Hacker News Reader

Comment by endtime | Hacker News Reader

(Disclaimer: I work for the same former-division-of-Google-and-now-Alphabet-subsidiary that built this, though I don't work on OnHub.)

I think you need an account for cloud-based configuration, credential sharing, etc. Maybe it's not for everyone, but I think it makes sense as a product. I highly doubt they added a Google account requirement to improve ad targeting.

View on HN

Thanks, but shouldn't these features be optional? I still don't get why I need a Google Account.

These features are the value proposition. If you don't want them, a different router might actually be better for you.

I thought the value proposition was a better designed antenna and intelligent on-board bandwidth prioritization.

>These features are the value proposition

Asking for an explanation or complaining or criticizing a product is good and should be encouraged. Companies should expect negative feedback if they release products that consumers do not like. In fact this helps the Companies too in making products that people want.

I don't quite see why you're telling people to "take it or leave it". That applies to every single product in existence, and I would hazard a guess that most people here are aware of it.

I'm not saying that it's "take it or leave it".

I'm saying that if you're unwilling to use a Google account for this, then (in all likelihood) it probably isn't the best product for you.

The same way that if you're unwilling to use an Amazon (or Apple) account, the Kindle (or iPhone) isn't going to be the best product for you.

The router is cloud configured from your mobile device, that is how it works.

Some cloud services for the device are actually optional. But AFAIK you still need a Google Account.

Here is the help page on the topic of data collection and privacy:

https://support.google.com/onhub/answer/6246642?hl=en&ref_to...

And see also, how to set a whole bunch of privacy settings:

https://support.google.com/onhub/answer/6279845?vid=1-635755...

Disclaimer: I work on the project. I am not a spokesperson or legal or marketing, or anything like that.

That's bullshit. It should use something like Thread or Bluetooth 4.0 to let you configure it from your mobile device, which already assumes you'll be in the same room with the router in 99% percent of the cases.

There's no reason for this to be sent over the Internet, when you're both in the same room.

I wouldn't phrase it so negatively but I do share the same sentiment. I think this is the craziness that seems to be so widespread that people don't notice how crazy it is - the primary way for two devices sitting few meters from each other to communicate should not be routing packets around half of the planet. I get it's easier, but it's bad engineering, unnecessarily wasteful energy-wise and I bet the only reason this is the default is for companies to lock people down and make money on data.

Totally agree.

"unnecessarily wasteful energy-wise"

This is just for setup right? So the energy cost is insanely trivial, hardly worth mentioning.

I'm making a general point here. In case of this router, one-time expense is indeed hardly worth mentioning. I just dislike the whole trend.

The general point is "local direct communication is hard and unreliable". Your phone falls back to 3G - connection broken. You're on "HouseWifi" and the other device is on "HouseWifi_5Ghz" - connection broken. You have a router with a guest mode and stops guests accessing the local LAN - guest can't print or chromecast or whatever.

It allows configuring while not near it too, to check what's wrong with it while at the office. Bluetooth doesn't extend that far.

If you can debug the device remotely, you can debug the device remotely without trusting a third party.

There's absolutely no reason your private home router should be a slave to whatever remote configuration, monitoring, or intercept that some third party may be under legal orders to implement.

IMO these devices are nothing but parasites. On the positive side, Google has no track record with selling this kind of device and hopefully they will fail badly at it.

I'd say Google has done amazingly well with selling at least one device like this, the Chromecast.

Maybe I'm over-stating the similarities, or the actual success.

Google Fiber is one of the most wanted things in the tech world. You think having your traffic go through their router is bad? I don't even want to know how you'd feel about every internet thing you do being on their network.

There is a significant difference between being the first hop after the firewall, and the firewall actual.

This then assumes that authentication is handled by some combination of device proximity, physically pushing a "grant admin access" button on the device, or falling back to password management (possibly on a sticker on the bottom of the device).

There is something to be said for tying the device into an existing strong authentication infrastructure.

IPv6 support?

yes

> The router is cloud configured from your mobile device, that is how it works.

How do I configure a router if I need an internet connection to configure it? Sounds like a circular dependency issue.

Out of box configuration of the device is done without the need for Internet access.

Also, these days a good % of customers are walking around with an Internet connection in their hands, separate from their home connection.

Does it mean that you can set it up without a Google Account, then? Or does it let you create one (without being set up for the internet) somehow?

It's a wirless bridge, and it assumes you already have a router with an internet connection(i.e. your cable/dsl/fiber box). Setup instructions are here:

https://support.google.com/onhub/answer/6246481?hl=en

>> that is how it works.

That's how it's "made to" work (needing a google account).

Is guest access on a private SSID? Is my traffic separate from theirs? What about VPN support? I was getting ready to by an Asus router because I'm in the market for one, and it's at a similar price point. The three features I'm most interested in are QOS (which it looks like you have), having guests segregated from my network, and VPN access to my server

For users in some country can't access Google Account (e.g. China), Can I still buy and use it? That'll be no Google Account on daily use.

> The router is cloud configured from your mobile device, that is how it works.

So is the Chromecast and you don't need an account for that, unless you want to customize it with your own photos etc

They are optional. You have the option of just buying a different device.

No way! I deserve the best, and I also deserve the best without giving up anything nothing notta zilch! /s

You're actually giving up $200. Quite a good chunk of change. And no discount for my meta data passing through Google.

Uh, I think that's the discounted price... ;)

I understand the sentiment but I can see a certain logic to using a Google Account.

It gives some protection against an attacker using a default password (as with every other router in the world). Also the hardware could be locked to a particular account in case the firmware is reset and you return to a welcome page.

Also it seems preferable that Google should use it's existing infrastructure instead of creating something new just for this.

