However I'm disappointed that their response is essentially lip service to the highlighted problem. If I read the article correctly, the auto-signin will contin

However I'm disappointed that their response is essentially lip service to the highlighted problem. If I read the article correctly, the auto-signin will continue to be the default and you'll get an option to turn it off. This does not address the breach of trust issues highlighted in the thread and linked posts .. unless they're going to ask you about signing in to the browser before doing it. Also, the consequences of saying "yes" to that would continue to be unclear if one path leads to data sync and another path doesn't. Personally, browsers don't need users to signin. They can sync data laterally with other instances. I suppose Google hasn't heard of bonjour.