5 ms·

Some of you here might be thinking, "well you can always use a passphrase while using chrome sync" to mitigate all privacy issues. I generally advocate use of a

by r2dof 8y ago

Some of you here might be thinking, "well you can always use a passphrase while using chrome sync" to mitigate all privacy issues. I generally advocate use of a passphrase to people I know. BUT digging a bit into it I found that chrome's encryption is NOT STRONG AT ALL. Here[1] the author describes that brute force is possible within 4 days if the sync passphrase has 40 bits of entropy, with $1000 hardware. So with more expensive hardware, this can be done within minutes. TBF even firefox is not excellent in this regard(based on the article), but it is much better. [1]:https://palant.de/2018/03/13/can-chrome-sync-or-firefox-sync-be-trusted-with-sensitive-data https://palant.de/2018/03/13/can-chrome-sync-or-firefox-sync... and associate chrome bug : https://bugs.chromium.org/p/chromium/issues/detail?id=820976 https://bugs.chromium.org/p/chromium/issues/detail?id=820976

palant 8y ago
Yes, Firefox could do better, but at least Sync there was designed with privacy in mind - Chrome Sync wasn't, and even if you set a passphrase it will only encrypt passwords and none of the other data such as your browsing history. Either way, Chrome exists to give Google's web services an advantage, that's the only reason. I wrote about that seven years ago: https://adblockplus.org/blog/google-chrome-and-pre-installed-web-apps https://adblockplus.org/blog/google-chrome-and-pre-installed...
- r2dof 8y ago
  >even if you set a passphrase it will only encrypt passwords and none of the other data such as your browsing history. This[1] seems to imply otherwise. [1]:https://support.google.com/chrome/answer/165139#passphrase https://support.google.com/chrome/answer/165139#passphrase
  - palant 8y ago
    Yes, it does. I just tried this, when I set a passphrase everything shows up as encrypted in the Google Dashboard. So maybe things changed since I wrote this, or maybe I misunderstood it initially. Either way, the default is not having a passphrase, and the passphrase setting is buried pretty deep, so most people won't set it. What's worse, you cannot really avoid an initial unencrypted sync before you can set up a passphrase. The point still stands, this isn't a system designed for privacy.

by r2dof 8y ago

palant 8y ago

Yes, Firefox could do better, but at least Sync there was designed with privacy in mind - Chrome Sync wasn't, and even if you set a passphrase it will only encrypt passwords and none of the other data such as your browsing history. Either way, Chrome exists to give Google's web services an advantage, that's the only reason. I wrote about that seven years ago: https://adblockplus.org/blog/google-chrome-and-pre-installed-web-apps https://adblockplus.org/blog/google-chrome-and-pre-installed...

r2dof 8y ago
>even if you set a passphrase it will only encrypt passwords and none of the other data such as your browsing history. This[1] seems to imply otherwise. [1]:https://support.google.com/chrome/answer/165139#passphrase https://support.google.com/chrome/answer/165139#passphrase
- palant 8y ago
  Yes, it does. I just tried this, when I set a passphrase everything shows up as encrypted in the Google Dashboard. So maybe things changed since I wrote this, or maybe I misunderstood it initially. Either way, the default is not having a passphrase, and the passphrase setting is buried pretty deep, so most people won't set it. What's worse, you cannot really avoid an initial unencrypted sync before you can set up a passphrase. The point still stands, this isn't a system designed for privacy.