"I highly doubt they added a Google account requirement to improve ad targeting."

I find that a highly optimistic statement given advertising is pretty much Google's only significantly profitable product and is supporting the entire conglomerate.

It doesn't seem very plausible that Google made OnHub just to sell lots of them at the $200 price point. I think the official stance on this will be that they want to make the internet work better and be easier to setup. I do think that's plausible.

Plus, unless Google can snoop into HTTPS connections, how would this help them with ad targeting? (since HTTP will be phased out within the next few years)

Haven't the NSA revelations of the past few years driven home the fact that metadata is extraordinarily valuable and informative?

> unless Google can snoop into HTTPS connections, how would this help them with ad targeting

Hostname from TLS SNI is also useful for AD targeting.

I suppose a workaround could be just an OnHub specific Google Account.

How is creating a Google Account a workaround to creating a Google Account?

How is creating a throwaway Google Account anything other than a minor inconvenience?

If you're able to tell, which division is that? Is this really inner-Google product development, or mostly/partial/somewhat outsourced via a prod-dev consultancy?

Pretty sure they mean Nest.

Not directly, but they would certainly have included it as an entry point to bring users into Google's account-driven services, and to make a Google account "stickier".

That indirectly does increase ad revenue and targeting, and you can be sure that over time different people in the company will keep having the "bright idea" that if they correlate OnHub data with data from Analytics, DNS, and location services, they can improve ad-targeting by 0.x%, leading to $Y million in additional revenue, and within a few years it will be.

What division is that?

Fiber was part of "Access and Energy" led by Craig Barratt. Has a spot on their super out of date management page: https://www.google.co.uk/about/company/facts/management/

    I highly doubt they added a Google account requirement
    to improve ad targeting.

You might be right but it's really hard for me to agree with you. It could be optional, but it appears not to be.

I believe the post was not disputing the existence of the requirement, but the idea that it was to improve ad targeting.

I understand, and I still think an ad company has every interest to improve its ad targeting. What is so controversial about that?

Cloud-based configuration? Isn't that virtually always a terrible idea security wise for a router? Is it another form of "lawful intercept"?

Depends on if you think un-updated, bad PRNG devices are better.

This isn't an "either-or" situation. You can have an auto-updating router which doesn't depend on configuring via a third party service.

Not really. If the router auto-updates, it has to get that update from somewhere. If anything, being able to push firmware is more powerful than being able to push configuration.

Their privacy policy seems open ended enough to indicate otherwise. Using this router allows Google to collect a HECK of a lot of data about your Internet usage.

No it doesn't? https://support.google.com/onhub/answer/6279845

For now

> For now

Sure! What else doesn't it do "for now"? You should make a list. Subliminal messaging out of the speaker, ad hoc mesh for coordinating kill-bots...

More seriously, one nice feature of that page:

If changes are made to this article (which should be rare), a revision history will be available on this page to let you know what has changed and why.

All privacy policies should have this.

That IS a lot of data!

I like the "for example.." present in most sentences.

Attempting to list out each and every individual instance where a piece of data might be used does not a good privacy policy make.

Well, privacy policies are weaksauce and in general haven't been legally tested that much.

-- When you upload, submit, store, send or receive content to or through our Services, you give Google (and those we work with) a worldwide license to use, host, store, reproduce, modify, create derivative works communicate, publish, publicly perform, publicly display and distribute such content.

The rights you grant in this license are for the limited purpose of operating, promoting, and improving our Services, and to develop new ones. This license continues even if you stop using our Services.

Our automated systems analyze your content to provide you personally relevant product features, such as customized search results, tailored advertising, and spam and malware detection. This analysis occurs as the content is sent, received, and when it is stored. --

So yeah, the Terms of Service is filled with so many legal loopholes that only a lawyer would love.

[1] http://www.google.com/intl/en/policies/terms/

> I highly doubt they added a Google account requirement to improve ad targeting.

Ad delivery networks, and google is one of the biggest, have one core business: delivering ads. Everything is setup to make that as big and as solid as possible. Whatever it takes (and we all know how far ad delivery networks will go: almost infinitely far).

Now they ship a piece of hardware, require signing up with an account, and it's not for prolonging / helping their core business? If you believe that, I have a piece of land I want to sell to you, special price.

I'm not going to say you're wrong, but Google has an interest in maximizing the number of people who have consistent, reliable, enjoyable internet experiences. If this hardware does not collect data to help them target ads (and that may very well be the case), but causes more eyeballs to spend more time online where they will find Google-hosted ads, it helps their core business AND the customer.

> Ad delivery networks, and google is one of the biggest, have one core business: delivering ads

It's made by an alphabet subsidiary, not google. Google are the bad ad-selling guys, they're the good guys. 100% true!

I agree!

- Typed on Google Chrome on my Android Phone, connected to my Google Fiber network via my onHub router.

Believe it or not there are a lot of teams at Google that don't think about ads. I worked on Geo for over three years and had plenty of discussions about how various things should work, and ads never came up. (There was one case where we pushed pointless login requirements on the user, gating Zagat reviews behind a G+ login, and I (along with many others) argued against it.) Like I said, I'm not on the OnHub team, but knowing how these sorts of things work my educated guess is that they did some market research and found that the best way to have the best UX for the median user was to do cloud-based configuration.

On top of which, the privacy policy (linked elsewhere in the comments)_ makes it clear that your actual web browsing data isn't tracked.

At a strategic level, if we make wifi better and people use the internet more, sure, we can show them more ads. Maybe that and/or other strategic concerns are part of why the project got funded in the first place. But the people actually designing the features are probably a disjoint set of people from the ones thinking about that kind of strategy.

Reply on news.ycombinator.com