Hacker News Reader

Comment by hn_throwaway_99 | Hacker News Reader

I'm quite familiar with this whole lawsuit, and I still think it's total and complete bullshit (and, to be clear, I have huge concerns about Google's tracking and surveillance).

Incognito Mode basically puts you in a mode as if you had installed a fresh, new instance of the browser every time, e.g. none of your past cookies can be accessed by any websites. Websites, though, can still use analytics APIs, including things like Google Analytics, to track you within that Incognito Mode session. They may also be able to correlate you by, for example, matching your IP address. And, to be clear, the Incognito Mode new window has always made this clear.

I can still be really concerned about Google's overall tracking and also point out this lawsuit is a bullshit money grab from lawyers hoping for a lotto payout.

View on HN

I always felt this was obvious, what did people think incognito mode was? It literally says "Now you can browse privately, and other people who use this device won’t see your activity." when you open an incognito window. It doesn't claim to be a VPN or anything.

It's also literally called incognito mode. If they want to rename it to "temporary profile" or something, I for one would be a lot happier.

A lot more bland/boring too

So this lawsuit is just concern trolling? Nobody is actually upset about the feature itself, some people are just taking the worst faith interpretation that nobody irl actually has and pretending to be mad about it?

Worst case scenario, it moves the Overton Window on the "reasonable person" principle.

> So this lawsuit is just concern trolling? Nobody is actually upset about the feature itself, some people are just taking the worst faith interpretation that nobody irl actually has and pretending to be mad about it?

Websites mediate a significant part of how a significant chunk of the people in the world live a significant part of their lives. You and I know what incognito mode is and isn't, but can you seriously claim that, among a significant chunk of the population of the world, no reasonable person overestimates the privacy incognito mode offers?

> no reasonable person

The standard is would a reasonable person and the answer is absolutely not. Among non techies people assume that Incognito/Private Browsing provides less protection than is actually offered. You go into private browsing when you don’t what sites you visit to show up in your browser history, that’s it.

> > no reasonable person

> The standard is would a reasonable person and the answer is absolutely not. Among non techies people assume that Incognito/Private Browsing provides less protection than is actually offered. You go into private browsing when you don’t what sites you visit to show up in your browser history, that’s it.

You quote my referring to what a reasonable person would do, and then seem to be offering a rebuttal by saying that it's about what a reasonable person would do …? Anyway, I think we must just disagree on a reasonable person's expectations.

> You quote my referring to what a reasonable person would do, and then seem to be offering a rebuttal by saying that it's about what a reasonable person would do …?

Yes. What's confusing about that?

They didn't say it was wrong to talk about a reasonable person, or anything like that.

But you were applying the reasonable person test incorrectly. You don't make a pile of reasonable people, and then check if any of them are confused. You look at what a single median reasonable person would think, basically.

A reasonable person would think the word incognito was being used as it's defined in every dictionary. But it's not, hence the lawsuit.

A reasonable person without substantial technical knowledge could have mistaken beliefs about lots of Internet concepts, and I don’t think it’s reasonable to expect that a browser UI needs teach all of them. Should the cache settings have a big banner warning you to disable caching entirely or accept that a clever website operator can extract certain information about your browsing history?

Yes, the naming of “Incognito” or “Private” browsing could be improved, but the messaging in Chrome is pretty clear.

In addition to:

Now you can browse privately, and other people who use this device won’t see your activity. However, downloads, bookmarks and reading list items will be saved.

It also explains:

Your activity might still be visible to:

• Websites you visit

• Your employer or school

• Your internet service provider

The whole point is that list does not mention "* Google"

The argument would have to be that Google was using Chrome itself to track you in Incognito because they controlled the browser, otherwise they are just “websites you visit.”

Yes, that is in fact the subject of the lawsuit. From literally the first sentence of the article:

> alleges the Silicon Valley giant misled the public about how much data it collects from users even when they're in its Chrome browser's "Incognito" private browsing mode.

The accusation is that Google is leveraging Chrome to track you even in incognito mode, and it does not give any notice that it is doing so. It warns about the websites you visit, about who owns your local network, and about the ISP, it doesn't warn that Google is still actively tracking you in incognito.

Every source about this lawsuit has said that what is meant by this is Google tracking you on Google properties. Unless they outline how the tracking is done it’s pointless.

https://casetext.com/case/brown-v-google-llc

> through means that include Google Analytics, Google ‘fingerprinting’ techniques, concurrent Google applications and processes on a consumer's device, and Google's Ad Manager…

So not using Chrome. They’re arguing that Google is collecting the usual web tracking and that other Google apps a user might have collect user data.

