Google CEO allegedly sought to keep Incognito mode issues out of spotlight
reuters.com
reuters.com
The entire lawsuit revolves around the idea that incognito ("private") browsing somehow implies that users aren't tracked at all, despite a clear, front-and-center warning that they still might be whenever you use it, purely based on the name alone.
Someone saw that law makers were going after big tech and wanted in on the action. This lawsuit servers nothing but the lawyers. If Google loses this, ANY name that COULD be ambiguous could become grounds for a lawsuit for billions despite all warnings you might add to software.
The focus seems to be the idea that Google knew about misconceptions and did not adequately address them, even with the prominent disclaimer. It seems like an arbitrary focus because there are so many other ways users misunderstand computers. I would think that EULAs would be a better target. Legislation requiring simpler summaries along the lines of Creative Commons licences would go a long way toward better informed users.
One single business (Google) promised the users anonymity on the client-side ... that same single business (Google) then broke that promise when their server-side tech worked around it.
They LIED and should be punished.
--------------------------------------------
edit: I see people don't seem to have a counter argument and are just down-voting an uncomfortable truth ;-)
The only incognito mode I've seen comes with an explicit DISCLAIMER that you WILL probably be tracked by the websites you visit, the ISP you use etc.
The terms for using Chrome are pretty clear, as are youtube / gmail etc.
Your activity might still be visible to: * Websites you visit * Your employer or school * Your internet service provider
"might" makes sense because some or none of those may apply, depending on how you're using the browser.
If you aren’t technical and understand difference between client and server, you may not know that while using one Google product, that claims to be incognito, other Google products are still tracking you. That’s how internet is designed to work, but when one company controls clients and servers, it can get confusing to a general public.
The same argument could apply to firearms (shouldn't harm the holder, so the same firearm model shouldn't hurt other holders of the same firearm model?) and a lot of things.
Google's fundamental business model involves tracking people, so if you use one of their features that supposedly turns off tracking, it would be natural to assume that Google would stop all tracking.
The internet was not designed to track us. Unfortunately, we've allowed it to happen.
That doesn't mean they can't track you when you steal something. You are not unidentifiable.
I go out of my way not to use suggestive names like incognito because for the non-technical, it creates an expectation that will be relied upon by those that do not have the background understand what they are reading. "History-less", "local self-clean", "non-caching"... All of these names are accurate and far less suggestive than incognito. Incognito, like it or not, evokes the expectation that the browser is doing something to frustrate monitoring by other parties.
Here be the wrath of the non-technical masses, and why the "luser" attitude is the most destructive, anti-social, and regressive attitude in tech.
Our goal should be simplification of computing. Not the unceasing obfuscation and complexifying of it in some misguided attempt to create job security. I sincerely hope Google loses. Hard. It's about damn time that the tech industry be held to a higher standard.
Google needed a name that fits on a button, translates easily and is recognisable. That's why we're using "browsers" instead of "HTML5 user agents", why we use "windows" instead of "top level control elements" and "sleep mode" instead of "ACPI power state S3". Using technically correct terms for the general public is exactly why people prefer dumbed down smartphones over complex traditional software.
Since its inception, private mode has shown a screen that describes what it does or doesn't do whenever you open it. Had Google omitted that, and directed private mode directly to the user's home page, then perhaps I'd agree with you. In this case, I believe Google did the best they could to balance a technically correct explanation with something that's understandable by normal people and children.
You can't blame everything on "the user shouldn't have to know better". An automatic gearbox won't put itself into reverse when you want it, but it's still called automatic. A juicer won't turn a spoon into metal juice. A vacuum cleaner won't work in a vacuum. All of this is perfectly logical if you're used to the context things are used in, but that context obviously doesn't need to be part of most products' naming.
Misunderstanding naming and terminology is a sign that things need better explanations, but not the basis for a lawsuit in my opinion.
And it does this: cookies are not shared or stored past the session, etc.
The issue is that some tracking can still be accomplished by websites, even while other tracking is stymied.
What do you call this?
IIRC, this was not considered a bug.
If I go to a party incognito, I don't expect to leave no physical trace of my presence.
