Continuing our journey to bring instant experiences to the whole web
blog.chromium.org
blog.chromium.org
Apple/Cloudflare are working on privacy-friendly protocols that reduce the amount of information exposed to them [1].
At exactly the same time, Google here is working on proxying non-Google browser traffic through them without consents from either the user or the publisher.
I wonder how would Google engineers feel if they found out that their Samsung phone was sending subset of their Photos and Gmail data through their servers in Korea without any consent? (To be clear, Samsung does not do this. I'm just providing an analogous example).
Just because users run the Chrome browser does not mean that they give consent to Google to proxy their network traffic. There is a vast difference, and that's why Android and most operating systems require explicit user permission when installing VPNs.
Besides privacy and obvious web-centralization issues, there are bunch of security issues associated with proxying the traffic. Apple and Mozilla brought these issues to the attention of Google during SxG spec discussions. At that time, Google's rebuttal was that SxG is a opt-in feature for sites.
Quoting from [1] (Mozilla's official position on SxG): "Sites opt-in to using this mechanism, and in doing so need to be aware that this comes with some risks, but in doing so they enable a new feature".
This time, Google really did not handle any of the previously discussed security/privacy concerns. Instead, they just went ahead and started proxying the user's traffic without the opt-in from the users or the sites.
[1] https://docs.google.com/document/d/1ha00dSGKmjoEh2mRiG8FIA5s...