5 ms·

The privacy problem isn't that Chrome is offering this permission to websites, it's that they built it into the browser at all. Now their browser, regardless of

The privacy problem isn't that Chrome is offering this permission to websites, it's that they built it into the browser at all. Now their browser, regardless of whether you're using any websites with this permission granted or not, has code that tracks if you're idle or not. There's no bar of entry whatsoever for this. Chrome will automatically update itself to Chrome 94 and voila - it tracks your idle status. Worse yet is if you try to complain, they can shift the conversation by saying the ability is there for websites behind a permission dialog, and of course they take user privacy seriously. Basically exactly what you've done! I don't think it's paranoid to assume nefarious intent because web devs weren't asking for this functionality nor was it impossible before. You add a mouse listener to the page, you check document.hidden, etc. With so many techniques already available ask yourself: why did Google spend time building this? And why didn't they consult other web stakeholders?

omgitsabird 5y ago
Meh, there is so much telemetry pouring out of Chrome, if this wasn't already a capability of the people interpreting that data, I would be surprised.
AgentME 5y ago
If the feature only tracks idleness when the user has been appropriately asked, then why care? It sounds like you're just worried instead by a potential future version that works with a completely different permission model and use-case. I don't think that's any more useful to worry about than "what if Google decides to just send someone a virus with their auto updates?" (well ok, maybe that's kind of interesting to worry about but it's not especially related to this API). >I don't think it's paranoid to assume nefarious intent because web devs weren't asking for this functionality I use chat webapps occasionally like Discord and it would be very useful there. Right now I usually use the desktop application which is basically a wrapper around the web app with a few more abilities like idleness tracking. It would be nice if the web app could have that functionality so I don't have to run an unsandboxed executable on my computer with access to all my files just for it. >nor was it impossible before. You add a mouse listener to the page, you check document.hidden, etc. That only tracks idleness within the current tab, not the whole device. For chat applications that difference is important.
- somehnacct3757 5y ago
  I think you missed my main point which is that for a browser to offer a permission-gated flow to website developers, the browser executable itself needs to have the idle detection system in place. There's no permission to turn _that_ off in the browser itself. It can track your lock screen, and activity outside the browser without prompting you. It's installed automatically by the auto update mechanism. You could argue that Chrome was already doing this and sending that data back to Google over telemetry. (I don't know if they were.) That's where my second point comes in. Before, they had no justification for this. If they do it, it would look like creepy tracking. Now if you call attention to it they can say oh that's just there to power idleness API, nothing to worry about.
google234123 5y ago
Feel free to block updates and enjoy security vulnerabilities. Or better yet just build your own version if chromium
- hungryforcodes 5y ago
  Or switch browsers.
8eye 5y ago
google’s catch phrase was something about not being evil, pretty sure that saying is bogus now and has been bogus for a long time. it really seems like they’ve been siding with some highly questionable practices and no official is gonna step in and check them, especially if a government can benefit by passing laws that force google to hand over the keys/info. it’s kinda sick how much we are engulfed with this stuff lately
akagusu 5y ago
Nefarious intent? This is Google. People should avoid Google like the plague.

omgitsabird 5y ago

Meh, there is so much telemetry pouring out of Chrome, if this wasn't already a capability of the people interpreting that data, I would be surprised.

AgentME 5y ago

If the feature only tracks idleness when the user has been appropriately asked, then why care? It sounds like you're just worried instead by a potential future version that works with a completely different permission model and use-case. I don't think that's any more useful to worry about than "what if Google decides to just send someone a virus with their auto updates?" (well ok, maybe that's kind of interesting to worry about but it's not especially related to this API). >I don't think it's paranoid to assume nefarious intent because web devs weren't asking for this functionality I use chat webapps occasionally like Discord and it would be very useful there. Right now I usually use the desktop application which is basically a wrapper around the web app with a few more abilities like idleness tracking. It would be nice if the web app could have that functionality so I don't have to run an unsandboxed executable on my computer with access to all my files just for it. >nor was it impossible before. You add a mouse listener to the page, you check document.hidden, etc. That only tracks idleness within the current tab, not the whole device. For chat applications that difference is important.

somehnacct3757 5y ago
I think you missed my main point which is that for a browser to offer a permission-gated flow to website developers, the browser executable itself needs to have the idle detection system in place. There's no permission to turn _that_ off in the browser itself. It can track your lock screen, and activity outside the browser without prompting you. It's installed automatically by the auto update mechanism. You could argue that Chrome was already doing this and sending that data back to Google over telemetry. (I don't know if they were.) That's where my second point comes in. Before, they had no justification for this. If they do it, it would look like creepy tracking. Now if you call attention to it they can say oh that's just there to power idleness API, nothing to worry about.

google234123 5y ago

Feel free to block updates and enjoy security vulnerabilities. Or better yet just build your own version if chromium

hungryforcodes 5y ago
Or switch browsers.

8eye 5y ago

google’s catch phrase was something about not being evil, pretty sure that saying is bogus now and has been bogus for a long time. it really seems like they’ve been siding with some highly questionable practices and no official is gonna step in and check them, especially if a government can benefit by passing laws that force google to hand over the keys/info. it’s kinda sick how much we are engulfed with this stuff lately

akagusu 5y ago

Nefarious intent? This is Google. People should avoid Google like the plague.