14 ms·
Chromium calls home even in incognito mode with safe browsing turned off
- kragen 11y agoMaybe it's updating its list of sites that are known to be infected with malicious code? Firefox does this, and it seems like a good idea to me. (I wish it didn't.) How is Chromium's malicious site filtering implemented? It's good to be transparent about this, but maybe this is something legitimate and safe that's already documented, and the Debian user and maintainer just haven't found the documentation yet.
- scintill76 11y agoThat's what "safe browsing turned off" (or "malware protection" in the report text) is ruling out.
- kragen 11y agoOh, thanks! I didn't understand that part.
- calpaterson 11y agoThe maintainer's reply is a sad statement on how hard it is just to package and distribute a modern web browser.
- api 11y agoPackaging and distributing anything for endpoint devices is a profound exercise in pain and suffering. If your target is anything other than a Mac or a phone, multiply it even further. It's a major driver of Internet centralization: things must be centralized to escape the deployment nightmare. It's exponentially easier to manage deployment on a handful of servers than it is to actually ship an app to users. With our app, we test our Windows build on Windows Vista, 2008 Server, 7, 2012 Server, 8, 8.1, and 10, on both x86 and x86_64. It always passes before we ship. Then inevitably we get bug reports: the UI won't open, device drivers won't install, the app mysteriously crashes, etc. Investigation always reveals some weird little variation or clashing piece of software on the customer's machine. Every Windows machine is a special snowflake, and as Windows machines run they accumulate 'OS rot' and gradually become less reliable (due to the mutability of the OS and dependencies). To fully test deployment you'd have to test hundreds of thousands of VMs with different software install histories, etc. In the end we have to tell people 'sorry, we tested with clean Windows installs on eight different versions, you're on your own.' Mac is the only tolerable deployment target and that's because it's a fascist dictatorship compared to Windows: uniform hardware, strict restrictions on OS modification, and enforced software conformity. Phones aren't too bad either but that's because they're also fascist dictatorships with locked-down OSes. Basically the modern OS is broken. Things are mutable that shouldn't be, process isolation is a joke, etc. Server OSes are broken too but at least if you own all the servers you can make sure they're all broken in the same way. Even there the trend is toward statically linked binaries (Go) and packaging apps as entire containers with their own OS (Docker) to basically deprecate the OS and achieve predictable deployment.
- r0m4n0 11y agoA fairly common practice is shipping applications utilizing Citrix to have end users remote into a citrix server to minimize the various configurations of a desktop application. Personally I dislike the architecture in that the user experience is compromised (glitchy/laggy/hacks for interfacing with the client) but it does return some of the control back to those managing the host
- skrebbel 11y agoInsightful! I didn't know it was that bad. Did your team ever consider using something like Turbo Studio (called Spoon Studio until recently), which is a bit like Docker, but different, and for Windows? Their promise is that they basically solve most of the problems you mention, so I'm curious how well it stands up in practice or why you choose not to use it. https://turbo.net/studio https://turbo.net/studio EDIT: I'm a bit confused: I just got two downvotes for asking a question. So just to be absolutely clear: I don't have any relationship with Turbo or whatsoever.
- given 11y agoYou shouldn't be confused. It's all just numbers and ideas. There isn't really such a thing as a "vote" or "clear" or even "Hacker News" apart from the idea you have of it in your mind.
- wsloth514 11y agoThis is in the Debian bug list, not on the chromium bug list. The maintainer who replied is not a chromium developer, so I don't blame him that he doesn't have a lot of time to look at chromium's source code since a 'modern web browser' is really big. I have built chromium from source before. The android application alone is 44MB, not including the libraries, just saying, for one person to 'look' at chromium will take awhile to do so. The person who replied did have a good comment with the 'chrome://net-internals/#sockets'. It will list specifically what this person is looking for.
- gjm11 11y agoHow so? He just says: this seems like it'll be hard to track down and I don't have much time to dedicate to it. I don't see how that says anything about (1) packaging and distributing specifically or (2) modern web browsers specifically. It just says that complex pieces of software can require a lot of work to debug. What am I missing?
