3 ms·

The signing into an account in Chrome almost got someone fired at a small customer of mine a few weeks ago. Fortunately they called me first to look into it, I

The signing into an account in Chrome almost got someone fired at a small customer of mine a few weeks ago. Fortunately they called me first to look into it, I pointed out that the porn bookmarks in question were years old and that since Chrome was signed into a personal account it was pretty likely that the same account had been used by other family members at home. I also wrote this up for the owners to send to their staff, feel free to reuse if appropriate for you: We’ve seen at least one situation recently where a user “signed in” to Chrome when prompted, which brought that user’s personal bookmarks and website logins onto their work computer. While Chrome offers this as an option, there are no situations where your personal account should be linked to a browser at work – if you need to be using personal email, etc. please do so from your own phone or other device on your own time. This is for your own privacy and security as well as for the practice – we want to not have your personal data on our systems, and you don’t want your private email, bookmarks, etc. accessible to anyone else who happens to be at your desk while you’ve stepped away. If you have linked your browser to a personal account, please remove that connection using the instructions below. You can check whether Chrome is linked to an online account by clicking on the small person icon at the top right corner of the window – just to the left of the “X” to close the window. • If you click on that and it asks you to sign in, you’re not linked to an account. • If you click on that and it lists a personal account, click on “Manage People” to open a new window listing connected accounts. On each account there are 3 dots in the top right corner – click those and “Remove this person” • If you see a name rather than a generic person icon, click on that and use “Manage People” to remove that connected account. Firefox offers a similar but less-used version of this that would have required creating a Firefox account to use Firefox Sync. If you have done this with Firefox please disconnect it; if you’re not sure then you almost certainly haven’t done this in Firefox and don’t need to worry about it.

dewiz 9y ago
This story would deserve a blog post of its own. Google might not realize it, but the ease of being tracked by them is also a risk in work place.
- justatdotin 9y ago
  > Google might not realize it, LOL
sangnoir 9y ago
> I pointed out that the porn bookmarks in question were years old and that since Chrome was signed into a personal account it was pretty likely that the same account had been used by other family members at home. So the offence was merely having porn bookmarks in their browser - not visiting porn sites at work? Wow.
- Mayzie 9y ago
  Eh, I mean fair enough. Somebody else goes to use the browser and notices the bookmarks, what else would they expect?
- gatmne 9y ago
  I imagine porn bookmarks showing up in an official screencast, presentation, or live product demo would do wonders to a company's image and reputation.
- fencepost 9y ago
  This is in an environment with multiple people at a long open desk with patients on the other side of the counter. Someone sat down to check something, or check someone in or out, I don't know the details. They hit the Bookmarks button, and right there on the list was a PornHub link to something about a teen and anal sex. This caused a bit of an uproar about inappropriate use of the computer systems, though it may have stayed behind closed doors. It wouldn't surprise me a bit if the person whose account it was didn't even know that bookmarks exist in Chrome - it's not like Google makes it obvious these days. I suspect there were some awkward discussions at home that evening, or possibly on the phone with college-age children.
scottlamb 9y ago
I think the idea that you only access personal stuff from your own devices on your own time is unrealistic. There are restricted environments (intelligence agencies and such) where it's necessary, but outside of those I think people commonly expect that if they get their work done and avoid illegal / pornographic / other NSFW content, they can do some personal browsing at work, typically on work-owned hardware. The company can expect otherwise, but it may not work out well for morale / staff retention. I don't know anyone who comes in, maintains 100% focus on work for 8+ hours, and then goes home. Of course, if someone is signing into their personal account using work hardware, they're basically saying they trust the company not to do any intrusive monitoring, where "intrusive" is something I'm deliberately leaving a bit vague. The company probably has some idea what sites they visit but employees expect that the company is not stealing their credentials or having someone virtually read over their shoulder without a very good reason. If outside intruders get into work device management servers and such, employees' personal stuff is at risk also, but they're willing to accept this for the sake of convenience. I have, on my work-owned laptop, both work and personal Chrome profiles. (The analogous Firefox feature is multi-account containers.) I might only bring a work laptop when traveling for work. Most of the time, and certainly if I'm presenting during a meeting, I'm using the work profile. I'll use the other only when I'm alone. I lock my screen when I'm not there; I have sensitive access, so this is expected for reasons other than protecting my personal data. Conversely, work allows me to access my work email and some other internal sites from my personal phone if I agree to certain device management restrictions. I do this rather than carry two phones. Some people choose otherwise.
- _virtu 9y ago
  I've been going back an forth between Chrome and Firefox for the past couple of months with the number of posts that I've seen on HN. Every time I always realize that Firefox doesn't have workspaces. This comment made me realize that containers are the alternative. Hopefully, I'll be able to switch over to FF more full time now that I have this solution. Thanks for this comment!
- fencepost 9y ago
  > I think the idea that you only access personal stuff from your own devices on your own time is unrealistic. Once upon a time that was the case - "Cyber Monday" as a prime case in point. Some limited amount of non-work browsing is generally still fine at most offices I deal with, most notably checking news, weather, sports scores, etc. However as a person responsible for making sure there are no breaches (particularly reportable ones) at offices, I'm moving more and more to the "No personal use. Period. No debate." position. I can control the kind of filtering, AV checks and attachments that come into the office via the business email as an example, but if people are checking their personal email on company systems I may not be able to catch the "Huh, I don't remember ordering from them, I wonder what this invoice email is all about?" person. Antivirus is all well and good but it's not 100%, and while I can look at the mail filters and see that there were 400 PDFs with variations of "Delivery Notification" or "Invoice 1234567" blocked in the last half hour to a ton of different addresses, Jane Smith in Billing or Accounts Payable may only see one or two - and on a really bad day, opening just one may be all it takes. Also, these days a huge percentage of people not only have smartphones but use those smartphones as their primary devices for Internet access. 5 years ago that wasn't the case, but now? George with the iPhone 7 Plus can quite easily check his email or do plenty of other things that would have been much less pleasant on an iPhone 4.
artur_makly 9y ago
@fencepost - do u know if it is possible to transfer all those chrome accnt pref from a personal gmail to a gsuite accnt?
Paianni 9y ago
For this reason my place of work hosts Firefox rather than Chrome.

