5 ms·

Doesn't Chrome send your entire browsing history to Google as well? Edit: I thought this was a well know fact and if it isn't I might have been to harsh about

Doesn't Chrome send your entire browsing history to Google as well? Edit: I thought this was a well know fact and if it isn't I might have been to harsh about Google and Chrome. Edit 2: Thinking about it and searching a bit I conclude that IIRC Google at least used to have access to your browsing history as part of syncing it unencrypted.

t34543 7y ago
I would love to see a source for this.
- auslander 7y ago
  It is not so easy to do this MITM trick with Chrome, it has Google certs pinned down. "For the transparent proxy to work, it needs .google.com to be added to the URL whitelist to allow all traffic to .google.com. This configuration is not supported because of Chrome security features that are in place, and we recommend that you avoid the use of transparent proxies." https://support.google.com/chrome/a/answer/3504942?hl=en https://support.google.com/chrome/a/answer/3504942?hl=en
  - occamrazor 7y ago
    This link refers to Chrome devises, like Chromebooks, not to the Chrome browser.
    - auslander 7y ago
      You'll be getting "ERR_SSL_PROTOCOL_ERROR". I could not find any posts on internet that were able to MITM and analyse Chrome to google.com traffic.
liability 7y ago
Everything you type into the address bar gets considered for possible completion, right? And part of that quite possibly entails sending it off to Google servers which take a stab at finding completions for it. Your claim seems plausible at least.
- kps 7y ago
  Yes, there are some options under chrome://privacy/settings that suggest they send full or partial URLs: - Use a web service to help resolve navigation errors - Use a prediction service to help complete searches and URLs typed in the address bar and then there's - Use a web service to help resolve spelling errors whose description suggests it sends more than URLs.
  - Karunamon 7y ago
    And, if I recall right, you're asked if you want search suggestions in the omnibar the first time you use it for that purpose.
    - liability 7y ago
      Does that prompt effectively explain its impact to nontechnical users?
- janbporterb 7y ago
  Also note there is a “roulette” feature in most address bars, where the browser starts loading and rendering the site before you ever hit submit. Very handy for sites wanting to pursue persistence
jhanschoo 7y ago
If you are logged into Chrome your history is synchronized across platforms, tied to your Google account. Same as with Firefox Sync. Not sure about behavior when not logged in, or when incognito.
- mnutt 7y ago
  Firefox Sync is quite different than Chrome's version; with Firefox your data is encrypted locally on your machine before it is synced.
  - qieja 7y ago
    That is also an option for Chrome.
    - cjs_2 7y ago
      But not the default.
      - staticassertion 7y ago
        Are you sure about that? Certainly at least some of the synced information is encrypted before sync by default (passwords).
    - deleted 7y ago
      [deleted]
asveikau 7y ago
If you sign in it syncs history across devices, so I assume it does. Although it would technically be possible that they encrypt it using a key Google doesn't have, I wouldn't assume they implemented that.
- deleted 7y ago
  [deleted]
- kps 7y ago
  It's an option under the sync settings: ○ Encrypt synced passwords with your Google username and password ◉ Encrypt synced data with your own sync passphrase
Youden 7y ago
Only through sync, which you can encrypt with a separate password to your Google account. My sync is encrypted so I can't test this for you but I believe if it's not, you can check (and clear) your history here: https://myactivity.google.com/myactivity https://myactivity.google.com/myactivity Google's privacy policy seems to make it clear that this happens unless encryption is turned on: https://www.google.com/chrome/privacy/index.html#signed-in https://www.google.com/chrome/privacy/index.html#signed-in
- janbporterb 7y ago
  you missed the obvious one (that is actually related to the linked edge issue): SafeBrowse. SafeBrowse gets ALL your traffic from most browsers.
  - janbporterb 7y ago
    Ah I was wrong about this!!! SafeBrowse uses hashes. Edit: never be afraid to admit your were wrong folks :) So it only gets a “potential list” of sites you visited. Wonder if the operators could aggregate the data enough to deanonymize things
    - staticassertion 7y ago
      The hash isn't even necessarily transmitted, and it's often partial hashes at that.
Panino 7y ago
> Doesn't Chrome send your entire browsing history to Google as well? Most browsers/users do, essentially. When a person searches Google for example, results are links to Google that redirect to the target sites. Try it, mouse over a result, and look at the URL. Then a user clicks on one and finds a page that likely has doubleclick.net/adsense/analytics/fonts, which all feed back to Google. Or buttons/pixels/whatever for Facebook. Or both. Or both and 10 more organizations. Then since all mainstream browsers by default send referrer info, and since tracker code is so pervasive, and since browsers are easily fingerprintable, trackers follow you along as you click links going from page to page. Trackers are getting redundant high quality data. They're right there with you as you browse; they see what you see. Although some browsers are easier to configure for privacy, IMO the browser you use is less important than how you use it. Multiple organizations have the potential to possess a near-complete view of your browsing history.
im3w1l 7y ago
My activity[0] is Google's official way of telling you what it has collected about you from sources like Chrome. Things there will be used to personalize your experience. https://myactivity.google.com/myactivity https://myactivity.google.com/myactivity

t34543 7y ago

I would love to see a source for this.