It's more like going to a party hosted by someone who makes a living by tracking you, where you were told that you are going to be incognito. But secretly, behind the scenes, you're still being tracked by the host of the party using a different technique.
I always understood it to be about avoiding leaving details of your browsing on a shared computer.
How does google block your ISP / website from doing their usual stuff (ie, google analytics etc).
It says some websites "might" track you. It doesn't let you know that Google itself is going to track you.
When google sticks their BIG warning on incongnito EVERY time you launch it I thought that was silly. I guess not.
One problem is that Google's Incognito Mode says this:
> You’ve gone Incognito ... Your activity might still be visible to: Websites you visit, Your employer or school, Your internet service provider
It isn't some ambiguous "websites" that are tracking you in Incognito Mode, Google is tracking you on those websites (Google Analytics, etc.) and providing some of that data to the website owners. Users don't understand how the Internet works, and it's misleading for Google to imply that it's only someone else that is doing the tracking.
from Google’s English dictionary:
adjective adjective: incognito
(of a person) having one's true identity concealed.
in a way that conceals one's true identity.
an assumed or false identity.I had been logging into accounts in an Incognito window, then opening a new Incognito window to visit other sites assuming they were new private sessions. One day I was surprised to find myself already logged in to someplace I visited, in a new Incognito window.
At that point, I discovered that much of my Incognito activity across the web for the previous few months was in fact tracked to my identifiable, logged in accounts. And that my multiple accounts (for work, other work, personal) were potentially being linked together, which I did not want.
For months I hadn't noticed because I tended not to open the same sites more than once. So I hadn't realised that cookie sharing was happening, which means cross-site tracking was happening.
Now I don't use Incognito windows any more. There's no point, they aren't what I expected.
Now I use Firefox Containers to segregate account logins and reduce unwanted profiling (e.g. with YouTube), and Temporary Containers when I want a new, ephemeral session.
Firefox Temporary Containers actually do what I'd mistakenly thought Incognito mode was for.
Firefox containers is a neat idea but creates a new session per container and wastes memory and open connections
do you work for google?
It was a surprise to open an new Incognito window and find it had access to sessions active in a different window.
That defeats one of the expected use-cases of Incognito mode locally, which is when someone asks if they can borrow your computer to access their account. For example I've done this a few times in a library or hackerspace for someone I didn't know well. You open an Incognito window for them, and both you and they think it's safe for them to access their Facebook and Gmail or whatever, and then close the window. They think you can't browse their accounts after, and you think they can't browse your accounts if they stick to that window. Both turn out to be unexpectedly false - unless you know to kill all your existing Incognito windows first. Which you wouldn't do if you need to use them later, unless you know you have to close all the other windows first.
As for local vs remote tracking. Incognito documentation does not say local eavesdropping is the only feature. It talks about holding a separate session for "cookies and site data" and that those are deleted when the session is closed; and about restrictions on third-party cookies. From Chrome help:
> "Cookies and site data are remembered while you're browsing, but deleted when you exit Incognito mode. You can choose to block third-party cookies when you open a new incognito window."
Like anyone technically aware of how the web works, I don't expect this feature to prevent tracking in general, or to truly hide my identity. But I do expect a cookie session container, which Incognito mode does advertise, to allow me to login to separate accounts without ending up logged into an account unexpectedly.
The issue is not that tracking takes place. It's that the scope and duration of a session was surprising in a way I didn't expect from the UX, and it's not the most useful in situations such as the "make a window for a guest" situation described above. Getting this wrong also adds a security risk to those of us tasked with protecting other people's data via browser tools. I posted about it here because I think the behaviour will be a surprise to other people too; it should at least be more well known.
I would expect the opposite behavior as you describe.
[1] https://support.google.com/chrome/a/answer/3504943?hl=en
To be honest, it’s sometimes a bit of a pain (e.g. when you are using incognito to just have a different identity, like to be on a corporate/personal account.) I wish a browser offered the idea of opening windows/tabs with selectable incognito identities.
That's exactly what the Firefox Containers feature is.
It's not that easy to use, and extensions that improve the UX or automate container selection are kind of messy. But it does work. It's excellent for when you need to use multiple accounts on a service.
