as an American skilled in computer science, I am literally aghast at what the mobile phone has done in barely fifteen years, degrading decades and in fact centuries of individual rights mores.

Meanwhile, as far as I can tell, in East Asia, there was a completely different series of social evolutions, such that a large majority of people are not bothered and in fact expect services tied to identity tied to finance. This conveniently is expressed by a government issued ID tied to a smart phone number tied to banking. There are exceptions but not the majority. This simple formula is repugnant to my US Western sense of social boundaries.

Investors are the ones that seem to have no problem with individuals giving up their privacy, while the people in question cross the gamut of social condition.

In a way it seems pragmatic. You say all the boundaries are being violated, you might as well get something out of it. Also I’m not sure there’s a lot of difference in loss of privacy and tapping or swiping a credit card.

Using a credit card still has an easily recognizable physical interaction element that’s easy for most people to understand. “I swipe my card, so my card company and maybe others know what I bought and where”.

The pervasive passive collection on a mobile phone is harder to internalize. “I carry a persistent, always on radio beacon that can record and transmit to arbitrary third parties all of my actions, searches, continual location, contacts both electronically and in person, and is tied directly to my identity (many countries require ID to obtain a SIM card)” is not how most non tech people would describe their mobile phone.

Sorry I was ambiguous in my comment. The smartphone itself is a different privacy question, but is the digital transaction interface losing anything more than a credit card swipe?

> is not how most non tech people would describe their mobile phone.

Yeah, being in tech, I wouldn't describe it like that either. It seems like so overboard that I would describe your post as misinformation/FUD.

I wouldn't say it's misinformation/FUD, if anything they missed a point or two. It's also the main interface to social media platforms with systems that are designed to take as much of your attention as possible, in an effort to use psychology to take ownership of your focus.

> Also I’m not sure there’s a lot of difference in loss of privacy and tapping or swiping a credit card.

Well for one thing, at least in my experience, most credit card transaction data does not include granular information about the transaction (like the list of groceries you bought).

> Well for one thing, at least in my experience, most credit card transaction data does not include granular information about the transaction (like the list of groceries you bought).

No, that information is collected as part of the "points" discount card and then sold to advertisers together with your credit card transation data.

You don’t have to give them the points card.

Also, I know an engineer that was inside a monstrous grocery chain many years back. Back then the payment and loyalty systems were separated by technical measures and firing level policies. If you used a CC without a points card they were not able to associate it to any kind of account.

Obviously the CC processor could but they didn’t get a list of purchases.

If you use the same credit card at walmart.com and in a physical Walmart store, then your itemized in-store purchases will show up as orders in your walmart.com account. This is without providing any other form of ID.

home depot is the same way, i bought something online on HD once and one day went in the store and bought something with the same credit card and the emailed me about my in store purchase.

i never logged it or provided any other information than my credit card swipe in the store but they tied it to the account i had on homedepot.com

But to what benefit? I use a discount card at my local supermarket. It also saves me anywhere from $0.10 - $0.40/gallon on gasoline. Beyond getting lower prices, I don't see any personalized marketing tied to my use of the card.

But the supermarkets gather that data, for sure. Several times I've bought a brand name item, then reverted to generic, then got offers related to that brand (just because I was buying based on value). I assume if they can establish a buying pattern with a few offers then often that will convert someone to the brand goods. (It's way easier just to pick the packet that looks like the one you got before than it is to look for the best offer).

One thing about returning to relative wealth is how much stress it removes from 'weekly' shopping.

I was ambiguous in my comment, but in my mind I was thinking about the loss of privacy from newer electronic transaction standards vs credit cards transactions. I suspect itemized data is generally not transmitted with the newer standards but I could be wrong.

I would like to know if this is still true.

I think in the future in order to stay private online, there's no way unless web traffic is decentralized off their servers.

That is the real power behind a peer-to-peer system in my opinion: Offloading, and therefore removing the capabilities to track anything as a single node in the system.

The only issue is peer-to-peer transport encryption, which can be solved if done correctly.

