Comment by aasasd | Hacker News Reader

Comment by aasasd | Hacker News Reader

> Re: forced Chrome logins. Don't need cookies if you own the browser!

(https://twitter.com/fasterthanlime/status/145209451374118912...)

The swindle with FLOC was pretty obviously tied in this, but people still went in circles discussing whether it's private or not, and downvoting those who said FLOC is a trap.

Let's consult the plan, nothing is even secret about this:

- Google disables third-party cookies, crippling competitors to its Analytics, and thus their data for ads.

- Google throws them the FLOC bone to avoid being sued, dressing it up as a privacy measure. Meanwhile FLOC is controlled by Google's code in the browser.

- Google itself continues to vacuum up users' stats for all sites through the browser, never needing the cookies or FLOC.

So, if this is not a case of Google using its monopoly on web services (email and video) and the monopoly on the browser to prop up its monopoly on web ads, then I don't know what is.

The baffling part, really, is: with Goog already being ahead of the rest of the planet by having surveillance in The Browser, why don't they chill the hell out and stop right there. It's almost like someone inside decided to set up a multibillion-dollar morality performance and demonstrate what happens when a company is being too greedy.

Also, we probably need to remember that even if Goog is told off and has to dial its appetites back, it still sits on a database of surveillance data on people through the web, the browser, the services and Android. Which database, for example, is used by the US police for location->people requests, of which folks by definition only some are potential subjects of investigation (see e.g. https://www.nytimes.com/2019/04/13/technology/google-sensorv...).

Everyone reading this on Chrome should switch their browser today. Get off of Gmail while you're at it. There is no perfect alternative, but all those reasons why you think you can't switch don't add up to anything a fraction as bad as what Google is doing.

What's a good alternative to gmail? Fastmail? Protonmail? Other? I don't mind paying a small subscription.

I have been using Fastmail for many years. My wife also switched a couple of years ago. The web interface is fast, they have great IMAP support, contribute to open standards (JMAP). They can also be the DNS server for your domain.

When I contacted support a few years ago about a keyboard shortcut issue in their webmail, they were very friendly and rolled out a fixed to their beta version very quickly.

I use Fastmail and have been very happy with them. They have been trying to deal with a DDoS attack from around the time this story broke. I initially didn't think anything of the timing, but given that this story is _literally about potentially criminal conspiracy_ it tickles the part of my brain that wants to indulge in other conspiracy theories -- e.g. someone connected to Google thinking "quick, we'd better make it look like a bad idea to try moving off GMail".

Personally I liked disroot, not only does their email fits me well (most of the time), but so does their calendar. For some reason though, sometimes some emails take a bit longer to reach you, but that's quite rare.

I use hey.com

You have to get used to their system but now I prefer it compared to Gmail

I mean at this point hotmail, outlook or icloud would be preferable.

I have a paid protonmail account but haven't fully switched because the search feature is abysmal.

Their spam detection is true garbage. One year in I had zero actual spams blocked and hundreds of false positives.

Unsolicited mail from a direct mailer in India for an SEO webinar, straight to the inbox. Every message from your bank, straight to the spam folder.

Am I sure it didn't catch some spam and age it out before I saw it? Yes, because I had to go in every 2-3 weeks to pull my banking messages and other false positives out. A process which invariably went "Open Junk folder, Look for spam, Find none, Check All, Move to Inbox."

Here's the kicker, there's no option to even turn spam filtering off. It took me five cycles with the support team to get them to offer an inscrutable sieve filter that would disable filtering if I pasted it exactly right in an unvalidated free text field.

(The second-to-last agent told me there is a way to do it with sieve filters and then closed the ticket without saying how, so I had to open another ticket asking if they would kindly share the solution they coyly hinted at.)

So what you are saying is that they are very good at filtering spam, they just got inbox and junk folders mixed up? ;)

Gmail was behaving exactly like that for me for a couple of months. There was a huge HN thread of people with the same issue and that might have made someone at Google to fix finally the issue.

I recommend Posteo!

https://posteo.de/en

I'm very happy with gandi.net, $16.49 per year for a .com domain name and two email accounts (accessible via web, imap, etc), plus aliases. Been around for twenty years. They have a "no bullshit" promise.

