> Anything that is behind such a whitelist should be a userland permission, approved (or not) by the end user, not Google. You’re assuming that Google’s desire

> Anything that is behind such a whitelist should be a userland permission, approved (or not) by the end user, not Google. You’re assuming that Google’s desire here is to protect the user. I don’t think that’s the case: I think that their desire is to control the user. Cf. how Android presents the user with a warning if he installs his own trusted HTTPS certificate (and how newer version of Android simply ignore his trusted certificate): Google claim that they are simply concerned about naïve users, but my contention is that they are motivated by a desire to prevent users from viewing the traffic of Google apps.