[deleted]
Massive spying on users of Google's Chrome shows new security weakness
61–70 of 270 posts
Re: Massive spying on users of Google's Chrome shows new security weakness
#62Earlier quoted context omitted.
Wow talk about revisionism! Chrome was meant as a hedge against IE and lesser so against Firefox. Microsoft owned the desktop with Windows and could easily shut Google out. See the reason surrounding the creation of the Google toolbar. Similarly Android is a hedge against IOS and mobile search.
Yes and no. If Google only wanted to hedge against IE they could have just contributed to Mozilla/Firefox. They clearly also wanted total control.
In fact they did contribute to Firefox by paying engineers like Ben Goodger and Seth Spitzer, but clearly they weren't happy with that level of control. Goodger was lead developer for Firefox. They pulled all those people to work on Chrome instead, a step that immediately hurt Mozilla.
Re: Massive spying on users of Google's Chrome shows new security weakness
#63Earlier quoted context omitted.
Chromium, but they're effectively the same. The average user doesn't know what Chromium is. https://chromium.googlesource.com/chromium/src/+/e51dcb0c148...
I see, thanks. I'm looking at that source and confused what it's actually doing though. What is the "tracking" aspect? I see ShouldAppendHeaders() returns true on doubleclick.net, but on the face of it, it seems to just be saying: "Should we send experimental headers to this URL? If it's doubleclick.net, then yes." But they claim [1] this X-Client-Data header is used for experimenting with Chrome, not for tracking. B…
Yeah, and that sounds totally plausible. That Google need to send "experimental headers" to a hardcoded domain for an advertising company they bought a decade or so back - because of course the results of web browser experiments should go to an advertising company (or these days th advertising division of a company) ad not, say, to google's own domain? /s
Google are totally lying here.
Re: Massive spying on users of Google's Chrome shows new security weakness
#64Earlier quoted context omitted.
I see, thanks. I'm looking at that source and confused what it's actually doing though. What is the "tracking" aspect? I see ShouldAppendHeaders() returns true on doubleclick.net, but on the face of it, it seems to just be saying: "Should we send experimental headers to this URL? If it's doubleclick.net, then yes." But they claim [1] this X-Client-Data header is used for experimenting with Chrome, not for tracking. B…
Because the statement is deliberately ambiguous, and doesn't say they do not use it for tracking. "The X-Client-Data header is used to help Chrome test new features before rolling them out to all users. The information included in this header reflects the variations, or new feature trials, in which an installation of Chrome is currently enrolled. This information helps us measure server-side metrics for large groups…
I have no clue if they're lying or not, and I'm open to the possibility that they are, but you're not really making a good case for it here. It's pretty disingenuous to claim they track users and base it on lack of mathematically airtight evidence that they don't. That's not how accusations are supposed to work, right? I might as well claim you're a burglar because there's nothing to indicate you're not one.
If you want to say you think they're tracking people because of reasons X/Y/Z, or that what they're doing looks suspicious, that's a lot better of an argument. But to claim they are with no evidence of it actually happening is really pushing it.
Re: Massive spying on users of Google's Chrome shows new security weakness
#65Earlier quoted context omitted.
Wow talk about revisionism! Chrome was meant as a hedge against IE and lesser so against Firefox. Microsoft owned the desktop with Windows and could easily shut Google out. See the reason surrounding the creation of the Google toolbar. Similarly Android is a hedge against IOS and mobile search.
Yes and no. If Google only wanted to hedge against IE they could have just contributed to Mozilla/Firefox. They clearly also wanted total control.
If Google wanted to support open standards and reduce reliance on IE, they wouldn't have targeted Firefox customers with Chrome ads on YouTube and Google aggressively.
Now, Firefox and Safari will protect customers against tracking (measures against third-party cookies) while Chrome won't do anything -- because that's where the cash is.
Re: Massive spying on users of Google's Chrome shows new security weakness
#66I've been developing Chrome extensions full-time for about a year now [1], and it's honestly terrifying just how much access extensions have to sensitive user data.
