Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Interesting. Between this and the Incognito Mode lawsuit, it seems some lawyers are trying to make a case that companies have the burden of making their systems plain-language understandable to the consumer, not technically understandable. "Incognito mode" has never meant "Third party sites can't track you," but one could argue its plain-language understanding should be that. Similarly, disabling "Web & App Activity" actually means Android's built-in tracking is disabled, but does nothing about third-party site tracking (which is what Firebase is; it's a framework for third parties building usage tracking into apps that happens to be owned by Google but doesn't drop its data into the same hopper as the Android project's tracking). One can clearly see how turning off Web & App Activity tracking could cause a person to assume systems like Firebase are also disabled, but it doesn't.

I don't know what the right answer is yet. Manufacturer responsibility v. personal responsibility is an old question, and it's why we have court systems.



> "third-party site tracking (which is what Firebase is; it's a framework for third parties building usage tracking into apps"

Firebase isn't that at all. It can be used to build such things, but so can PHP and CSV files.


"At the heart of Firebase is Google Analytics, a free and unlimited analytics solution."

https://firebase.google.com/docs/analytics

Of course Firebase is more than just analytics, but it sounds like it does offer much better tools for tracking than PHP.


Sorry; my mistake. Should have said user tracking is a feature the Firebase platform makes easy to build, not that its intent or sole purpose is that.


> Firebase isn't that at all. It can be used to build such things, but so can PHP and CSV files.

You can use PHP and CSV for purposes unrelated to tracking. Firebase cannot be used without any tracking going on.


Yes, it absolutely can. I'm doing so currently.

Firebase at its core is cloud functions, triggers, and storage.


Never mind where the blurry line might be. Can we just get a bare minimum working as expected? Going incognito in google maps shouldn't then bombard me with notifications to rate the places I've been to, let alone send me smug emails listing my recent history!


"Happens to be owned by Google" is a cop-out.

They get the benefits of being a megacorp. They should get the drawbacks too.


I mean, in this case the drawback appears to be "troll lawsuit by a firm paid by Oracle that is trying to bend precedent to screw Google, but would have secondary effects on other web services as well." That's not just a drawback for Google.


One person's troll lawsuit is another person's corporate gridlock leading to a balance of power. It's not an entirely bad thing when they start fighting over issues that are actually important to end users, and may provide some net gain for society.

Tech cooperation and infighting, like governmental cooperation and infighting, has its pros and cons.


Agreed. "Happens to be owned by Google" makes it sound like they accidentally purchased it.

"I'm sorry mister judge, the the rootkit happened to be owned by my company and written by my devs, but there's mere chance."


Even if they prevail, what happens then? Google Ads is broken out into a separate legal entity and suddenly all that tracking going on is legal again. Nothing will have changed except how a few beans are counted.


What would change is that the incentives of the non-ads company would become better aligned with protecting their users against the ads company. Right now Google is working both sides, creating a conflict of interest.

Google would obviously never divest the Ads business, as it is a large revenue stream. Instead they would divest the non-Ads components of Chrome/Android/etc. Given that the larger purpose of those platforms is to create more surveillance subjects (commoditize your complements), this outcome would actually be somewhat sensible.


> What would change is that incentive of the non-ads company would become purely protecting their users against the ads company

[citation needed]. Apple should fit that category, and while they have added features to throttle how users can be tracked they haven't exactly gone thermonuclear on tracking in Safari.


Way to jump on a single word. Edited.


While to us on HN, who by all accounts are computer experts, these things are trivially obvious, they aren't to the average user. Remember that the average person isn't tech literate. We do see literacy increasing but a lot is because there's been abuse of this illiteracy. Unfortunately people aren't learning from actual experts, but the person in their social circle that is the "smart person." I'm not sure there is a great solution, but we can at least understand that these things aren't obvious. Especially since most people still don't understand anything about how they are tracked across the web. Saying something like "how you use your mouse is used to determine if you're human and can be used to identify you" still sounds crazy to many people, yet we all here know that Google captcha does this.


Never considered firebase.. How would you even avoid that?


Firebase is loosely speaking an app development framework which hosts the server side of your app on Google Cloud. The firebase web site lists some apps built with it like NYT and trivago and Duolingo, but I don't think you could reasonably avoid them based on how they look, those look like every other app.

It's really not clear what this lawsuit is about from this article, either. Is the problem the Google Cloud integration? Is the problem Google Analytics being shipped with apps? All that we can really tell from the information given is that there is some conflict between non-Google apps and the Google privacy settings, which just sounds like a strange tension. Like, of course non-Google apps are not subject to Google's privacy policy. Still, this lawsuit may have some indirect effect where Google someday needs to rebrand, and the apps that it sends straight to you like Docs and Gmail continue to be “Google” while the platforms for other developers like Google Cloud carry some other name as part of a different subsidiary of Alphabet, Inc.

