9 ms·

People often defend companies with explanations of how the world is, when common folk often expect (or just want) the world to behave differently. Is it unreas

People often defend companies with explanations of how the world is, when common folk often expect (or just want) the world to behave differently. Is it unreasonable to want, or even expect, an incognito window to disable all forms of tracking? Wouldn't the world be far better if a phone alerted me to an app scanning my local area network or contacts? Or if I got warnings when it took such actions? I think us tech folks need to, collectively, stop defending companies reasoning and explanations for the world they created, and start standing with and for a world which matches common folks expectations. It really seems like a better world. --- EDIT: Ask what the layperson would think tracking is! Imagining the answer is pretty simple "a website [or the web at large] learning or remembering anything about me." If we start from there, rather than the mumbo-jumbo thrown at us, we can make progress.

jeffbee 6y ago
The problem is that "tracking" has no meaning, unless you are trying to align the wheels on a car. It has no definition in the language, no definition as industry jargon, and definitely no definition in the law.
PragmaticPulp 6y ago
> Is it unreasonable to want, or even expect, an incognito window to disable all forms of tracking? "Tracking" is a nebulous term. If a company records your visit in their logs, is that tracking? If they increment a counter every time someone visits a page, is that tracking? If a user logs in under Incognito Mode and the site records their new last login IP and timestamp, is that tracking? These questions would have sounded facetious years ago, but now nearly every form of user tracking has come under scrutiny. The common confusion is that Incognito mode isn't equivalent to using Tor or a VPN. For 99% of cases, that doesn't really matter. Explaining the distinction to the average user is a challenge, though. > Wouldn't the world be far better if a phone alerted me to an app scanning my local area network or contacts? Or if I got warnings when it took such actions? Modern phone OSes will ask for permission if an app wants to access your local network, your contacts, or your photos. That's not the concern here, though.
- yunruse 6y ago
  I'm not sure how tracking is nebulous. If you want to identify an anonymous counter, or keep depersonalised logs, or IP logs for security, that's fine; it can't identify the user. (Maybe IP logs could) Essentially you can boil "tracking" to two main sources: when there's data collected without a legitimate purpose for doing so, and when data is collected to the point that could identify a user, but no explicit consent is given. Take for example a Facebook comment section on a third party site. It'd be fine to click the comments and have a quick prompt for Facebook to interact – the comment is public, so it's known to all. But if the user never comments, Facebook has no right to be aware the user was ever there; that's tracking. You could make the extended argument that overcorrelation of data for advertising is tracking in a sense, as this would cover intra-site tracking (e.g. a shopping site knowing you're pregnant before you know yourself.) This is a little more nebulous to define, as it's hard to define who it benefits If your phone launcher suggests an app, or Uber suggests a location, that's because it wants to save time. But if a shopping site suggests a product, that's advertising, and should be given explicit consent.
  - ggggtez 6y ago
    > If you want to identify an anonymous counter, or keep depersonalised logs, or IP logs for security, that's fine; it can't identify the user. (Maybe IP logs could) Some laypeople would disagree. That's what it means to be "nebulous". A term like "tracking" needs to be defined in technical/legal language. You can't simply ask a random sample of the entire world's population and expect to get a consistent answer about what should be allowed and what should not.
    - TheCoelacanth 6y ago
      There is no such need. Plenty of laws are based on what a "reasonable person"[1] would believe rather than based on an objective standard. [1] https://en.wikipedia.org/wiki/Reasonable_person https://en.wikipedia.org/wiki/Reasonable_person
    - afiori 6y ago
      the gdpr managed to do that. the solution is to focus on user experience and privacy not technical details as counters or ip addresses
MattGaiser 6y ago
> Is it unreasonable to want, or even expect, an incognito window to disable all forms of tracking? Yes, because the product explicitly says it does not do that. Your activity might still be visible to: - Websites you visit - Your employer or school - Your internet service provider
glitchc 6y ago
Upton Sinclair is why you see this behaviour. Google pays well, very well indeed.
jka 6y ago
You might enjoy this article about "positive" and "negative" definitions of liberty (and discussion about whether a a clear division like that really exists) from Stanford's Encyclopedia of Philosophy: https://plato.stanford.edu/entries/liberty-positive-negative/ https://plato.stanford.edu/entries/liberty-positive-negative...
ggggtez 6y ago
> Is it unreasonable to want, or even expect, an incognito window to disable all forms of tracking? > Ask what the layperson would think tracking is! No. No no no no no. There is a serious problem with this line of thinking. Lay people cannot dictate how technology must work. Because they don't understand what is possible. This post is like the famous quote from that Australian politician > The laws of mathematics are very commendable, but the only law that applies in Australia is the law of Australia It's simply not appropriate to assume that just because a lay person wants something to be true, that it must somehow be possible to actually do.
- loveistheanswer 6y ago
  You don't think its appropriate for users to have informed consent?
  - deleted 6y ago
    [deleted]
- true_religion 6y ago
  If lay people are misunderstanding what incognito does, and cannot be expected to understand how it truly functions then Google shouldn't be allowed to advertise it to lay people in the way that they do. It'd be easiest to just not provide incognito mode at all, than allow another footgun into the hands of the public at large in a way that only benefits Google. I think though that people can be made to understand with better education and examples in a reasonable time period.
