6 ms·

Chrome to be deployed by US State Department

127 points by 11031a 15y ago

dpearson 15y ago
While this is a great step forward, it could be rendered pointless if auto-updating is disabled and updates are not pushed out quickly after going through an approval process. Given how quickly Google pushes out major updates, old versions of Chrome could simply be as prevalent as old versions of IE, with little long term benefit.
- homosaur 15y ago
  Great step forward for whom? Is it meaningful at all that the US State Dept is letting people use Chrome now? Is this going to push adoption of modern browsers in other circumstances? Remember, the State Dept has a massive group of people that are working and monitoring social media and the like, so their people were probably clamoring extra loud for this.
  - w1ntermute 15y ago
    > Remember, the State Dept has a massive group of people that are working and monitoring social media and the like, so their people were probably clamoring extra loud for this. Every company probably has people clamoring for modern browsers. Don't sites like Facebook and Gmail no longer function under older versions of IE? Those versions are particularly prevalent at megacorps.
    - artursapek 15y ago
      Wait - these people aren't allowed to just install Chrome if they choose? (I'm a student and have no idea what working at a big corp/for the government is like)
      - trotsky 15y ago
        Nope - they don't have an administrator account and installing unsupported software isn't allowed. You can't really manage or secure a sizable number of seats without those rules.
        artursapek 15y ago
        That makes sense. I wonder why this thread got downvoted
  - drivebyacct2 15y ago
    I think it's more the point that places where IE has remained due to policy, may be coming around to realize that the security and performance of Chrome is worth the lessened ability to control every aspect of their users' browsing experience. If the State Department is comfortable with their employees using Chrome, why not [insert random business/organization still clinging to IE out of tradition/"security"].
    - politician 15y ago
      Shouldn't that be "perceived lessened ability"? Honest question: doesn't Chrome interop with Windows group policy settings?
TazeTSchnitzel 15y ago
Suddenly there is a huge interest in Chrome NaCl vulnerabilities on Windows...
- nkassis 15y ago
  And there wasn't interest with a 25+% install share on the web? Not sure what you are trying to get at with your post? Are you implying that NaCL is vulnerable because of it's nature and now will be an major attack vector? But NaCL in my view can be made(or already is in my opinion) solid and with more focus will become safer and coupled with fast updates, it should make it a lot less of an issue as Flash or ActiveX vulnerabilities have been.
  - pyre 15y ago
    I think the point is that the State Department is a juicier (or at least more high profile) target than 25% of people on the web.
    - deleted 15y ago
      [deleted]
    - spindritf 15y ago
      Is it though? 25% of people on the web has to include some pretty juicy targets (like... Google itself, Chrome's probably pretty popular there).
- drivebyacct2 15y ago
  As far as I know, NaCl is still only enabled for very manually installed Chrome Web Store apps. If they want to target the tiny niche of developers that have free-for-all NaCl turned on, well, have at it.
- magicalist 15y ago
  considering that a flash movie embedded in an excel document is what took down RSA, I don't think NaCl is going to be moving much on the priority list of places to look for vulnerabilities.
dev1n 15y ago
So is this Google inside the State Department, or the State Department inside Google?
- politician 15y ago
  I imagine that the answer is "less so than Microsoft is". What is with the hellish trolling on this story? Did every shill for IE get some kind of bat signal?
robomartin 15y ago
Bad idea: Chrome is dangerous for the uninformed! It still has a pretty serious security hole: Passwords are visible in plain text. A quick trip into "Personal Stuff" and "Manage saved passwords..." is all you need in order to expose this info. I ran a quick test. Without straining much, you can click the "show" button on about 40 passwords in one minute. A quick Ctrl+P and the entire list is printed in plain text! It probably wouldn't take much longer than that to email it or transmit the plain text list via some other method. If you have three to five minutes on someone's workstation you can walk away with the login information for absolutely everything they've done through the browser, banking, social, email, whatever. What sucks is that people have been very vocal on the Chrome support forum about this particular issue and, well, they've been summarily ignored. Maybe I'm missing something fundamental here but I just can't understand why Google would leave this huge gaping hole in there. It can't be that hard to at least provide one more layer of security. You should not be able to see any passwords without a master password. I've looked at some of the arguments pointing out that this could provide a false sense of security. My point (and that made by countless others) is very simple: The way it works today a ten-year-old could steal all of your passwords inside of five minutes without even having to work very hard. A layer or two of security would make it so that a far more knowledgeable and seriously involved process (or spying software) would have to be utilized to steal your stuff. I vote for option #2. I use Chrome as my primary browser, but I am not a civil servant at a government office. I am keenly aware of the security hole. That said, I don't recommend it to family and friends because a non-techie will screw themselves in an instant with this browser. Imagine Uncle Pete taking his laptop to be serviced and having all of his personal login data fully exposed to the 17-year-old pimple-faced kid at the computer shop. Terrible stuff. Google: Please fix this before it becomes the source of embarrassment and huge personal loss to lots of people.
