4 ms·

> they would dump Firefox for the hero of privacy Chrome Wrote this in a previous discussion: https://news.ycombinator.com/item?id=15940491 https://news.ycombi

> they would dump Firefox for the hero of privacy Chrome Wrote this in a previous discussion: https://news.ycombinator.com/item?id=15940491 https://news.ycombinator.com/item?id=15940491 >> updates have been known to re-enable it if you turn it off ... But it doesn’t matter - you’re going to re-enable it on the next update. > It's surprising how ... trustworthy Chrome is in this regard. My default search engine is set to DDG and through countless updates Chrome has never once attempted to reset it to Google. Even though Chrome has every incentive to break privacy settings, even though Chrome has every incentive to revert the default search engine to Google, they don't.

rodorgas 9y ago
It’s very sad that they reset some privacy preferences on updates. It can be explained by incompetence or bad faith, but coming from Mozilla I'd rather assume incompetence.
- qbaqbaqba 9y ago
  It's not sad: it's illegal - as long as the EU is concerned.
mintplant 9y ago
In its default configuration Chrome's sync service uses transport-only encryption, not end-to-end, so that Google can read all your history, cookies, and so on. Their privacy policy [0] allows Google to mine this data for its own purposes. I would wager a very, very small proportion of Chrome's userbase manually enables the end-to-end sync encryption option buried in the settings; even technically-minded friends I've told about this are usually surprised. So Chrome's privacy settings are already broken by default, in nearly the worst way they could be. [0] https://www.google.com/chrome/browser/privacy/index.html https://www.google.com/chrome/browser/privacy/index.html, "Signed-in Chrome mode"
- TAForObvReasons 9y ago
  You completely sidestepped the issue at hand: >> [Firefox] updates have been known to re-enable it if you turn it off ... But it doesn’t matter - you’re going to re-enable it on the next update. You can choose to opt out of Chrome's phoning home in the privacy settings and they haven't tried to revert those settings in an update (and given their track record, I have no reason to believe they will try to surreptitiously change the settings in a future release)
- agentdrtran 9y ago
  they do this becuase I set up end to end for my parents and they lost the password. they never want to use encryption again. the default to user-friendliness which is not a bad thing.
  - Sylos 9y ago
    Firefox Sync is end-to-end-encrypted with only one password. That Google requires two is a design choice.
    - Fnoord 9y ago
      Mozilla changed this somewhere down the line (I don't know when). Firefox Sync, back when it was called Mozilla Weave, used 2 passwords.
      - Sylos 9y ago
        I don't remember that too precisely anymore, but are you sure that you're not thinking of the identifier? It used to be pretty cryptic by itself. Now they use the e-mail address as identifier.
        Fnoord 9y ago
        Maybe I'm confused with some other services. Various services went from 2 passwords to 1. I did find this on their wiki: https://wiki.mozilla.org/CloudServices/Sync/FxSync/Archived/Weave_FAQ https://wiki.mozilla.org/CloudServices/Sync/FxSync/Archived/... interesting tidbit that you could host it yourself. Not sure if you still can.
        Sylos 9y ago
        You can: https://github.com/mozilla-services/syncserver https://github.com/mozilla-services/syncserver I hear, it's not that easy to setup, though, as Mozilla only really needed to set it up for themselves a handful of times, probably.
- solomatov 9y ago
  They document everything they do. See here: https://www.google.com/chrome/browser/privacy/whitepaper.html https://www.google.com/chrome/browser/privacy/whitepaper.htm... According to the policy, they use this data only in anonymized and aggregated form.
  - mintplant 9y ago
    > If “Include history from Chrome and other apps in your Web & App Activity” is checked on the Web & App Activity controls page, Google also uses your synchronized browsing data to provide personalized Google products and services to you. That's the default, isn't it? So no, not only anonymized and in aggregate. And either way, your compylete raw browsing data is sitting there on Google's servers and associated with your account.
    - solomatov 9y ago
      As far as I know, history isn't included in the web & app activity by default, at least on the desktop.
Sylos 9y ago
Because that would be absolutely nuclear for Chrome's PR. There are a handful of places where Chrome needs to shine and then they obviously watch out for those more. The depths of the codebase look much the contrary. With Firefox, the entire codebase has to shine, because someone will find it and hold Mozilla to a far higher standard. A bug in the update process that resets search engines is then only one of many things that they're supposed to watch out for.