Can you explain how Google tracks users in incognito mode outside of the websites they visit? If there's no client-side Chrome telemetry in incognito mode, why should Google be special-cased when all ad networks can do the same thing that Chrome caveats explicitly?

> 2. Google's Alleged Collection of Plaintiffs’ Data

> Plaintiffs allege that Google collects data from them while they are in private browsing mode "through means that include Google Analytics, Google ‘fingerprinting’ techniques, concurrent Google applications and processes on a consumer's device, and Google's Ad Manager." Id. ¶ 8. According to Plaintiffs, "[m]ore than 70% of all online publishers (websites) use one or more of these Google services."

> Specifically, Plaintiffs allege that, whenever a user, including a user in private browsing mode, visits a website that is running Google Analytics or Google Ad Manager, "Google's software scripts on the website surreptitiously direct the user's browser to send a secret, separate message to Google's servers in California." Id. ¶ 63. This message includes six elements, each of which is discussed below.

[...followed by a lot of detail on what gets tracked...]

https://casetext.com/case/brown-v-google-llc

So there is client-side telemetry which completely de-anonymizes and geolocates you and Google tracks you in incognito mode everywhere that Google Analytics is deployed (~70% of the web). If you use incognito mode and visit porn sites that use Google Analytics, then Google has your complete de-anonymized porn surfing history in their databases. This is not what people are led to believe is happening by the incognito warning message.

> So there is client-side telemetry which completely de-anonymizes and geolocates you

This is not supported by the quote you posted.

How is it client side telemetry when the exact same things would happen in edge, Firefox, Opera etc. with or without private browsing turned on. All of what you listed has zero to do with Chrome.

no, it wouldn’t because firefox and opera block cross site tracking.

You're misreading or misunderstanding. It's not your fault, the plaintiff is taking great pains not to say "Google Chrome sends this data" and make it unclear.

Ultimately though, it is Chrome sending the data to third party services. Firefox, Safari, et. al, do not permit these cross-site tracking requests.

They don't? How do they prevent javascript on a webpage making cross-site requests? That seems impossible.

Summary:

- Google Chrome won't track you in Incognito mode.

- Google Analytics javascript (if added by the webmaster to their site) will track you in any mode.

So the lawsuit is saying, "Google promised us that Incognito would let us browse privately, but Google is still tracking us". To me, they're really muddying the waters here, because clientside Chrome doesn't track you, but, doubleclick on a website, will still track you.

According to this lawsuit, Google's biggest sin is saying "Now you can browse privately..." but when you open Chrome Incognito it clearly says "Your activity might still be visible to websites/employer/ISP"

Kind of a weak case for the plaintiff, and a weak article (engineers joked about the icon? and wanted to change the name? It's definitely a shitty name but this article makes it sound like this a smoking gun.)

ChromeId

https://www.theregister.com/2020/02/05/google_chrome_id_numb...

Why the hell would anyone assume that the software vendor who made the browser had no visibility into the use of the browser?

> Why the hell would anyone assume that the software vendor who made the browser had no visibility into the use of the browser?

Why the hell wouldn't anyone? I mean, expectations of privacy have eroded, but "you used this company's product, so you must be giving them permission to see everything you do with it" is an argument that, despite many companies' attempts to push it as just common sense, doesn't and shouldn't fly.

Because they accepted terms of service that explicitly stated what information can be collected.

That's actually one of the points of the lawsuit: the TOS is unclear and improperly vague.

It really is the status quo now. It's in fact surprising when online software doesn't collect telemetry. It's increasingly surprising when offline software on an Internet-connected device doesn't collect telemetry.

VSCode collects telemetry these days.

> It really is the status quo now. It's in fact surprising when online software doesn't collect telemetry. It's increasingly surprising when offline software on an Internet-connected device doesn't collect telemetry.

I completely agree that it is the status quo, but it shouldn't be. It's unreasonably for people to be surprised by violations of privacy, but I don't think that it's unreasonable for people to expect respect for their privacy.

What "respecting people's privacy" means is very unclear and varies widely from person to person (the best quote I've heard on the topic is something to the effect of "People claim they value their privacy but then they'll give their information to a clipboard-holder in a mall for a Snickers bar... In fact, usually they don't even offer the Snickers.").

