3 ms·

Which part of the spyware section were they in violation of? Pretty much everything on that table has to be explicitly enabled and does the obvious thing when i

Which part of the spyware section were they in violation of? Pretty much everything on that table has to be explicitly enabled and does the obvious thing when it is.

KennyBlanken 4y ago
He was sending every domain in a user's contact list to a third party service to retrieve favicons if users enabled the service...and not disclosing that. More importantly, Google told him that he needed to disclose what he was doing, and his response was petulance. You know the type: "I was speeding because I was LATE TO WORK, officer!" Further discussion in this comment thread: https://news.ycombinator.com/item?id=31434975 https://news.ycombinator.com/item?id=31434975
- miloignis 4y ago
  Based on that linked thread, it was off by default, mentioned there might be privacy implementations, and contacted the domain itself (which I would not classify as a third-party - that's the service that is in control of the email address) to retrieve its favicon. That seems more than reasonable to me (off by default, with a warning!), and would be exactly what I would expect the app to do if I did enable favicons.
  - jeroenhd 4y ago
    The favicon privacy issue seems quite mild to me, but the libreavatar integration should've been listed more clearly.
- jeroenhd 4y ago
  From what I can tell he didn't just bulk send every domain, only the ones that are visible in the inbox. If you don't receive mail from a contact, I don't think the app ever uploaded anything. Still pretty bad, and I don't think Google is wrong to flag the app because of this. However, Google didn't say "if the user enables a certain setting, your app is uploading domain names from your users' contact list to third party avatar services", it said "you're uploading contact list information without disclosing that in the privacy policy". They seem to know exactly what the problem was but described it in such a vague way that it definitely reads like an accusation of extracting data. Both are wrong here, but Google is in a position of power and should be held to a higher standard. I'm sure just listing the hostnames that weren't covered by the privacy policy were enough to prevent this whole situation.
pavon 4y ago
It is good that these things were opt-in but I disagree that the implications were obvious. There is an entire spectrum of implementation options for many of these features regarding how much work is done on the device and how much is done on an external server, and thus what data must be sent to the service. The user needs to have this explained to them so they can make an informed decision.

Which part of the spyware section were they in violation of? Pretty much everything on that table has to be explicitly enabled and does the obvious thing when it is.

KennyBlanken 4y ago

He was sending every domain in a user's contact list to a third party service to retrieve favicons if users enabled the service...and not disclosing that. More importantly, Google told him that he needed to disclose what he was doing, and his response was petulance. You know the type: "I was speeding because I was LATE TO WORK, officer!" Further discussion in this comment thread: https://news.ycombinator.com/item?id=31434975 https://news.ycombinator.com/item?id=31434975

miloignis 4y ago
Based on that linked thread, it was off by default, mentioned there might be privacy implementations, and contacted the domain itself (which I would not classify as a third-party - that's the service that is in control of the email address) to retrieve its favicon. That seems more than reasonable to me (off by default, with a warning!), and would be exactly what I would expect the app to do if I did enable favicons.
- jeroenhd 4y ago
  The favicon privacy issue seems quite mild to me, but the libreavatar integration should've been listed more clearly.
jeroenhd 4y ago
From what I can tell he didn't just bulk send every domain, only the ones that are visible in the inbox. If you don't receive mail from a contact, I don't think the app ever uploaded anything. Still pretty bad, and I don't think Google is wrong to flag the app because of this. However, Google didn't say "if the user enables a certain setting, your app is uploading domain names from your users' contact list to third party avatar services", it said "you're uploading contact list information without disclosing that in the privacy policy". They seem to know exactly what the problem was but described it in such a vague way that it definitely reads like an accusation of extracting data. Both are wrong here, but Google is in a position of power and should be held to a higher standard. I'm sure just listing the hostnames that weren't covered by the privacy policy were enough to prevent this whole situation.

pavon 4y ago

It is good that these things were opt-in but I disagree that the implications were obvious. There is an entire spectrum of implementation options for many of these features regarding how much work is done on the device and how much is done on an external server, and thus what data must be sent to the service. The user needs to have this explained to them so they can make an informed decision.