9 ms·

I really wish they wouldn't overload terms that they themselves invented. In Chrome, "incognito" means we don't save your local history, but it does not add to

by chias 10y ago

I really wish they wouldn't overload terms that they themselves invented. In Chrome, "incognito" means we don't save your local history, but it does not add to the transport security. Here, "incognito" means you've got end-to-end encryption (and presumably also doesn't save local history). Why on earth would you re-use the same term when naming two things with similar (thus easily confused) consumer-visible attributes but completely different security guarantees?!

Mizza 10y ago
The worst was "Off the Record", which, for an XMPP service, didn't mean the "Off the Record" encryption protocol, it means "we don't log messages to your own email inbox." It's another dark pattern from an unscrupulous company.
- Sargos 10y ago
  I doubt anyone has ever confused the two. "Off the record" is a well known phrase in our culture. The "off the record" protocol is not very well known.
dovdov 10y ago
End-to-end encryption from your phone to Google's server, where neural networks now analyze all your data, Super cute! Lovely Labrador!
- jjcm 10y ago
  From their FAQ: "Your chats are end-to-end encrypted and can only be seen by you and the person you're chatting with. Google can't read any of your messages, so you won't see any Smart Reply or Google Assistant features." https://support.google.com/allo/answer/6383724?ref_topic=6376094&hl= https://support.google.com/allo/answer/6383724?ref_topic=637...
  - pjmlp 10y ago
    Who validates that that statement is indeed true, we in our naivety should just plain believe it?
    - oneeyedpigeon 10y ago
      As much as you would any other company - Apple, for example - unless someone trawls through the source code to verify the claim.
      - pjmlp 10y ago
        Exactly, but somehow many seem to believe Google is different.
    - matt4077 10y ago
      As much as people like a good conspiracy, that would be a pretty pointless one. There are tens of thousands people at google who could look at the source code, many of them with a left-wing/civil liberties attitude. To get all of them to stay silent, and to evade analysis of the binary is, if not impossible, simply not worth whatever they could get out of reading my messages (esp. considering their uninterrupted stream of emails to read). It's also why the concept of "brands" makes more sense than may are willing to admit: a blatant lie such as this would probably be worse for google than VWs little problem. Reading someone's private stuff is just bound to rouse more emotions than whatever comes out of the back of your car.
      - pjmlp 10y ago
        Yeah right. http://www.theverge.com/2016/9/21/12994362/allo-privacy-message-logs-google http://www.theverge.com/2016/9/21/12994362/allo-privacy-mess... "Allo messages will still be encrypted between the device and Google servers, and stored on servers using encryption that leaves the messages accessible to Google’s algorithms." [....] "The decision will also have significant consequences for law enforcement access to Allo messages. By default, Allo messages will now be accessible to lawful warrant requests, the same as message data in Gmail and Hangouts and location data collected by Android. "
- nannal 10y ago
  But that's end to middle encryption!
  - dx034 10y ago
    But perhaps middle out compression?
  - jakobloekke 10y ago
    Middle-out encryption ...? :)
- kuschku 10y ago
  The encryption for incognito actually is Moxie’s protocol, as used in Signal and WhatsApp. The one single good thing about allo.
  - pimeys 10y ago