In that context, companies do their best to guess what their users want and ask for explicit consent when they can't. In Google's case, once we actually dig down and unravel the complaint that was filed by the Texas AG (https://www.texasattorneygeneral.gov/sites/default/files/ima..., page 55-ish), the claim is Incognito mode doesn't stop targeted advertising based on browsing behavior because the fact that browsing occurred is known by the servers. Well, duh. Of course servers have a history of access to them; expecting them to not is like expecting Amazon to not have a list of people that ordered from it (how are they supposed to ship you what you ordered if they don't know that?).

And in the cases where people have gotten retargeted ads because they went incognito and then logged into Google... how the heck do they figure they're in any sensible way "incognito" when their name and face are at the top of the page they're viewing?

I mean, I certainly wouldn't expect/want Microsoft to have a copy of everything I've ever typed into a Word document or Excel spreadsheet.

I'm now honestly curious whether Word and Excel still do spell check locally or have delegated to a cloud service.

Cloud Word and Cloud Excel obviously do, but "online services are online" had better not be surprising.

It shouldn't have to. There's no implication that the list in the Incognito start page is comprehensive. Nor is there anything special about Google in this context -- the fact that they created Chrome doesn't give them any more access to users' data in Incognito mode than any other web analytics firm.

The lawsuit alleges that they have a lot more access that any other web analytics firm and that they deanonymize and geolocate you on any web property that uses Google Analytics which enables them to fully track you.

https://casetext.com/case/brown-v-google-llc

That's a very long document. Can you point to the exact place where they allege that they have "a lot more access that any other web analytics firm"? I tried searching for "access", "geolocat" and "deanonym" and none of the hits describe anything like what you claim is alleged.

So can Facebook. Should they add that disclaimer on the incognito page too? If you're going to argue that they should call out Google analytics specifically, then you're saying that they should have a comprehensive list of every tracking company out there. But why? They've already made it clear that websites can still track you in Incognito.

"* Google" is part of "websites you visit" since the tracking asserted here happens only to the extent that you visit Google websites or when websites track you using Google tools.

I'd argue (and this is the point of the lawsuit) that Google being a third party spying on you on 70% of the websites that use Google Analytics is not being adequately disclosed by the warning message in Incognito mode. There is no "oh by the way we de-anonymize and geolocate you and we have your entire porn surfing history in our servers, cheers mate" notice there. The vast majority of internet users would expect that their IP would naturally leak to the porn site they visit, and that seems to be what the warning is about. It doesn't suggest at all to the average user that Google is watching all your activity across all the porn sites you visit--that doesn't become an obvious risk without a lot of specialized knowledge (which most of the readers here probably know, but which 99% of the rest of the world doesn't, which makes that interpretation highly deceptive to the average person).

Not that I disagree with you about whether the average person realizes it, but it's not just a risk because Google has JavaScript trackers on your porn site. Google could just make a deal with the porn site to access their server logs and correlate data that way. The fact that you disclose information to the sites you visit means they may, in turn, disclose information to whomever else.

As a totally non-web example of this, as of 2017, "Google’s third-party partnerships ... capture approximately 70% of credit and debit card transactions in the United States." https://adwords.googleblog.com/2017/05/powering-ads-and-anal...

When you buy something with MasterCard, in person, with a magstripe or even an old-school carbon-copy imprinter, MasterCard can go give that data to Google.

I think the incognito warning could say "Websites you visit, and anyone those sites share data with" to draw attention to this, but I'm not sure if that's quite enough. I'm leaning towards the argument from this article that "incognito" itself is simply a poor name.

"By using Chrome or ChromeOS, you agree to the Google Terms of Service located at https://policies.google.com/terms and these Google Chrome and ChromeOS Additional Terms of Service. These Google Chrome and ChromeOS Additional Terms of Service apply to the executable code version of Chrome and ChromeOS."

Google's TOS (as you can see linked there) seems to apply to both Chrome and Google Analytics. By downloading Chrome and agreeing with their EULA, you already acknowledge that this data is being collected. I don't really get what people are objecting to, here.

>99% of people aren't capable of reading the legalese in a TOS agreement, those are all by their very nature inherently deceptive.

And Google's Privacy Policy linked to off of there is one of the subjects of the lawsuit and that it is deceptive.

What I object to, at least, is that GA could ignore incognito mode users, but doesn't. Yes, other ad networks might still get incognito users' data, but they're not the biggest spy company on Earth, Google is. It's misleading that they collect data on both ends of the HTTP call, and have a feature called "Incognito mode" that only affects one end.