- xmprt 6y ago
  > The laws of mathematics are very commendable, but the only law that applies in Australia is the law of Australia Isn't this true though. If a country decided one day that 2+2=5 and wrote laws around it and enforced it then in that country you have to say 2+2=5 even if the laws of mathematics would disagree. It would be a dystopian place to live but that's just how laws work (assuming we're talking about some sort of authoritative regime where you can't challenge this law). I think programmers are at a much greater luxury though because there is not really a thing called the laws of computer science. There are certain problems like P=NP or the halting problem but ad tracking is so far removed from that to the point that if we decided one day that it made sense to outlaw tracking, it could be done. It would kill a lot of businesses and would probably be a bad thing but to say that we shouldn't take into account lay people's wants when designing software systems is wrong.
cmiles74 6y ago
I would say that, yes, no one wants "incognito" or "private browsing" to prevent any kind of tracking. Wouldn't this render the majority of websites useless? The average person is probably looking for something that allows tracking of some information by sites they deliberately want to use but not as much (or at all) for third party websites. Except third party sites that they use to log into sites that they want use. And so on. Neither of these features is meant to address the use-case you outline: browsing the internet free of tracking. I do think there is a market for such a mode, but both "incognito" and "private browsing" are meant to hide your activity from _the physical computer you are using._ You would want to use this mode if you are using a shared computer, like in a library or a computer lab.
- deleted 6y ago
  [deleted]
damagednoob 6y ago
I think people are conflating Chrome and Google Search. A better example is Chrome and Facebook. Chrome Incognito can appear as an anonymous user but how is Chrome supposed to prevent Facebook from storing ip addresses and clicks?
SilasX 6y ago
>Is it unreasonable to want, or even expect, an incognito window to disable all forms of tracking? No, because incognito doesn't have power over what sites do with request data. As for the layperson, I think they hold the (reasonable) model that an incognito session is just like using a burner phone that you throw away after: it creates a dummy identity separate from your normal one. So at worst, the places you call can compare notes and see that the same number called both of them, and they might also secretly log or record the calls. A burner phone doesn't prevent any of that, and neither would incognito (prevent the analog of). However, if the phone companies somehow learned which people bought which burner phones, and shared their "normal" info with anyone who asked about a particular burner phone, then yes, that would break the expectation/agreement, and it sounds like Google does something similar to that.
- lolinder 6y ago
  Your last paragraph is exactly right: the problem is that it's doubtful that Incognito mode actually produces burner identities. If all Incognito does is create a temporary cookie jar, there are plenty of other ways to fingerprint a browser that would persist across Incognito sessions. The average user almost certainly doesn't realize that, and Google absolutely benefits from keeping up the pretense of privacy in Incognito.
- ironmagma 6y ago
  > incognito doesn't have power over what sites do with request data Again, this is just a description of how the world works. It says nothing about how the world could work. Incognito could turn your browser into a Tor client, or use a random sequence of VPNs to tunnel your traffic, or both, for example.
  - SilasX 6y ago
    Fair enough -- I agree that there's more that a browser can do to protect your privacy. But I was mainly speaking to the question of what a reasonable user can expect, given what incognito mode communicates to them. And that reasonable expectation is "browser works the same, except with a new dummy identity", just like a burner phone vs your regular cell phone. A mode like you describe is great, but I wouldn't expect a browser's built-in privacy mode to do all of that by default. (And, FWIW, even then my statement is true. Even with the max privacy protections, once your request data has reached their servers, you can't do anything about their data storage by technical means. So even with a Tor client, if you've logged in and have to persist cookies to maintain session state, you can expect that the site to match identities across VPNs/Tor endpoints.)
deleted 6y ago
[deleted]
nathanfig 6y ago
Man. So many comments responding with more descriptions of the world tech companies created. Fascinating how much even us tech folk don't realize how much of our work environment is subject to design.
titzer 6y ago
Well said! We're so deep in the details that we can't see that every long-winded explanation sounds like total BS to regular people but is really just a subconscious apology.
hvis 6y ago
I wonder if this could be the case where Chrome's dominant position would bite Google in the ass. Because if you're just a website, you do what you can with the information provided to you by the user agent (browser). But if you're also the browser manufacturer which provides an "incognito" option, and your other (main) property explicitly goes around it as much as it can... that smells bad.
themacguffinman 6y ago
Why don't you ask the layperson what they think Chrome's Incognito mode is for? The answer I imagine is also pretty simple: "hide my porn habits from my family or friends". It's what everyone I know expects and what I expect, and that's what Incognito does. If anything, it's the tech folks who get hung up on what "tracking" means.

jeffbee 6y ago

The problem is that "tracking" has no meaning, unless you are trying to align the wheels on a car. It has no definition in the language, no definition as industry jargon, and definitely no definition in the law.