    Just recently there was a HN post about security bugs in Signal. Signal is open source and the bugs will be fixed at some point, but I wouldn't trust all these proprietary apps will follow the lead so fast.
    - ithkuil 10y ago
      If there is one think I'd trust about Google is them to be serious about security vulnerability.
    - uph 10y ago
      "We've released an update to the Android app (3.19.0) which includes a fix. Signal for iOS and Desktop were not affected, nor were other consumers of Signal Protocol. Non-attachment message confidentiality and integrity was not affected. We're publishing our analysis to make as much information available as possible, but given both the limited impact of this bug and the set of circumstances necessary to exploit it, we consider this to have been of low risk to Signal for Android users." https://whispersystems.org/blog/signal-android-attachment-bug/ https://whispersystems.org/blog/signal-android-attachment-bu...
pqhwan 10y ago
I guess overloading a term with similarly-themed features ~= branding.
toephu2 10y ago
You must live in a bubble or have never worked at a large company before. There are two totally different teams building these products. Is it really that inconceivable for them (yes, even Google) to make this oversight?
- Mao_Zedang 10y ago
  I feel like incognito mode has been around long enough that this isnt a valid excuse.
- hueving 10y ago
  Are you trying to suggest there are employees at Google that don't know what incognito mode is in chrome? More specifically, every employee that worked on this project?
- huckyaus 10y ago
  If you read the blog post you might have noticed that they specifically mention Chrome's Incognito mode. > But we went a step beyond this and we created a mode within Google Allo called Incognito (h/t Chrome).
nl 10y ago
For most people, in both cases "incognito" means "porn mode". Chrome: "Won't save your (porn) history" Allo: "features like discreet notifications and message expiration" (ie, for sending naked pics) The transport layer security is great too, but for a lot of people "message expiration" is the key feature.
- drdaeman 10y ago
  I believe it's a bit different. It could be different for shared computers, but, I think, for porn browsing on one's own hardware, incognito mode is more about having a separate (ephemeral) browser profile, so you aren't accidentally sharing your kinks on Facebook and Google won't (visibly, at least) associate it with your main browsing profile and won't show you relevant ads there. A comparable feature for the IM world would be "alter ego"/pseudonymous mode, where your contacts aren't provided with your identity information (google account/phone numbers/etc - not even your "normal" name or nickname), but a throw-away identities, yet you still have a convenience of using a single app. Not really private in a sense your favorite TLA won't know you, but good enough in a sense your peers won't know you. I don't think any IM system does that, without setting up separate accounts. I mean, "self-destructing" messages weren't there in a lot of systems, and users perfectly know how to delete SMS or emails they don't want to keep - and saving the ones they do. Not to say "message expiration" is a myth (haven't they learned it with Snapchat already?) Maybe that's just my view of things, though.
hbharadwaj 10y ago
I read this and then I read this - Google backs off on previously announced Allo privacy feature (http://www.theverge.com/2016/9/21/12994362/allo-privacy-message-logs-google http://www.theverge.com/2016/9/21/12994362/allo-privacy-mess...) Performance for privacy - LOL
- jug 10y ago
  I would have shrugged if the performance over privacy idea had to do with just some random app, but this is a messaging app where privacy will for many reasons be paramount. :S

