6 ms·

Maybe for some people Google owning their data is worse than the odds that they will be targeted by the latest exploits.

witty_username 10y ago
I've configured Chrome to not send my address bar to Google and to encrypt my sync with a custom passphrase. What data does Google own?
- CaptSpify 10y ago
  Have you done any network monitoring to see if Chrome is sending anything back to Google?
  - witty_username 10y ago
    No. But I use Chromium so the source code is open. I mean if we're going to go to this level of paranoid; then we might as well look at attacks on Firefox (which have been suspected to be used by the NSA against Tor Browser).
    - deleted 10y ago
      [deleted]
    - CaptSpify 10y ago
      I'm curious as to why you think checking network connections is paranoia. As a sysadmin, I routinely log and check many of my network connections, though I have not done that for my browser.
      - witty_username 10y ago
        No, I meant that suspecting Chrome of covertly sending data to Google (without telling us) is paranoia. Especially since the source code is open.
        CaptSpify 10y ago
        I would disagree. I'd genuinely be surprised if google made it that easy to not send anything back to them. Additionally, I'd be genuinely surprised if FF made it that simple to avoid sending things back to Mozilla. It's less about being covert, and more about having multiple settings to send different types of data back.
  - mda 10y ago
    Have you? So what does it send back?
    - reitanqild 10y ago
      I think GPs point was the uncertainty, which I think is a valid point either way.
      - lorenzhs 10y ago
        Well, "I haven't bothered to check so for all I know it could be doing tons of bad things" isn't really a valid argument.
        rickycook 10y ago
        it is if your mistrust for google outweighs your time to check these things... maybe in that case you shouldn't say "for sure google is doing bad things" but you can mistrust and not use a product for fear of the company that produces it without current evidence
        CaptSpify 10y ago
        who is making that argument?
    - deleted 10y ago
      [deleted]
    - DavideNL 10y ago
      For example, I noticed a while back that the Chrome/Chromium browsers send the dns lookup of every website you visit to Google's own dns servers - even though i have NOT configured them in my OS. (You can easily check this with an app like Little Snitch, look for the browser connecting to IPs 8.8.8.8 and 8.8.4.4)
      - konart 10y ago
        Which is why I can't use chrome at work at all. Google's services and DNS are blocked by admins, so when you try to open any site you get DNS_LOOKUP_FAILED error.
  - justinschuh 10y ago
    There's no reason for FUD. We've always listed all potential data transmission or collection in this regularly updated whitepaper: https://www.google.com/chrome/browser/privacy/whitepaper.html https://www.google.com/chrome/browser/privacy/whitepaper.htm...
    - nailer 10y ago
      That's an excellent resource but the poster you're replying to simply asked if he'd done a tcpdump, accusing them of spreading FUD isn't necessary.
    - CaptSpify 10y ago
      What did I say that was FUD? I'm legitimately curious if he's checked and seen any data being sent to google *edit: I'd genuinely be surprised if google made it that easy to not send anything back to them. Additionally, I'd be genuinely surprised if FF made it that simple to avoid sending things back to Mozilla.
- akerro 10y ago
  > I've configured Chrome to not send my address bar to Google and to encrypt my sync with a custom passphrase. Remove physical microphone from your computer, Chome will turn it on randomly and send recordings to Google.
  - TeMPOraL 10y ago
    [citation needed]
    - akerro 10y ago
      https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=786909 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=786909 this history is long, search on your own for more.
      - justinschuh 10y ago
        Please don't spread misinformation. Here are the facts: 1. While the Hotword module was downloaded at startup, the feature was not activated without the user explicitly enabling it via the settings menu. <https://crbug.com/500922#c6> https://crbug.com/500922#c6> 2. Downloading the module in Chromium was a bug, and it was fixed after being reported. <https://crbug.com/50922#30> https://crbug.com/50922#30> 3. The Hotword feature was dropped from Chrome not too long after, because it was an experiment that never really panned out (and was enabled by very few people).
rtpg 10y ago
Given current ransomware trends, that seems like setting up a bunker but crossing a highway on foot daily. Sure, the nukes won't get you, but those cars will. It's not that you're not allowed to worry about google holding your data (of course it is!), but it's pretty unsafe to be on the 'net without being properly patched. If I had to set about this, I would have an upstream fork of Chromium that would patch the various networking functions to blacklist known google domains, and then offer a flag to ignore the blacklist in the "obvious" spots (like when you go to google.com). Probably not perfect, but a bit safer. If you're super serious, you could just 404 all access to google.
- lucideer 10y ago
  Users should absolutely use the latest version of a browser, and it is dangerous on the web, but I'd agree with wfunction that your analogy veers slightly into the hyperbolic. I'm currently doing work in an office of ~30 people where the IT support company (supposedly accidentally) set up this lovely policy https://i.ytimg.com/vi/rC4FQwYXIok/maxresdefault.jpg https://i.ytimg.com/vi/rC4FQwYXIok/maxresdefault.jpg which was in place for about a year before I noticed it on a colleague's computer. Pretty terrible security-wise, but no-one's been hit by a car to my knowledge.
- wfunction 10y ago
  > Given current ransomware trends, that seems like setting up a bunker but crossing a highway on foot daily. Sure, the nukes won't get you, but those cars will. I haven't updated Chrome in quite a while. My computer's been running just fine. I'm pretty sure I would've died if I'd tried to cross highways as you mentioned all this time. So I think something about the comparison doesn't smell right.
  - rtpg 10y ago
    Hey some people win the lottery, right? The relative odds aren't quite right, but consider how many people you might know who lost their PCs to virii, compared to people compromised by their Google searches.... Maybe it's a wash ;) I think your likelyhood of getting your PC messed up is pretty dependant on habits too. You're much more likely to get hit by drive-by adware if you're (on Windows and) going to those random illegal streaming sites to watch some show than if you're reading HN. An example: I was on a less than stellar video hosting site, and a bunch of pop-ups got me to accidentally download "FlashPlayer.dmg" I'm pretty well versed in this stuff! And they got me to download this right as I was going to watch this video. If I didn't know better, it would have been like all those other plugin updaters (of course you need root to install flash right?) Of course, updated Chrome didn't prevent this case for me...

