Hacker News Reader

Comment by chopin24 | Hacker News Reader

I'm happy that HN has accepted a change in the article's title, which appears as "Google says it may have found a privacy-friendly substitute to cookies." This terminology -- "found" -- has been used by Google and others to imply that their capture of behavioral "exhaust" is somehow a natural phenomenon, rather than a conscious, deliberate, profit-driven choice. Google didn't "find" a substitute. They are developing it because they are getting pushback from users and companies who object to their tracking methods and they're desperate to find something that convinces users they've Really Changed This Time.

Don't fall for it. Break up with Google. They are abusive.

View on HN

I'm very attentive to wording but I think you're reading too much into this one.

In programming and in business you talking about "finding" a solution to a problem all the time. In this case, the problem is how to improve privacy without advertising revenue dropping off a cliff. And it's not like the solution is staring you in the face -- it takes iteration and testing for it to be "found".

So I don't think Google is being disingenuous here. Nothing is being implied as a somehow natural phenomenon. Business in general is about "finding" satisfactory solutions to problems day in and day out. "Find" and "develop" are essentially synonymous and interchangeable here.

Haha! Yes to both. Replies!

I'm not comfortable assuming the best intentions from a $1.2T company whose business model relies on tracking my behavior. They burned that bridge after the war-driving "Wi-Spy" scandal, which went on from 2007-2010. [0].

It's clear that Google sees a threat to their business model, and they'll use any PR-friendly language they can to convince people that they're addressing the user concerns. Just like they did in 2010, when they ascribed their willful malfeasance to a "rogue engineer" who they then put in charge of StreetView.

If I'm "reading too much into it" it's because we collectively haven't been reading enough into it for the past 15 or so years, and in that time our Overton window has shifted too far.

[0]https://www.theregister.com/2019/07/23/google_wispy_payout/

You, myself, everyone -- we're jaded. Got it.

Not much concerned with descriptions, so what's your prescription:

What do you believe to be satisfactory wording in this case?

this. I'm fine with GP's use of "finding" a solution. Yes, they found one; finding solutions is a central process in software.

But I'm absolutely not fine with the wording. When confronted with the phrase "Google says it may have found a privacy-friendly substitute to cookies", I'd wager most people would think "this improves my privacy in a general way".

It doesn't. What it actually means is: Google will make it more difficult for others to track you, but Google will remain committed to tracking everything about you that it possibly can. Except silently, and without your ability to opt out using ad blockers etc.

Net result: even less control over your privacy, and Google further entrenches its monopoly to boot.

That's not an improvement in privacy.

> That's not an improvement in privacy.

Okay, that's obviously not true from your own comment, you also say:

> Google will make it more difficult for others to track you

So if Google can still track me at the same level, but others can no longer track me, that IS an improvement in privacy. Not from Google, but from everyone else.

I get and agree with your point about how it's an advantage for Google because they can make their tracking harder to avoid and lock others out, but I find it hard to sell "This is not an improvement in privacy" as being unequivocally true.

> So if Google can still track me at the same level, but others can no longer track me, that IS an improvement in privacy.

This is only true if Google does not sell the gathered information to others. If they sell the data, the net privacy gain is nil.

Google doesn't sell your personal information to anyone. They sell ads that are targeted based on your personal information. Selling your information directly would entirely negate their market advantage in advertising, it would be suicide for Google. Facebook has been known to do this, Google has not.

Not saying you are one such person, or that you are doing so intentionally, but this argument is a clever sleight of hand employed by surveillance capitalists and their apologists to deflect attention away from the real issue: that thousands of well-paid, highly intelligent engineers devote 40+ hours a week to coming up with ways to influence your behavior.

“Selling personal data” — as if your particular affinity for left handed baseball gloves were of special interest to large corporations — is a red herring. Let’s stop perpetuating it.

But there are companies that sell personal data. Google is not one of them. The phone companies sell your location. There are regular articles about companies buying up chrome extensions to harvest/sell browsing data. Etc

OP also says > but Google will remain committed to tracking everything about you that it possibly can. Except silently, and without your ability to opt out using ad blockers etc.

