Hacker News Reader

Well, the topic of the article is not Google collecting data. It is about Chrome extensions.

I can agree to some parts of what you said.

Yep, but since Google's whole business model revolves around monetizing user information, I am not surprised about this article. Google's Motto is "Data Collection for monetary purposes is not evil".

Think about Android Application Permissions for example, I am not sure whether or not you now can revoke permissions one by one on your own (think I read something about this), but for how long was this not possible?

This has nothing to do with Google's business model. This is about the business model of extension developers.

It's also what the Platform allows the Extension Developers to do and the users not to do.

One Example? I have been disabling what Apps get access to on my Blackberry for I don't know how long. Forbid Whatsapp to have Access to the Camera? No Problem, if I want to make a photo from within Whatsapp it then says something that it isn't capable of doing so, just how it should be.

How a Browser behaves in private Browsing also is a browser-side issue. Whether or not the API allows Extension developers to give users the functionality NoScript for example provides to its users it also a browser-side issue.

See for example here (you won't see Google spearheading this cause) http://techcrunch.com/2015/08/14/mozilla-makes-private-brows...

The distinction between "This concerns only the Extensions" and "this concerns only the browser itself" is not as clear and easy as you say it is, especially in this case.

Since Google is all about obtaining information and using it, I don't think they are to be trusted in developing a browser that is highly concerned with user's privacy. Everybody has to make their own decision.

So do you feel like Google Chrome as a platform is not giving you enough information about what the Google Chrome extensions are doing and not giving users enough power to act on such information?

Also about firefox from the comments in this discussion by zetafunction: zetafunction 5 hours ago:

    From the article:
    Are Firefox extensions any better?
    To be honest, no.

This isn't about Google's business model - which by the way isnt as terrible as you make it seem. Unless you'd like to start paying them for all their services, how exactly do you think they should make money?

I actually pay money for E-Mail for example, I think many would be happy to pay for GMail if they would offer the option of "No Ads, and we don't use your information at all", but since Google has perfected the business with information, they rather have that than get money, so... I also want to make clear: This of course is highly subjective, like I said, I have an issue with this, some don't and that is perfectly fine, the world doesn't revolve around me and as long as there are alternatives...

But Google certainly is a company solely built upon obtaining user information and using that information as efficient as possibly, that is their right, and it is my right to not approve of this, state my opinion, and use something else / block their services :)

Would you agree that the article is focusing on companies/programmers making extensions and ignoring their users' privacy, which might harm the users if they store their users information (access keys) in a database?

So, imagine if you were an elite hacker and I have an extension that I made in Google Chrome that asked for users authentication keys and I stored that in a database. Then you figured out where my database is located. If your best friend uses my chrome extension, would you suggest to your best friend to use my chrome extension?

> I block their Scripts, only temporarily allow if I need them, I don't keep cookies for longer than my current session except for Fastmail, I use VPN, have no DNS-Leak and WebRTC Detection turned off (last I checked you could not turn WebRTC Detection off in Chrome and the Extensions promising to do that were not working).

It's been possible to disable multiple webrtc routes since M42[1]. uBlock exposes this option as a checkbox in its main settings.

> And that's also why I use Mozilla Firefox. Not because it's the technically better browser, but I have trust in Mozilla and their API just allows capabilities Chrome isn't capable of (that's why there is no NoScript in Chrome and no, there is no NoScript-Alternative in Chrome with the same features and capabilities, look it up).

The only thing Chrome/Chromium cannot block are inline script tags[2]. Inline script tags should apparently be considered cosmetic filtering according to [2].

Other than the above exception you can pretty close to blocking everything you could in Firefox with uBlock[3]/uMatrix[4]. Unless you're referring to something else? With uMatrix you can get basically the same granularity that you can with NoScript just in a much nicer looking interface (which is available for Firefox now as well).

> Back when I used both Chrome and Firefox side by side, Firefox for example would turn off some Add-Ons/Extensions in Private Browsing Mode, while Chrome would not. I guess we all can grasp what most likely was the reason for it (Add-Ons/Extensions should not be able to obtain information from the user if in private browsing).

Chrome extensions will by default NOT be allowed in incognito mode. I don't know what you observed but you must have explicitly allowed this behavior.

[1] https://code.google.com/p/chromium/issues/detail?id=457629 [2] https://github.com/gorhill/uBlock/wiki/Inline-script-tag-fil... [3] https://github.com/gorhill/uBlock [4] https://github.com/gorhill/uMatrix

>We all know their business model. Either you pay with money or with information.

That isn't actually their business model. They make money from people paying for ads not information. I've got friends in marketing and they'd love Google to sell them say a list of email address of high net worth investors which Google probably knows but they won't do that. They will let you pay to run ads aimed at certain groups but that's a different thing.

they'd love Google to sell them say a list of email address of high net worth investors which Google probably knows but they won't do that

There are at least two possible reasons why Google won't do that:

a) they're doing the right thing or b) they're not stupid enough to dis-intermediate themselves that way

I think it's mostly "b". Selling the addresses is one-time revenue, selling ads targeted at high net worth investors is an ongoing annuity stream.

Agreed, but additionally to "one-time revenue" versus "ongoing annuity stream":

a) Acceptance, Image

The fact that they don't sell is the reason why many don't mind it as much. "So their automatic algorithms look for some key words in my mail and searches to target ads, I get better ads, they get money for clicks, what's the problem?"

Selling it would be a whole different story

b) Once you sold out, what then?

I guess that selling to thousands of companies you loose control over your information. x-many Companies have lists of high net worth investors for product category y from us, how to guarantee this information does not get out? Will be given to other companies/people? Will it be correctly used? How can we guarantee those x-many companies are storing that information securely? I can think of all kinds of issues with that business model.

All my Chrome extensions listed on the Settings page have an 'allow in Incognito?' checkbox, which is unselected by default.

Agree completely with this. The tracking capability today is, scary. Between Google and Facebook I've noticed some gorilla type ad behaviour. I'm basically done with both services now.