- kbenson 11y agoIs this the hotword component[1][2] again? 1: https://news.ycombinator.com/item?id=9758759 https://news.ycombinator.com/item?id=9758759 2: https://news.ycombinator.com/item?id=9771212 https://news.ycombinator.com/item?id=9771212
- abraham 11y agoNo, the hotword component has been removed. https://productforums.google.com/forum/#!topic/chrome/6wIqlxPZq4o https://productforums.google.com/forum/#!topic/chrome/6wIqlx...
- blub 11y agoUsing a web browser from a company basing most of its income on web advertising does come with such unpleasantness. I was hoping mozilla would have their users' back, but a default install of Firefox also makes multiple connections to mozilla, google and other domains when started. Some extensions (notably NoScript and Ghostery) ping the mothership. Safari connects to configuration.apple.com and the google website blacklist. uBlock for Safari tries to update itself even if no one asked it to. Later edit: I have been told that I am perhaps being unfair to Mozilla. Let's see - I started reading https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections https://support.mozilla.org/en-US/kb/how-stop-firefox-making..., to see how I can stop Firefox from connecting to servers without being requested to. While it's nice that they provide this page, this article's breadth only serves to prove that this browser is out of control when it comes to making connections to servers by itself. I have the following settings: * disabled Firefox health report * disabled crash reporting * never check for updates * do not check for addon updates * block reported attack sites * block reported forgeries After reading the page, it turns out that I also have to disable the following from about:config: * the addons blocklist * link prefetching * DNS prefetching * speculative pre-connections * firefox Hello * tiles, even if they were already disabled from the UI * the default search engine geo-location * the what's new page * add-on metadata updating * the heartbeat For reference, here are the connections that Firefox tries to establish immediately after startup: Outgoing to self-repair.mozilla.org (54.230.200.16), Port https (443), Protocol TCP (6), 0 B sent, 0 B received Outgoing to shavar.prod.mozaws.net (52.26.89.67), Port https (443), Protocol TCP (6), 0 B sent, 0 B received Outgoing to safebrowsing.google.com (2a00:1450:4001:809::1005), Port https (443), Protocol TCP (6), 0 B sent, 0 B received Outgoing to tiles.r53-2.services.mozilla.com (52.25.98.110), Port https (443), Protocol TCP (6), 0 B sent, 0 B received Outgoing to cmp-cdn.ghostery.com (54.152.180.212), Port https (443), Protocol TCP (6), 0 B sent, 0 B received Outgoing to search.services.mozilla.com (54.69.18.27), Port https (443), Protocol TCP (6), 0 B sent, 0 B received
- newman314 11y agoIt would be nice if there was an extension/script that enabled "max privacy mode" by frobbing all these config bits.
- 11y ago
- BuckRogers 11y agoThese codebases are too large to vet easily, and I've always been suspicious of someone hiding something like this in plain sight. I'm a FF user since before 1.0 and I never switched to Chrome, for obvious reasons. I did keep Chromium as a media browser on Linux, now I'm done with Chromium too.
- deleted 11y ago[deleted]
- drstrangevibes 11y agobut isnt chromium open source?
- rockdoe 11y agoThat unfortunately doesn't make it easy to see where those requests are coming from, especially given that the vast majority of Chrome(ium) developers are from Google.
- AdmiralAsshat 11y agoBeing open source doesn't mean the source code is easy or quick to read.
- brudgers 11y agoSure. But the theory that open source prevents problems of this sort is a theory, not a universal law. The solution is social and based on trust. https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomp...
- wonkaWonka 11y agoI'm not puzzled, at all. In fact, I'm puzzled that your puzzled. What's hard to understand about maintaining radio silence? Does no one understand that keeping your mouth shut, and not accidentally blabbing packets across the network is ALSO a security posture? Anyone between you and The Mother Ship now has a shiney new target to MITM payloads at. Why do you hate freedom?
