Hacker News Reader

Comment by lrem | Hacker News Reader

> Google is not known for respecting user privacy.

As a Googler, I’m always confused by this sentiment. We live in times where car manufacturers reserve the right to collect and sell any data the car can sense, up to and including your sex life. But somehow Google does not sell or share any of your data with anyone, makes it public how it fights a lot of law enforcement overreach, even outright exits markets and sunsets features and products due to privacy concerns… And is everyone’s top focus when it comes to privacy.

View on HN

Simple answer. Google doesn't cultivate an image of caring about privacy. It's the complete failure of Google PR. It's also due to an outdated notion of confidentiality that kept so much privacy-related deliberations within the company. Google should just publish slightly sanitized versions of their internal PDDs with PWG comments to win back trust. (For people who had never worked at Google: PDD means privacy design doc, like a privacy policy but with a lot more details; PWG means privacy working group, specific teams tasked with ensuring good privacy practices in all products launched by Google.)

> But somehow Google does not sell or share any of your data with anyone

Well, except we know about PRISM, so it's not even a theory anymore. And all their ad system tapping into the user data is pretty creepy as well.

I don't want to share any data to Google because of their poor track record and Google makes it as hard as humanely possible to not do that.

If PRISM is in your threat model… You can safely assume that any large enough US-affiliated web service, hardware and software manufacturer is in scope of something like this. Good luck evading.

To play devils advocate, there are a few reasons off the top of my head:

1. More people have phones than cars

2. Cars take someone to a general location (i.e a shopping mall carpark) but phones are precise enough to say which section of a store (or hospital) you are in

3. Car manufacturers can't inherently link the passengers of the car to the driver, or to each other

4. Manufacturers of cars don't have ads as a core business model

That's not to say what car manufacturers are doing isn't scummy -- it deserves more light. But what Google does affects more people in a much more complex way. Google doing this essentially takes attention away from these smaller cases of privacy violations -- if the Google issue is solved (and I'm using Google here as a supplement for "phone tracking") then the world would turn their focus to the smaller issues like car tracking.

2. Often that would be enough if other pieces of data can be linked to that time and location.

3. No, but based on driving patterns and sensor data, police can infer certain things.

4. Very soon. Very very soon.

Maybe because it's the biggest advertisement company that continually hits the news regarding privacy issues, market position misuse, deceptive marketing, legal issues, etc?

For me it's the the way RTB works. It leaks massive info.

Google is hostage from ad selling.

My understanding is the adcopalypse happened because Google refused to share as much information with partners such as WPP and big spending customers such as Pepsi. I'm just saying as bad as things are with real time bidding, it could be much worse with a company such as Microsoft or Oracle setting industry standards.

I mean, really? Let's see, Google is trying to force through Web Environment Integrity which would eventually obliterate any remaining semblance of privacy on the web, it has historically disrespected GDPR, it's trying to work around GDPR with a so-called "Privacy Sandbox" which is anything but, it's trying to sunset Manifest v3 which will take power away from Chrome users, just to name a few current & recent developments.

This is not an image/PR issue, Google really is doing Evil™ things.

> Google is trying to force through Web Environment Integrity which would eventually obliterate any remaining semblance of privacy on the web,

How so?

Assuming good faith, the technology makes it possible for your browser, OS and hardware to attest that the website is running in a certain type of environment (e.g. not a bot/scraper) which could be trivially extended to attestations such as "No, this client isn't using an ad blocker". It takes even more control away from users by having their own hardware snitch on them.

You can reference numerous previous discussions on HN regarding WEI for more information.

They withdraw it somewhere between 2-6 weeks ago due to the reaction.

I used to work at Google, I got over the initial 'gee we're pretty nice and concerned' thing, but would like to gently point out the tendency of people to be slightly histrionic and misinformed about it. The gap between what it was, briefly, and the confidence you have in its intent and current state are quite wide. Certainly well-intentioned and appreciated, but ultimately alarmist and inaccurate.

I know the current iteration of WEI was withdrawn and I don't claim to know what their current intentions are. They might be completely innocent, but the fact is that WEI would pave the way for abuse. Once the core functionality is there, there's an obvious financial incentive for them to start expanding WEI in order to boost their advertising revenue.

These types of ideas with significant potential for abuse should be introduced with extreme caution and with at least majority agreement of everyone affected. Instead Google tried to pull a fast one and refused to engage criticisms in good faith. My response might seem alarmist at first glance, but I don't think that's a fair accusation given Google's behavior. I expect this proposal to return under a different name once everyone's forgotten about it and I hope the backlash then will be as severe as it was against WEI.

> attest that the website is running in a certain type of environment (e.g. not a bot/scraper)

> No, this client isn't using an ad blocker

Sure, but I still fail to see how it would "obliterate any remaining semblance of privacy on the web".

Google is a company that, over the years, employed over a million unique human beings. In such a population you’re bound to find some that would sell their own mother for a promo.

WEI is following Apple’s lead isn’t it? But unlike Apple, Google got pushback and abandoned it.

When it comes to GDPR, that’s even funnier. Most companies woke up in 2018 and looked for a way to brush this off. My org in Google was investing serious development (we’re talking engineer-years, don’t know how many) into GDPR compliance in 2015. And that’s not some superficial fronted tweak. I’m talking about adding data removal to analytical storage, something where first design assumption was that it has immutable append-only history.

Manifest v3… I don’t understand what are they trying to achieve.

Plenty of people find retargeting ads objectionable and a violation of user privacy for which Google is handsomely rewarded financially.

Reply on news.ycombinator.com