Also others may no longer track you at the moment but they definitely will do in the future.

So... Google breached a bit deeper in our privacy and paved the way for others to follow them. I can't help seeing them so evil.

Google will track you more since adblockers will do nothing against this new practice.

So, again, this is not an improvement for users privacy.

This does not address my point at all, which is that if it locks out OTHER parties that currently abuse third party cookies from tracking, there's a substantial improvement for user privacy from those parties.

Not to mention that while adblockers currently do not do anything against this practice, this does not mean that adblockers can never come up with anything to block this tracking.

You are reading way too much into that incident.

At the time, "Engineer put in feature not asked for."

Later, "Upon full examination, engineer put description of feature in piece of paper shoved in front of busy manager, and told selected co-workers what he had done." (None of whom, when the shit hit the fan, should be expected to stick their necks out.)

Neither version suggests that the feature was something reflective of corporate policy, or would have had support from higher ups if they knew about it. Also, said engineer turns out to be a very good programmer. Which explains the company's decision to try to keep him and correct his behavior rather than immediately firing him.

That Google’s management is so unaware of their data collection software that they allowed engineers to drive around spying on people for three years does not inspire trust. Incompetence or malice is besides the point. Google did not take responsibility for the error, and in fact stonewalled Congress for more than a year when it was investigated.

What do you expect them to do? Randomly sample the internal data formats? Or verify that the official outputs look right?

Google specializes in automation at scale, not lovingly handcrafted data.

I don't have any expectations for how they will address their transgressions. They don't have a right to my personal data, don't have a right to track me, don't have a right to sell my attention to modify my behavior. People who are the target of their data collection -- which includes users and innocent bystanders -- are victims, and we don't expect victims to come up with performance improvement plans for their abusers.

You want rules that run counter to every trend in technology. And believe that it can be done with government fiat.

I emphatically believe the opposite. Data collection, storage, and manipulation is ever becoming easier. The only actual choice is between a society where we're lied to about surveillance, or one where surveillance is generally available. https://www.amazon.com/Transparent-Society-Technology-Betwee... laid out the case for this over 20 years ago.

Here are the realistic choices.

On the one hand, we can create any set of rules we want on paper. We can get governments to officially support it. We can be frustrated as those same governments do it ineffectively. And then watch as the rules meant to curtail monopolies get caught by regulatory capture and are manipulated to support the very organizations that they are theoretically supposed to punish. (Seriously, do you expect any secret service to not take advantage of what is possible? Have you heard of Snowden?)

Or we can choose the path recommended in https://www.amazon.com/Transparent-Society-Technology-Betwee..., accept that surveillance is real. And put the tools in the hands of the masses. This is already happening. See https://asherkaye.medium.com/do-you-know-this-man-7836e54abc... for a story of how a random person in a random photo was tracked down by an internet stranger using reverse image search with facial recognition. And the tools are only getting better and harder to stop over time.

I personally hate both futures. But I hate the first one more. And I see people like you as unwitting pawns who are creating the first of those two futures. And your unwillingness to understand how things actually work, combined with your certainty that you've got the moral high ground, makes you an easily manipulated true believer.

Enjoy your certainty that you're in the right here. I guarantee that you'll have a lot to be upset about in the way that our world is shaping up.

Thanks for the recommendation on The Transparent Society. I haven't read it, but certainly will.

The idea that the surveillance tools are "put in the hands of masses" neglects the part where the "masses" includes corporations that do it better, because they have the ability to pay handsomely thousands of people to make it effective. So rather than accept the defeatist position -- "We are powerless to stop technology," even though surveillance capitalism is a choice, and one that we don't have to accept -- we can choose meaningful laws which restrict those actions. We can choose meaningful laws which change the economic imperatives so that corporations don't profit from tracking and shaping human behavior. Will it be perfect? Absolutely not. Is defeat inevitable? Perhaps. But sitting on the sidelines and choosing not to shape that future because of some sense of foregone inevitability.... that cannot be the future, unless we believe that those now with the ability to shape it (and someone will -- Google, Facebook, or someone else) deserve to have that right without being challenged.