- robomartin 15y ago
  I'd appreciate explanations for down-voting. I don't think the downvote is fair. Is any of what I said factually incorrect? How? HN can be really weird sometimes.
- spindritf 15y ago
  User access to user settings is not a "security hole". And I don't think there is a way to protect your logged in, unattended session without demolishing productivity. If you walk away from your computer, lock it. I would expect the State Department to have some protections in place (proximity cards, mandated timeout settings, etc) when actual privileged information is concerned and being accessed. Yes, it would probably be nice if Chrome had the kind of protection of passwords database with a master password that Firefox does. But it still isn't a "security hole".
joejohnson 15y ago
So, will Google have access to what State Dept officials browse and search? How can this be legal?
dbarlett 15y ago
Quite a change from three years ago, when State was stuck on IE6 and Secretary Clinton didn't know what Firefox was. http://www.theregister.co.uk/2009/07/13/firefox_and_us_state_department/ http://www.theregister.co.uk/2009/07/13/firefox_and_us_state...
- chimeracoder 15y ago
  The last line of the article is priceless: "No doubt, the State Department will officially adopt Facebook at about the same time the revenue-challenged site follows Friendster into social networking oblivion"
Metapony 15y ago
Now the State dept will get out of memory errors too!
- jrockway 15y ago
  As an Emacs user, it makes me happy that some other piece of software finally gets to be the butt of out-of-memory jokes. It only took 20 years.
niels_olson 15y ago
Having read all the concerns on here, and having worked with field officers from State, I think some folks have pointed out some great things to work on, but State is still making the right decision. We can secure buildings reasonably well, even in very dangerous parts of the world where we are the prime targets by a factor of 10. Securing the best vehicle for navigating the network has proven quite a bit harder. Keep in mind, State is quite small compared to some other agencies, and most people with secrets are pretty sharp, and they are working infinitely more with information than with physical security. Also, if we have stuff that obviously needs to be heavily secured, we use other networks. For the NIPRnet, firefox_vs_opera_vs_ie.jpg remains fairly relevant: http://imgur.com/SYgZ5 http://imgur.com/SYgZ5
- robomartin 15y ago
  Oh, OK. Wikileaks can't possibly get ahold of sensitive data, emails and memos then. Security is always bulletproof until it isn't.
- jsight 15y ago
  I've worked at government agencies (recently) that banned all "third party browsers". Compared to that kind of policy, I think choosing Chrome is wonderful.
niels_olson 15y ago
Having read all the concerns on here, and having worked with field officers from State, I think some folks have pointed out some great things to work on, but State is still making the right decision. We can secure buildings reasonably well, even in very dangerous parts of the world where we are the prime targets by a factor of 10. Securing the best vehicle for navigating the network has proven quite a bit harder. Keep in mind, State is quite small compared to some other agencies, and most people with secrets are pretty sharp, and they are working infinitely more with information than with physical security. Also, if we have stuff that obviously needs to be heavily secured, we use other networks. For the NIPRnet, this remains fairly relevant: http://imgur.com/SYgZ5 http://imgur.com/SYgZ5
alan_cx 15y ago
Just a simpleton point here: I read a lot of stuff, every day, about how evil google and its chromey thing steal all our personal information and use it to advance their super villain take over of the world. So, um, why would any body bothered by security want to use google? Its like "Q" department being supplied by Dr No.
- richardw 15y ago
  Google with Evil turned up to 11 is trying to serve you more adverts. State is more interested in the fact that Google is having to offer hackers more money to hack Chrome in pwn2own. Last year they didn't even try. http://www.securitynewsdaily.com/496-hacking-contest-smashes-safari-internet-explorer.html http://www.securitynewsdaily.com/496-hacking-contest-smashes... "Google’s Chrome Web browser managed to remain untouched. In fact, Computer World reported that nobody even attempted to crack into Google Chrome , despite the $20,000 Google offered to anyone who could successfully exploit it."