PragmaticPulp 6y ago

> Is it unreasonable to want, or even expect, an incognito window to disable all forms of tracking? "Tracking" is a nebulous term. If a company records your visit in their logs, is that tracking? If they increment a counter every time someone visits a page, is that tracking? If a user logs in under Incognito Mode and the site records their new last login IP and timestamp, is that tracking? These questions would have sounded facetious years ago, but now nearly every form of user tracking has come under scrutiny. The common confusion is that Incognito mode isn't equivalent to using Tor or a VPN. For 99% of cases, that doesn't really matter. Explaining the distinction to the average user is a challenge, though. > Wouldn't the world be far better if a phone alerted me to an app scanning my local area network or contacts? Or if I got warnings when it took such actions? Modern phone OSes will ask for permission if an app wants to access your local network, your contacts, or your photos. That's not the concern here, though.

yunruse 6y ago
I'm not sure how tracking is nebulous. If you want to identify an anonymous counter, or keep depersonalised logs, or IP logs for security, that's fine; it can't identify the user. (Maybe IP logs could) Essentially you can boil "tracking" to two main sources: when there's data collected without a legitimate purpose for doing so, and when data is collected to the point that could identify a user, but no explicit consent is given. Take for example a Facebook comment section on a third party site. It'd be fine to click the comments and have a quick prompt for Facebook to interact – the comment is public, so it's known to all. But if the user never comments, Facebook has no right to be aware the user was ever there; that's tracking. You could make the extended argument that overcorrelation of data for advertising is tracking in a sense, as this would cover intra-site tracking (e.g. a shopping site knowing you're pregnant before you know yourself.) This is a little more nebulous to define, as it's hard to define who it benefits If your phone launcher suggests an app, or Uber suggests a location, that's because it wants to save time. But if a shopping site suggests a product, that's advertising, and should be given explicit consent.
- ggggtez 6y ago
  > If you want to identify an anonymous counter, or keep depersonalised logs, or IP logs for security, that's fine; it can't identify the user. (Maybe IP logs could) Some laypeople would disagree. That's what it means to be "nebulous". A term like "tracking" needs to be defined in technical/legal language. You can't simply ask a random sample of the entire world's population and expect to get a consistent answer about what should be allowed and what should not.
  - TheCoelacanth 6y ago
    There is no such need. Plenty of laws are based on what a "reasonable person"[1] would believe rather than based on an objective standard. [1] https://en.wikipedia.org/wiki/Reasonable_person https://en.wikipedia.org/wiki/Reasonable_person
  - afiori 6y ago
    the gdpr managed to do that. the solution is to focus on user experience and privacy not technical details as counters or ip addresses

MattGaiser 6y ago

> Is it unreasonable to want, or even expect, an incognito window to disable all forms of tracking? Yes, because the product explicitly says it does not do that. Your activity might still be visible to: - Websites you visit - Your employer or school - Your internet service provider

glitchc 6y ago

Upton Sinclair is why you see this behaviour. Google pays well, very well indeed.

jka 6y ago

You might enjoy this article about "positive" and "negative" definitions of liberty (and discussion about whether a a clear division like that really exists) from Stanford's Encyclopedia of Philosophy: https://plato.stanford.edu/entries/liberty-positive-negative/ https://plato.stanford.edu/entries/liberty-positive-negative...

ggggtez 6y ago

> Is it unreasonable to want, or even expect, an incognito window to disable all forms of tracking? > Ask what the layperson would think tracking is! No. No no no no no. There is a serious problem with this line of thinking. Lay people cannot dictate how technology must work. Because they don't understand what is possible. This post is like the famous quote from that Australian politician > The laws of mathematics are very commendable, but the only law that applies in Australia is the law of Australia It's simply not appropriate to assume that just because a lay person wants something to be true, that it must somehow be possible to actually do.