I cannot accept that. I will not be gaslit into believing that I'm 'too concerned' or 'reading too much into it'. This does not have to be our future.

> ...without advertising revenue dropping off a cliff.

Ah, the 'ole "right to my business model" attitude. Not blaming you in particular for this, but it's pervasive. Needless to say, I thoroughly and utterly disagree than any business has a right to any business model, particularly one that robs me of my time, attention, and computational resources.

If you read into the federated technology they've been deploying I'm fairly comfortable saying I agree with their decisions.

Let's take a look at the "Now Playing" architecture available on Pixel devices.

At first glance by a critic you think "You're crazy for giving Google permission to have your microphone always on and listening for songs you're hearing, privacy this privacy that".

If you read into it, you'll be comforted to know they've built a model to generate signatures clientside which are able to be compared on-device to a list of signatures which are similar to it. Then as far as I understand, they are able to take signatures which contain no discernable audio data and use those to discover new audio trends.

> On Pixel 4 and later phones, the counts of songs recognized are aggregated using a privacy-preserving technology called federated analytics. This will be used to improve Now Playing's song database so it will recognize what’s playing more often. Google can never see what songs you listen to, just the most popular songs in different regions.

Privacy-preserving, user-beneficial, and useful for advertising targeting if you haven't opted out of interest based ads.

As far as "now playing",what they say the software does may be quite clever in privacy preserving ways.

But once you have given them access to your microphone, you have to trust that their software does what they say it does, without mistakes or bugs (whether in design or implementation) or accidental security vulnerabilities (possibly maliciously introduced by the NSA or who knows).

If you do not give them access to your microphone (assuming the OS access controls are themselves working; but that's a much smaller attack area), you do not need to understand trust anything.

And this is from a company that forgot to tell people that the flashy smart thermostat they bought last year has had a mic in it the whole time.

They are a company that will only pay attention to privacy when forced to by an existential threat. It just isn't in their company DNA to care about user privacy. They aren't the customers.

What do you mean a microphone in a thermostat? You mean nest?

I know Ecobee Thermostat has a mic built in... but not Nest Thermostat.

So, OP is likely mistaken in their comment.

> that the flashy smart thermostat they bought last year has had a mic in it the whole time.

Note to readers: This is false.

EDIT: If you're downvoting, please provide evidence. There is a lot of misinformation out there, and OPs post increases it.

EDIT #2: Here is Rishi Chandra, GM of Nest: "Putting a microphone on a thermostat, I actually don't think makes any sense"

https://www.cnet.com/news/google-calls-nests-hidden-micropho...

It was in their security hub which is perhaps better or worse than the thermostat depending on your view.

My understanding is that security hub announced glass break detection from day 1. And that feature uses a microphone to listen to glass breaks... so I wasn't surprised. But, I guess that's not obvious to everyone, so they could've put it on the box.

And, I just didn't HN readers to think there was a mic on the thermostat, so I was correcting that.

Having a microphone to detect broken glass is very much not obvious. As someone completely unfamiliar with the problem space, I would have assumed the normal solsolution was something along the lines of: run a current throught the glass and check the voltage "drop".

I could see this if you connected the device to the system that monitored this. But since you never do that in the install process, I am not sure why you'd assume that's how the system would work.

you have to trust

Remember when Google sent hundreds if not thousands of cars all around the world and 'accidentally' hoovered up massive amounts of information?

I'm sure it was all an innocent mistake. Google are certainly worthy of our trust! /s

https://www.theguardian.com/technology/2010/may/15/google-ad...

> If you read into the federated technology they've been deploying I'm fairly comfortable saying I agree with their decisions.

I don't, not in this case. The only thing that FLoC seems to change is how data is aggregated and how buckets are determined. But fundamentally, the idea of taking users, putting them into a box based on their normal browsing habits behind the scenes, and then broadcasting that box and associated data to every website they visit -- that's just not a private model.

What Google doesn't seem to understand (or chooses not to understand) is that the end result of bucketing users and sharing data about them behind the scenes while they browse is the part that many people object to. So Google keeps on trying to come up with systems that allow them to serve different content to people and to collect demographic info based on variables and processes outside of users' control -- but to somehow do it in a way that is magically not a problem.

