11 ms·
Google Deceptively Tracks Students’ Internet Browsing, EFF Says in FTC Complaint
- blfr 11y agoChrome's sync data is supposed to be encrypted at least with your Google account password. They could be doing all that (mining, tracking) but there is a clear, legitimate purpose to this feature: providing the same environment across computers.
- ryanhuff 11y agoSyncing data between chrome environments is different than mining usage data across google's properties. It sounds like that's the beef here. Children are required to use the Chrome systems, and parents have no say in the matter, or control over how Google uses the data.
- lsaferite 11y agoWhere did they present proof that Google is data mining vs. just syncing data across devices?
- natch 11y agoIt's Google. Any plaintext data they are in possession of is mined by definition. If all they wanted was sync, they could use some flavor of secure key exchange to protect it, as others do.
- 5ilv3r 11y agoIf it was only being synced, it would be encrypted with a client side passphrase. It is not.
- Sephr 11y agoYou can set a sync passphrase that is separate from your Google password.
- kllrnohj 11y agoBy default only passwords are encrypted afaik. There's a setting you can choose that will encrypt everything, but then you need to provide a passphrase.
- thomaskcr 11y agoIs the EFF's problem that this information is stored on Google servers? Syncing settings to an account seems like one of the prime selling points for a school using chromebooks. A child loses their chromebook, or gets issued a different one the next September all their favorites, apps, etc are there ready to go when they sign in. https://support.google.com/chromebook/answer/2914794?hl=en https://support.google.com/chromebook/answer/2914794?hl=en
- maratd 11y agoLet's try this exercise. Replace "Google" with "Lenovo". Lenovo sells computers to schools. The computers upload everything entered onto the computer to Lenovo by minors without consent. Everything uploaded is data-mined. You can switch it off in some obscure setting. You would have people carrying pitchforks here instead of saying "really?". Google doesn't get a pass. This is shady. Should be off by default.
- Zhenya 11y agoWrong - Replace Google with Canonical/Apple. Doesn't seem so bad now, does it? Lenovo does not make the OS on the machine and DEFINITELY does not provide cloud services like Google.
- natch 11y agoYou overlooked that small detail where for services where the cloud does not require plaintext, Apple encrypts everything with a key that never leaves the client.
- Zhenya 11y agoCool. Challenge to you; get some plain text from another google user account that's private. If you do, don't reply in this thread. Just go straight here: https://www.google.com/about/appsecurity/reward-program/ https://www.google.com/about/appsecurity/reward-program/
- arebop 11y agoAccording to the FAQ, "It’s also possible that Google does not use student data for any of these purposes—but unfortunately, Google has refused to articulate the reasons" so it seems like the EFF's position on Internet-hosted applications is that the specific uses of each kind of data should be described in a privacy policy. I think it's a tenable but extreme position, because basically they are objecting to Google reserving the right to develop new features in an empirical/data-driven way. I think most people don't think of e.g., their privacy w/r/t tax data being compromised when their tax prep software company mines it to make data entry simpler, or to make it easier to understand the consequences of various filing choices by visualization, etc. Similarly, I don't think Google is invading my privacy when it takes my search queries and uses not only to produce SERPs for me but also to notice that when people type cyombinator it is likely a typo for ycombinator.
- ryanhuff 11y agoI don't think it's asking much for Google to put a wall around the profiles and associated usage data for these school related accounts.
- arebop 11y agoAs I said, I think reasonable people can disagree about it, but I think they are demanding that the wall have a shape like "this data will be displayed back to you while you work on it and to your teacher during the grading period and otherwise it will not be used," whereas many people are totally happy for the wall to be "we will use this data to help you learn and allow your teacher to evaluate your progress." Lots of people object to advertising to kids, not so many people object to building a better word processor or kids-oriented theorem prover or whatever, including ideas that haven't been thought about yet but are (in the developer's honest opinion) wholly motivated by the purpose of education. EFF basically doesn't trust a cloud software company to have any discretion, but I think most people are willing to take an informed risk when they entrust their data to someone else's instructions or computational resources; otherwise they'd write the software themselves and run it on their own device and so forth.
- Navarr 11y ago> EFF’s filing with the FTC also reveals that the administrative settings Google provides to schools allow student personal information to be shared with third-party websites in violation of the Student Privacy Pledge. What? Is the EFF complaining here that Google gives schools the ability to share their student's data with third parties and that is wrong (by Google)?
- free2rhyme214 11y ago"If Google wants to use students’ data to ‘improve Google products,’ then it needs to get express consent from parents.” This is true.
- SystemOut 11y agoIt is not actually true. The school district acts as the agent for the child and it is their responsibility to spell out in contracts what the vendor can do with the data (in most cases). They are bound by various state and federal laws on what they can allow as well as what they must require of vendors but in general the parents don't have to provide consent on a case-by-case basis. Of course, parent can talk to the district about it and potentially have the child not use the service but this is not something vendors would ask of each parent.
