6 ms·

50% savings is not enough, for me, to justify the MITM. I would rather have data sovereignty than data bandwidth at this tradeoff.

cbhl 11y ago
The great thing is, even if you use Chrome, you can turn "Data Saver" off by going into Settings on Chrome for Android/iOS. (I'm biased, but I'd personally rather have Google MITM me than a mobile carrier like Verizon or T-mobile.)
- stephenr 11y ago
  Why do you trust an advertising company more than a telecom?
  - chinpokomon 11y ago
    For me, it is because there is an expectation that my data will pass through the telecom. Not only is it expected, but as the end user I have little choice in the matter. If Eve wanted to inspect my traffic, that is a one-stop shop. Flywheel ends up masquerading some of that traffic, so if for no other reason, it is atypical. I also perceive that it would be in Google's best interest not to abuse that privilege since advertisements are how they make their money. If they abuse that privilege, consumers will go elsewhere and they will lose their market advantage. You only need but look at the cookie tracking the telecoms are doing right now to see that their oligopoly gives them little incentive to respect consumer's privacy.
    - stephenr 11y ago
      > their oligopoly gives them little incentive to respect consumer's privacy It's true they may not have much incentive to protect your privacy (besides perhaps competition from "better" companies and/or legislation). But also keep in mind that Google has a huge incentive to breach your privacy, and have been taken to court over it, numerous times.
- rjvs 11y ago
  You seem to be conflating the choice; really, it's a choice of adding Google to the list of MITM or not. This system can't remove your mobile carrier from the circuit or stop them playing with your data.
  - mdwelsh 11y ago
    This is not strictly true. In most cases, Chrome uses an encrypted (HTTP/2) connection to the Flywheel proxy which would bypass by ISP-side middleboxes. However, some carriers are downgrading the Flywheel connection to HTTP for the purposes of implementing adult content filtering; see https://support.google.com/chrome/answer/3517349 https://support.google.com/chrome/answer/3517349. So we do "remove the mobile carrier from the circuit" in most cases.
deleted 11y ago
[deleted]
tyho 11y ago
They mentioned that (it is an opt-in feature) that usage was far higher in developing countries where data bills can be between 11-25% of income.
mdwelsh 11y ago
I am the tech lead on the Flywheel proxy. Flywheel does not MITM SSL connections; it does not proxy SSL at all. If you just mean "MITM" in a generic sense, the fact that you believe you have "data sovereignty" is interesting since we're talking about unencrypted HTTP here. Nearly all ISPs and mobile carriers undertake proxying and extensive analysis and manipulation of in-the-clear HTTP traffic. We agree that users need to opt into this feature -- since you have to trust Google to proxy your traffic, after all -- but it's important to keep in mind that many other parties on the path between you and a website already do transparently proxy your unencrypted traffic.
- xnull2guest 11y ago
  I do mean MITM in a generic sense. Regarding the Third Party Doctrine, the fewer third parties with access to the information, the more sovereign over the data the remaining parties are. But I agree with you that ISPs and mobile carriers are other companies who intercept, profile, sell and partner away plaintext information - and indeed in the case of at least some mobile carriers encrypted communications too. I agree with the assessment that this is an opt in feature. I have spoken about the reasons I won't be opting in. (In my opinion it is a very bad trade.) Definitely agreed that many other parties have access to the data. I disagree that this is an argument to add another. [By the way, thank you very much for taking the time to speak on HN about Flywheel from your position. :)]
  - mdwelsh 11y ago
    I absolutely agree with your rationale for not wanting to opt in; we appreciate that this is a highly privacy-sensitive topic and one that users need to make up their own minds about.

cbhl 11y ago

The great thing is, even if you use Chrome, you can turn "Data Saver" off by going into Settings on Chrome for Android/iOS. (I'm biased, but I'd personally rather have Google MITM me than a mobile carrier like Verizon or T-mobile.)

stephenr 11y ago
Why do you trust an advertising company more than a telecom?
- chinpokomon 11y ago
  For me, it is because there is an expectation that my data will pass through the telecom. Not only is it expected, but as the end user I have little choice in the matter. If Eve wanted to inspect my traffic, that is a one-stop shop. Flywheel ends up masquerading some of that traffic, so if for no other reason, it is atypical. I also perceive that it would be in Google's best interest not to abuse that privilege since advertisements are how they make their money. If they abuse that privilege, consumers will go elsewhere and they will lose their market advantage. You only need but look at the cookie tracking the telecoms are doing right now to see that their oligopoly gives them little incentive to respect consumer's privacy.
  - stephenr 11y ago
    > their oligopoly gives them little incentive to respect consumer's privacy It's true they may not have much incentive to protect your privacy (besides perhaps competition from "better" companies and/or legislation). But also keep in mind that Google has a huge incentive to breach your privacy, and have been taken to court over it, numerous times.
rjvs 11y ago
You seem to be conflating the choice; really, it's a choice of adding Google to the list of MITM or not. This system can't remove your mobile carrier from the circuit or stop them playing with your data.
- mdwelsh 11y ago
  This is not strictly true. In most cases, Chrome uses an encrypted (HTTP/2) connection to the Flywheel proxy which would bypass by ISP-side middleboxes. However, some carriers are downgrading the Flywheel connection to HTTP for the purposes of implementing adult content filtering; see https://support.google.com/chrome/answer/3517349 https://support.google.com/chrome/answer/3517349. So we do "remove the mobile carrier from the circuit" in most cases.

deleted 11y ago

[deleted]

tyho 11y ago

They mentioned that (it is an opt-in feature) that usage was far higher in developing countries where data bills can be between 11-25% of income.

mdwelsh 11y ago

I am the tech lead on the Flywheel proxy. Flywheel does not MITM SSL connections; it does not proxy SSL at all. If you just mean "MITM" in a generic sense, the fact that you believe you have "data sovereignty" is interesting since we're talking about unencrypted HTTP here. Nearly all ISPs and mobile carriers undertake proxying and extensive analysis and manipulation of in-the-clear HTTP traffic. We agree that users need to opt into this feature -- since you have to trust Google to proxy your traffic, after all -- but it's important to keep in mind that many other parties on the path between you and a website already do transparently proxy your unencrypted traffic.

xnull2guest 11y ago
I do mean MITM in a generic sense. Regarding the Third Party Doctrine, the fewer third parties with access to the information, the more sovereign over the data the remaining parties are. But I agree with you that ISPs and mobile carriers are other companies who intercept, profile, sell and partner away plaintext information - and indeed in the case of at least some mobile carriers encrypted communications too. I agree with the assessment that this is an opt in feature. I have spoken about the reasons I won't be opting in. (In my opinion it is a very bad trade.) Definitely agreed that many other parties have access to the data. I disagree that this is an argument to add another. [By the way, thank you very much for taking the time to speak on HN about Flywheel from your position. :)]
- mdwelsh 11y ago
  I absolutely agree with your rationale for not wanting to opt in; we appreciate that this is a highly privacy-sensitive topic and one that users need to make up their own minds about.