by chias 10y ago

Mizza 10y ago

The worst was "Off the Record", which, for an XMPP service, didn't mean the "Off the Record" encryption protocol, it means "we don't log messages to your own email inbox." It's another dark pattern from an unscrupulous company.

Sargos 10y ago
I doubt anyone has ever confused the two. "Off the record" is a well known phrase in our culture. The "off the record" protocol is not very well known.

dovdov 10y ago

End-to-end encryption from your phone to Google's server, where neural networks now analyze all your data, Super cute! Lovely Labrador!

jjcm 10y ago
From their FAQ: "Your chats are end-to-end encrypted and can only be seen by you and the person you're chatting with. Google can't read any of your messages, so you won't see any Smart Reply or Google Assistant features." https://support.google.com/allo/answer/6383724?ref_topic=6376094&hl= https://support.google.com/allo/answer/6383724?ref_topic=637...
- pjmlp 10y ago
  Who validates that that statement is indeed true, we in our naivety should just plain believe it?
  - oneeyedpigeon 10y ago
    As much as you would any other company - Apple, for example - unless someone trawls through the source code to verify the claim.
    - pjmlp 10y ago
      Exactly, but somehow many seem to believe Google is different.
  - matt4077 10y ago
    As much as people like a good conspiracy, that would be a pretty pointless one. There are tens of thousands people at google who could look at the source code, many of them with a left-wing/civil liberties attitude. To get all of them to stay silent, and to evade analysis of the binary is, if not impossible, simply not worth whatever they could get out of reading my messages (esp. considering their uninterrupted stream of emails to read). It's also why the concept of "brands" makes more sense than may are willing to admit: a blatant lie such as this would probably be worse for google than VWs little problem. Reading someone's private stuff is just bound to rouse more emotions than whatever comes out of the back of your car.
    - pjmlp 10y ago
      Yeah right. http://www.theverge.com/2016/9/21/12994362/allo-privacy-message-logs-google http://www.theverge.com/2016/9/21/12994362/allo-privacy-mess... "Allo messages will still be encrypted between the device and Google servers, and stored on servers using encryption that leaves the messages accessible to Google’s algorithms." [....] "The decision will also have significant consequences for law enforcement access to Allo messages. By default, Allo messages will now be accessible to lawful warrant requests, the same as message data in Gmail and Hangouts and location data collected by Android. "
nannal 10y ago
But that's end to middle encryption!
- dx034 10y ago
  But perhaps middle out compression?
- jakobloekke 10y ago
  Middle-out encryption ...? :)
kuschku 10y ago
The encryption for incognito actually is Moxie’s protocol, as used in Signal and WhatsApp. The one single good thing about allo.
- pimeys 10y ago
  Just recently there was a HN post about security bugs in Signal. Signal is open source and the bugs will be fixed at some point, but I wouldn't trust all these proprietary apps will follow the lead so fast.
  - ithkuil 10y ago
    If there is one think I'd trust about Google is them to be serious about security vulnerability.
  - uph 10y ago
    "We've released an update to the Android app (3.19.0) which includes a fix. Signal for iOS and Desktop were not affected, nor were other consumers of Signal Protocol. Non-attachment message confidentiality and integrity was not affected. We're publishing our analysis to make as much information available as possible, but given both the limited impact of this bug and the set of circumstances necessary to exploit it, we consider this to have been of low risk to Signal for Android users." https://whispersystems.org/blog/signal-android-attachment-bug/ https://whispersystems.org/blog/signal-android-attachment-bu...

pqhwan 10y ago

I guess overloading a term with similarly-themed features ~= branding.

toephu2 10y ago

You must live in a bubble or have never worked at a large company before. There are two totally different teams building these products. Is it really that inconceivable for them (yes, even Google) to make this oversight?

Mao_Zedang 10y ago
I feel like incognito mode has been around long enough that this isnt a valid excuse.
hueving 10y ago
Are you trying to suggest there are employees at Google that don't know what incognito mode is in chrome? More specifically, every employee that worked on this project?
huckyaus 10y ago
If you read the blog post you might have noticed that they specifically mention Chrome's Incognito mode. > But we went a step beyond this and we created a mode within Google Allo called Incognito (h/t Chrome).

nl 10y ago

For most people, in both cases "incognito" means "porn mode". Chrome: "Won't save your (porn) history" Allo: "features like discreet notifications and message expiration" (ie, for sending naked pics) The transport layer security is great too, but for a lot of people "message expiration" is the key feature.

drdaeman 10y ago
I believe it's a bit different. It could be different for shared computers, but, I think, for porn browsing on one's own hardware, incognito mode is more about having a separate (ephemeral) browser profile, so you aren't accidentally sharing your kinks on Facebook and Google won't (visibly, at least) associate it with your main browsing profile and won't show you relevant ads there. A comparable feature for the IM world would be "alter ego"/pseudonymous mode, where your contacts aren't provided with your identity information (google account/phone numbers/etc - not even your "normal" name or nickname), but a throw-away identities, yet you still have a convenience of using a single app. Not really private in a sense your favorite TLA won't know you, but good enough in a sense your peers won't know you. I don't think any IM system does that, without setting up separate accounts. I mean, "self-destructing" messages weren't there in a lot of systems, and users perfectly know how to delete SMS or emails they don't want to keep - and saving the ones they do. Not to say "message expiration" is a myth (haven't they learned it with Snapchat already?) Maybe that's just my view of things, though.

hbharadwaj 10y ago

I read this and then I read this - Google backs off on previously announced Allo privacy feature (http://www.theverge.com/2016/9/21/12994362/allo-privacy-message-logs-google http://www.theverge.com/2016/9/21/12994362/allo-privacy-mess...) Performance for privacy - LOL

jug 10y ago
I would have shrugged if the performance over privacy idea had to do with just some random app, but this is a messaging app where privacy will for many reasons be paramount. :S