But it's like trying to create a 'nice' mugging. It's not just the methods I'm opposed to, it's also the end goal.

FLoC still doesn't give users control over how they present themselves on the web. And part of privacy -- part of the reason I care about privacy in the first place -- is because people should have control over how they present themselves on the web. There are tools Google could build if they wanted to go in that direction, but FLoC remains an opaque system that runs in the background that collects data about you and sends it to every website that you visit. That's not a private system, regardless of how the data is collected. It's not designed to be transparent, it's not designed around user consent.

Honestly, it shouldn't even be an opt-in/opt-out system. Why can't I choose what buckets I belong to? Google isn't thinking deeply about user choice, they're not even being remotely imaginative about how they could give users more power over what ads are shown to them. They're still stuck in a mindset of "this needs to happen behind the scenes outside of your control where you don't know what we think about you. And we'll let you opt out of the entire system purely because we're forced to. But nothing else!"

This is actually a really good point. A lot of privacy-related things people complain about are actually related to how you present yourself, how your identity is seen by the computer system you’re interacting with.

That’s been on my mind a lot lately, so much that I wrote a thing about it: https://kronopath.net/blog/segmented-identity-as-necessary-f...

This is a great point. What is "found"? Like the point is "I don't want 3rd party websites to be AT ALL AWARE that I visited another site". How can you find an alternative? I don't want an alternative, I want it gone.

If google does this, and other browsers don't, it would mean that just using another browser like Firefox will effectively hide you. Hoping for that.

Company: Supports measures that lead to additional privacy because they realize how important it is to their users

HN: Don't be tricked, Google is evil.

Like I understand WHY there's a hate boner for Google. I just don't understand why people think it's bad for them to acknowledge the preferences of their users and make decisions accordingly.

Because the preferences of their users would be to stop tracking their users. You don't need a replacement, you just need to get rid of it.

There's a significant amount of gaslighting to claiming that you value user privacy whilst developing new ways to track users.

Are you sure? I think there's lots of consumers that find the tradeoff okay - in fact I hear people state as much all the time. Maybe they don't know the extent of the tracking, or they don't care, but the opinion exists and it's not negligible.

If companies could anonymously track users, and still maintain the marketing backbone of the internet I think most people would be fine with it -- in fact, prefer it.

Would they prefer it enough to opt into that tracking and targeting?

If users had to go to a setting to turn on targeted ads, what percentage of them do you think would do it? I suspect it would be pretty low. I wonder if most people would even notice that the setting had been turned off?

We use the opt out model all the time to justify why users don't actually care about tracking -- we say that they'd opt out if they did care. But I feel like we all mostly know that an opt in system would also not see much use (that's the reason why ad networks are so opposed to them), and I don't know why we don't consider that to be evidence that consumers probably don't value targeted ads very much at all.

> Would they prefer it enough to opt into that tracking and targeting?

I believe a a sizable portion would. They like the targeted offers and ads. Maybe because they enjoy the feel of something being catered to them, maybe because they are addicted to shopping/consumerists. IDK.

> If users had to go to a setting to turn on targeted ads, what percentage of them do you think would do it? I suspect it would be pretty low. I wonder if most people would even notice that the setting had been turned off?

I think this is a really good question. The power of opt-in vs. opt-out, as you noted.

However, I don't know if we can conclude whether they value it or not solely from their willingness to opt-in. We really have to account for how the ability to opt-in is exposed. If we showed it on every size (akin to the cookie accept craze of today), we'd see a lot of people opt-in. If it were hidden in a chrome settings, far less just because that's mentally off limits for many, and easily forgettable.

I totally agree with you on somewhat sinister motivation of opt-out over opt-out patterns.

> I think there's lots of consumers that find the tradeoff okay

How often do consumers even get asked? My webmail provider seems to have no issues providing both paid and ad supported. Other services just pulled the paid plan from under my feet. Whats App with its new terms and conditions once had a small yearly fee, Facebook dropped it. User choice? certainly not mine.

> If companies could anonymously track users

That is like trying to identify a suspect using a smiley face. If they track you it isn't anonymous.

