<story><title>De-AMP: Cutting out Google and enhancing privacy</title><url>https://brave.com/privacy-updates/18-de-amp/</url></story><parent_chain><item><author>tentacleuno</author><text>&amp;gt; Second, AMP is bad for security. By design, AMP confuses users about what site they’re interacting with. Users think they’re interacting with the publisher, when in actuality the user is still within Google’s control. User-respecting browsers defend the site as the security and privacy boundary on the web, and systems like AMP intentionally confuse this boundary.&lt;p&gt;They&amp;#x27;ve actually been pushing to confuse that boundary even more since 2019, with their Signed Exchanges specification[0][1]. In essence, when you (unintentionally) visit an AMP page from Google Search, the URL typically starts with google.com&amp;#x2F;amp&amp;#x2F;websiteyouwantedtogoto.com. Signed Exchanges is essentially a way to drop the &amp;quot;google.com&amp;#x2F;amp&amp;#x2F;&amp;quot; bit, as demonstrated by one of the animations on [0].&lt;p&gt;Even Cloudflare supported this and rolled it out on their free tier[2].&lt;p&gt;[0]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;developers.google.com&amp;#x2F;search&amp;#x2F;blog&amp;#x2F;2019&amp;#x2F;04&amp;#x2F;instant-loading-amp-pages-from-your-own&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;developers.google.com&amp;#x2F;search&amp;#x2F;blog&amp;#x2F;2019&amp;#x2F;04&amp;#x2F;instant-lo...&lt;/a&gt;&lt;p&gt;[1]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.theverge.com&amp;#x2F;2019&amp;#x2F;4&amp;#x2F;16&amp;#x2F;18402628&amp;#x2F;google-amp-url-problem-signed-exchange-original-chrome-cloudflare&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.theverge.com&amp;#x2F;2019&amp;#x2F;4&amp;#x2F;16&amp;#x2F;18402628&amp;#x2F;google-amp-url-p...&lt;/a&gt;&lt;p&gt;[2]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;blog.cloudflare.com&amp;#x2F;announcing-amp-real-url&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;blog.cloudflare.com&amp;#x2F;announcing-amp-real-url&amp;#x2F;&lt;/a&gt;</text></item></parent_chain><comment><author>37</author><text>This seems insane and malicious as hell and I can&amp;#x27;t believe it&amp;#x27;s being sold as a feature. It&amp;#x27;s essentially just lying to users about which website they are currently visiting, or maybe I&amp;#x27;m missing something.</text></comment>
<story><title>De-AMP: Cutting out Google and enhancing privacy</title><url>https://brave.com/privacy-updates/18-de-amp/</url></story><parent_chain><item><author>tentacleuno</author><text>&amp;gt; Second, AMP is bad for security. By design, AMP confuses users about what site they’re interacting with. Users think they’re interacting with the publisher, when in actuality the user is still within Google’s control. User-respecting browsers defend the site as the security and privacy boundary on the web, and systems like AMP intentionally confuse this boundary.&lt;p&gt;They&amp;#x27;ve actually been pushing to confuse that boundary even more since 2019, with their Signed Exchanges specification[0][1]. In essence, when you (unintentionally) visit an AMP page from Google Search, the URL typically starts with google.com&amp;#x2F;amp&amp;#x2F;websiteyouwantedtogoto.com. Signed Exchanges is essentially a way to drop the &amp;quot;google.com&amp;#x2F;amp&amp;#x2F;&amp;quot; bit, as demonstrated by one of the animations on [0].&lt;p&gt;Even Cloudflare supported this and rolled it out on their free tier[2].&lt;p&gt;[0]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;developers.google.com&amp;#x2F;search&amp;#x2F;blog&amp;#x2F;2019&amp;#x2F;04&amp;#x2F;instant-loading-amp-pages-from-your-own&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;developers.google.com&amp;#x2F;search&amp;#x2F;blog&amp;#x2F;2019&amp;#x2F;04&amp;#x2F;instant-lo...&lt;/a&gt;&lt;p&gt;[1]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.theverge.com&amp;#x2F;2019&amp;#x2F;4&amp;#x2F;16&amp;#x2F;18402628&amp;#x2F;google-amp-url-problem-signed-exchange-original-chrome-cloudflare&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.theverge.com&amp;#x2F;2019&amp;#x2F;4&amp;#x2F;16&amp;#x2F;18402628&amp;#x2F;google-amp-url-p...&lt;/a&gt;&lt;p&gt;[2]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;blog.cloudflare.com&amp;#x2F;announcing-amp-real-url&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;blog.cloudflare.com&amp;#x2F;announcing-amp-real-url&amp;#x2F;&lt;/a&gt;</text></item></parent_chain><comment><author>BrendanEich</author><text>ICYMI, &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;twitter.com&amp;#x2F;BrendanEich&amp;#x2F;status&amp;#x2F;1516492008700796929&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;twitter.com&amp;#x2F;BrendanEich&amp;#x2F;status&amp;#x2F;1516492008700796929&lt;/a&gt;</text></comment>