Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Massive spying on users of Google's Chrome shows new security weakness

reuters.com

Post reply on HN
Print view View original

21–30 of 270 posts

Re: Massive spying on users of Google's Chrome shows new security weakness

#21

Post by 0xy »

sandstrom wrote: post #18
0xy wrote: post #5

I wonder if these extensions are so hard to spot because spying is a core feature of Google Chrome, and most top extensions do this. For example, the extraordinarily popular extension Honey phones home about your purchases, shopping habits and other data without adequately disclosing that fact. It's hard to see why Google would care when Chrome was always a trojan horse to co-opt web standards for their own purposes…

Here are more details about 'X-Client-Data'. I'm not saying it's necessarily a good practice (and maybe it's something they should stop doing), but I wouldn't call it "spying". It's analytics, used to test new Chrome features. https://9to5google.com/2020/02/06/google-chrome-x-client-dat...

Why is DoubleClick in the whitelist?

Re: Massive spying on users of Google's Chrome shows new security weakness

#22

Post by ketzu »

TheChaplain wrote: post #9

I'd say most such issues with extensions could be solved if they were "read-only", i.e. were prevented from inserting data into documents, making or adding data into outbound requests.

Unfortunately that would also remove the reason that people are using the extension in the first place.

Re: Massive spying on users of Google's Chrome shows new security weakness

#23

Post by bartkappenburg »

I would pay money for an extension that keeps track on datatraffic of other installed extension and creates firewall rules (or something equivalent) based on my permission/deny. (I know that this is the other way around, but apparantly chrome isn't fixing these data issues...)

Re: Massive spying on users of Google's Chrome shows new security weakness

#24

Post by 0xy »

dontblink wrote: post #19
0xy wrote: post #5

I wonder if these extensions are so hard to spot because spying is a core feature of Google Chrome, and most top extensions do this. For example, the extraordinarily popular extension Honey phones home about your purchases, shopping habits and other data without adequately disclosing that fact. It's hard to see why Google would care when Chrome was always a trojan horse to co-opt web standards for their own purposes…

Wow talk about revisionism! Chrome was meant as a hedge against IE and lesser so against Firefox. Microsoft owned the desktop with Windows and could easily shut Google out. See the reason surrounding the creation of the Google toolbar. Similarly Android is a hedge against IOS and mobile search.

IE had bad standards support and bad defaults, while Chrome will actively track you on practically every site by sending an identifier to a whitelist including DoubleClick.

Would you be defending it if it was called "DoubleClick Browser"?

Google wants to secure the status quo with their own browser. What is the status quo? Massive spying, surveillance and tracking.

This is why Safari and Firefox implemented strict measures against third-party cookies which Chrome watered down until it was practically useless or didn't implement at all.

If Chrome is such an open and independent project, what do you think are the chances of a PR being approved that removed DoubleClick from the tracking header whitelist?

Re: Massive spying on users of Google's Chrome shows new security weakness

#27

Post by Mirioron »

DuckConference wrote: post #3

The other side of this is the many complaints in HN threads about restrictions on what extensions can do and which ones are allowed. I can't say whether chrome's extension library strikes the right balance, but I think it's a difficult tradeoff.

Instead of just outright limiting extensions you could give users the choice. Give us an option to make it impossible for extensions to send out data for example.

Re: Massive spying on users of Google's Chrome shows new security weakness

#28

Post by mehrdadn »

0xy wrote: post #24
dontblink wrote: post #19

Earlier quoted context omitted.

Wow talk about revisionism! Chrome was meant as a hedge against IE and lesser so against Firefox. Microsoft owned the desktop with Windows and could easily shut Google out. See the reason surrounding the creation of the Google toolbar. Similarly Android is a hedge against IOS and mobile search.

IE had bad standards support and bad defaults, while Chrome will actively track you on practically every site by sending an identifier to a whitelist including DoubleClick. Would you be defending it if it was called "DoubleClick Browser"? Google wants to secure the status quo with their own browser. What is the status quo? Massive spying, surveillance and tracking. This is why Safari and Firefox implemented strict me…

Are you talking about Chrome or Chromium?

Re: Massive spying on users of Google's Chrome shows new security weakness

#29

Post by joshuamorton »

0xy wrote: post #21
sandstrom wrote: post #18

Earlier quoted context omitted.

Here are more details about 'X-Client-Data'. I'm not saying it's necessarily a good practice (and maybe it's something they should stop doing), but I wouldn't call it "spying". It's analytics, used to test new Chrome features. https://9to5google.com/2020/02/06/google-chrome-x-client-dat...

Why is DoubleClick in the whitelist?

Presumably, since, as the list you're referring to mentions, it's a Google owned property, and accessed by a lot of people, even those who don't usually access other google properties, which makes it really useful for analytics on a broader selection of sites/connections.

Like, the function you're referring to, `IsGoogleAssociatedDomainUrl`, seems to only be used to log some information about https. Or at least that's all I found from searching for it. So it's even less innocuous, the use appears to be "we'd like to know if our sites are broken under HTTPS", vs. just HTTPS being broken in general.

[I work at Google, but don't work anywhere near chrome, and I know basically nothing about it]

Edit: You were referring to a different spot (experiments), where what I originally said applies. Having more analytics is really useful when trying to diagnose problems.

Re: Massive spying on users of Google's Chrome shows new security weakness

#30

Post by ricardo81 »

bartkappenburg wrote: post #23

I would pay money for an extension that keeps track on datatraffic of other installed extension and creates firewall rules (or something equivalent) based on my permission/deny. (I know that this is the other way around, but apparantly chrome isn't fixing these data issues...)

While I only have limited experience writing extensions, this seems doable.

You can most definitely add a hook for every outgoing request, though I'm not sure if the browser lets you know the origin of the request, i.e. the browser window or an extension.

If it could, at the most basic level it could write outgoing data to a log file.

Post reply on HN