3 ms·

I tried to look at what chrome sends to google with wireshark, and there are quite a lot of connections made to google servers, but it's all encrypted (ssl). So

I tried to look at what chrome sends to google with wireshark, and there are quite a lot of connections made to google servers, but it's all encrypted (ssl). So I actually have no way to know what is sent to google. Did someone make a detailed analysis of what info gets sent to google on a default install of chrome?

buddydvd 15y ago
I noticed awhile back that even if you disable Chrome's safe browsing feature, Google still sends data to their server. I'm not sure if this is still the case today. http://superuser.com/questions/236637/how-to-disable-google-chrome-from-sending-data-to-safebrowsing-cache-google-com-a http://superuser.com/questions/236637/how-to-disable-google-...
- huhtenberg 15y ago
  Yep, this still appears to be the case. It establishes a long-lived SSL connection to one Google's servers few seconds after the start. If the connection is forcefully killed (e.g. with SysInternal's TcpView), it won't be re-established, but needing to kill it every time I need to use Chrome is really annoying. It is also the reason why I have Chrome updates permanently disabled - I don't trust Chrome enough to let it run anything in a background.
  - mikewest 15y ago
    Can you file a bug at http://new.crbug.com/ http://new.crbug.com/ please? That doesn't sound like the behavior I'd expect.
    - huhtenberg 15y ago
      Sorry, I can't. It wants me to log in with Google ID which I don't and won't have.
      - huhtenberg 15y ago
        Why the hell am I at -1? Do enlighten me how can I file a bug report against Chrome if I don't have and don't want to create a Google ID.
      - mikewest 15y ago
        Ok. Would you mind dropping me an email (mkwst@chromium.org) with details? I'm happy to file the ticket for you.
        huhtenberg 15y ago
        Well... :) That would require setting up a dummy email account and what not, and that's a bit too much hassle. It'd be far more prudent if you'd remove Google ID requirement in front of the bug repository. I frankly don't understand why it is needed in the first place, at least for browsing the repo that is.
        magicalist 15y ago
        you can browse just fine: http://code.google.com/p/chromium/issues/list http://code.google.com/p/chromium/issues/list I'm pretty sure all the browser bugtrackers require an account to file a bug.
    - WalterGR 15y ago
      Can you file a bug at http://new.crbug.com/ http://new.crbug.com/ please? That doesn't sound like the behavior I'd expect. The behavior you expect out of Chrome is just simply not what its actual behavior is. Asa Dotzler from Mozilla corrects some of your misconceptions here: http://news.ycombinator.com/item?id=3034450 http://news.ycombinator.com/item?id=3034450. EDIT: Oh, I see you're actually on the Chrome team. I learned the stuff Asa that describes in his comment in your privacy policy. It's pretty easy to understand.
- justinschuh 15y ago
  That should definitely not be happening. If you're seeing this behavior please provide file a bug with full details at the following URL: https://code.google.com/p/chromium/issues/entry?template=Privacy%20issue https://code.google.com/p/chromium/issues/entry?template=Pri...
wslh 15y ago
On 2008 we published an article about this using our own hooking tool: http://blog.nektra.com/main/2008/10/15/the-truth-about-google-chrome-using-spy-studio/ http://blog.nektra.com/main/2008/10/15/the-truth-about-googl... don't know what's the state of this stuff on 2011. This is hooking the application so you don't have issues with sniffing SSL.
pagekalisedown 15y ago
This is the tool I use to see SSL traffic: http://www.tcpcatcher.org/ http://www.tcpcatcher.org/ http://www.tcpcatcher.org/monitoring_SSL.php http://www.tcpcatcher.org/monitoring_SSL.php It effectively helps you to man-in-the-middle-yourself.

buddydvd 15y ago

I noticed awhile back that even if you disable Chrome's safe browsing feature, Google still sends data to their server. I'm not sure if this is still the case today. http://superuser.com/questions/236637/how-to-disable-google-chrome-from-sending-data-to-safebrowsing-cache-google-com-a http://superuser.com/questions/236637/how-to-disable-google-...

huhtenberg 15y ago
Yep, this still appears to be the case. It establishes a long-lived SSL connection to one Google's servers few seconds after the start. If the connection is forcefully killed (e.g. with SysInternal's TcpView), it won't be re-established, but needing to kill it every time I need to use Chrome is really annoying. It is also the reason why I have Chrome updates permanently disabled - I don't trust Chrome enough to let it run anything in a background.
- mikewest 15y ago
  Can you file a bug at http://new.crbug.com/ http://new.crbug.com/ please? That doesn't sound like the behavior I'd expect.
  - huhtenberg 15y ago
    Sorry, I can't. It wants me to log in with Google ID which I don't and won't have.
    - huhtenberg 15y ago
      Why the hell am I at -1? Do enlighten me how can I file a bug report against Chrome if I don't have and don't want to create a Google ID.
    - mikewest 15y ago
      Ok. Would you mind dropping me an email (mkwst@chromium.org) with details? I'm happy to file the ticket for you.
      - huhtenberg 15y ago
        Well... :) That would require setting up a dummy email account and what not, and that's a bit too much hassle. It'd be far more prudent if you'd remove Google ID requirement in front of the bug repository. I frankly don't understand why it is needed in the first place, at least for browsing the repo that is.
        magicalist 15y ago
        you can browse just fine: http://code.google.com/p/chromium/issues/list http://code.google.com/p/chromium/issues/list I'm pretty sure all the browser bugtrackers require an account to file a bug.
  - WalterGR 15y ago
    Can you file a bug at http://new.crbug.com/ http://new.crbug.com/ please? That doesn't sound like the behavior I'd expect. The behavior you expect out of Chrome is just simply not what its actual behavior is. Asa Dotzler from Mozilla corrects some of your misconceptions here: http://news.ycombinator.com/item?id=3034450 http://news.ycombinator.com/item?id=3034450. EDIT: Oh, I see you're actually on the Chrome team. I learned the stuff Asa that describes in his comment in your privacy policy. It's pretty easy to understand.
justinschuh 15y ago
That should definitely not be happening. If you're seeing this behavior please provide file a bug with full details at the following URL: https://code.google.com/p/chromium/issues/entry?template=Privacy%20issue https://code.google.com/p/chromium/issues/entry?template=Pri...

wslh 15y ago

On 2008 we published an article about this using our own hooking tool: http://blog.nektra.com/main/2008/10/15/the-truth-about-google-chrome-using-spy-studio/ http://blog.nektra.com/main/2008/10/15/the-truth-about-googl... don't know what's the state of this stuff on 2011. This is hooking the application so you don't have issues with sniffing SSL.

pagekalisedown 15y ago

This is the tool I use to see SSL traffic: http://www.tcpcatcher.org/ http://www.tcpcatcher.org/ http://www.tcpcatcher.org/monitoring_SSL.php http://www.tcpcatcher.org/monitoring_SSL.php It effectively helps you to man-in-the-middle-yourself.