Hacker News Reader

Comment by GavinMcG | Hacker News Reader

This assertion without an argument is not especially helpful. What legal distinction must hold the line here, in your view? Why is it insufficient to suggest that a user in a Google Chrome Incognito window might reasonably expect Google to be on notice that they do not consent to Google tracking?

Edit: the parent has since been edited. It had said only "Not in court, no. In court that is a huge difference."

View on HN

Because "incognito mode" is not about tracking! It is about saving information on your local machine. If you are in incognito mode and log into Gmail, you will see your own email! You are not incognito to Gmail. It used to be called "porn mode". I think that's a better name for incognito. It is there to stop others who use your computer to spy on you. Ofcourse you can use incognito (assuming you don't log into anything) and be reasonably anonymous (there are many other things that can track you even in incognito). I think it just need a rebranding. I vote "porn mode".

“Porn mode” is bad name for the thing because for the typical porn use case the user actually wants the persistent persistent browser state (eg. so that pornhub’s “Recommended for you” shows relevant content) and only wants it to be disconnected from their non-porn online activity.

You can still log into the porn website and watch your recommended videos. But after you close that window, no history of that ever happening is stored on your local machine. No urls, history, or cookies.

I suspect "no-history-mode" would be an easier sell. It would certainly explain a little better what's going on, but clearly lots of folks wouldn't still understand that the 'history' is only on their end. "I wanted no history of what I was doing anywhere!" Use Firefox+uBlock, or Tor, or...

My problem here is google's attempt to correlate incognito users to their non-incognito history.

The intent of the user is clear.

>My problem here is google's attempt to correlate incognito users to their non-incognito history.

To a web server incognito mode isn't a thing. It's a client only thing. You don't know if a user is using incognito mode, or if they just cleared their cookies / cache. There's no way to know the user's intent.

And this is by design (even though it's actually detectable -- try watching Netflix or Amazon, or any similar DRMed content, in incognito mode), because telling the server "hey, I'm in incognito mode" is antithetical to the goal of seeming to blend in.

But I still see a problem with Google's control of both sides of the connection, and with fingerprinting in general.

In your view should Google not allow people to log in to Gmail while in incognito mode? How can someone remain untracked by Google while in incognito mode but also interact with personalized Google services, like email?

By logging into one's account. Surely you see the distinction between deliberately availing oneself of a service and bring tracked on entirely separate websites without being informed, much less consenting.

You're making an argument against tracking in general. That's fine, but it's not what we're discussing. What we're discussing is if sites should treat traffic from browsers in incognito mode differently than traffic from browsers not in incognito mode. Do you think they should? I would argue that sites shouldn't even know whether or not their users are in incognito mode.

> Because "incognito mode" is not about tracking! It is about saving information on your local machine.

Expecting laypeople to understand that distinction is probably a bit optimistic.

Porn mode is also about companies and governments finding out information that they can use to blackmail you.

The legal argument is not about Google's tracking in the abstract, but about whether is is misleading users in how they describe Incognito mode. As of today, the Incognito mode screen says loudly that that Chrome won't record your activity, not that Google won't record your activity, so I think it's a hard argument that users were deliberately misled.

It is placing the onus on a layperson to understand the technicalities of how third-party advertising trackers work.

What is interesting is that they do explain this more clearly in some of their help articles -- but the leave out some of those details in description embedded in chrome. It takes 4 clicks to get to this from the "learn more" link -- it's pretty buried.

> Your activity, like your location, might still be visible to: * Websites you visit, including the ads and resources used on those sites * Search engines

https://support.google.com/chrome/answer/7440301

Yet, the first click from "learn more" has even more confusing language:

https://support.google.com/chrome/answer/9845881

> Chrome doesn’t tell websites, including Google, when you're browsing privately in Incognito mode.

It seems that you really have to dig to get to the parts that tell you clearly that Google is one of the "websites that track you" that they're talking about.

> It is placing the onus on a layperson to understand the technicalities of how third-party advertising trackers work.

No they aren't. It's spelled out entirely when you just open incognito mode. It specifically says "Chrome won't save the following information" and also specifically says "Your activity might still be visible to websites you visit"

You don't have to dig into any help articles or have deep technical knowledge of how Google Analytics works. Open up incognito and it's all right there right in front of you.

A layperson would understand the phase "website you visit" to be the name at the top of the page. Google leaves out the fact that the vast majority of those websites you visit also include their trackers... and they do not even suggest this as a possibility unless you dig into their help articles. The initial page doesn't mention that the list of those who can track you is incomplete and is conveniently missing themselves.

A layperson also understands that when a company says "this product does X" they don't mean "everything we make does X."

Sometimes. [0] There are ways that statements can be made 100% textually correct, but semantically misleading. Other companies have done this before to mislead people, with varying degrees of legal success.[1] What a court would be interested is not whether Google is technically correct, but whether they misled people. They are in a unique position in this case to monetarily profit from misleading people, which may be something that would look bad in court.

0: For example: ask anyone who works at a helpdesk what it means when someone says "my Google doesn't work"

1: For example: Regulatory action against AT&T for "unlimited data" claims

> It is placing the onus on a layperson to understand the technicalities of how third-party advertising trackers work.

Let's remove computers from laypersons because they can't understand simple English. /s

Seems to me that the end result of such a lawsuit, if it moves forward, is that Chrome will drop the feature. It's not like it has any legal requirement to provide a feature like Incognito and if the courts decide that it can be easily misunderstood (and if it costs Google actual money because of that decision) then why spend engineering time providing such a feature.

I think it's obvious that they were mislead. If you allow this form of defence, then I can, on one hand, sell you a privacy product, and on the other, have my subsidiary, which knows exactly how to get around it, spy on you and sell your data. Both entities are controlled by the same holding company, their 'separateness' is legal fiction.

Its basically like insider trading. You are playing both sides.

But suppose I were to take your argument - are the entities actually separate? Is Chrome development not funded by revenue from google ads? They would not pass any kind of test for 'independance'

Reply on news.ycombinator.com