127 points by 11031a 15y ago

While this is a great step forward, it could be rendered pointless if auto-updating is disabled and updates are not pushed out quickly after going through an approval process. Given how quickly Google pushes out major updates, old versions of Chrome could simply be as prevalent as old versions of IE, with little long term benefit.

homosaur 15y ago
Great step forward for whom? Is it meaningful at all that the US State Dept is letting people use Chrome now? Is this going to push adoption of modern browsers in other circumstances? Remember, the State Dept has a massive group of people that are working and monitoring social media and the like, so their people were probably clamoring extra loud for this.
- w1ntermute 15y ago
  > Remember, the State Dept has a massive group of people that are working and monitoring social media and the like, so their people were probably clamoring extra loud for this. Every company probably has people clamoring for modern browsers. Don't sites like Facebook and Gmail no longer function under older versions of IE? Those versions are particularly prevalent at megacorps.
  - artursapek 15y ago
    Wait - these people aren't allowed to just install Chrome if they choose? (I'm a student and have no idea what working at a big corp/for the government is like)
    - trotsky 15y ago
      Nope - they don't have an administrator account and installing unsupported software isn't allowed. You can't really manage or secure a sizable number of seats without those rules.
      - artursapek 15y ago
        That makes sense. I wonder why this thread got downvoted
- drivebyacct2 15y ago
  I think it's more the point that places where IE has remained due to policy, may be coming around to realize that the security and performance of Chrome is worth the lessened ability to control every aspect of their users' browsing experience. If the State Department is comfortable with their employees using Chrome, why not [insert random business/organization still clinging to IE out of tradition/"security"].
  - politician 15y ago
    Shouldn't that be "perceived lessened ability"? Honest question: doesn't Chrome interop with Windows group policy settings?

TazeTSchnitzel 15y ago

Suddenly there is a huge interest in Chrome NaCl vulnerabilities on Windows...

nkassis 15y ago
And there wasn't interest with a 25+% install share on the web? Not sure what you are trying to get at with your post? Are you implying that NaCL is vulnerable because of it's nature and now will be an major attack vector? But NaCL in my view can be made(or already is in my opinion) solid and with more focus will become safer and coupled with fast updates, it should make it a lot less of an issue as Flash or ActiveX vulnerabilities have been.
- pyre 15y ago
  I think the point is that the State Department is a juicier (or at least more high profile) target than 25% of people on the web.
  - deleted 15y ago
    [deleted]
  - spindritf 15y ago
    Is it though? 25% of people on the web has to include some pretty juicy targets (like... Google itself, Chrome's probably pretty popular there).
drivebyacct2 15y ago
As far as I know, NaCl is still only enabled for very manually installed Chrome Web Store apps. If they want to target the tiny niche of developers that have free-for-all NaCl turned on, well, have at it.
magicalist 15y ago
considering that a flash movie embedded in an excel document is what took down RSA, I don't think NaCl is going to be moving much on the priority list of places to look for vulnerabilities.

dev1n 15y ago

So is this Google inside the State Department, or the State Department inside Google?

politician 15y ago
I imagine that the answer is "less so than Microsoft is". What is with the hellish trolling on this story? Did every shill for IE get some kind of bat signal?

robomartin 15y ago

Bad idea: Chrome is dangerous for the uninformed! It still has a pretty serious security hole: Passwords are visible in plain text. A quick trip into "Personal Stuff" and "Manage saved passwords..." is all you need in order to expose this info. I ran a quick test. Without straining much, you can click the "show" button on about 40 passwords in one minute. A quick Ctrl+P and the entire list is printed in plain text! It probably wouldn't take much longer than that to email it or transmit the plain text list via some other method. If you have three to five minutes on someone's workstation you can walk away with the login information for absolutely everything they've done through the browser, banking, social, email, whatever. What sucks is that people have been very vocal on the Chrome support forum about this particular issue and, well, they've been summarily ignored. Maybe I'm missing something fundamental here but I just can't understand why Google would leave this huge gaping hole in there. It can't be that hard to at least provide one more layer of security. You should not be able to see any passwords without a master password. I've looked at some of the arguments pointing out that this could provide a false sense of security. My point (and that made by countless others) is very simple: The way it works today a ten-year-old could steal all of your passwords inside of five minutes without even having to work very hard. A layer or two of security would make it so that a far more knowledgeable and seriously involved process (or spying software) would have to be utilized to steal your stuff. I vote for option #2. I use Chrome as my primary browser, but I am not a civil servant at a government office. I am keenly aware of the security hole. That said, I don't recommend it to family and friends because a non-techie will screw themselves in an instant with this browser. Imagine Uncle Pete taking his laptop to be serviced and having all of his personal login data fully exposed to the 17-year-old pimple-faced kid at the computer shop. Terrible stuff. Google: Please fix this before it becomes the source of embarrassment and huge personal loss to lots of people.

