4 ms·

Google Meet Security and Privacy for users

54 points by ffpip 6y ago

simias 6y ago
Seems like Google is making a new push for people to be logged in at all times. Youtube nags me continually to log in when I watch videos on the website, pausing the video to display a pop up and then restarting from the beginning even if I had a timestamp in the URL.
- contravariant 6y ago
  I think it doesn't apply to the Google Suite version (i.e. the non-free version) of Google Meet, but I can't be entirely sure.
- jstanley 6y ago
  You could watch YouTube using one of the Invidious mirrors if you prefer: https://invidio.us/ https://invidio.us/
- kevin_thibedeau 6y ago
  NoScript that into the past.
  - lucb1e 6y ago
    YouTube works without JavaScript? Or can you somehow selectively block the scripts responsible for nag screens?
    - ffpip 6y ago
      https://old.reddit.com/r/uBlockOrigin/comments/ilvepd/new_aggressive_google_cookie_consent_popup/g3yew3i https://old.reddit.com/r/uBlockOrigin/comments/ilvepd/new_ag... https://www.ghacks.net/2020/09/27/how-to-deal-with-googles-and-youtubes-aggressive-popups-before-you-continue-sign-in/ https://www.ghacks.net/2020/09/27/how-to-deal-with-googles-a...
- mihaaly 6y ago
  Some log in, some register, others go away with disapproval and aversion, seeking for services elsewhere - or giving up on nonessential ones.
- steanne 6y ago
  notifications, too. they keep re-sending me a message in the play store app to turn on system notifications for the play store.
pfortuny 6y ago
They put it under “security”. Can anyone enlighten me about this being an honest statement?
- mlthoughts2018 6y ago
  I am no Google apologist, but I don’t see anything wrong with this. It’s an increasingly common thing from many companies in response to GDPR and CCPA. The theory (which isn’t backed by case law yet) is that if a user signs up for an account of some kind, a much wider set of tracking data is lawful to collect under the sections of these laws that provide for “necessary” data collection for the operation of the service. Lots of data capture is argued to be required for managing the user session and measuring product usage, both of which are much harder to justify if the user is anonymous. Many companies are moving account sign up as a required step earlier in all funnel or free tier user experiences as a result.
  - pfortuny 6y ago
    Yes, I agree with you but... that is not “security”, as far as I understand, or is it? They mught have put it under any other heading but “security”. Anyway, thanks for the answer.
    - mlthoughts2018 6y ago
      Most companies consider data privacy and compliance to be a subset of security, yes.
protomyth 6y ago
Well, so ends Meet's use by sales folks and conferences. The friction to require the use of account is a turn off for many situations. Heck, even when I have an account on some of these services, I might not login when sent an invite. Friction is a killer.
- deleted 6y ago
  [deleted]
- m-p-3 6y ago
  GSuite isn't affected by this.
gallego2007 6y ago
One thing to call out is that this is true for consumer created Meet calls, but not for G Suite/Workspace created Meet calls. Users w/o a Google account can join those calls by “knocking” and being accepted to the call (by the organizer or a user on the same domain) [1]. There's also a dial-in by phone option. [1] https://support.google.com/a/answer/7582940#top&privacy&encryption&counterabuse&secure&incident& https://support.google.com/a/answer/7582940#top&privacy&encr... [Edit to clarify wording and add citation to Workspace specific HC article]
- lima 6y ago
  Wasn't this always the case?
  - luto 6y ago
    at least in the last three years, yes.
    - jsnell 6y ago
      I thought Meet was only made available to consumer accounts after Covid, not years ago? Here's the announcement blog post: https://blog.google/products/meet/bringing-google-meet-to-more-people https://blog.google/products/meet/bringing-google-meet-to-mo... (But yes, it looks like the requirement was there from the start, and the editorializing in the title is incorrect.)
  - gallego2007 6y ago
    AFAIK, yes this has always been the case with Meet.
AndyMcConachie 6y ago
Just another brick in the wall.
lima 6y ago
The title is simply not correct - you can join GSuite Meet sessions anonymously. I just tested it and confirmed it was still possible. This only applies to personal accounts, and was already the case in April when consumer Meet launched: https://web.archive.org/web/20200429182608/https://support.google.com/meet/answer/9852160 https://web.archive.org/web/20200429182608/https://support.g... So, nothing changed and this is just spreading FUD about the product. How is it #6 on the front page?
- lima 6y ago
  (the title was changed, it used to be "You can no longer join any Google Meet session without a Google account")
- ffpip 6y ago
  The mods changed the title. Btw, I didn't mention GSuite. I tested with personal accounts. Which is why I posted 'You can no longer join any Google Meet session without a Google account'
diogenescynic 6y ago
Great. As if using the G Suite for work wasn't a complete hassle already, this will really make setting up meeting with business partners easy. Seriously, G Suite is one of the worst tools I am forced to use. I HATE it.
- kevsim 6y ago
  As many other comments have mentioned, this doesn't apply to G Suite.
  - pnutjam 6y ago
    But, you need a standard gmail to join a personal gmail. Custom domain gmail won't work.
EE84M3i 6y ago
Note: title used to be "You can no longer join any Google Meet session without a Google account" Thank you https://hackernewstitles.netlify.app/ https://hackernewstitles.netlify.app/
hacker_newz 6y ago
I was hoping they would actually secure Meet so that not just anyone with the meeting code can join.
braindongle 6y ago
TLS not E2E. When Zoom got called out for lying about having E2E [0], I looked into the landscape around this a bit. Facetime and Signal are E2E, but don't support recording, which would of course need to be on-device if implemented. Does the distinction matter? I think so. There's a big difference between the provider promising to keep your data secure and to not do anything underhanded with it versus the provider simply not having access to your data. [0] https://www.theverge.com/2020/3/31/21201234/zoom-end-to-end-encryption-video-chats-meetings https://www.theverge.com/2020/3/31/21201234/zoom-end-to-end-...
- braindongle 6y ago
  Really, a ding here? I thought HN was where you go to discuss what's actually going on under the hood, not so much "now you need a Google account", which will surface itself in your general tech news feed. Hmm. I hope we don't go the way of Slashdot. What a sad decline that was. Where Google comes down on TLS vs E2E is a BFD.
crazypython 6y ago
See also, the security page of the Free Software and Open Source solution, Jisti Meet: https://jitsi.org/security/ https://jitsi.org/security/

