Hacker News Reader

Comment by yuhong | Hacker News Reader

"proceeds to send all this data to App B's vendor"

Proof?

It's called "sync" and you can bet everyone who has a Gmail account who gets asked to "log into Google" when Chrome is opened (as their new default browser) will enter their username and password without giving a second thought to it or realizing what they just authorized.

That's ofcourse if they even noticed that their browser now looks slightly different at all.

Voila. Data stolen. Or are you going to argue that this represents completely concentfull and legitimately syncing?

Are you talking about Chrome browser?

If you say synchronized data in Chrome is being sold to 3rd parties by Google, I would really love to see a proof for this claim.

I'm not saying Google is selling the data.

I'm saying Google shouldn't have the Firefox/MSIE data in the first place, because lots of users never intended to install chrome, but got it as a drive-by installation.

They are the illegitimate third party "stealing" the data.

> They are the illegitimate third party "stealing" the data.

And you still didn't provide any proof of that

Chrome can do client side encryption of your data, which isn't something you can say about the new Firefox Sync.

Source?

Are you perhaps thinking of the currently unused "class-A data"?

https://blog.mozilla.org/services/2014/04/30/firefox-syncs-n...

https://blog.mozilla.org/services/2014/02/07/a-better-firefo...

https://github.com/mozilla/fxa-auth-server/wiki/onepw-protoc...

Edit:

From what I can see, client side encryption in Google Chrome appears to be opt-in?

It is entirely optional, and don't fit normal definitions of "spyware".

You mistakenly assume this feature which by default requests your google login for sync will be understood by users as this, when they open their browser and see "Log into google". Much more likely is that your casual user will think they're logging into Gmail.

This is a dark UX anti-pattern, using the same technique as a regular scammer or phishing site.

Google is absolutely, horrifyingly into evil territory here.

I think what Win8.1 does with pushing you to use MS accounts during OOBE is a much worse dark pattern than this.

"I think hanging someone is worse than just giving them poison."

I don't particularly care about this spyware debate but I can't see how something bad being better than something else bad bears any relevance unless we are talking about choosing between two bad options.

The vast majority of "spyware" and "malware" these days has a big long page of EULA legalise that makes the tracking totally optional too.

People clicking the "I agree" button on a EULA is not consent.

Reply on news.ycombinator.com