- srtjstjsj 11y agoNot blabbing packets across the network to a security provider, while blabbing packets across the network to many other hosts, is not a security posture. If you want radio silence, exit the program
- wonkaWonka 11y agoPah! I laugh at that answer. So, you mean to tell me that I'm not allowed presume that I might actually be in complete control of the machines my program is holding conversations with? Is that what you're saying?
- gpvos 11y agoIf you want to be in complete control, you need to understand the complete source code. Otherwise, you at least need to trust whoever wrote the software you're using.
- wonkaWonka 11y agoThings like this may represent a violation of trust, depending on who you are, where you live, and who you perceive your adversaries to be.
- jo909 11y agoI guess nobody is happy that chromium opens a undocumented network connection to transfer unknown data. But the biggest problem is that we don't (yet) _know_ exactly why and what is happening. Fortunately we can understand it by looking at the code, and somebody will do that. Then we can discuss if this was a violation of trust, a simple error, a useful feature etc.
- Justsignedup 11y agoCould be it is pinging home for synchronization and not actual browsing data.
- sigjuice 11y agoWhat do you mean by synchronization?
- agentdrtran 11y agoSync of tabs/bookmarks etc.
- mod 11y agoChromium & chrome sync all of your bookmarks, settings, etc across browsers. If I fav something in my mobile, it shows up in my desktop.
- azakai 11y agoThat should only happen when logged in, and given the context here, I assume the user was not logged in (since when you're logged in, all privacy is definitely completely lost).
- mackal 11y agoThe limited checking I did on my machine points to this, at least that's what the URLs in the code appeared to be for. Didn't really look at the code, just searched for the URLs.
- srtjstjsj 11y agoChromium is an open source branch of chrome, offered as a convenience. It is not a standalone product with its own goals. Shouldn't there be a "Chromium-Privacy" project that branches Chromium and reviews code changes, to keep it aligned with such goals?
- slasaus 11y ago> Shouldn't there be a "Chromium-Privacy" project that branches Chromium and reviews code changes, to keep it aligned with such goals? Maybe Iridium is what you're looking for. From their fp: > Iridium is a free, open, and libre browser modification of the Chromium code base, with privacy being enhanced in several key areas. Automatic transmission of partial queries, keywords, metrics to central services inhibited and only occurs with consent. In addition, all our builds are reproducible, and modifications are auditable, setting the project ahead of other secure browser providers. https://iridiumbrowser.de/ https://iridiumbrowser.de/
- kentonv 11y agoUnfortunately these forks -- of which there are many -- often fall behind Chromium's security updates and even introduce serious bugs of their own. E.g. "WhiteHat Aviator", another "security-oriented" fork, had this fiasco: https://plus.google.com/+JustinSchuh/posts/69qw9wZVH8z https://plus.google.com/+JustinSchuh/posts/69qw9wZVH8z Maybe Iridium has a better record but with so few eyes on them it's hard to have much confidence. Probably the best thing to do if you're worried about Chromium spying on you is to use Firefox.
- tptacek 11y agoMore went wrong with Aviator than that: they munged up the code rebranding it and made it much harder to track upstream. It also didn't start out open source!
- jsprogrammer 11y ago>It is not a standalone product with its own goals. Uh, what? >Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web. [0] [0] https://www.chromium.org/Home https://www.chromium.org/Home
- necessity 11y agoAnyone monitoring their connections has already noticed this long ago, I know I have. It is not a bug. If privacy is a concern you wouldn't (or at least shouldn't) be using chromium in the first place.
- copsarebastards 11y ago> If privacy is a concern you wouldn't (or at least shouldn't) be using chromium in the first place. Privacy is a concern for everyone, whether they understand that or not.
- bduerst 11y agoSo is oxygen, but I'm not going to carry a scuba tank with me everywhere. Just when I'm diving or doing something where it is equally important. Same reason you don't use TOR on a virtual machine over a drone mesh network to starbucks for the majority of your internet browsing.
- mborsuk 11y agobut then people know when your diving, if you carry all the time they won't know
- bduerst 11y agoAll they'll see is the diver's flag, just as all they'll see is a random computer on TOR at starbucks. Likewise, if you use the gear all the time, people will figure out that you're probably a scuba diver.