I don't want to speculate too much about that, it seems strange but that's why we have court systems to work through the stranger points of law.


"Of course" to us. IIUC, the lawyer is trying to build a reasonable-person-principle case that an average user, downloading an app from the Android store to their Android phone, who turns off web and app activity tracking, is right to believe that it turns off all tracking on the DEVICE, regardless of who owns the apps (because from the user's point of view, they all come from Google).


On the other hand, each app has a developer name right under the app name and includes a link to their T&C/Privacy policy, so it'll be interesting to see this play out.


Don't use services where you are the product.


If only it were that simple.

Just because you pay them doesn't mean they're not tracking you. Look at Windows 10.

And just because they promise not to misbehave doesn't mean they're not subject to secret coercion (e.g. from China) or to getting hacked.

The only solution is for them not to have your data at all. It has to stay on your machine and never be on theirs.


> "Incognito mode" has never meant "Third party sites can't track you," but one could argue its plain-language understanding should be that.

This is how browsers have increasingly implemented the feature as well, to match user expectations. Arguing that incognito mode is solely a "I don't want this in my history" feature ignores how it is perceived by pretty much everyone.


Chrome does warn you every time you open an incognito tab that "Your activity might still be visible to: Websites you visit".

And as long as you don't log into Google, Facebook, Amazon, etc. accounts during that incognito session, third party sites really can't track you once the session ends. (Yes fingerprinting is a thing but I don't think it sees that much real-world use.)


> Yes fingerprinting is a thing but I don't think it sees that much real-world use.

Fingerprinting is such a pervasive problem on the internet that Safari and Firefox both advertise fingerprinting prevention as a core privacy feature.

It's also used heavily in endpoint security products and services, and was gaining traction in financial institutions as long ago as 2010.


This is getting ridiculous letting people's misperceptions of concepts like incognito mode and autopilot have legal ramifications for companies using them correctly.


Who are the legal ramifications for?


Tesla can't say autopilot in Germany anymore and now people are rabbling about incognito despite the clear explanation you get when you open it.


If that theory prevails, then it will be illegal for a computer program to do anything that a human doesn't understand in a single summary sentence. Which defeats most of the purpose of computers.


Or it means that naming something that clearly implies it does more than it actually does is just false advertising... I'm looking at you "autopilot."


My pet peeve is the standard of writing "Buy" on the ad, "Buy" on the button, and "buy a license to use under the following terms" in the thousand word TOS document which no one reads. "Lease" would be more honest.


Agreed! We are eroding the meaning of many words that we use to describe ownership and the exchange of goods + services. My sophomoric interpretation has always been that when your economy is shifting to being more service-centered that trend seems inevitable... but crud if it is not disconcerting.


Tesla's mistake there was not making it clear that was a "brand name"/"trade mark" rather than a description. If everywhere they were very careful in all their marketing with something like Tesla™ Autopilot® Cruise Control System style branding, they'd be in less hot water. "We call it Autopilot® because that is our registered brand mark, not because that is a complete and accurate description of its capabilities."


It depends where you are. Certainly some mobile providers here got in trouble claiming that "Unlimited" was just the name of the package.


That’s not a “mistake” it is deliberately deceptive.


It's not even that deceptive from a technical standpoint: an airplane autopilot maintains course and speed, and nothing more. Tesla's autopilot maintains course (lane) and speed, and nothing more. It's in the common imagination that airplane autopilot, based on name alone is more autonomous than it is (you can't takeoff/land on autopilot in a plane, and a pilot isn't just napping during autopilot). A lot of people seem to imagine the joke version of autopilot from the movie Airplane! where an inflatable "pilot" takes over full control of the plane, when the reality is much simpler and less autonomous.

The question remains if Tesla expected more goodwill from the common/popular imaginative view of the thing over the technical description, and I have no idea how "deliberate" that was.

I also probably should have put a sarcasm/irony tilde on mistake as my post above was intended more as a joke than an honest attempt at problem solving.


You've seen the disclaimers in drug commercials and infomercials, right? Programs would be free to use more than one sentence, they just might need bulky glossaries read by a sonorous voiced narrator before use.


The issue is that there is no firewall between services that Google offers. Which means that there is protection against data leakage when you use any of its services despite turning on its privacy settings.


> no firewall between services that Google offers

In what sense?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: