Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Massive spying on users of Google's Chrome shows new security weakness

reuters.com

Post reply on HN
Print view View original

31–40 of 270 posts

Re: Massive spying on users of Google's Chrome shows new security weakness

#31

Post by 0xy »

mehrdadn wrote: post #28
0xy wrote: post #24

Earlier quoted context omitted.

IE had bad standards support and bad defaults, while Chrome will actively track you on practically every site by sending an identifier to a whitelist including DoubleClick. Would you be defending it if it was called "DoubleClick Browser"? Google wants to secure the status quo with their own browser. What is the status quo? Massive spying, surveillance and tracking. This is why Safari and Firefox implemented strict me…

Are you talking about Chrome or Chromium?

Chromium, but they're effectively the same. The average user doesn't know what Chromium is.

https://chromium.googlesource.com/chromium/src/+/e51dcb0c148...

Re: Massive spying on users of Google's Chrome shows new security weakness

#32

Post by tannhaeuser »

Is Chromium safe to use, or at least safe to use as packaged with Ubuntu's snaps? I know, I know, snaps are a difficult topic on their own, but my point is that, if Chrome's (and Edge's AFAIK) general hunger for data is a generally accepted fact at this point, then wouldn't employers/enterprises advising to use Chrome in their corporate networks not put themselves under risk of being sued for gross neglect in case customer data were leaking from Chrome sessions?

Re: Massive spying on users of Google's Chrome shows new security weakness

#33

Post by 0xy »

joshuamorton wrote: post #29
0xy wrote: post #21

Earlier quoted context omitted.

Why is DoubleClick in the whitelist?

Presumably, since, as the list you're referring to mentions, it's a Google owned property, and accessed by a lot of people, even those who don't usually access other google properties, which makes it really useful for analytics on a broader selection of sites/connections. Like, the function you're referring to, `IsGoogleAssociatedDomainUrl`, seems to only be used to log some information about https. Or at least that'…

This would make sense if they needed to collect that information organically, but there's already requests made to Google as soon as Chrome launches. So, no, it's not required for analytics. [1]

That leaves... ad tracking. Chrome will send a tracking ID to DoubleClick with every request to that host. Doesn't this prove that Chrome is a trojan horse used for ads and tracking purposes?

[1] https://twitter.com/jonathansampson/status/11654932064417792...

Re: Massive spying on users of Google's Chrome shows new security weakness

#34

Post by fulafel »

ThePhysicist wrote: post #7

There is a web intelligence company in Israel that is known to buy popular browser extensions like “Web of Trust” and use them to exfiltrate browsing data (with tons of sensitive and personal information). They have been called out for this several times already and some of their extensions got removed from the store, they invariably turn back up again after a few weeks though (good connections to Google/Mozilla I gu…

Re security measures: these features have sadly been put under "enterprise" stuff but they are there:

https://support.google.com/chrome/a/answer/9296680?hl=en

I wonder if there could be a community pseudo-enterprise that could eg have a reasonable whitelist of extensions...

edit: whoops, that was a windows-only guide despite the title, here are linux / mac links: https://support.google.com/chrome/a/answer/7517525#permissio... https://support.google.com/chrome/a/answer/7517624?hl=en&ref...

Re: Massive spying on users of Google's Chrome shows new security weakness

#35

Post by mehrdadn »

0xy wrote: post #31
mehrdadn wrote: post #28

Earlier quoted context omitted.

Are you talking about Chrome or Chromium?

Chromium, but they're effectively the same. The average user doesn't know what Chromium is. https://chromium.googlesource.com/chromium/src/+/e51dcb0c148...

I see, thanks. I'm looking at that source and confused what it's actually doing though. What is the "tracking" aspect? I see ShouldAppendHeaders() returns true on doubleclick.net, but on the face of it, it seems to just be saying: "Should we send experimental headers to this URL? If it's doubleclick.net, then yes." But they claim [1] this X-Client-Data header is used for experimenting with Chrome, not for tracking. But you're claiming they're using it for tracking, so you're claiming they're lying... which I mean is certainly possible, but I see no evidence for it. What's your basis for claiming they're lying with such certainty?

[1] https://9to5google.com/2020/02/06/google-chrome-x-client-dat...

Re: Massive spying on users of Google's Chrome shows new security weakness

#36

Post by ponker »

ThePhysicist wrote: post #7

There is a web intelligence company in Israel that is known to buy popular browser extensions like “Web of Trust” and use them to exfiltrate browsing data (with tons of sensitive and personal information). They have been called out for this several times already and some of their extensions got removed from the store, they invariably turn back up again after a few weeks though (good connections to Google/Mozilla I gu…

Why is this business model usually from Israel?

Re: Massive spying on users of Google's Chrome shows new security weakness

#37

Post by joshuamorton »

0xy wrote: post #33
joshuamorton wrote: post #29

Earlier quoted context omitted.

Presumably, since, as the list you're referring to mentions, it's a Google owned property, and accessed by a lot of people, even those who don't usually access other google properties, which makes it really useful for analytics on a broader selection of sites/connections. Like, the function you're referring to, `IsGoogleAssociatedDomainUrl`, seems to only be used to log some information about https. Or at least that'…

This would make sense if they needed to collect that information organically, but there's already requests made to Google as soon as Chrome launches. So, no, it's not required for analytics. [1] That leaves... ad tracking. Chrome will send a tracking ID to DoubleClick with every request to that host. Doesn't this prove that Chrome is a trojan horse used for ads and tracking purposes? [1] https://twitter.com/jonathans…

> This would make sense if they needed to collect that information organically, but there's already requests made to Google as soon as Chrome launches. So, no, it's not required for analytics.

Wait what? You don't think there's analytics that can be done about the browser itself? Let's say chrome ships a new experiment, that when enabled on certain devices uses 100% of the CPU until chrome is closed. Analytics sent on browser startup would provide insight into that.

If you're asking why they need both:

having analytics in the context of a given page is also useful. If you can see that different experiments in chrome cause different performance impacts when loading the same page, that's also useful data that you can't get from analytics sent on startup. Nor could you centralize the logging of that information, as it would essentially be sending your browser history to Google all in one request, which is even easier to track.

> Doesn't this prove that Chrome is a trojan horse used for ads and tracking purposes?

Bluntly, no.

Re: Massive spying on users of Google's Chrome shows new security weakness

#38

Post by boomboomsubban »

dontblink wrote: post #19
0xy wrote: post #5

I wonder if these extensions are so hard to spot because spying is a core feature of Google Chrome, and most top extensions do this. For example, the extraordinarily popular extension Honey phones home about your purchases, shopping habits and other data without adequately disclosing that fact. It's hard to see why Google would care when Chrome was always a trojan horse to co-opt web standards for their own purposes…

Wow talk about revisionism! Chrome was meant as a hedge against IE and lesser so against Firefox. Microsoft owned the desktop with Windows and could easily shut Google out. See the reason surrounding the creation of the Google toolbar. Similarly Android is a hedge against IOS and mobile search.

Android was being developed before IOS, and had a prototype phone in 2006. If anything, Windows Mobile was probably what they feared.
Post reply on HN