3 ms·

Some of these changes, such as realtime sending of all non-popular URLs, concern me a little. I am happy for Google to use this information for aggregated secu

by dannyw 7y ago

Some of these changes, such as realtime sending of all non-popular URLs, concern me a little. I am happy for Google to use this information for aggregated security purposes (e.g. bots analyse suspicious new pages). I am not happy with this being associated to the Google account. However, AFAIK, I have no way of knowing this, and in the absence of an explicit statement, I have to assume the worst: that Google will use this to target me ads. If any Chrome team members are reading this comment, could we get some sort of confirmation that these security features will not be used to collect more data to target me ads?

msbarnett 7y ago
> If any Chrome team members are reading this comment, could we get some sort of confirmation that these security features will not be used to collect more data to target me ads Any statement they make is open for change at a later date if management changes their mind. You’d be better off thinking about moving to a browser made by a company that whose privacy protections don’t exist in a perpetual conflict of interest with the company’s dominant revenue source
aawc 7y ago
Disclosure: I'm the TL of this project on Chrome. Your concern is fair. TL answer: I can tell you that this data is used only for improving user security. Legal answer: Please read the Chrome Privacy Notice :)
- tsukurimashou 7y ago
  So basically "you have our word, so trust us!"
  - delroth 7y ago
    Do you see any other alternative than trust for such a system? - Building a fully local system will not provide the same coverage and doesn't allow sharing findings across users (which means that when a new phishing page appears, it will appear as "new" for every single user, instead of being new for N users and then known bad for the rest of users). It also heavily reduces what kind of analysis can be done since you can't just store large datasets on every single device and/or run expensive algorithms on every single web page load on a mobile phone. - Making it open source would not help. You can't know whether the code you can see is what is deployed remotely, so in the end you just end up trusting a different assertion instead (if you can't trust a privacy policy, why could you trust that the deployment is not backdoored?). It also has some significant cons: malware / phishing / abuse detection is in essence a cat-and-mouse game, and secrecy is unfortunately a key requirement in how everyone is building anti-abuse systems across the industry (not necessarily because they want to, but because nobody knows how it could work otherwise). - You could even go all the way and have e.g. remote attestations, reproducible builds, etc. that allow proving that indeed the code running remotely is the open source code you want and can audit. This is barely doable with available technology these days, and even if someone was to do it there would maybe be 1K people on this planet able to understand why this is trustworthy. A prime example of this is looking at people in this very thread not understanding the differential privacy scheme for detecting compromised passwords. Not trusting Google is a personal opinion, and I completely respect that. But implying that there is an alternative to trust for this kind of system is IMO misleading. Using DDG or Protonmail or any other service doesn't change the fact that you have to trust someone, it's just a different someone. You might personally believe their word more than Google's word, but if e.g. DDG started logging your identity and log requests and sell that to ad companies you would have very little way of learning about it either. Disclaimer: I work for Google, not on Chrome, but I have worked on anti-abuse systems in the past.
GoblinSlayer 7y ago
AFAIK, Chrome was already sending everything for ad purposes (it's basically enhanced google analytics that happens to be the user agent too). It will just now send for another purpose.

by dannyw 7y ago

msbarnett 7y ago

> If any Chrome team members are reading this comment, could we get some sort of confirmation that these security features will not be used to collect more data to target me ads Any statement they make is open for change at a later date if management changes their mind. You’d be better off thinking about moving to a browser made by a company that whose privacy protections don’t exist in a perpetual conflict of interest with the company’s dominant revenue source

aawc 7y ago

Disclosure: I'm the TL of this project on Chrome. Your concern is fair. TL answer: I can tell you that this data is used only for improving user security. Legal answer: Please read the Chrome Privacy Notice :)

tsukurimashou 7y ago
So basically "you have our word, so trust us!"
- delroth 7y ago
  Do you see any other alternative than trust for such a system? - Building a fully local system will not provide the same coverage and doesn't allow sharing findings across users (which means that when a new phishing page appears, it will appear as "new" for every single user, instead of being new for N users and then known bad for the rest of users). It also heavily reduces what kind of analysis can be done since you can't just store large datasets on every single device and/or run expensive algorithms on every single web page load on a mobile phone. - Making it open source would not help. You can't know whether the code you can see is what is deployed remotely, so in the end you just end up trusting a different assertion instead (if you can't trust a privacy policy, why could you trust that the deployment is not backdoored?). It also has some significant cons: malware / phishing / abuse detection is in essence a cat-and-mouse game, and secrecy is unfortunately a key requirement in how everyone is building anti-abuse systems across the industry (not necessarily because they want to, but because nobody knows how it could work otherwise). - You could even go all the way and have e.g. remote attestations, reproducible builds, etc. that allow proving that indeed the code running remotely is the open source code you want and can audit. This is barely doable with available technology these days, and even if someone was to do it there would maybe be 1K people on this planet able to understand why this is trustworthy. A prime example of this is looking at people in this very thread not understanding the differential privacy scheme for detecting compromised passwords. Not trusting Google is a personal opinion, and I completely respect that. But implying that there is an alternative to trust for this kind of system is IMO misleading. Using DDG or Protonmail or any other service doesn't change the fact that you have to trust someone, it's just a different someone. You might personally believe their word more than Google's word, but if e.g. DDG started logging your identity and log requests and sell that to ad companies you would have very little way of learning about it either. Disclaimer: I work for Google, not on Chrome, but I have worked on anti-abuse systems in the past.

GoblinSlayer 7y ago

AFAIK, Chrome was already sending everything for ad purposes (it's basically enhanced google analytics that happens to be the user agent too). It will just now send for another purpose.