Something like "statistically correct" DNS, or assets, or contents should've been the norm a long time ago. That's exactly what I'm striving for with my Tholian Stealth Browser [1]

(to clarify: I mean peer-to-peer as a networking concept, specifically as the opposite concept of a decentralized blockchain)

[1] https://github.com/tholian-network/stealth

If a peer to peer system of interest caught on, I'm sure google would be glad to run 90% of the nodes (incognito) to have some view of what's happening therein.

Well, that depends on the scenarios that the threat model tries to identify.

The question at this point (or rather in that specific moment) is what will lead to classifying malicious actors, and how these malicious actors can be identified permanently.

If it's a blocked IP: not a good solution. If it's a TLS certificate for said peer: probably better.

Fighting anti censorship mechanisms is really hard due to its statistically local-true nature. The buckets have to be carefully sorted and randomized with multiple geolocations, ISPs, and fully-encrypted network protocols - to the very least in order to make this work.

All they would have to do is "support" the p2p network in chrome/chromium and because of the ease of use the majority of p2p nodes will be running code written by Google.

One thing I've been meaning to do for a while is try to use a 'hardcore' AOSP 'de-googled' Android rom, like ParanoidAndroid. I've no idea how much of a pain in the arse this will be. Heck, being rooted causes enough unexpected "why do you not work" moments for me. If anything, I feel Google has got more hostile to the privacy-conscious user over time.

The trouble with privacy as a product is that it's _very_ hard to verify it. Apple has basically said "Trust us, We're Okay" and smaller fry are even harder to verify.

I've never run, willing or knowlingly, an android phone that has not been de-googlified as my main phone (since my n900 died in 2012 ... I miss it ).

For my purposes, that works out well, there are, within reason, replacements for all the basics. And now that I have done it for so long, I don't really know how having an android phone with google works. The niche is big enough that something like https://microg.org/ exists that implements some of the core libraries for using google, without using google code. This enable installing some things from the playstore if neccessary ( I have not had the need - but I understand I am in a tiny minority ) - and it made it possible to install some corona contact tracing apps without having to rely on the google implementation.

I am sure though, and I see it around me, that things won't continue exactly as before just without google, because of how deeply ingrained tracking everyone and everything all the time is.

I don't know how hardcore you wanna get, but you might also want to take a look here https://e.foundation/ , here https://lineageos.org and here https://f-droid.org

There's like - dozens of us

...and thank you for reminding me of ParanoidAndroid. I've not tried them in a while.

Do it! I switched from iOS to a Google 4a last week, and have flashed my phone with CalyxOS. I was very tempted by GrapheneOS, but having microg built into Calyx has meant the very few apps I want that aren't on fdroid work perfectly fine for me (so far, these are my banking apps).

CalyxOS turned out to be about perfect for my use case, and I've been incredibly happy with it.

They have a flashing tool, which basically involved me plugging my phone into my laptop and running a script. Only thing I really needed to do was follow the prompts.

This kind of stuff is not, in general, possible to verify. You will always be trusting someone to be doing what they say they are doing.

This isn't a bad thing. Society is built on trust. All it means is that there needs to be consequences for breaking that trust, to keep everyone honest.

>One thing I've been meaning to do for a while is try to use a 'hardcore' AOSP 'de-googled' Android rom, like ParanoidAndroid.

I used paranoid android in the past and it definitely isn't privacy focused. The name makes it sound it's privacy focused but that's about it.

now i wonder to what degree apple's public refusal to unlock a particular phone for the FBI was a publicity stunt...

Google Fiber was about:

threatening behavior of the carriers and net neutrality

obtaining access rights to add fiber when new placement occurred

… not trying to build a viable new business.

Waymo (and basically all of X) is there to make google look sexy and to provide an exec playground than actual businesses. The Waymo team is the most competent team in the space and they know there is no business there this decade.

The Google fiber project was very much a aligned with their regular business model.

Google fiber is dead because deep packet inspection is dead.

