Hacker News Reader

Comment by Scarbutt | Hacker News Reader

Doesn't chrome lets you use your own encryption key?

Yes, but it's not the default. From the article:

> One could, however, add a second passphrase that is never sent to the server, and encrypt the data using that. Chrome provides this as a non-default option.

The average user doesn't have the expertise to know that they have to configure an additional "master password" to keep Google from mining their data for ads.

That is true, defaults are important. Firefox users know that because they have to disable the advertisements that appear in the Firefox new tab page by default.

https://prod-cdn.sumo.mozilla.net/uploads/gallery/images/201...

I strongly dislike that they've done that. In their partial defense, the selection of recommended articles based on your browsing history is done on device.

In fact this was one of the primary motivations behind Sponsored Tiles in Firefox, to prove the viability of a privacy-preserving monetization model for the web.

It's interesting that while some could certainly characterize all of that screenshot's "Recommended by Pocket" stories as advertisements, recently they've started showing actual Sponsored Stories advertisements in that spot as well.

I'm downvoting this as the same off-topic whataboutism that comes up any time this topic is discussed on HN (and the fact that you felt the need to create a throwaway account to post it makes me think you knew what you were doing here).

I'm not sure account age is so relevant. I create new accounts all the time (several times per month) even though I stand behind what I write. It takes 15 seconds so hardly a big effort. I've noticed that it's possible to extract a lot of info from people's posts, in many cases deanonymizing them if you go through enough history and correlate with other sites. Maybe he is a bit privacy concerned.

>keep Google from mining their data for ads

I just got this morbid idea of Google mining storing passwords to recommend LastPass/1Password in ads based on your password strength.

Hmm I wonder if LastPass/1Password advertises on websites listed on haveibeenpwned

1Password is promoted by the HIBP itself, a.k.a Troy Hunt. I would not use it.

It already encrypts sync data with your G username/password, but you can choose to change it in settings. Chrome 69 or 70 made it even easier to change it right from the settings.

Yes, but that leaves you with 2 passwords and isn't default.

The advantage here is twofold. - Your encryption key is derived from your single Firefox password, rather than having 2 passwords. - The ease of use of this system makes it possible to have e2e encryption by default rather than by opt-in.

Reply on news.ycombinator.com