Feedback by souterrain on Wednesday September 26, 2018 @07:13AM (#18074720)
With a blog named “The Keyword” is there any surprise they want to be AOL?
Re:Product Updates Based on Your Feedback by evrydayhustling on Wednesday September 26, 2018 @07:23AM (#18074762)
Yes, opt-in is the beginning, middle and end of the problem here. Google has plenty of tools to inform users of these capabilities and allow them to turn them on or off. I wouldn't even mind if they nagged me a couple of times with a pop-up about browser log in, or a confirmation that I want to keep or delete Google cookies. But on-by-default features have a special responsibility to be conservative with a user's privacy.

I actually value and use sync. Google sees most of by browsing through page-hosted GA anyway! But at best, this was really lazy product management that smacks of condescension about less technical users (don't worry your head about these cookies). And at worst, it's testing the waters on some really nefarious strategies.

Re:Product Updates Based on Your Feedback by StanAngeloff on Wednesday September 26, 2018 @06:54AM (#18074616)
This same change to Google Chrome forced me to go to Firefox, too. After about a week of pain, I'm now much more comfortable about my choice.

I do have a Firefox account which syncs up my passwords, history, etc. so in a sense I'm still logged into the browser.

I do trust Mozilla more than I do Google with my personal data, though.

Re:Product Updates Based on Your Feedback by nailer on Wednesday September 26, 2018 @07:04AM (#18074663)
Mozilla don't have access to your data even with Sync turned on! They've confirmed it multiple times this week.

One more reason to go with Firefox.

Re:Product Updates Based on Your Feedback by crummy on Wednesday September 26, 2018 @07:13AM (#18074721)
why do we trust them when they say this, when we don't trust google when they say it?
Re:Product Updates Based on Your Feedback by commoner on Wednesday September 26, 2018 @07:44AM (#18074882)
Data in Firefox Sync is end-to-end encrypted, while data synced to Chrome is subject to Google's privacy policy.

"The security model of Firefox Sync ensures that your sync data is encrypted before it ever leaves your machine, and that the password to unlock this encryption is never transmitted to the server. Not even Mozilla can access your sync data, so while we transmit it all over TLS for additional security, we do not depend on the confidentiality of TLS to keep your data safe."

https://medium.com/mozilla-tech/how-firefox-sync-keeps-your-...

"When you sync Chrome with your Google Account, we use your browsing data to improve and personalize your experience within Chrome. You can also personalize your experience on other Google products, by allowing your Chrome history to be included in your Google Web & App Activity."

https://www.google.com/chrome/privacy/

Re:Product Updates Based on Your Feedback by joshuamorton on Wednesday September 26, 2018 @11:01AM (#18076630)
There is also the option to e2e encrypt your chrome data.
Re:Product Updates Based on Your Feedback by Hendrikto on Wednesday September 26, 2018 @07:37AM (#18074845)
Because collecting user information is Google’s main business.
Re:Product Updates Based on Your Feedback by nailer on Wednesday September 26, 2018 @07:37AM (#18074842)
Have Google said they can't see your data when syncing?
Re:Product Updates Based on Your Feedback by cbolton on Wednesday September 26, 2018 @12:37PM (#18077691)
First I don't want to be logged in in my browser at all.

OK but I expect that most Chrome users feel different about that. Most are probably happy that this UI change makes things less confusing.

Second, and probably more important, software is about trust. [...] And what google did is to shatter that trust by sneaking that change discretely.

Why did the UI change shatter trust for you? It doesn't enable syncing so I don't see what the big deal is. With syncing out of the equation, I can imagine that you don't like being logged in in the browser for aesthetic reasons or something, but to have one's trust shattered?

Re:Product Updates Based on Your Feedback by lwhi on Wednesday September 26, 2018 @04:39AM (#18073973)
I do think Google has turned a corner recently.

They've achieved so much ubiquity, that their offerings are becoming incompatible with an open web.

Re:Product Updates Based on Your Feedback by x0re4x on Wednesday September 26, 2018 @08:16AM (#18075088)
Well, putting:

{ "SyncDisabled": true }

into /etc/chromium/policies/managed/test_policy.json (for debian linux) seems to do the trick for now, unsure how long it lasts...

see: https://www.chromium.org/administrators/policy-list-3#SyncDi...

Re:Product Updates Based on Your Feedback by nsmith14 on Wednesday September 26, 2018 @04:16AM (#18073853)
>And what google did is to shatter that trust by sneaking that change discretely.

How did you expect them to announce a change they probably perceive as a minor UX improvement? Also this has been brewing for months in canary/beta, it's not like they actually snuck the change as you imply.

Re:Product Updates Based on Your Feedback by grey-area on Wednesday September 26, 2018 @04:25AM (#18073889)
How did you expect them to announce a change they probably perceive as a minor UX improvement?

Just because you split a large change into a set of minor UX improvements and have different excuses for each individual change, that doesn't make the direction of travel any less damaging.

To be clear, the direction of travel is for Google to abuse their de-facto monopoly on search and browsers to own SSO across the web and track their users completely, at which point they will pretty much own your entire web experience (logins, browser history, maps, news, search, tracking, analytics - all this data will form a huge moat making it hard to compete and hard to resist decisions made by google about the web) - even if you don't use them they'll own the experience of the majority of your customers. This is why these small changes are so pernicious, and why people have reacted badly to them. This is why people reacted so badly to AMP.

This is not an argument over technicalities or quibbles over UX, this is a fundamental question of who owns the web.

Google have built up a lot of trust over the years by keeping the browser independent of their other operations, and making great technical progress with Chrome, but these changes (and others like starting to abuse their search monopoly by privileging certain google results) show that is not going to last - they are now at the monetising phase of their lifecycle, and nothing can stop it - a huge corporation has a momentum of its own.

Re:Product Updates Based on Your Feedback by wbl on Wednesday September 26, 2018 @06:08AM (#18074436)
The competition to their products is a click away. People use google products because they find them more useful. If that's a result of the data they have, who cares?
Re:Product Updates Based on Your Feedback by grey-area on Wednesday September 26, 2018 @02:37PM (#18078965)
People use google products because they find them more useful

No - because they are free, ubiquitous, and often installed by default. People choose their browser as they would choose a hat, from the limited selection available.

Re:Product Updates Based on Your Feedback by mirko22 on Wednesday September 26, 2018 @07:16AM (#18074734)
It’s not the result of data they have but the other way around.
Re:Product Updates Based on Your Feedback by wbl on Wednesday September 26, 2018 @07:56AM (#18074965)
So because they make more useful products people give them data as opposed to money?
Re:Product Updates Based on Your Feedback by notyourday on Wednesday September 26, 2018 @10:10AM (#18076084)
Google pays the salaries of every tech person whose opinion it values at a rate of > $0.00.
Re:Product Updates Based on Your Feedback by bla2 on Wednesday September 26, 2018 @09:33AM (#18075721)
I don't understand what "because of this" means. Chrome made some change that some famous blogger misunderstood, and everyone got up in arms over nothing -- https://motherboard.vice.com/en_us/article/gyny83/google-chr...

Given that, their reaction on their blog seems above and beyond to me.

Edit: Downvoters, reply with how this is incorrect instead of downvoting.