The description of Incognito Mode was always very clear that the client wasn't tracking you, but servers could still track you. The fact that Google has another product, Google Analytics, that they offer any website developer that want to put it on their site, does not mean their original description of Incognito Mode was inaccurate.
Especially as a technologist, it irks me when I see journalists deliberately obfuscating what actually goes on with Incognito Mode.
It's one thing if somebody raised internal concerns about possible misconceptions and it was ultimately decided that it wasn't likely.
It's another issue when those concerns are important enough to reach the CEO of Google-sized company, and that CEO then decides not to do anything lest they attract any attention. This is particularly true when dealing with something like a privacy mode.
Wasnt what they wrote though.
That's why I think this lawsuit is such bullshit, in that many of the "recommendations" in these comments are saying Google server technologies should specifically get called out (or worse, notified when a user is using Incognito Mode, which actually would be a gross privacy violation), when the whole point is that Chrome's Incognito Mode isn't any different that Safari or Firefox's Private Browsing, so why should Chrome call out something about Google's specific server-side analytics?
No, that's the whole point, Google on the server-side (or any other server-side components) shouldn't be able to know you're in Incognito. Chrome already goes to great lengths to try to hide the fact you're in Incognito to servers, because many servers try to block content if they could detect you're in Incognito.
So the only other option would be to only let Google server-side services know you're Incognito, and that actually would be a gross violation of privacy.
Your activity might still be visible to:
Websites you visit
Your employer or school
Your internet service provider
It's not a lie. Chrome doesn't know which ISPs and web servers retain logs or not, so it says might.
I don’t even know what the Incognito Mode opponents even wanted. Built-in free VPN service? Total removal of Incognito Mode?
Google didn’t have any nefarious intent or actions in this. I don’t see why it would be wrong for them to downplay exaggerated allegations.
Agreed. I think this is a case of individual users deriving their own set of functional requirements and assumptions on what it means to be in "Incognito mode", which many people will have a differing opinion on, rather than a specific issue with the functionality provided by the browser.
If it can't be called Incognito mode, I am not sure what other positioning or branding can be applied. There is merit for the current feature set, and gating those features until a significantly high bar is met seems unreasonable.
> Chrome won’t save the following information:
> Your browsing history
> Cookies and site data
> Information entered in forms
> Your activity might still be visible to:
> Websites you visit
> Your employer or school
> Your internet service provider
The idea that Chrome won’t track your browsing but Google might is more than a little incongruous/confusing for the average user IMO.
It'll track your searches on google.com, but not browsing history. Browser history is a function of signing into the browser, and you can't sign in an incognito window.
The discontinuity is that when you go in Google Browsers private browsing mode Google will still track you by the websites you visit, across the web due to their tracking token, and they are one of the only companies on the web that can actually do that tracking.
there might be a few people who are confused, but i don't think you can make the argument that google has intentionally misled anybody here. the fact that some people might be confused is not really google's fault. a lot of people are confused about a lot of things every day, nobody needs to be liable for that other than the confused people.
IMO there is a difference between “the websites you visit might track you” and “the websites you visit might have a google tracker on which will mean we will still track your activity and the sites you visit with that token and link them against your identity”. The first might be technically true, but I think a lot of users would be surprised by the second more nuanced version.
As, sadly, are many other things. It seems to be the zeitgeist of modern marketing.
Telling them that a country road is far more complex than the open sky, and that air traffic is quite sparse, helps little.
How about "keep your spouse from finding out you look at porn" mode? Because that's what it's for.
I wonder if some differences in perspectives are the result of when you first became familiar with the feature.
Why not keep it for Google services, if you want, but use Brave / Firefox / anything else for all other activities?
Edit: Here's some empirical evidence: https://www.cnbc.com/2018/07/12/private-web-browsing-not-as-...
Given the existing functionality of incognito mode, what would you call its set of features that it provides? Is it a naming / branding issue?
I believe it should be possible to provide these set of features (or browser operating mode) without going to the extent of not being tracked by Google (the company and its services), even though the ability to do the latter seamlessly would be beneficial.