I use Gmail but never use the web interface (or log in with it at all for the most part). I just use the built in mail clients for iOS/macOS but any app will do. They can still see your mail but can't do much with it as I use DDG for the most part and am logged into a different account for stuff like YouTube.

Not saying it’s a good alternative, but if you believe Apple’s marketing about privacy, they now allow you to use your own custom domain for family emails.

I've done my research just yesterday and decided upon mailbox.org. I fully switched over in less than 4 hours.

It's hosted in Germany (GDPR regulations and reasonable privacy), supports custom domains, provides cloud storage and office suite and supports full inbox encryption with your own public key - the service provider allegedly can't even read your email after they encrypt it.

To move your existing email from GMail, first remove large junk/spam/ads emails and then download everything with Thunderbird over IMAP, then slowly copy emails to mailbox.org folder.

It also provides cloud storage (which I intend to use in addition to Syncthing) and cloud office suite.

Migadu is very cheap and a great alternative. 20 dollars a year if you don't use email much

Seriously. Anyone who cares at all about privacy should never have touched Chrome in the first place. The reasons for its existence were obvious from the outset.

I have close to 15 years of emails stored in Gmail.

Is there an easy way to download that or move it to another provider?

Gmail still offers IMAP, right? Use your favorite mail client (if you don't have one, Thunderbird is FLOSS and pretty good) that has an archiving feature.

Yes, you can easily import it to Fastmail.

https://www.fastmail.help/hc/en-us/articles/360058753594-Imp...

They have a service called Takeout which will generate mbox file of your Gmail account. You can then import to Thunderbird or elsewhere to do as you like.

>I have close to 15 years of emails stored in Gmail.

>Is there an easy way to download that or move it to another provider?

You can set up pop3 access[0] to your gmail account, download your emails (with any of a variety of clients[1]) and have the client delete them from your google account.

I'm sure there are other ways to do so as well.

[0] https://support.google.com/mail/answer/7104828?hl=en

[1] https://www.getmailbird.com/pop3-email-account/#Top_Mail_Cli...

Woah, so if a user is logged into chrome, Google has permission / is able to track all web activity for that user?

Doesn't chrome have browsing history sync?

Uh uh! While I'm obviously no fan of Google and Chrome, afaik the synced data is encrypted, or at least Goog says so. I.e. it's used just for syncing.

Can't remember, though, if it's always encrypted, or just optionally encrypted.

Optionally encrypted, if you provide your own sync passphrase.

Frankly, I'm not sure about the current state of things, seeing as it likely has changed several times in the past few years. However, a) I'm not sure why Goog would want to bother with browser accounts otherwise, and b) my use of Chrome ceased soonish after I had the following experience in the early 2010s:

- set up a new empty site, listed absolutely nowhere, on quite dedicated hosting.

- open it in Chrome.

- a couple minutes later, observe Googlebot appearing in the visitor logs of the site.

Lastly, if you go to the ‘My activity’ settings on Google, you can see: “Include Chrome history and activity from sites, apps, and devices that use Google services”, which I guess can still be dissected further. And I have some website visits from 2016 listed there: including Wikipedia, which doesn't seem to use Google Analytics currently (not sure about 2016)—though these could be visits through Google search.

Also, text in the linked tweet directly says that Google tracks users on third-party sites through Chrome.

I expect bots on a new unadvertised site within minutes. I've seen it many times. Bots are always scanning, along with script kiddies.

Seems testable by setting up randomized subdomains hosting http and visiting with different browsers. Also, make sure you aren't using Google's DNS services to resolve or managing your domain's DNS through their registrar.

It is far more likely that Google found the new site from telemetry from Chrome than it is a random bot, owned by Google scanned the site within seconds.

Google also runs their own public DNS servers which afaik Chrome defaults to. They can just sit server side waiting for DNS lookups of domains they've never seen before and queue them up for the Google bot. No browser telemetry needed.

Why does chrome need to use DNS other than what I have set up through my IP stack? How does that work for inranet sites?

Because they see their solution as more secure. Intranet sites still work because Chrome only prefers their DNS first, it will still use your system settings if it doesn't work.

> Google also runs their own public DNS servers which afaik Chrome defaults to.

The statement that Chrome does not honour the networking stack's DNS settings does not agree with my observational data. I run pi-hole DNS and Chrome absolutely fails to load domains blacklisted there.