Best practices I've adopted for my own extension use:
- Create a separate test Chrome profile to try out extensions
- Delete extensions that ask for the overly broad "Read and change all your data on the websites you visit" permission unless (a) the extension is open-source (b) backed by a reputable company or (c) has a very good reason for requesting it, and I trust the makers
One of the biggest issues with extensions today is the permissions model. On more established platforms like iOS and Android, all sensitive permissions have to be requested at runtime rather than at install-time, which forces developers to explain why they need the permissions they ask for. With browser extensions, there's no such requirement, which leads many developers to ask for all the permissions they can get because there's no downside to doing so. That's why over 80% of the top 1000 extensions ask for access to ALL domains [2], which means they have the power to steal any of your data (emails, passwords, etc.) on any site if they wanted or became compromised.
I've written about this issue before [3] and the good news is that with Manifest V3, the Chrome team is planning to require that host permissions (which specifies the domains an extension can run on) be requested at runtime. I think the team should go even further and enforce the runtime restriction for all sensitive permissions, not just host permissions — if you agree, feel free to chime in on the post I made about it on the chromium-extensions mailing list [4].
The extension ecosystem is pretty broken right now security and privacy-wise, but with the upcoming changes, it's headed in a better direction.
[1] https://news.ycombinator.com/item?id=22936742
[2] https://docs.google.com/document/d/1nPu6Wy4LWR66EFLeYInl3Nzz...
[3] https://www.notion.so/dkthehuman/Day-4-The-Dangers-of-Chrome...
[4] https://groups.google.com/a/chromium.org/d/msg/chromium-exte...
Re: Massive spying on users of Google's Chrome shows new security weakness
#67The other side of this is the many complaints in HN threads about restrictions on what extensions can do and which ones are allowed. I can't say whether chrome's extension library strikes the right balance, but I think it's a difficult tradeoff.
Instead of just outright limiting extensions you could give users the choice. Give us an option to make it impossible for extensions to send out data for example.
Maybe also introduce a paranoia button where every request can be vetted in its context, so every request you get to see the code and a button permit or not.
Re: Massive spying on users of Google's Chrome shows new security weakness
#68Earlier quoted context omitted.
> This would make sense if they needed to collect that information organically, but there's already requests made to Google as soon as Chrome launches. So, no, it's not required for analytics. Wait what? You don't think there's analytics that can be done about the browser itself? Let's say chrome ships a new experiment, that when enabled on certain devices uses 100% of the CPU until chrome is closed. Analytics sent o…
Let me put it another way. Do you think the average user knows of or would approve of Google Chrome itself sending information to an advertising network that could be used to track their behaviors and identity? Do you think this "feature" is adequately disclosed to customers downloading Google Chrome, that it includes a DoubleClick tracking backdoor that no other ad network or website receives.
Given that
> that it includes a DoubleClick tracking backdoor that no other ad network or website receives.
is false, yes, I think the disclosures are reasonable. Your standard of disclosure is that companies need to disclose things that they aren't actually doing. That's ridiculous.
Re: Massive spying on users of Google's Chrome shows new security weakness
#69Earlier quoted context omitted.
Wow talk about revisionism! Chrome was meant as a hedge against IE and lesser so against Firefox. Microsoft owned the desktop with Windows and could easily shut Google out. See the reason surrounding the creation of the Google toolbar. Similarly Android is a hedge against IOS and mobile search.
Android was being developed before IOS, and had a prototype phone in 2006. If anything, Windows Mobile was probably what they feared.
Windows Mobile was as good as dead on most markets. If anything, the competition was against Symbian, and to a lesser extent against Blackberry.
Re: Massive spying on users of Google's Chrome shows new security weakness
#70Earlier quoted context omitted.
Because the statement is deliberately ambiguous, and doesn't say they do not use it for tracking. "The X-Client-Data header is used to help Chrome test new features before rolling them out to all users. The information included in this header reflects the variations, or new feature trials, in which an installation of Chrome is currently enrolled. This information helps us measure server-side metrics for large groups…
I have no clue if they're lying or not, and I'm open to the possibility that they are, but you're not really making a good case for it here. It's pretty disingenuous to claim they track users and base it on lack of mathematically airtight evidence that they don't. That's not how accusations are supposed to work, right? I might as well claim you're a burglar because there's nothing to indicate you're not one. If you w…
It's an advertising company making a statement about a "feature" in their browser that phones home to advertising domains with information that could be used for tracking purposes. You don't think that deserves extreme scrutiny? Do you think that statement was made by a random developer or filtered through 100 PR and legal people?
Every single word of that statement was carefully crafted and constructed. Knowing that, why is it so ambiguous?