> and still maintain the marketing backbone of the internet I think most people would be fine with it

Why do we need targeted ads? Websites usually have topics they are focused on, is it wrong to show car ads on a page for car enthusiasts? On a news story showing a newly released car?

> How often do consumers even get asked?

Purely anecdotal that I am drawing from -- I've had this discussion with quite a few non-tech folks over the last few years privacy/tracking has hit the zeitgeist.

Many dismissively state something like, "I know. Don't care. Means stuffs free right?", or "I'm not doing anything wrong, I don't care".

> That is like trying to identify a suspect using a smiley face. If they track you it isn't anonymous

By that I mean regulations around what they track, identifiable data, not being able to explicitly say User2021 === Josefx on the system. I think this is why Google is going with the 'cohorts' in their FloC approach.

> Why do we need targeted ads?

Good question. "Need", probably not. But if I am on facebook, and ads are going to happen, do I want highest bidder ads like "Find Hot Milks in your Area Now" interspersed between my feed's family baby photos or an add for "World's best Uncle" T-Shirts? There's a happy medium somewhere.

> Are you sure?

If users are given the option in clear terms, most users will turn off tracking. Facebook knows this, it's why they are so pissed off at Apple and have taken such an aggressive public stance against Apple. Google knows it, it's why they haven't published an update to any of the iPhone apps since Apple started requiring their apps report what end user data they collect.

Google and Facebook are sure... not sure anyone else is more qualified on this.

> If companies could anonymously track users, and still maintain the marketing backbone of the internet I think most people would be fine with it -- in fact, prefer it.

If this were true, why doesn't Google, Facebook, and others give us straight-forward ways to opt out? If people would prefer it, why exactly is Facebook trying so damned hard to prevent Apple from giving people a simple opt out?

> If this were true, why doesn't Google, Facebook, and others give us straight-forward ways to opt out?

I don't think anyone expected them to just flip the switch and do that without a reasonable (maybe to just them?) alternative I can say, the idea of using 'cohorts' as discussed by this FLOC approach, from what I can tell, is positive progress. Is it far enough? Perhaps not.

> why exactly is Facebook trying so damned hard to prevent Apple from giving people a simple opt out?

Good question. I am not aware of that issue.

I also Question Apple as they take payment from Google to the tune of billions of dollars for search, pushing 'beacons' etc, while promoting themselves a bastion of privacy and security. None of it is as simple as it seems.

> I don't think anyone expected them to just flip the switch and do that without a reasonable (maybe to just them?)

No more than anyone expects a heroin addict to stop cold turkey. The problem is Google isn't stopping or giving people the option to opt out, they are just changing tactics slightly.

This also doesn't really talk about how this data gets integrated into the rest of the profile Google has built and will continue to build on users (without their permission) based on their search history, mapping, email, etc.

Google isn't

> "Google isn't"

Did you accidently clip the rest of your message?

I think I started a paragraph then started it again and forgot to crop the dead end.

Don't you need at least some tracking to avoid fraudulent clicks?

I'm as pro-privacy as they come, but until someone comes with the incentive or dedication to build an alternate payment ecosystem out of nowhere, ads are what the web is built on.

I may begin to trust Google when they provide a single switch to disable ALL tracking on android phone (or better disable all of them by default). That's what my preference is and it isn't respected.

> I just don't understand why people think it's bad for them to acknowledge the preferences of their users and make decisions accordingly.

Aside from that. Why on earth should we trust Google will limit their collection to this one method? They've lied over and over about what they collect. Been caught multiple times breaking laws to collect information only to say "Oops, it was a rough engineer". They've been caught bypassing the no-tracking flag in browsers. They've been caught abusing location data after users disabled it.

As the saying goes: Burn me once, shame on you. Burn me 750 times, why in the fuck am I still using Google?

Agreed. When I saw this title and read the article, the first thing I thought was "Ok, how to I block this/opt-out". It sounds like this is only in Chrome though, for now. One hopes that FF will continue to be privacy focused and not add anything like this.

You said "they are desperate to find something".

They said they "found" something. I see similarities.

Reply on news.ycombinator.com