54 points by ffpip 6y ago

Seems like Google is making a new push for people to be logged in at all times. Youtube nags me continually to log in when I watch videos on the website, pausing the video to display a pop up and then restarting from the beginning even if I had a timestamp in the URL.

contravariant 6y ago
I think it doesn't apply to the Google Suite version (i.e. the non-free version) of Google Meet, but I can't be entirely sure.
jstanley 6y ago
You could watch YouTube using one of the Invidious mirrors if you prefer: https://invidio.us/ https://invidio.us/
kevin_thibedeau 6y ago
NoScript that into the past.
- lucb1e 6y ago
  YouTube works without JavaScript? Or can you somehow selectively block the scripts responsible for nag screens?
  - ffpip 6y ago
    https://old.reddit.com/r/uBlockOrigin/comments/ilvepd/new_aggressive_google_cookie_consent_popup/g3yew3i https://old.reddit.com/r/uBlockOrigin/comments/ilvepd/new_ag... https://www.ghacks.net/2020/09/27/how-to-deal-with-googles-and-youtubes-aggressive-popups-before-you-continue-sign-in/ https://www.ghacks.net/2020/09/27/how-to-deal-with-googles-a...
mihaaly 6y ago
Some log in, some register, others go away with disapproval and aversion, seeking for services elsewhere - or giving up on nonessential ones.
steanne 6y ago
notifications, too. they keep re-sending me a message in the play store app to turn on system notifications for the play store.

pfortuny 6y ago

They put it under “security”. Can anyone enlighten me about this being an honest statement?

mlthoughts2018 6y ago
I am no Google apologist, but I don’t see anything wrong with this. It’s an increasingly common thing from many companies in response to GDPR and CCPA. The theory (which isn’t backed by case law yet) is that if a user signs up for an account of some kind, a much wider set of tracking data is lawful to collect under the sections of these laws that provide for “necessary” data collection for the operation of the service. Lots of data capture is argued to be required for managing the user session and measuring product usage, both of which are much harder to justify if the user is anonymous. Many companies are moving account sign up as a required step earlier in all funnel or free tier user experiences as a result.
- pfortuny 6y ago
  Yes, I agree with you but... that is not “security”, as far as I understand, or is it? They mught have put it under any other heading but “security”. Anyway, thanks for the answer.
  - mlthoughts2018 6y ago
    Most companies consider data privacy and compliance to be a subset of security, yes.