The preemptive bad PR around snoopvertising and AT&T trying to compete made Google go, “oh yeah man ... we totally will not engage in deep packet inspection. Psh, stupid AT&T, what creeeps (ok guys shut it down!)”

personal data should be 2-party consent for every data sale transaction by law, not this ‘opted-in by corporate mandate and backed by regulatory capture and monopolistic power’ we have now. people should be able to negotiate a rate at which they’re willing to allow the corporation to sell their data, including not allowing it at all ever.

Can't we have a smart contract system where every company in possession of some user data can be asked to provide a machine-verifiable proof that it legally obtained that information?

sure, but it’s essentially a social/legal problem, not a technical one. the onus is on the company holding data to show the chain of consent, which doesn’t require anything fancy outside a purpose-built database.

So how does that work then? How does Google prove that I clicked that accept-EULA button? Or that I approve of them keeping track of my information? I never put my signature anywhere and still there are companies holding or even trading my information.

> it’s essentially a social/legal problem, not a technical one

And ironically, it's the tech companies who are getting away with it.

right, that’s the social/legal problem, that consent is assumed, and i’d argue, coerced. bundling like this is actually an anti-trust concern, because it’s using power in one market (for instance, search) to exert control in another (data brokerage), but we’ve collectively lost sight of this being a problem.

but yes, they should be required to get your unambiguous consent for data sharing separate from any other transaction, otherwise it shouldn’t be considered consent.

For software that doesn't require you to click a EULA button or change a value in a EULA file to acknowledge you agree to the EULA, they can just make it part of the Terms Of Service that you inherently agree to by using their software/service.

There is no technical solution to this problem. First parties can just lie or use dark patterns to gain permission.

Look, if some authority finds your personal information on some server, and they can't produce your digital signature on a contract which says that the company can keep the information from some date to some other date, then they are in violation. It is simply not possible to lie about it.

https://en.wikipedia.org/wiki/Digital_signature

Now every person needs to have a government-verified signing key, and suddenly consent given on disparate sites can be trivially linked to the same public key that verifies it...

Why does there need to be only one public key per user?

The authorities only have to look at the leaked information, contact you, and ask you to generate proof that you signed the contract.

The best part is, that it's not proven that all this tailored ads really have the desired effect. Especially if many buy those ads. Most of them are useless because the targeted customer only choose one to buy from for a wanted product, if he is choice is based on ads at all.

This is the real rub to me.

It would be one thing if you rip off all my data but I am constantly seeing ads for cool things I would never have found otherwise and can't wait to buy. Instead the ads are always shit that I never even consider.

If things were not tailored I would probably randomly run across products that are just outside my current taste but at least spark some interest.

The one who pays the most is the one who gets the spot. Tailored to make the most profit and you are part of a group of people who buy 'x' product. The group might be males, 20-25 year olds, sailors from Malta. You would expect ads for sailing equipment or vacations or beer. This group get's an ads for Corn Flakes instead. Why because Kellogg want to attract more young males and they may target a spot like sailing where they will sponser races and buy as many digital ads in that category as they can. You seeing cereal ads makes it seem very untargeted but in reality your data has been highly targetted to give you the unwanted ad.

This! Customer is served, except the customer is not the site visitor, it is the advertiser.

Google would be able to get a ton of revenue without tracking users at all. Selling ads based on search keywords would still work very well

Indeed, that's DuckDuckGo's main monetisation strategy right now, and it's working very well for them.

True and for others perhaps. But they still rely on the ad networks of, and passing data on to Microsoft (DDG, Ecosia....) or Google (Startpage).

Apologies for the self-promotion but there is another way: https://www.mojeek.com/support/ads/

> Google and Facebook’s business models depend deeply on being able to track information that consumers are increasingly unhappy to share

I see no evidence that regular people are particularly unhappy with sharing their information. While it's true that on the internet there's a loud privacy activist movement that's grown over the past few years, I don't think this movement reflects the true preferences of the silent majority. I think it's a self-serving moral panic.

Users benefit from the services that their information funds. It would be a mistake to incinerate trillions of dollars of institutional value on the say-so of a few strident and unrepresentative activist voices.

