4 ms·

I can see why they thought this was a good change. It makes the UX for G-suite apps much more pleasant, almost like you get the full functionality of G-suite pr

I can see why they thought this was a good change. It makes the UX for G-suite apps much more pleasant, almost like you get the full functionality of G-suite productivity stuff as part of installing Chrome. For most people, that's a good thing. I think as tech people we systematically tend to under-think the second-order effects of the systems we build. Case in point, Chrome and G-suite being that closely integrated brings up serious privacy concerns, and the part where the Chrome team doesn't seem to appreciate the nuance reflects poorly. I do cybersecurity now (didn't used to), and a good number of problematic things I run into just come from engineers like my previous self not thinking through the security implications of a specific design, mostly because not thinking about security means shinier UX delivered on less resources. Just another example I encounter regularly: I use U2F to sign into my Google accounts. However, when you log in, the checkbox to "trust this computer" is checked by default, meaning that if you're not paying attention your account will get automatically downgraded to single factor authentication going forward. It's a clear nod to convenience, but done this way it makes you shoot yourself in the foot.

grey-area 8y ago
I can see why they thought this was a good change. It's a good change only if you are permanently logged in to google services, which is probably why it seemed like a great idea to the Chrome team, who probably have no idea how much distrust Google has started to build up. It moves the browser closer to an app runner for google services - I'd understand that if this was on Chrome OS or a specific 'Google' app, but in a general purpose browser the browser chrome should never indicate login state about specific websites, nor should my browser be logging in to google itself. It was bad enough when that was a choice for users, now it is one policy change away from being obligatory. This is how we end up living in a world where google has access to all your data. I've switched browsers due to the move, not just because of this specific action, but because combined with all the other dark patterns Google has engaged in recently, and their clear moves to abuse their monopoly in search, it tipped me over the edge. I no longer use google search (have been using ddg for a while), and now no longer use google browsers as a result of their disregard for user privacy.
- 3pt14159 8y ago
  Just use different browsers for different things man, this isn't even hard. I seriously do not understand the outrage over this. Half the websites we visit host their fonts on Google domains, where is the outrage over that?
  - grey-area 8y ago
    Why use Chrome at all? I'm not outraged, just voting with my feet.
  - auslander 8y ago
    > Half the websites we visit host their fonts on Google domains, where is the outrage over that? Copy that. Thats a serious privacy leak, Referrers, none of the adblockers handle today.
    - claudius 8y ago
      ublock Origin blocks third-party content, including silly fonts hosted by Google, just fine for me.
      - auslander 8y ago
        I recall seeing fonts.googleapi.com being allowed by uBO (in medium mode) once, so it needs be double checked. Also, it not just fonts, but jquery and other stuff. And two places to check: Referrers HTTP header and meta element Referrer Policy of the page
        deleted 8y ago
        [deleted]
    - flukus 8y ago
      uBlock blocks remote fonts. Between sites hosting their own assets becoming old fashioned and font's being used for icons it breaks a lot of things. I'm hoping CDN's get the same privacy treatment as facebook and the like have been getting lately and we can go back to a self hosted world.
Semaphor 8y ago
> your account will get automatically downgraded to single factor authentication going forward. *your device If someone has access to my desktop PC, they also have access to my yubikey anyway.
- tumetab1 8y ago
  Yubikey still saves you from a PC malware but I would suggest anyone not to store your yubikey besides your computer (or laptop bag) but to attach to your phone/keychain so it's on you all the time since it's safer that way.
  - Semaphor 8y ago
    If someone breaks into my apartment, I have more problems than losing my Yubikey. And my threat scope does not include agencies that would get my passwords AND be able to break in and steal my key. And if it did, I would think they could just take it from me.
- munchbunny 8y ago
  No, I definitely meant "your account". Specifically, I meant that you will accidentally trust devices you log in on that you might not be aware of, which exposes your account to unintentional reduction to single factor. I don't only log in at home. If Google switched it to not trusting by default, you could still trust whatever device you want, just without the risk of a default behavior working against you.

grey-area 8y ago

I can see why they thought this was a good change. It's a good change only if you are permanently logged in to google services, which is probably why it seemed like a great idea to the Chrome team, who probably have no idea how much distrust Google has started to build up. It moves the browser closer to an app runner for google services - I'd understand that if this was on Chrome OS or a specific 'Google' app, but in a general purpose browser the browser chrome should never indicate login state about specific websites, nor should my browser be logging in to google itself. It was bad enough when that was a choice for users, now it is one policy change away from being obligatory. This is how we end up living in a world where google has access to all your data. I've switched browsers due to the move, not just because of this specific action, but because combined with all the other dark patterns Google has engaged in recently, and their clear moves to abuse their monopoly in search, it tipped me over the edge. I no longer use google search (have been using ddg for a while), and now no longer use google browsers as a result of their disregard for user privacy.

3pt14159 8y ago
Just use different browsers for different things man, this isn't even hard. I seriously do not understand the outrage over this. Half the websites we visit host their fonts on Google domains, where is the outrage over that?
- grey-area 8y ago
  Why use Chrome at all? I'm not outraged, just voting with my feet.
- auslander 8y ago
  > Half the websites we visit host their fonts on Google domains, where is the outrage over that? Copy that. Thats a serious privacy leak, Referrers, none of the adblockers handle today.
  - claudius 8y ago
    ublock Origin blocks third-party content, including silly fonts hosted by Google, just fine for me.
    - auslander 8y ago
      I recall seeing fonts.googleapi.com being allowed by uBO (in medium mode) once, so it needs be double checked. Also, it not just fonts, but jquery and other stuff. And two places to check: Referrers HTTP header and meta element Referrer Policy of the page
      - deleted 8y ago
        [deleted]
  - flukus 8y ago
    uBlock blocks remote fonts. Between sites hosting their own assets becoming old fashioned and font's being used for icons it breaks a lot of things. I'm hoping CDN's get the same privacy treatment as facebook and the like have been getting lately and we can go back to a self hosted world.

Semaphor 8y ago

> your account will get automatically downgraded to single factor authentication going forward. *your device If someone has access to my desktop PC, they also have access to my yubikey anyway.

tumetab1 8y ago
Yubikey still saves you from a PC malware but I would suggest anyone not to store your yubikey besides your computer (or laptop bag) but to attach to your phone/keychain so it's on you all the time since it's safer that way.
- Semaphor 8y ago
  If someone breaks into my apartment, I have more problems than losing my Yubikey. And my threat scope does not include agencies that would get my passwords AND be able to break in and steal my key. And if it did, I would think they could just take it from me.
munchbunny 8y ago
No, I definitely meant "your account". Specifically, I meant that you will accidentally trust devices you log in on that you might not be aware of, which exposes your account to unintentional reduction to single factor. I don't only log in at home. If Google switched it to not trusting by default, you could still trust whatever device you want, just without the risk of a default behavior working against you.