witty_username 10y ago

I've configured Chrome to not send my address bar to Google and to encrypt my sync with a custom passphrase. What data does Google own?

CaptSpify 10y ago
Have you done any network monitoring to see if Chrome is sending anything back to Google?
- witty_username 10y ago
  No. But I use Chromium so the source code is open. I mean if we're going to go to this level of paranoid; then we might as well look at attacks on Firefox (which have been suspected to be used by the NSA against Tor Browser).
  - deleted 10y ago
    [deleted]
  - CaptSpify 10y ago
    I'm curious as to why you think checking network connections is paranoia. As a sysadmin, I routinely log and check many of my network connections, though I have not done that for my browser.
    - witty_username 10y ago
      No, I meant that suspecting Chrome of covertly sending data to Google (without telling us) is paranoia. Especially since the source code is open.
      - CaptSpify 10y ago
        I would disagree. I'd genuinely be surprised if google made it that easy to not send anything back to them. Additionally, I'd be genuinely surprised if FF made it that simple to avoid sending things back to Mozilla. It's less about being covert, and more about having multiple settings to send different types of data back.
- mda 10y ago
  Have you? So what does it send back?
  - reitanqild 10y ago
    I think GPs point was the uncertainty, which I think is a valid point either way.
    - lorenzhs 10y ago
      Well, "I haven't bothered to check so for all I know it could be doing tons of bad things" isn't really a valid argument.
      - rickycook 10y ago
        it is if your mistrust for google outweighs your time to check these things... maybe in that case you shouldn't say "for sure google is doing bad things" but you can mistrust and not use a product for fear of the company that produces it without current evidence
      - CaptSpify 10y ago
        who is making that argument?
  - deleted 10y ago
    [deleted]
  - DavideNL 10y ago
    For example, I noticed a while back that the Chrome/Chromium browsers send the dns lookup of every website you visit to Google's own dns servers - even though i have NOT configured them in my OS. (You can easily check this with an app like Little Snitch, look for the browser connecting to IPs 8.8.8.8 and 8.8.4.4)
    - konart 10y ago
      Which is why I can't use chrome at work at all. Google's services and DNS are blocked by admins, so when you try to open any site you get DNS_LOOKUP_FAILED error.
- justinschuh 10y ago
  There's no reason for FUD. We've always listed all potential data transmission or collection in this regularly updated whitepaper: https://www.google.com/chrome/browser/privacy/whitepaper.html https://www.google.com/chrome/browser/privacy/whitepaper.htm...
  - nailer 10y ago
    That's an excellent resource but the poster you're replying to simply asked if he'd done a tcpdump, accusing them of spreading FUD isn't necessary.
  - CaptSpify 10y ago
    What did I say that was FUD? I'm legitimately curious if he's checked and seen any data being sent to google *edit: I'd genuinely be surprised if google made it that easy to not send anything back to them. Additionally, I'd be genuinely surprised if FF made it that simple to avoid sending things back to Mozilla.
akerro 10y ago
> I've configured Chrome to not send my address bar to Google and to encrypt my sync with a custom passphrase. Remove physical microphone from your computer, Chome will turn it on randomly and send recordings to Google.
- TeMPOraL 10y ago
  [citation needed]
  - akerro 10y ago
    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=786909 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=786909 this history is long, search on your own for more.
    - justinschuh 10y ago
      Please don't spread misinformation. Here are the facts: 1. While the Hotword module was downloaded at startup, the feature was not activated without the user explicitly enabling it via the settings menu. <https://crbug.com/500922#c6> https://crbug.com/500922#c6> 2. Downloading the module in Chromium was a bug, and it was fixed after being reported. <https://crbug.com/50922#30> https://crbug.com/50922#30> 3. The Hotword feature was dropped from Chrome not too long after, because it was an experiment that never really panned out (and was enabled by very few people).

