5 ms·

They also brought the dark pattern to automatically upload and save any file you select in the file uploaded control, even when you mistakenly selected the wron

by nokya 5y ago

They also brought the dark pattern to automatically upload and save any file you select in the file uploaded control, even when you mistakenly selected the wrong file. For more than twenty years, we had to click "upload" or alike to confirm the upload of a file to a server. I wonder how many millions or billions files Google steals (yes, that's theft) from gullible users who use their web interface.

djur 5y ago
How is it a "dark pattern" to upload a file that you selected to upload? And how is it "theft" to accept a file that was selected for upload? What benefit does Google get from this "theft"?
- nokya 5y ago
  Well, that is my opinion. If I take an analogy: think of it as if you were typing a message in an IM chat window. Anything you'd type would be sent immediately to the service owner, whether or not you click "send" at the end. I understand this feel normal to you but I personally find this abusive and a total treachery from Google. To support my point: I used to have access to a corporate proxy that performs TLS inspection for a little less than 50k employees. I looked into this specific scenario to get an idea of how many employees were being abused by this. It is quite easy to find: just filter for queries sent to GMail's API when you cancel a file upload or you remove an attachment from a draft. We have several hundreds of those events each year in our logs. These people quite candidly think they "cancelled" the upload, but it didn't. Google got the file, analysed it, extracted knowledge out of it and potentially adjusted your profile and your employer's. This falls under the definition of a dark pattern. There is something worse than using GMail for your emails: it's using GMail's web interface.
  - djur 5y ago
    > Google got the file, analysed it, extracted knowledge out of it and potentially adjusted your profile and your employer's How do you know this? It's against their stated privacy policy. This is also a kind of strange position to be arguing when you just described snooping on people's secure communications. Why is that OK and what Gmail does isn't?
    - nokya 5y ago
      I don't think it is a strange position, what you seem to describe is actually completely illegal... You may have jumped to conclusions too rapidly. Let me try changing your mind :) We do not prevent our users from using GMail for personal use, but we analyze the traffic for malicious or deviant patterns to detect potential data leaks. Analyzing the amount of users who inadvertently send a file in GMail then rapidly "change their mind" is still, in our shared opinion, a relevant analysis to perform. We report the number of quarterly cases in an awareness newsletter and remind users to be attentive when selecting a file to be uploaded in webmails. Good thing: the occurrences have decreased since we raise this concern. We cannot prove it is linked to our newsletter but our "ego" enjoys believing so. I would have agreed with you if I actually had both a username and a filename shown on my screen, but this does not happen. Our report shows the total count of cancelled uploads per country. We have someone at HR who can actually see the detailed events (including file names) for a given user. It seems to that this would match what you see as "snooping". But this an investigation led by Human resources upon a suspicion of employee misbehavior. It has nothing to do with our infosec activities. I hope I changed your mind, at least a little ;)
      - djur 5y ago
        My point was that in both cases the potential for abuse exists but that users have to trust that existing policies will prevent that abuse. Why should your users trust you and not Google to follow your stated policies?
        nokya 5y ago
        In my opinion, we offer a more trustworthy relationship in three ways: 1. We don't use ambiguous wording in our policies. 2. Any employee interested in knowing how we process these requests can actually come physically and see in detail how they are processed. 3. Our business does not depend upon our ability to harvest our employee data and monetize it.

by nokya 5y ago

djur 5y ago

How is it a "dark pattern" to upload a file that you selected to upload? And how is it "theft" to accept a file that was selected for upload? What benefit does Google get from this "theft"?

nokya 5y ago
Well, that is my opinion. If I take an analogy: think of it as if you were typing a message in an IM chat window. Anything you'd type would be sent immediately to the service owner, whether or not you click "send" at the end. I understand this feel normal to you but I personally find this abusive and a total treachery from Google. To support my point: I used to have access to a corporate proxy that performs TLS inspection for a little less than 50k employees. I looked into this specific scenario to get an idea of how many employees were being abused by this. It is quite easy to find: just filter for queries sent to GMail's API when you cancel a file upload or you remove an attachment from a draft. We have several hundreds of those events each year in our logs. These people quite candidly think they "cancelled" the upload, but it didn't. Google got the file, analysed it, extracted knowledge out of it and potentially adjusted your profile and your employer's. This falls under the definition of a dark pattern. There is something worse than using GMail for your emails: it's using GMail's web interface.
- djur 5y ago
  > Google got the file, analysed it, extracted knowledge out of it and potentially adjusted your profile and your employer's How do you know this? It's against their stated privacy policy. This is also a kind of strange position to be arguing when you just described snooping on people's secure communications. Why is that OK and what Gmail does isn't?
  - nokya 5y ago
    I don't think it is a strange position, what you seem to describe is actually completely illegal... You may have jumped to conclusions too rapidly. Let me try changing your mind :) We do not prevent our users from using GMail for personal use, but we analyze the traffic for malicious or deviant patterns to detect potential data leaks. Analyzing the amount of users who inadvertently send a file in GMail then rapidly "change their mind" is still, in our shared opinion, a relevant analysis to perform. We report the number of quarterly cases in an awareness newsletter and remind users to be attentive when selecting a file to be uploaded in webmails. Good thing: the occurrences have decreased since we raise this concern. We cannot prove it is linked to our newsletter but our "ego" enjoys believing so. I would have agreed with you if I actually had both a username and a filename shown on my screen, but this does not happen. Our report shows the total count of cancelled uploads per country. We have someone at HR who can actually see the detailed events (including file names) for a given user. It seems to that this would match what you see as "snooping". But this an investigation led by Human resources upon a suspicion of employee misbehavior. It has nothing to do with our infosec activities. I hope I changed your mind, at least a little ;)
    - djur 5y ago
      My point was that in both cases the potential for abuse exists but that users have to trust that existing policies will prevent that abuse. Why should your users trust you and not Google to follow your stated policies?
      - nokya 5y ago
        In my opinion, we offer a more trustworthy relationship in three ways: 1. We don't use ambiguous wording in our policies. 2. Any employee interested in knowing how we process these requests can actually come physically and see in detail how they are processed. 3. Our business does not depend upon our ability to harvest our employee data and monetize it.