- MattHeard 11y ago"… Google’s “Sync” feature for the Chrome browser is enabled by default…" "… since some schools require students to use Chromebooks, many parents are unable to prevent Google’s data collection." Doesn't "enabled by default" mean that parents should be able to disable the sync feature? That being said, I would assume that any tracking features would be separated from syncing features on a machine built for a student. Google appears to be attempting to correct that, after EFF's prompt: "Google told EFF that it will soon disable a setting on school Chromebooks that allows Chrome Sync data, such as browsing history, to be shared with other Google services."
- marincounty 11y agoOff topic comming up. I feel the one thing that will really get Google in trouble is this hypothetical senerio--right out of a bond movie: Google has the ability to look at all our internet history. They have the ability to read our emails. That can match up ip addresses with street address. They can most likely figure out what most people do for a living. (yes, some of this spying in illegial, unless advertising purposes?) Could you imagine looking at the Internet history, and emails of the Titans of business around the world? Looking at the information that stock/investment types pass around. Looking at all this information, collating it, data mining it, etc., and then buying and selling stocks/bonds/etc.? Yea, I know it's illegial. It just seems like it would be tempting? I know the SEC is probally, or I hope they are, watching out for this kind of hypothetical behavior, and no--I don't think the founders of Google would ever even think about doing someting like this. If I worked there, and had access to sensitive files on those servers; It just seems like it would be hard to not look at that information, and make a few bets? Yea, I know they have great internal security, and have strict policies, but there's always a guy who would be willing to break the rules? I don't think I could not look at that information, and try to predict the future? (In reality I would never do anything like I proposed, but it sure would be tempting?)
- pdkl95 11y agoPeople are attacked physically over tiny sums of money. Occasionally someone is murdered over sums small and moderate sums of money. If people can be tempted by money to commit terrible crimes of violence, we should expect it would be easier to tempt someone with either larger amounts of money or less risk of getting caught.\ Mining data - from any source - is a lot less risky than murder, with a very low probability of being caught. Sometimes, selling data can be incredibly profitable. What is the probability that all of the current and future people at google will overcome that temptation? Even if people currently at google somehow resist the temptation, the open-ended nature of the data means that someone will eventually break.
- toupeira 11y agoNevermind the possibility of intelligence assets/agents working undercover at companies like Google and Facebook.
- chestnut-tree 11y agoIt's depressing how perfectly normal and natural the idea of tracking users has become. I know this isn't a popular opinion on Hacker News, but why should there be any tracking whatsoever when using an OS? Are people saying that they're perfectly fine for their Windows/Mac/Linux distribution to track everything they do? The apps they use? The sites they visit? Because that's basically what ChromeOS does. It even tracks the documents you print to your desktop printer (routed through Google's cloud print service). You aren't even anonymous when you use ChromeOS - you must be signed into your Google account. Just as a reminder, your Google account = your name, your date of birth, your location and optional phone number. In other words, some of your most personal and private information all tied to the activity you conduct on ChromeOS. Google states that it does not read the content of your emails in GMail (emails are scanned by computer), but you could argue that your browsing habits are just as private and personal. No such assurances on how they handle this data. Does Google disassociate the identity of the user from their activity? If not, then who sees this data at Google? How long is this data kept for? These are important questions, but you won't find answers in Google's privacy policy. (And you're unlikely to find many in the tech community asking Google about them either.) I would never recommend an OS that tracked the activity of students so relentlessly, especially when many students are too young to understand the horrendous privacy implications of using ChromeOS. Other companies like Microsoft are rightfully criticised for their tracking in Windows 10, yet Google gets a completely free ride. It's just baffling.
- deleted 11y ago[deleted]
- awqrre 11y agoThey don't read all emails because it is easier for a program to look for certain phrases/words/etc... but in the end, they are still looking at them even if it is indirectly (unless you encrypt everything).
- Laaw 11y agoWhat alarms me is how important privacy has suddenly become, despite a distinct lack of actualization on the "nightmare" scenarios we keep hearing.
- newman314 11y agoWhile I think it's great (but insufficient) that students and kids have greater privacy protection than adults, it begs the question why all of us shouldn't enjoy the same level of protection. Just because one becomes an adult does not mean that an adult is less deserving of the same level of protection.
- bduerst 11y agoI think it's assumed that because an adult is more autonomous they are also more sapient, and typically not needing the same protection. It's why some countries have banned certain advertisement mediums targeting children, and why you won't see many tobacco billboards by schools.
- gohrt 11y agoAdults can decide for themselves whether they want to use Google. Schoolchildren can't.
- khed 11y agoCan they? I am not convinced that most (any?) adults can give informed consent for any of these datamining services.
- newman314 11y agoPlus there are scenarios where choice is not available, for example, Comcast as the only ISP in town etc. I suppose one could choose not to use the Internet in that case but that's not really a viable solution. It's an asymmetric fight which individuals are on the losing end and given what we now know post-Snowden, I'd argue that greater privacy protection is absolutely necessary and available to all those who desire it.