rtpg 10y ago

Given current ransomware trends, that seems like setting up a bunker but crossing a highway on foot daily. Sure, the nukes won't get you, but those cars will. It's not that you're not allowed to worry about google holding your data (of course it is!), but it's pretty unsafe to be on the 'net without being properly patched. If I had to set about this, I would have an upstream fork of Chromium that would patch the various networking functions to blacklist known google domains, and then offer a flag to ignore the blacklist in the "obvious" spots (like when you go to google.com). Probably not perfect, but a bit safer. If you're super serious, you could just 404 all access to google.

lucideer 10y ago
Users should absolutely use the latest version of a browser, and it is dangerous on the web, but I'd agree with wfunction that your analogy veers slightly into the hyperbolic. I'm currently doing work in an office of ~30 people where the IT support company (supposedly accidentally) set up this lovely policy https://i.ytimg.com/vi/rC4FQwYXIok/maxresdefault.jpg https://i.ytimg.com/vi/rC4FQwYXIok/maxresdefault.jpg which was in place for about a year before I noticed it on a colleague's computer. Pretty terrible security-wise, but no-one's been hit by a car to my knowledge.
wfunction 10y ago
> Given current ransomware trends, that seems like setting up a bunker but crossing a highway on foot daily. Sure, the nukes won't get you, but those cars will. I haven't updated Chrome in quite a while. My computer's been running just fine. I'm pretty sure I would've died if I'd tried to cross highways as you mentioned all this time. So I think something about the comparison doesn't smell right.
- rtpg 10y ago
  Hey some people win the lottery, right? The relative odds aren't quite right, but consider how many people you might know who lost their PCs to virii, compared to people compromised by their Google searches.... Maybe it's a wash ;) I think your likelyhood of getting your PC messed up is pretty dependant on habits too. You're much more likely to get hit by drive-by adware if you're (on Windows and) going to those random illegal streaming sites to watch some show than if you're reading HN. An example: I was on a less than stellar video hosting site, and a bunch of pop-ups got me to accidentally download "FlashPlayer.dmg" I'm pretty well versed in this stuff! And they got me to download this right as I was going to watch this video. If I didn't know better, it would have been like all those other plugin updaters (of course you need root to install flash right?) Of course, updated Chrome didn't prevent this case for me...