loveistheanswer 6y ago
You don't think its appropriate for users to have informed consent?
- deleted 6y ago
  [deleted]
true_religion 6y ago
If lay people are misunderstanding what incognito does, and cannot be expected to understand how it truly functions then Google shouldn't be allowed to advertise it to lay people in the way that they do. It'd be easiest to just not provide incognito mode at all, than allow another footgun into the hands of the public at large in a way that only benefits Google. I think though that people can be made to understand with better education and examples in a reasonable time period.
xmprt 6y ago
> The laws of mathematics are very commendable, but the only law that applies in Australia is the law of Australia Isn't this true though. If a country decided one day that 2+2=5 and wrote laws around it and enforced it then in that country you have to say 2+2=5 even if the laws of mathematics would disagree. It would be a dystopian place to live but that's just how laws work (assuming we're talking about some sort of authoritative regime where you can't challenge this law). I think programmers are at a much greater luxury though because there is not really a thing called the laws of computer science. There are certain problems like P=NP or the halting problem but ad tracking is so far removed from that to the point that if we decided one day that it made sense to outlaw tracking, it could be done. It would kill a lot of businesses and would probably be a bad thing but to say that we shouldn't take into account lay people's wants when designing software systems is wrong.

cmiles74 6y ago

I would say that, yes, no one wants "incognito" or "private browsing" to prevent any kind of tracking. Wouldn't this render the majority of websites useless? The average person is probably looking for something that allows tracking of some information by sites they deliberately want to use but not as much (or at all) for third party websites. Except third party sites that they use to log into sites that they want use. And so on. Neither of these features is meant to address the use-case you outline: browsing the internet free of tracking. I do think there is a market for such a mode, but both "incognito" and "private browsing" are meant to hide your activity from _the physical computer you are using._ You would want to use this mode if you are using a shared computer, like in a library or a computer lab.

deleted 6y ago
[deleted]

damagednoob 6y ago

I think people are conflating Chrome and Google Search. A better example is Chrome and Facebook. Chrome Incognito can appear as an anonymous user but how is Chrome supposed to prevent Facebook from storing ip addresses and clicks?

SilasX 6y ago

>Is it unreasonable to want, or even expect, an incognito window to disable all forms of tracking? No, because incognito doesn't have power over what sites do with request data. As for the layperson, I think they hold the (reasonable) model that an incognito session is just like using a burner phone that you throw away after: it creates a dummy identity separate from your normal one. So at worst, the places you call can compare notes and see that the same number called both of them, and they might also secretly log or record the calls. A burner phone doesn't prevent any of that, and neither would incognito (prevent the analog of). However, if the phone companies somehow learned which people bought which burner phones, and shared their "normal" info with anyone who asked about a particular burner phone, then yes, that would break the expectation/agreement, and it sounds like Google does something similar to that.

lolinder 6y ago
Your last paragraph is exactly right: the problem is that it's doubtful that Incognito mode actually produces burner identities. If all Incognito does is create a temporary cookie jar, there are plenty of other ways to fingerprint a browser that would persist across Incognito sessions. The average user almost certainly doesn't realize that, and Google absolutely benefits from keeping up the pretense of privacy in Incognito.
ironmagma 6y ago
> incognito doesn't have power over what sites do with request data Again, this is just a description of how the world works. It says nothing about how the world could work. Incognito could turn your browser into a Tor client, or use a random sequence of VPNs to tunnel your traffic, or both, for example.
- SilasX 6y ago
  Fair enough -- I agree that there's more that a browser can do to protect your privacy. But I was mainly speaking to the question of what a reasonable user can expect, given what incognito mode communicates to them. And that reasonable expectation is "browser works the same, except with a new dummy identity", just like a burner phone vs your regular cell phone. A mode like you describe is great, but I wouldn't expect a browser's built-in privacy mode to do all of that by default. (And, FWIW, even then my statement is true. Even with the max privacy protections, once your request data has reached their servers, you can't do anything about their data storage by technical means. So even with a Tor client, if you've logged in and have to persist cookies to maintain session state, you can expect that the site to match identities across VPNs/Tor endpoints.)

deleted 6y ago

[deleted]

nathanfig 6y ago

Man. So many comments responding with more descriptions of the world tech companies created. Fascinating how much even us tech folk don't realize how much of our work environment is subject to design.

titzer 6y ago

Well said! We're so deep in the details that we can't see that every long-winded explanation sounds like total BS to regular people but is really just a subconscious apology.

hvis 6y ago

I wonder if this could be the case where Chrome's dominant position would bite Google in the ass. Because if you're just a website, you do what you can with the information provided to you by the user agent (browser). But if you're also the browser manufacturer which provides an "incognito" option, and your other (main) property explicitly goes around it as much as it can... that smells bad.

themacguffinman 6y ago

Why don't you ask the layperson what they think Chrome's Incognito mode is for? The answer I imagine is also pretty simple: "hide my porn habits from my family or friends". It's what everyone I know expects and what I expect, and that's what Incognito does. If anything, it's the tech folks who get hung up on what "tracking" means.