* Chrome sends a signal to google.com around not tracking in incognito mode (Chrome already does all sorts of magic on Google sites, this would be a small addition)
* Incognito mode has a clear warning that Google specifically will keep tracking you
* Chrome loses all Google branding
1. So you're saying only Google is the publisher that specifically gets notified when you use incognito mode. That actually would be a real, concerning privacy violation in my opinion.
2. But the whole point is that it is not just Google who "specifically keeps tracking you". It's any server software out there that keeps logs. The warning Incognito Mode has now is much more correct and accurate that some sort of "Google specific" one would be.
3. That's just dumb. It's a Google product, why shouldn't it have Google branding.
* unlimited: not actually unlimited
* Full self driving: not actually fully self driving
* incognito: not even trying to be incognito
As long as you have a paragraph explaining it you could bottle piss and sell it as fresh spring water.
Incognito prevents the browser from remembering the things you do locally to the browser itself. The browser, any browser, cannot control what the server does. The browser cannot block whatever javascript you have allowed it to run. All it can do is block javascript. You log into a server while in Incognito doesn't mean the server won't know you logged in (wtf?).
Icognito basically means your SO won't see your browser history, and that's about it.
But it is still reasonable to make that assumption.
Chrome benefits from its association with Google. This means that Google should also deal with the consequences of that association.
Google should stop tracking users when they’re in incognito mode.
The idea you can be in Google Browsers private browsing mode that says Google Browser won’t track you but in reality Google will still track you in that mode given the chance is a huge piece of slight of hand for the average users.
Google (the Chrome development team) should not track users when they're in incognito mode if they even do.
However, Google (the company and its services) should not care whether a user is using incognito mode or not; Otherwise you're asking for the implementation of additional functionality beyond what incognito mode is intended to provide (ala DNT, etc), and making it specific to only Google, and not other websites, would be a strange position.
And often times that wouldn't even be what you want. Often you go incognito to log into another account because it creates a fresh browser instance. Doing that would be impossible if it didn't enable any form of tracking, logging in requires them to track you. Making a sensible way where incognito somehow prevented all tracking while still being functional isn't possible.
In your model are you satisfied with Google still applying its tracking techniques to Microsoft Edge users in Microsoft's incognito mode?
I'm sick of megacorps reaping all the benefits of branding but none of the downsides.
What is absurd is seeking a remedy where Google is compelled to further couple their ecosystem so that now only Chrome users are exempt from server-side tracking, but Firefox Private Browsing or Edge InPrivate continue to be server-side tracked, because these plaintiffs suddenly understand how private browsing works when the browser doesn't say "Google Chrome" on it.
It's a cash grab. If they wanted a remedy where a user truly had control over their privacy and could turn off server-side tracking at the flick of a client-side switch, they'd lobby for privacy-positive legislation. They just see easy money here because they think they can confuse the courts into a muddled make-believe interpretation of how webservers and user agents work.
Its used to hide visits to sites from your machine from others who actually might look at your machine. This is all.
Incognito implies exactly that to the layman. Even with a warning about specifics. We had a sense that Google is acting in good conscious when incognito and it was the opposite, AND they have tried to hide it.
Google saved our incognito searches to our Google profiles. Period. They misrepresented a product they built and have earned these consequences.
It's not just Chrome incognito either. Google has acted shady time and time again with unfair business practices. Like YouTube, photos, mail, and drive account lockouts with no options to recover, because "we investigated our decision and we say we were correct. We're not going to tell you what you did wrong either, and you can't get your data back."
Google needs to pay for their misbehavior.
You’ve gone Incognito Now you can browse privately, and other people who use this device won’t see your activity. However, downloads, bookmarks and reading list items will be saved. Learn more
Chrome won’t save the following information:
Your browsing history
Cookies and site data
Information entered in forms
Your activity might still be visible to:
Websites you visit
Your employer or school
Your internet service provider
Block third-party cookies
When on, sites can't use cookies that track you across the web. Features on some sites may break.
If I do something "incognito" it doesn't make your camera not work if you take my picture. At the most it may it a little harder to identify me.
In recognition of the ongoing battle between celebrities and paparazzi, perhaps it should be called "floppy-hat" or "bad-wig" mode.