I don't see the difference between that and, say, Coke selling a product called "Diet Coke" that just has regular coke in it. A disclaimer reading "Warning: this is just regular coke," might make it legal but it's still messed up, and I wouldn't blame someone for trying their luck in the courts over it.

The TOS can make data collection legal but it doesn't make data collection and implying otherwise legal. Or do they have a clause that says you accept data collection even when they say you're browsing privately?

> Google being a third party spying on you on 70% of the websites that use Google Analytics is not being adequately disclosed by the warning message in Incognito mode

That's something which should be adequately disclosed by the websites you're visiting, which the problem that GDPR tries to solve (and currently fails to solve due to poor guidance and enforcement). Ideally a GDPR "cookie banner" should simply say "This site uses Google Analytics, <other services> to track you across the web. [Allow] [Deny]" instead of the current dark patterns.

Who ever would hit Allow?

There is ONE simple answer here that is in the best interest of your user, and that's rip the invasive 3rd party analytics out of your website.

Anything else is failing to put your users first, and eventually those users will go to a competitor who does. There's so much opportunity out there right now for startups that prioritize decency.

> Who ever would hit Allow?

That's kind of the point of GDPR. But they're not enforcing the main requirements under the law - that the consequences are clear and that choosing to allow or disallow are equally as simple.

But isn't that the same as opening a different browser (Firefox)? Your activity can still be tracked. It's not something that can be prevented within the scope of a private browsing feature.

I think the law would look at many questions like these by asking "what would the normal person think incognito mode was". Most people can't even write an excel formula. Not only do they not know this mode wasn't private, they don't even know enough to know understand the ways in which it wasn't private. Youre saying it doesn't claim to be a VPN, I'm saying that even if it was, mot people don't know what a VPN is, so they can't tell if they need it or if it's even a good thing.

> Now you can browse privately, and other people who use this device won’t see your activity. However, downloads, bookmarks and reading list items will be saved. Learn more

> Your activity might still be visible to: > Websites you visit > Your employer or school > Your internet service provider

It's pretty obvious that the only thing it's promising is to hide information from other users on the same device, and it goes out of its way to state that it won't protect against other tracking.

To the HN crowd this is entirely obvious... to others, perhaps not so much.

I think we're on the same ballpark as calling lane-assist Autopilot.

Those who know, know. Those who don't, don't.

I mean "RTFA" arose for a reason, right?

Stuff literally needs to be "what it says on the tin"... and even then.

> I think we're on the same ballpark as calling lane-assist Autopilot

Is aviation autopilot really any different than lane-assist?

A little.

A pilot under Autopilot is at least allowed to take their hands off off the wheel/yoke/control-stick during cruise-control elements of the flight ...

However, the connotations associated with "Autopilot" (to the wider public) mean it was a terrible term for its intended use on the road.

Maybe this issue is so well known now (I assume, in my bubble thinking) that it's no longer an issue ... but it is a relevant example.

It also goes out if its way to mention ways in which you can still be tracked (employer, isp, etc). This salacious headline is nonsense: Google employees joked internally about facts that the product clearly provides to users.

Consider that the vast, vast majority of people have no idea how networks or browsers or sessions or cookies or VPNs work.

I think it’s just fine and I don’t think Google misrepresented anything. But certainly there’s an enormous amount of people out there who still don’t understand the actual implications of what incognito mode means.

I might not understand how my car works, but I don't sue the manufacturer after putting it in first gear on the highway and it coming apart ("the gear was available for selecting, this should have done what I thought it did!"), or for making the radio have a button that doesn't do what I thought it did.

You might, however, sue the manufacturer if they sell you an automatic parking feature that routinely crashes into other cars.

I explicitly said "I don’t think Google misrepresented anything" so not terribly sure what your point is here.

The new page tab for incognito mode literally says

    Your activity might still be visible to:
        * Websites that you visit
        * Your employer or school
        * Your Internet service provider

I know people don't read warnings, but really I don't know what they could do to make it more clear.

Based on what is written there, if I'm a standard non tech user, and that I don't know anything about Js cross site requests, then, when I browse a news website (that is not Google), I don't expect google to be able to see my activity. As, again, it is not their website that I'm visiting.

In addition, Chrome is distributed by Google itself and they clearly advertise it as made by them, better and safe. They make it explicit that it is entirely under their control. So, it would be logic for a standard non tech user to expect that google do not track them when they are using the "google" chrome incognito mode.