rodorgas 9y ago

It’s very sad that they reset some privacy preferences on updates. It can be explained by incompetence or bad faith, but coming from Mozilla I'd rather assume incompetence.

qbaqbaqba 9y ago
It's not sad: it's illegal - as long as the EU is concerned.

mintplant 9y ago

In its default configuration Chrome's sync service uses transport-only encryption, not end-to-end, so that Google can read all your history, cookies, and so on. Their privacy policy [0] allows Google to mine this data for its own purposes. I would wager a very, very small proportion of Chrome's userbase manually enables the end-to-end sync encryption option buried in the settings; even technically-minded friends I've told about this are usually surprised. So Chrome's privacy settings are already broken by default, in nearly the worst way they could be. [0] https://www.google.com/chrome/browser/privacy/index.html https://www.google.com/chrome/browser/privacy/index.html, "Signed-in Chrome mode"

TAForObvReasons 9y ago
You completely sidestepped the issue at hand: >> [Firefox] updates have been known to re-enable it if you turn it off ... But it doesn’t matter - you’re going to re-enable it on the next update. You can choose to opt out of Chrome's phoning home in the privacy settings and they haven't tried to revert those settings in an update (and given their track record, I have no reason to believe they will try to surreptitiously change the settings in a future release)
agentdrtran 9y ago
they do this becuase I set up end to end for my parents and they lost the password. they never want to use encryption again. the default to user-friendliness which is not a bad thing.
- Sylos 9y ago
  Firefox Sync is end-to-end-encrypted with only one password. That Google requires two is a design choice.
  - Fnoord 9y ago
    Mozilla changed this somewhere down the line (I don't know when). Firefox Sync, back when it was called Mozilla Weave, used 2 passwords.
    - Sylos 9y ago
      I don't remember that too precisely anymore, but are you sure that you're not thinking of the identifier? It used to be pretty cryptic by itself. Now they use the e-mail address as identifier.
      - Fnoord 9y ago
        Maybe I'm confused with some other services. Various services went from 2 passwords to 1. I did find this on their wiki: https://wiki.mozilla.org/CloudServices/Sync/FxSync/Archived/Weave_FAQ https://wiki.mozilla.org/CloudServices/Sync/FxSync/Archived/... interesting tidbit that you could host it yourself. Not sure if you still can.
        Sylos 9y ago
        You can: https://github.com/mozilla-services/syncserver https://github.com/mozilla-services/syncserver I hear, it's not that easy to setup, though, as Mozilla only really needed to set it up for themselves a handful of times, probably.
solomatov 9y ago
They document everything they do. See here: https://www.google.com/chrome/browser/privacy/whitepaper.html https://www.google.com/chrome/browser/privacy/whitepaper.htm... According to the policy, they use this data only in anonymized and aggregated form.
- mintplant 9y ago
  > If “Include history from Chrome and other apps in your Web & App Activity” is checked on the Web & App Activity controls page, Google also uses your synchronized browsing data to provide personalized Google products and services to you. That's the default, isn't it? So no, not only anonymized and in aggregate. And either way, your compylete raw browsing data is sitting there on Google's servers and associated with your account.
  - solomatov 9y ago
    As far as I know, history isn't included in the web & app activity by default, at least on the desktop.

Sylos 9y ago

Because that would be absolutely nuclear for Chrome's PR. There are a handful of places where Chrome needs to shine and then they obviously watch out for those more. The depths of the codebase look much the contrary. With Firefox, the entire codebase has to shine, because someone will find it and hold Mozilla to a far higher standard. A bug in the update process that resets search engines is then only one of many things that they're supposed to watch out for.