This is configurable, the default is to use the default network stack.

Settings > search for Use secure DNS for DNS-over-TLS.

This could also be via dns records if you published some they would get scanned

Also, doesnt chrome hijack DNS to point to googles DNS servers?

Unless you've enabled DoH, it shouldn't.

This whole thread is about Google doing things they shouldn't.

Yes, and claims still require evidence. I'm quite anti-Google but I'm not going to just start believing in random theorizing of evil things they could conceivably be doing without evidence.

Otoh, why even bother with Chrome, when you have Firefox, Brave and others to choose from? It's not like there is any substantial difference between them. At this point we don't need (extra) evidence of wrongdoing, the incentives mismatch is enough to not trust them.

Cert transparency logs will show new subdomains too.

Not for wildcard certs, fortunately.

Registered domain names are public information.

Yes, whois is public but not all TLDs publish a list all domains and those lists of are usually updated only once per day. On the other hand it is very possible that they used the TLS transparency logs from the CA.

> I'm not sure why Goog would want to bother with browser accounts otherwise

Cross-device sync of passwords, autofills, bookmarks, history, open tabs

There’s a setting (Web and App Activity) to let Google collect activity on Google properties to use for personalization features.

I’m pretty sure it does not track any activity on non-Google properties.

I'll believe with at best 70% confidence.

You’re more generous than me

Or they only let you turn off tracking for google products, because those track you internally anyway and it makes no difference, while there's no way to turn off 3rd party tracking...

Last time I checked, they also removed the "identity consistency between browser and cookie jar" flag that controlled automatically signing into Chrome if you signed into a Google service like YouTube. It is no longer possible to turn it off.

Yes, they also probably have also an AI collecting what makes your activity a unique profile even if you are not logged in. Thanks to google search, map, analytics, android, dns, amp, google fonts and the like, you almost always load something from a google server if you browse the web.

The feature is called "Google Signals." Here are documentation links to how it's use in Google Ads & Google Analytics.

Ads: https://support.google.com/ads/answer/2662856#zippy=,when-yo...

Analytics: https://support.google.com/analytics/answer/9445345?hl=en&re...

tl;dr If logged in to Chrome, your Google Account can be used as an "identity signal" in place of a first-party cookie. This allows cross-domain and cross-device tracking.

Yes, if you have this option enabled, “Automatically send usage statistics and crash reports to Google”

Probably because of a spreadsheet. If they made the right deals, etc. the numbers they report and the returns to the investors increase.

Any time you ask, "why?", the answer is money for the investors.

Well they dropped the "don't be evil" motto a while back.

This was actually an act of kindness. They removed the motto to let us know to abandon them. I believe it was a canary clause.

Of course most people don't care, so here we are.

That’s actually a myth. Check out the last line here: https://abc.xyz/investor/other/google-code-of-conduct/

>The baffling part.....

The baffling part is 99.9% of the internet inclusive but not limited to HN were sold as they "Do No Evil". Even after they drop it.

None of these is new. The strategic thinking of Google has been clear since Day 1. And now revealed in multiple email shown in court, both in terms of Chrome browser during Firefox era and Ads. ( And possibly Google Earth ? )

While it is nice to see sentiment finally changing after nearly 20 years. For some strange reason I just feel rather sad about it.

> The swindle with FLOC was pretty obviously tied in this, but people still went in circles discussing whether it's private or not, and downvoting those who said FLOC is a trap.

The brigading on HN in particular seems extremely obvious when it comes to Google related articles.

Personally, i don't think there's anything wrong with holding a monopoly as long as it stems from merit.

However, we are proven time after time that power corrupts. Unless there's a regulatory body to watch their every move it seems they'll abuse their dominance to maximize profits.

Even if a monopoly were achieved on merit (I don't necessarily agree that it was in this case), the incentive to maintain that merit disappears once the power is obtained. Even if that weren't true (i.e. if power didn't corrupt) they could simply degrade naturally while the bar for entry would remain too high due to economies of scale and other reasons. And don't forget the incentives against downsizing: layoffs hurt labor, reduced consumption hurts suppliers while withdrawal of products and services hurts customers and the brand simultaneously. People have made better arguments than I have but my point is even a moments thought should make you reconsider your position.

Reply on news.ycombinator.com