Hacker News Reader

Comment by gshdg | Hacker News Reader

I’m really interested to find out how they’re approaching privacy. If they take a strong stance, this might be a good alternative to chrome for those sites that support nothing else.

View on HN

From a practical standpoint exactly what does Google collect from one’s browsing activity when they use Chrome? Not sure I’ve ever seen the technical analysis of what kinds of exposure users have.

I'm sure it's not limited to this but there are a lot of dark UI patterns in Chrome, e.g. any Google web login also logs you in to Chrome so Google "has permission" to record your browsing history and other browsing data.

I mean, I think Google gathers browsing history through other means (being embedded on a huge proportion of all webpages), but in the case of Chrome/Chromium, there is a separate password for the sync artifacts, I think at least in principle they are stored separately (especially since they now include passwords, social security numbers, etc.).

My sync password is different from my account password, I think it generally unlocks both at once if your sync password is the same as your account password, and you log in to your Google account.

I think this is also possible with the way that Microsoft has made "Edge" work with Microsoft accounts rather than Google accounts.

After the blowback from auto sign-in they added an option to disable that on both Chrome and ChromeOS.

Settings -> Advanced -> Allow Chrome Sign-in

If you want even more control use ADMX (enterprise policies) to permanently disable it. For example on Windows visit Software\Policies\Google\Chrome\ in either HKLM or HKCU and set SyncDisabled 1, EnableSyncConsent 0, BrowserSignin 0.

Full list/docs:

https://www.chromium.org/administrators/policy-list-3

I deal with it by having a separate google profile (“user”) and barely using it outside of gmail and google docs. I just let it sync.

Nowadays your Chrome Sync/Backup is encrypted with your G password (and you can change it to a separate password if you wish), but a lot is still sent to Google (and IIRC by default): https://support.google.com/chrome/answer/9116376?hl=en ("Learn about other Google Services")

Why not Safari? It's fast, power-efficient, and native.

And a lot of stupidly optimized-for-chrome sites break in it. Plus extensibility is limited.

Maybe if everything you use is a web-app that makes sense, but I avoid that like the plague. Maybe in the wonderful world of Silicon Valley you can rely on that, but in the real world internet connectivity can be choppy, especially when inside trains and planes.

Most startup workplaces these days use a lot of SaaS apps. Not like you have a choice to avoid web apps.

Nowadays many applications, and especially most big-name business application suites (G Suite, Microsoft Office online, etc), are converting all their web applications to Progressive Web Apps, adding Service Workers and such so that they work just fine when you're offline and sync to backup document changes and such whenever you reconnect later. Give it a couple years and it won't be a problem anymore.

Are these publicly-available sites, or private web apps?

I can't remember seeing sites that break Safari, but I'm sure I'm just lucky.

In my case our SSO requires a FIDO U2F hardware token and Safari doesn't support FIDO U2F at all. Someone wrote a third party extension but I can't get that working.

> In my case our SSO requires a FIDO U2F hardware token and Safari doesn't support FIDO U2F at all. Someone wrote a third party extension but I can't get that working.

If there is one specific website that requires Google Chrome, you could use Google Chrome for that and use Mozilla Firefox for everything else?

It's our SSO, so its every internal tool we have. Gmail, Slack, Jira, Confluence, GitLab, etc.

Windows itself is not a bastion of privacy.

I see your point, but I'll add that telemetry is focused on making sure stuff works, whereas selling ads based on your data is focused on making money from you.

Telemetry can be disabled on Enterprise: https://www.kapilarya.com/allow-or-prevent-telemetry-in-wind... but I agree it would be good for Microsoft to allow this to be disabled in Pro.

Motivation is irrelevant if I don't want to share any data as a user.

edit: Besides that, the telemetry service has caused multiple problems on different systems already. I just don't see any results from it compared to previous versions of windows.

Last I checked windows now has ads in it. Those ads may currently be totally untargeted, but that's a small comfort and I wouldn't count on it staying that way forever.

Why not just use Brave then?

I personally ditched them due to them pushing BAT to heavily on those that don't want to participate and Sync being broken randomly.

Broken on Debian stable due to a sandbox issue not solved for many months.

Not willing to compromise security to run Brave which it seemed the workaround at the time did.

> a good alternative to chrome for those sites that support nothing else.

Edge is literally Chrome with Microsoft slapped on top of it.

No. They're working on a big privacy dashboard which blocks tracking cookies as well as other stuff: https://www.microsoftedgeinsider.com/en-us/whats-next

Video: https://edgetipscdn.microsoft.com/insider-site/images/whatsn...

Still not buying it. I don't trust Microsoft at all with privacy especially with what they did to Windows 10.

Telemetry & spying is everywhere with everything that they build now even in their calculator[0][1].

I would stick to Ungoogled/Chromium, Safari or Firefox thanks.

[0] https://git.io/fj4Wl

[1] https://github.com/Microsoft/calculator/issues/148

Don't worry, it's all for your benefit. How else would they know what divisors to optimize first for?

Reply on news.ycombinator.com