- msk456 11y agothis argument is irrelevant; as whether adults can give informed consent or not is not important (at least) here. e.g. adults have voting right, at least in some countries,including USA (whether they give informed vote or not is not even checked just assumed) but the children don't have this right. It is outright wrong and unethical on google's part to steal a kid's information especially after declaring they are not doing it.
- gmisra 11y agoPeople seem to be conflating "tracking user behavior" with "tracking user behavior without consent or transparency". Yes, there are plenty of people opposed to the former, but that is a moot point with respect to Google. The latter, however, is symptomatic of a much bigger issue: there is a pervasive belief amongst many of the silicon elite that users simply aren't capable of making effective decisions regarding tracking, and therefore it is best if they are not allowed to make those decisions. I have heard this directly from many people, and each time it leaves me surprised. If Google were to provide real transparency into the information they track about me, that would be fantastic. I likely wouldn't even look at it, but I would know that organizations like the EFF and ACLU would serve as ombudspeople for the public. Furthermore, whichever of the big internet players does this first will likely generate a tremendous amount of brand loyalty and free marketing. I suspect current behavior won't change without legal intervention, which will potentially be adversarial, which is a shame since there are people at these companies who are much more qualified than lawmakers to anticipate and plan for the future. It's amazing that a company (and industry) that self-identifies so strongly with taking novel approaches to solving hard problems can get mired in such status quo bias.
- jpadkins 11y agohttps://myaccount.google.com/ https://myaccount.google.com/ you can see all the data google collects about you. You can export it or delete it.
- CaptSpify 11y ago> you can see all the data google collects about you. You can export it or delete it. A) In no way do I believe that is all the data Google tracks about me. It's just what they choose to present to you. B) How do I have any guarantee that it's actually deleted?
- asuffield 11y ago(Tedious disclaimer: not speaking for anybody else, my opinion only, etc. I'm an SRE at Google. I can't respond to most of the things in this thread, so don't bother asking.) "If Google were to provide real transparency into the information they track about me, that would be fantastic." "In no way do I believe that is all the data Google tracks about me." The second comment here is why there's no point in doing the first one. It doesn't matter how much information we release about this, when people are determined not to believe it. It is a frustrating experience for the people who work on them to pour time and effort into making sure a privacy policy is really precisely accurate about what is happening, and then see threads like this where people will go looking for loopholes that aren't there, and because English is fairly ambiguous they'll eventually find a way to misinterpret the words to support what they wanted to believe all along. Here's an interesting hypothetical question: if the primary effect of the conspiracy theorists is to throw bricks at the people who are trying really hard to make sure the bad things never happen, then which side are the conspiracy theorists really on? (I make no claims about whether this is what's happening, because I can offer no evidence, I just think it's an interesting question)
- semi-extrinsic 11y agoBegging the question. I do not think it means what you think it means. https://en.wikipedia.org/wiki/Begging_the_question https://en.wikipedia.org/wiki/Begging_the_question (Grammar-nazi-ing aside, I completely agree with you.)
- wrsh07 11y ago"Begs the question" is now commonly used in that way. This comment does not really contribute to the discussion. It feels like a "Well-actually" from Recurse Center's social rules.
- semi-extrinsic 11y agoI agree it's off-topic, but I'm not sure I agree it's a "Well-actually". Language is imprecise enough as it is, we don't need to make it even more so by letting common mistakes become accepted practice. Bad analogy: imagine if the Python docs were to recommend handling try-blocks with "except: pass" simply because many people do it.
- dragonwriter 11y ago> Begging the question. I do not think it means what you think it means. The transitive use "begs the question X" (where X is some actual question) is commonly used that way and well-understood (and this usage is, while idiomatic in structure, fairly obvious from the usual definitions of the words involved.) This is readily distinguished from the intransitive use "begging the question" or "begs the question" to refer to the petitio principii fallacy (an idiom based in what was, at the time, a poor translation into English that hasn't gotten better with age.) Even better, the intransitive use can be seen as (though this reverses the etymology) a special case of the transitive use in which the question begged is the original one the argument sought to address -- the justification for the conclusion which has been assumed in the petitio principii fallacy -- so that the transitive use that you complain about both generalizes the special intransitive case and rationalizes it with common usage.
- semi-extrinsic 11y ago
- pjc50 11y agoAn example of student privacy invasion using good old fashioned paper surveys and leading questions: http://www.thecanary.co/2015/12/01/children-branded-potential-terrorists/ http://www.thecanary.co/2015/12/01/children-branded-potentia... Note that "The surveys were supposed to be anonymous, and when concerns were raised about pupils being identified, assurances were made they would be destroyed." turned into the survey results being handed to the thought police. (There are various programs trying to combat "islamic extremism" in schools in the UK, all of which seem to be proceeding in clunky bureaucratic ham-fisted ways.)