protomyth 6y ago

Well, so ends Meet's use by sales folks and conferences. The friction to require the use of account is a turn off for many situations. Heck, even when I have an account on some of these services, I might not login when sent an invite. Friction is a killer.

deleted 6y ago
[deleted]
m-p-3 6y ago
GSuite isn't affected by this.

gallego2007 6y ago

One thing to call out is that this is true for consumer created Meet calls, but not for G Suite/Workspace created Meet calls. Users w/o a Google account can join those calls by “knocking” and being accepted to the call (by the organizer or a user on the same domain) [1]. There's also a dial-in by phone option. [1] https://support.google.com/a/answer/7582940#top&privacy&encryption&counterabuse&secure&incident& https://support.google.com/a/answer/7582940#top&privacy&encr... [Edit to clarify wording and add citation to Workspace specific HC article]

lima 6y ago
Wasn't this always the case?
- luto 6y ago
  at least in the last three years, yes.
  - jsnell 6y ago
    I thought Meet was only made available to consumer accounts after Covid, not years ago? Here's the announcement blog post: https://blog.google/products/meet/bringing-google-meet-to-more-people https://blog.google/products/meet/bringing-google-meet-to-mo... (But yes, it looks like the requirement was there from the start, and the editorializing in the title is incorrect.)
- gallego2007 6y ago
  AFAIK, yes this has always been the case with Meet.

AndyMcConachie 6y ago

Just another brick in the wall.

lima 6y ago

The title is simply not correct - you can join GSuite Meet sessions anonymously. I just tested it and confirmed it was still possible. This only applies to personal accounts, and was already the case in April when consumer Meet launched: https://web.archive.org/web/20200429182608/https://support.google.com/meet/answer/9852160 https://web.archive.org/web/20200429182608/https://support.g... So, nothing changed and this is just spreading FUD about the product. How is it #6 on the front page?

lima 6y ago
(the title was changed, it used to be "You can no longer join any Google Meet session without a Google account")
ffpip 6y ago
The mods changed the title. Btw, I didn't mention GSuite. I tested with personal accounts. Which is why I posted 'You can no longer join any Google Meet session without a Google account'

diogenescynic 6y ago

Great. As if using the G Suite for work wasn't a complete hassle already, this will really make setting up meeting with business partners easy. Seriously, G Suite is one of the worst tools I am forced to use. I HATE it.

kevsim 6y ago
As many other comments have mentioned, this doesn't apply to G Suite.
- pnutjam 6y ago
  But, you need a standard gmail to join a personal gmail. Custom domain gmail won't work.

EE84M3i 6y ago

Note: title used to be "You can no longer join any Google Meet session without a Google account" Thank you https://hackernewstitles.netlify.app/ https://hackernewstitles.netlify.app/

hacker_newz 6y ago

I was hoping they would actually secure Meet so that not just anyone with the meeting code can join.

braindongle 6y ago

TLS not E2E. When Zoom got called out for lying about having E2E [0], I looked into the landscape around this a bit. Facetime and Signal are E2E, but don't support recording, which would of course need to be on-device if implemented. Does the distinction matter? I think so. There's a big difference between the provider promising to keep your data secure and to not do anything underhanded with it versus the provider simply not having access to your data. [0] https://www.theverge.com/2020/3/31/21201234/zoom-end-to-end-encryption-video-chats-meetings https://www.theverge.com/2020/3/31/21201234/zoom-end-to-end-...

braindongle 6y ago
Really, a ding here? I thought HN was where you go to discuss what's actually going on under the hood, not so much "now you need a Google account", which will surface itself in your general tech news feed. Hmm. I hope we don't go the way of Slashdot. What a sad decline that was. Where Google comes down on TLS vs E2E is a BFD.

crazypython 6y ago

See also, the security page of the Free Software and Open Source solution, Jisti Meet: https://jitsi.org/security/ https://jitsi.org/security/