auslander 7y ago
It is not so easy to do this MITM trick with Chrome, it has Google certs pinned down. "For the transparent proxy to work, it needs .google.com to be added to the URL whitelist to allow all traffic to .google.com. This configuration is not supported because of Chrome security features that are in place, and we recommend that you avoid the use of transparent proxies." https://support.google.com/chrome/a/answer/3504942?hl=en https://support.google.com/chrome/a/answer/3504942?hl=en
- occamrazor 7y ago
  This link refers to Chrome devises, like Chromebooks, not to the Chrome browser.
  - auslander 7y ago
    You'll be getting "ERR_SSL_PROTOCOL_ERROR". I could not find any posts on internet that were able to MITM and analyse Chrome to google.com traffic.

liability 7y ago

Everything you type into the address bar gets considered for possible completion, right? And part of that quite possibly entails sending it off to Google servers which take a stab at finding completions for it. Your claim seems plausible at least.

kps 7y ago
Yes, there are some options under chrome://privacy/settings that suggest they send full or partial URLs: - Use a web service to help resolve navigation errors - Use a prediction service to help complete searches and URLs typed in the address bar and then there's - Use a web service to help resolve spelling errors whose description suggests it sends more than URLs.
- Karunamon 7y ago
  And, if I recall right, you're asked if you want search suggestions in the omnibar the first time you use it for that purpose.
  - liability 7y ago
    Does that prompt effectively explain its impact to nontechnical users?
janbporterb 7y ago
Also note there is a “roulette” feature in most address bars, where the browser starts loading and rendering the site before you ever hit submit. Very handy for sites wanting to pursue persistence

jhanschoo 7y ago

If you are logged into Chrome your history is synchronized across platforms, tied to your Google account. Same as with Firefox Sync. Not sure about behavior when not logged in, or when incognito.

mnutt 7y ago
Firefox Sync is quite different than Chrome's version; with Firefox your data is encrypted locally on your machine before it is synced.
- qieja 7y ago
  That is also an option for Chrome.
  - cjs_2 7y ago
    But not the default.
    - staticassertion 7y ago
      Are you sure about that? Certainly at least some of the synced information is encrypted before sync by default (passwords).
  - deleted 7y ago
    [deleted]

asveikau 7y ago

If you sign in it syncs history across devices, so I assume it does. Although it would technically be possible that they encrypt it using a key Google doesn't have, I wouldn't assume they implemented that.

deleted 7y ago
[deleted]
kps 7y ago
It's an option under the sync settings: ○ Encrypt synced passwords with your Google username and password ◉ Encrypt synced data with your own sync passphrase

Youden 7y ago

Only through sync, which you can encrypt with a separate password to your Google account. My sync is encrypted so I can't test this for you but I believe if it's not, you can check (and clear) your history here: https://myactivity.google.com/myactivity https://myactivity.google.com/myactivity Google's privacy policy seems to make it clear that this happens unless encryption is turned on: https://www.google.com/chrome/privacy/index.html#signed-in https://www.google.com/chrome/privacy/index.html#signed-in

janbporterb 7y ago
you missed the obvious one (that is actually related to the linked edge issue): SafeBrowse. SafeBrowse gets ALL your traffic from most browsers.
- janbporterb 7y ago
  Ah I was wrong about this!!! SafeBrowse uses hashes. Edit: never be afraid to admit your were wrong folks :) So it only gets a “potential list” of sites you visited. Wonder if the operators could aggregate the data enough to deanonymize things
  - staticassertion 7y ago
    The hash isn't even necessarily transmitted, and it's often partial hashes at that.

Panino 7y ago

> Doesn't Chrome send your entire browsing history to Google as well? Most browsers/users do, essentially. When a person searches Google for example, results are links to Google that redirect to the target sites. Try it, mouse over a result, and look at the URL. Then a user clicks on one and finds a page that likely has doubleclick.net/adsense/analytics/fonts, which all feed back to Google. Or buttons/pixels/whatever for Facebook. Or both. Or both and 10 more organizations. Then since all mainstream browsers by default send referrer info, and since tracker code is so pervasive, and since browsers are easily fingerprintable, trackers follow you along as you click links going from page to page. Trackers are getting redundant high quality data. They're right there with you as you browse; they see what you see. Although some browsers are easier to configure for privacy, IMO the browser you use is less important than how you use it. Multiple organizations have the potential to possess a near-complete view of your browsing history.

im3w1l 7y ago

My activity[0] is Google's official way of telling you what it has collected about you from sources like Chrome. Things there will be used to personalize your experience. https://myactivity.google.com/myactivity https://myactivity.google.com/myactivity