dewiz 9y ago

This story would deserve a blog post of its own. Google might not realize it, but the ease of being tracked by them is also a risk in work place.

justatdotin 9y ago
> Google might not realize it, LOL

sangnoir 9y ago

> I pointed out that the porn bookmarks in question were years old and that since Chrome was signed into a personal account it was pretty likely that the same account had been used by other family members at home. So the offence was merely having porn bookmarks in their browser - not visiting porn sites at work? Wow.

Mayzie 9y ago
Eh, I mean fair enough. Somebody else goes to use the browser and notices the bookmarks, what else would they expect?
gatmne 9y ago
I imagine porn bookmarks showing up in an official screencast, presentation, or live product demo would do wonders to a company's image and reputation.
fencepost 9y ago
This is in an environment with multiple people at a long open desk with patients on the other side of the counter. Someone sat down to check something, or check someone in or out, I don't know the details. They hit the Bookmarks button, and right there on the list was a PornHub link to something about a teen and anal sex. This caused a bit of an uproar about inappropriate use of the computer systems, though it may have stayed behind closed doors. It wouldn't surprise me a bit if the person whose account it was didn't even know that bookmarks exist in Chrome - it's not like Google makes it obvious these days. I suspect there were some awkward discussions at home that evening, or possibly on the phone with college-age children.

scottlamb 9y ago

I think the idea that you only access personal stuff from your own devices on your own time is unrealistic. There are restricted environments (intelligence agencies and such) where it's necessary, but outside of those I think people commonly expect that if they get their work done and avoid illegal / pornographic / other NSFW content, they can do some personal browsing at work, typically on work-owned hardware. The company can expect otherwise, but it may not work out well for morale / staff retention. I don't know anyone who comes in, maintains 100% focus on work for 8+ hours, and then goes home. Of course, if someone is signing into their personal account using work hardware, they're basically saying they trust the company not to do any intrusive monitoring, where "intrusive" is something I'm deliberately leaving a bit vague. The company probably has some idea what sites they visit but employees expect that the company is not stealing their credentials or having someone virtually read over their shoulder without a very good reason. If outside intruders get into work device management servers and such, employees' personal stuff is at risk also, but they're willing to accept this for the sake of convenience. I have, on my work-owned laptop, both work and personal Chrome profiles. (The analogous Firefox feature is multi-account containers.) I might only bring a work laptop when traveling for work. Most of the time, and certainly if I'm presenting during a meeting, I'm using the work profile. I'll use the other only when I'm alone. I lock my screen when I'm not there; I have sensitive access, so this is expected for reasons other than protecting my personal data. Conversely, work allows me to access my work email and some other internal sites from my personal phone if I agree to certain device management restrictions. I do this rather than carry two phones. Some people choose otherwise.

_virtu 9y ago
I've been going back an forth between Chrome and Firefox for the past couple of months with the number of posts that I've seen on HN. Every time I always realize that Firefox doesn't have workspaces. This comment made me realize that containers are the alternative. Hopefully, I'll be able to switch over to FF more full time now that I have this solution. Thanks for this comment!
fencepost 9y ago
> I think the idea that you only access personal stuff from your own devices on your own time is unrealistic. Once upon a time that was the case - "Cyber Monday" as a prime case in point. Some limited amount of non-work browsing is generally still fine at most offices I deal with, most notably checking news, weather, sports scores, etc. However as a person responsible for making sure there are no breaches (particularly reportable ones) at offices, I'm moving more and more to the "No personal use. Period. No debate." position. I can control the kind of filtering, AV checks and attachments that come into the office via the business email as an example, but if people are checking their personal email on company systems I may not be able to catch the "Huh, I don't remember ordering from them, I wonder what this invoice email is all about?" person. Antivirus is all well and good but it's not 100%, and while I can look at the mail filters and see that there were 400 PDFs with variations of "Delivery Notification" or "Invoice 1234567" blocked in the last half hour to a ton of different addresses, Jane Smith in Billing or Accounts Payable may only see one or two - and on a really bad day, opening just one may be all it takes. Also, these days a huge percentage of people not only have smartphones but use those smartphones as their primary devices for Internet access. 5 years ago that wasn't the case, but now? George with the iPhone 7 Plus can quite easily check his email or do plenty of other things that would have been much less pleasant on an iPhone 4.

artur_makly 9y ago

@fencepost - do u know if it is possible to transfer all those chrome accnt pref from a personal gmail to a gsuite accnt?

Paianni 9y ago

For this reason my place of work hosts Firefox rather than Chrome.