How much verification is too much?

from here

This is the precise problem I've been having with GMail. I enter the correct password and then GMail decides that's not good enough. Then they say they needs to verify me so they sends a code to my recovery email, and when I present the code back to them they decide that's not good enough either. Why attempt verification that way if you aren't going to accept the results? Anyway, now they want a cell phone number to send a code to, but I don't have a cell phone and even if I did I have little faith left that the result of that would be any different than the email verification.

Unfortunately I made the mistake of tweeting about the problem and as a result scammers have been sending me messages for days promising to help me get back into my account if I just contact them through Instagram or Whatsapp. I can recognize them for the scams they are, but not everyone would, so essentially Google's attempts to curb account take-overs are actually creating opportunities for account take-overs. 

Who'll scoop out the "Privacy Sandbox"?

from here and here

It appears that, under Google's new scheme, while you browse you're going to be added to various "interest groups" and then be shown ads based on those groups, and it'll up to you to go in and clear out/block the groups you don't want. 

In other words, the "interest groups" are the turds in the privacy kitty litter and you may well find that the job of cleaning it out never really ends.

As if we needed more reasons not to click on ads

from here and here

Ads on Google Search (among other places, most likely) have apparently gotten considerably more dangerous lately. Careful where you click. 

There's no perfect privacy

found on Reddit

You can keep things private from the people you live with or maybe even the sites that you visit, but not the company that makes your browser. Just something to think about while you use a browser made by an advertising company

Always listening

found on Memedroid

Just because you "muted" the microphone doesn't mean it's not still listening. It's ALWAYS listening. At best, muting the microphone just stops it from responding to your commands.

Isn't it ironic

from here and here

There is certainly a delicious irony in Google getting called out by none other than Google for taking to long to patch their shit. Seemingly the patch has been available for more than the 90 days that Google's Project Zero usually gives vendors. They didn't even need to develop the patch themselves, just apply it to their product, but apparently it's gotten held up in testing. 

Kinda makes you wonder, if Google can't even adhere to their own 90 day policy, why is it reasonable to expect it from others?

At least the lawyers get paid

from here and here

With this legal settlement between Google and the States Attorney Generals for 40 states, I'm starting to wonder who really benefits from privacy lawsuits now. I don't see anything to indicate that the money will go towards the people harmed, and even if it did it wouldn't be enough for each one to buy a coffee. It really seems like only the lawyers benefit, and I worry that we've found ourselves in a situation where privacy now just serves some sort of framework of perverse incentives for the legal profession (and maybe states).

Security can kiss my @$$

found on Izismile

I'm sure there's a good argument for this. For example, maybe if you make too many passwords with a particular body part a bias starts to emerge in the data, so if you're making a lot of passwords you have to keep switching up which body part you use, and this was the last one this engineer had left.

No location tracking data for you!

from here and here

The newest thing that's supposed to be the end of passwords is the passkey, and colour me shocked but it requires a cell phone. Now cell phone based authentication has been misused for tracking so many times now I'm not even going to pretend to believe there was any other motive involved in that particular design decision.

The biggest target takes the most hits

from here and here

Apparently Chrome has more than twice as many vulns this year as the next leading browser. I know more vulnerabilities doesn't necessarily mean Chrome is less secure than it's competitors. It has the most market share so it gets the most attention from people trying to find vulnerabilities. However, while that doesn't make it less secure, it does make it less safe. More attention from attackers (successful attention at that it appears) means that users of the software face more attacks than users of the alternative browser - and that has been the rationale behind using alternative software for a long time. If you're using something that has a smaller target on it's back, you're less likely to fall victim.

Look who thinks they won the browser wars

from here and here

Who's looking forward to seeing their ad blocker get lobotomized? That seems to be where we're headed if Google has it's way. It reminds me a little bit of the controversy over PatchGuard in Windows Vista years ago. A security mechanism was added to the system that blocked access to functionality that malware and security software alike made use of. 

Google's new extension system will basically be doing something similar, with ad blockers getting the short end of the stick. One of the big differences here, though, is that Google is the world's largest advertising company, so they will definitely have an incentive to not make exceptions for ad blockers, even though those are an important way to block malware online.

If ad blocking performance deteriorates too much in Google Chrome in comparison to other browsers, though, Google is going to start losing their dominant position in the browser market.

I've got a reputation to protect

found on Reddit

I don't know about you, but I certainly use Google in incognito-mode. Not even specifically dumb questions, but all the time. One of these days I'm probably going to have to figure out how to make every browser window an incognito window.

When advertising companies make browsers

from here and here

I mean, when you factor in the fact that Google is an ad company, their desperation to keep tracking people makes sense, but it's still desperation, and each year they drag out the end of tracking further just looks more and more desperate.

Who wants to pay to be the product?

from here and here

I can't get over how exploitative it is for Google to charge people for a service and then turn around and collect data about them anyway. That's supposed to be how you monetize services that users AREN'T paying for the service. If I'm paying for a service, I expect my fees to be adequate to reimburse the vendor for their services. I certainly don't expect to be used in that manner. 

I guess their motto of "Don't be evil" really is dead.

Don't Be Google

from here and here

Step right up and play the privacy controls shell game. Guess which settings will cause us to respect your privacy once and for all. It's an honest game. We wouldn't move things on you.

Even Google fails at asset management

from here

This is your irregular reminder to check your network to see if there are any servers on it that don't need to be there anymore. One less server is one less thing to patch and one less thing that could be exploited in the absence of a patch (and if it's been running for 21 years you've got to think it's missing a few patches)..

"Privacy" settings

found on eBaum's World

If the microphone were actually disabled, it wouldn't be able to respond to your question by saying the microphone is disabled because it wouldn't have heard your question in the first place. 

If you have a device that does this, it's lying to you when it says it's disabled.

Can't get any privacy

found on Funny Junk

I can't get no-o

Private spaces

They've got cell phones in

All the places

Privacy should be worth more than pocket change

from here

I used Google+. In fact, I kind of liked the way it did certain things. I definitely don't like them paying out a mere $2.15 per person for miserably failing to protect user's privacy, and opting instead to protect themselves by keeping it all secret. 

There better not be any ads after that

from here

While paying for Internet service is a technical requirement for using websites, paying for a phone is not - as evidence I point to all the sites I can currently use without a phone. If Google starts requiring a phone in order to log in then I can't see how to continue calling the service free, regardless of whether the money is going to them (although, considering how many phones are Android, it seems likely they're getting their cut).