- jalfresi 11y agoYes but the expectation is that people around you aren't pumping poisonous fumes into the AC.
- copsarebastards 11y agoYou can say anything with faulty analogies. The fault in your analogy is that you seem to think that oxygen is somehow less important in situations where it's easily available. You say, "Just when I'm diving or doing something where it is equally important." But oxygen is always equally important. It's just that in most situations it's easily available to you: all you have to do is inhale. Your analogy isn't even internally correct, but even if it were, it still doesn't prove anything about privacy, because privacy isn't easily available, at least not over technological channels. Privacy isn't oxygen, so accurate claims about oxygen don't imply anything about privacy at all. Analogies are for explanation, not evidence. If you can't make an argument without an analogy, you're may want to consider that you're wrong.
- andor 11y agoChrome can log SSL keys if you want. There's need to speculate about "unknown" data. https://www.imperialviolet.org/2012/06/25/wireshark.html https://www.imperialviolet.org/2012/06/25/wireshark.html
- paulirish 11y agoI'll add that I can't find a report of this issue upstream on the Chromium issue tracker. :/ If we remember the hotword detection issue from a few months ago, once the issue was filed, Chrome engineers responded rather quickly. (As of today, hotword detection is 100% removed not just from Chromium but Chrome as well). If anyone can reproduce this issue, I'd like to help getting it filed so we can determine what's going on. Edit: We've found the upstream issue: http://crbug.com/498272 http://crbug.com/498272 In it, we've isolated two separate pings in this scenario. One is to grab an experiment status; we're looking into if this is neccessary. The other ping is for the component updater, to evaluate if your Chrome extensions should be updated. Neither of these pings report what sites you are visiting to Google.
- rattray 11y agoGreat response IMO. Thanks Paul!
- rdancer 11y agoYep, that AS is Google: $ whois 2a00:1450:4009:80c::200d [snip] inet6num: 2a00:1450::/29 netname: IE-GOOGLE-20091005 descr: Google Ireland Limited country: IE org: ORG-GIL4-RIPE
- awqrre 11y agoI don't think that chromium should call home at all but incognito mode is not about this... it is about not leaving traces of your browsing history on the local computer.
- chrisfosterelli 11y agoAgreed. They actually specifically say that when you open an incognito tab...
- gopowerranger 11y agoBut what is home?
- PedroBatista 11y agoBaby don't spy on me, don't spy on me No more.
- gopowerranger 11y agoWho?
- toyg 11y agoHaddaway.
- deleted 11y ago[deleted]
- pmarin 11y agoGoogle
- pavement 11y agoThere's an implicit corollary that, if your trying to avoid leaving behind traces of activity on your own computer, you probably would also like to minimize traces of activity left behind on other computers as well. This might carry the expectation that unintentional interactions with other systems should be eliminated, since, the fewer systems touched, means the fewer traces of said activity there are in the entire world, no?
- deleted 11y ago[deleted]
- jryan49 11y agoIf you're using incognito mode for anything more than not recording local browser history, I think you're using it wrong.
- daveloyall 11y agoI use incognito mode to get Chrome (or Firefox) to pretend to have an empty cookie jar. So that I can log into some site again with a different account, for example.
- lfender6445 11y agoand to prevent installed extensions from running.
- vacri 11y agoI routinely use it to test alternate logins, given that it behaves as a separate browser session.
- godgod 11y agoHow google of them.
- drdaeman 11y agoWhat's this about? The link doesn't contain any useful information besides that Chromium was somehow opened "in incognito mode" (there's no such thing, incognito mode applies to windows, not browser itself) and there are some connections spotted. No information whenever Chromium had sync enabled, whenever it has Google account associated, whenever it has any extensions installed, etc. Say, I see a C2DM connection to get push notifications about updates. Whenever it's legit or not depends on the context. If browser's core has logged in user and a bunch of extensions installed, I'd say it's a bug if said connection is not present, even if no non-incognito windows are open at the moment.