Because most users do not know what consequences their data can have. The whole business is completely opaque. A few years ago, it turned out that Apple users were shown higher prices in online shops just because they had used an Apple browser. I doubt they were happy about it, but as long as they didn't know, they had seen no problem in sharing this information.

>I see no evidence that regular people are particularly unhappy with sharing their information.

There's actually a pretty cool graph from Google from the court docs that says the opposite.

https://pbs.twimg.com/media/E2f1tSEWYAAVHGY?format=jpg&name=...

That graph didn't have a scale. It could be that 97% of users disabled the feature, or less than 1%. You just don't know.

If the scale didn't matter, Google would not have called it a "Problem"

I think what it comes down to is that a small number of people coughs be "a problem", while still not being evidence that the median regular person or whatever cares.

> I see no evidence that regular people are particularly unhappy with sharing their information.

Then why trick Google and Facebook them into doing that instead of making it opt-in?

A key point if the article is that consumer sentiment is shifting, Google knows it, and isn’t happy about that.

75 million in the USA that voted for the Red team saw close up the stifling censorship and deplatforming. Awareness is growing but I do agree behavior will be slow to change.

Google even managed to incur heavy losses from offering cloud infrastructure services. A business which usually is a guaranteed golden goose.

They are really bad at making money with anything that isn't advertising.

Google cloud has huge year over year growth, and does really well especially in retail sectors. The losses are an investment.

Also, not sure where you get that is a guaranteed golden goose. Most companies that are in this space don't do well.

I'm pretty sure they're doing that to draw folks from AWS and similar.

Yeah, but you'd have to be a fool to go.

Google has proven over and over again that they don't value customer support or long term maintenance. They will get bored and sunset services you depend on, or switch off your entire business because some employee sent suspicious email on his gmail.

GCP is very different than the consumer services.

So they claim. Anecdotal evidence suggests otherwise:

https://www.reddit.com/r/googlecloud/comments/gbh7p6/gcp_sus...

https://news.ycombinator.com/item?id=26252533

I’m working on a piece of a project that’s on GCP and ran into an edge case issue. For at least this product, the engineer reminded me of the old school Sun and IBM support people. It was a breath of fresh air for me. I’ve heard AWS is similar but never experienced it firsthand. Other big tech companies are very different.

A few weeks ago, I submitted an incident with sample code and got a response back with code to implement a workaround, and the information related to the enhancement the engineer submitted so I could escalate if needed. They automatically transitioned support engineers in another geography at shift end without any drama or repetition from me. All within 12 hours.

No... Google actually has started hiring AWS style support engineers for GCP.

Google has realized that building up business to business support networks is a profitable approach.

Customers get nothing, because customers don't pay money. Customers are the product.

> Both companies attempts to diversify their dependency on such info for their revenue have been broadly unsuccessful (Google fiber or a Google car anyone?)

IMO, you're wrong on this one. Things like Google fiber/car are not ways to diversify Google's revenue.

They are just more tools in their arsenal to keep collecting more data on users and improving their ads.

By offering things like Google fiber, they ensure more people get online and that's more data they can collect.

Same with FB. Terragraph and Aquila are/were just ways to get people online so more data can be collected and fed into "the machine"

I think there are three categories of projects at Google:

1) Working out how they can milk even more money out of their magic cash cow of online advertising by providing more opportunities to serve ads (YouTube, Gmail, Maps)

2) Protecting their magic cash cow (ads) from external threats, the main threat being a loss of tracking (Chrome, Android, Fibre, Google Analytics, Ok Google, Maps). (As an aside, if you use Chrome and want to avoid this kind of behaviour, please consider swapping to a truly open source non-tracking browser)

3) Trying to find another magic cash cow before the first one runs out of milk (Eg Google Cloud, YouTube Red)

Some things will fall into multiple buckets, for example Google Maps and Gmail offers both an opportunity to further track users and serve them ads - double whammy!

I suspect Google Cars are more about category 3, although have no doubt that they will be mined for data as much as possible to serve categories 1 & 2. Agree with your point on fibre - it looks like that is an attempt to own even more of the tech stack to provide even more methods to track.