Keep in mind that a lot of users would not know the difference between a client and a server.

Also, remember that google do everything to blur the lines when it was convenient for them:

When you are logged in Google, your own browser is logged with a special profile icon. If you look at it you can launch a Google search directly from the url bar or from the "new tab" page.

Even as a power user, can you easily reply to the following question? is the new tab your browser domain or Google domain? Hint: some content here is dynamic depending on your Google account...

> I don't expect google to be able to see my activity.

The incognito default tab says that your activities are still visible websites. The incognito mode even explains that other people using the same device won't see what you browsed - which is the primary use of it anyway. I don't know what is the concern here - are people angry that a mode which doesn't promise untrackability doesn't give untrackability?

> If you look at it you can launch a Google search directly from the url bar or from the "new tab" page.

What is this meant to to poke at? You can change what the search bar does to another search engine (in fact I believe Duckduckgo is also one of the choices in a new install of chrome).

> When you are logged in Google, your own browser is logged with a special profile icon.

Doesn't Firefox also have the same browser sync service? It's a useful feature to track your browser tabs unless you're security conscious or paranoid (or both).

There's a difference between _not_ understanding what a browser does and misinterpreting what it does, which is what this entire post is.

That list appears to be not mentioning Google themselves though, which is one of the main thrusts of the suit in question.

I don't think it's that clear. For instance different incognito windows, opened separately, share everything among them. This was not at all clear to me, though I suppose at least for tabs in the same window it makes sense.

That’s news to me, too. Makes sense though. I assume it’s because you can drag tabs from one window to another. So if you open two incognito windows and drag one windows’ tabs into the other, the browser needs to decide what can be shared. You could keep their states separate, but what if you then you open a new tab in that shared window? What state/profile object is the new tab associated with? Just sharing between all windows is easier to handle.

Indeed. This is not the case in Safari, for example, where every incognito tab is isolated from the rest.

But Safari has its own problems. For instance, despite promising to be a safari I noticed that I am still located in exactly the place I started. If it doesn't rename to Apple Web User Agent then it is clearly misleading to the non-technical user.

That is not entirely correct. Incognito mode shows as incognito, meaning you can tell apart a guy using incognito from a guy with a freshly installed chrome.

IIUC it doesn't directly advertise this (and in many cases tries to hide this) but it can be fingerprinted.

"And, to be clear, the Incognito Mode new window has always made this clear."

But the spy icon and the name hint something different. I mean we technical folks do understand the words and explanations with one short glance, because we know a browser cannot make us anonymous nor invisible just like that.

But common folks who understand computers as dark magic not so much.

So it is somewhat missleading, even though I do not see a evil intention here, rather misscommunication.

Firefox and Safari call this "private browsing". Firefox also uses a mask icon. Are these any different?

And, to be clear, the whole focus of this lawsuit is the plaintiffs are saying that since Google also owns server-side Google Analytics, that incognito mode is inaccurate because "Google is still tracking you".

But the only way for Google to handle that would be if (a) Incognito mode specifically handled GA differently, and that would be a privacy violation, or (b) GA detects you're in Incognito and stops tracking, but all the browser vendors have gone to great lengths to try to make private modes as "unsniffable" as possible, and I view the very effort to sniff for privacy mode as a violation.

"Firefox and Safari call this "private browsing". Firefox also uses a mask icon. Are these any different?"

Well, "private" is clearly different from "incognito". But the mask with firefox is misleading, too.

And the article is misleading as well, because it implies that chrome is still tracking you in incognito mode, which is not right. Google might be tracking you.

But to comment on the lawsuit, I lack details.

Firefox and Safari actually behave differently with the cross-domain tracking requests being complained about here. So yes, they are different.

> Websites, though, can still use analytics APIs, including things like Google Analytics, to track you within that Incognito Mode session. They may also be able to correlate you by, for example, matching your IP address.

Well, that’s kind of what breaks intuition about it. Compare to a burner phone. People expect that eg calling the same place with the same number will tip off the recipient that you’re the same person.

But what if every business fed a voice analysis profile of everyone caller to a central database — without keeping a voice recording, of course — and associated each one with a number. And imagine it was cheap for some people to access this database.

That would kind of break most people’s expectations of a burner phone. But that’s basically what websites can do.

So even if you know the general structure of how websites and Incognito work, you might still fail to appreciate how unhelpful the anonymization is.

Reply on news.ycombinator.com