Thread · 2 tweets · 28 Aug 2020

I don't think that the idea is that no one inside Google looks at Google as a potential problem, we know you do. But there are plenty of cases in which it's obvious that Google was simply a blind spot in the threat model.

Identity in the browser, many of the privacy things (I've had conversations with Googlers who sincerely struggle to understand that them getting data could be a problem), AMP are a few good examples.