Hacker News Reader

Comment by Navarr | Hacker News Reader

Why are we assuming maliciousness?

My best guess that Chrome works this way would be due to combining the sign-in cookies with the general cookies of the browser (e.g. 1 cookie store instead of 2).

So when you log in to Google, you log in to Chrome - and vice versa. For non-technical users this is a convenience feature, though for many it does come with privacy concerns.

Judging by the comments re cookie clearing, there is some part of the login still separate from that, but as it re-establishes itself the cookies come back and you stay logged-in to Google.

Is this perhaps preventable by having a "Guest" Chrome account? What happens then?

View on HN

> Why are we assuming maliciousness?

Because Google has been screwing up so much, by this point they don’t deserve the benefit of the doubt.

> My best guess that Chrome works this way would be due to combining the sign-in cookies with the general cookies of the browser

Why keep Youtube cookies, then? https://twitter.com/ctavan/status/1044286636991877120

I agree — malicious would be to hide the Google cookies that are associated with your browser-level Google login.

As it is, I think it's quite transparent. You get new cookies. It shows you their age. They're new. You're still logged into your Google account.

Solution: Log out of your Google account.

It doesn't have to be malicious for it to harm privacy, help them track users for advertising and to be anti-competitive.

The implementation details around cookie recreation don't matter if users are still being tracked. Especially bad if this lets them track you on third party sites that contain Google Plus buttons or advertising iframes.

By ensuring users always remain logged in to the browser they gain a strong advantage over other companies that track users. Users attempting to remove tracking cookies shouldn't find Google ones permanently bundled with the browser.

The intent was likely to aid convenience and avoid users being unexpectedly logged out, but combined with Google automatically logging users into the browser this is a sign that the Chrome team is paying less attention to user privacy than they used to.

Perhaps users who regularly clear all cookies will start using guest accounts instead. Myself I'm more concerned about the general trend of unexpected behavior.

It is either malicious, or it is negligent. Either way it erodes trust significantly. Given the trend of changes in Chrome lately, if your alarm bells aren’t ringing yet, you are probably not paying attention.

I have switched to Firefox and have used this as an opportunity to begin my transition away from GMail.

Why are we assuming maliciousness?

Because based on their history big tech companies (possibly with the exception of Apple) lost any benefits of a doubt.

When they screw up like that I now assume that it's intentional and unless they run into a massive pr disaster or an EU fine of a couple billions they give exactly zero fucks about their users.

Reply on news.ycombinator.com