robomartin 15y ago
I'd appreciate explanations for down-voting. I don't think the downvote is fair. Is any of what I said factually incorrect? How? HN can be really weird sometimes.
spindritf 15y ago
User access to user settings is not a "security hole". And I don't think there is a way to protect your logged in, unattended session without demolishing productivity. If you walk away from your computer, lock it. I would expect the State Department to have some protections in place (proximity cards, mandated timeout settings, etc) when actual privileged information is concerned and being accessed. Yes, it would probably be nice if Chrome had the kind of protection of passwords database with a master password that Firefox does. But it still isn't a "security hole".

joejohnson 15y ago

So, will Google have access to what State Dept officials browse and search? How can this be legal?

dbarlett 15y ago

Quite a change from three years ago, when State was stuck on IE6 and Secretary Clinton didn't know what Firefox was. http://www.theregister.co.uk/2009/07/13/firefox_and_us_state_department/ http://www.theregister.co.uk/2009/07/13/firefox_and_us_state...

chimeracoder 15y ago
The last line of the article is priceless: "No doubt, the State Department will officially adopt Facebook at about the same time the revenue-challenged site follows Friendster into social networking oblivion"

Metapony 15y ago

Now the State dept will get out of memory errors too!

jrockway 15y ago
As an Emacs user, it makes me happy that some other piece of software finally gets to be the butt of out-of-memory jokes. It only took 20 years.

niels_olson 15y ago

Having read all the concerns on here, and having worked with field officers from State, I think some folks have pointed out some great things to work on, but State is still making the right decision. We can secure buildings reasonably well, even in very dangerous parts of the world where we are the prime targets by a factor of 10. Securing the best vehicle for navigating the network has proven quite a bit harder. Keep in mind, State is quite small compared to some other agencies, and most people with secrets are pretty sharp, and they are working infinitely more with information than with physical security. Also, if we have stuff that obviously needs to be heavily secured, we use other networks. For the NIPRnet, firefox_vs_opera_vs_ie.jpg remains fairly relevant: http://imgur.com/SYgZ5 http://imgur.com/SYgZ5

robomartin 15y ago
Oh, OK. Wikileaks can't possibly get ahold of sensitive data, emails and memos then. Security is always bulletproof until it isn't.
jsight 15y ago
I've worked at government agencies (recently) that banned all "third party browsers". Compared to that kind of policy, I think choosing Chrome is wonderful.

niels_olson 15y ago

Having read all the concerns on here, and having worked with field officers from State, I think some folks have pointed out some great things to work on, but State is still making the right decision. We can secure buildings reasonably well, even in very dangerous parts of the world where we are the prime targets by a factor of 10. Securing the best vehicle for navigating the network has proven quite a bit harder. Keep in mind, State is quite small compared to some other agencies, and most people with secrets are pretty sharp, and they are working infinitely more with information than with physical security. Also, if we have stuff that obviously needs to be heavily secured, we use other networks. For the NIPRnet, this remains fairly relevant: http://imgur.com/SYgZ5 http://imgur.com/SYgZ5

alan_cx 15y ago

Just a simpleton point here: I read a lot of stuff, every day, about how evil google and its chromey thing steal all our personal information and use it to advance their super villain take over of the world. So, um, why would any body bothered by security want to use google? Its like "Q" department being supplied by Dr No.

richardw 15y ago
Google with Evil turned up to 11 is trying to serve you more adverts. State is more interested in the fact that Google is having to offer hackers more money to hack Chrome in pwn2own. Last year they didn't even try. http://www.securitynewsdaily.com/496-hacking-contest-smashes-safari-internet-explorer.html http://www.securitynewsdaily.com/496-hacking-contest-smashes... "Google’s Chrome Web browser managed to remain untouched. In fact, Computer World reported that nobody even attempted to crack into Google Chrome , despite the $20,000 Google offered to anyone who could successfully exploit it."