41 ms·
Google Chrome has an API accesible only from *.google.com
- bonestamp2 2y agoIs it fair to assume this is used for fingerprinting/tracking users?
- sophiebits 2y ago[flagged]
- daniel_levine 2y agothis is a great comment, thank you for your service!
- IshKebab 2y ago[flagged]
- diggan 2y agoThe tweet says: > So, Google Chrome gives all *.google.com sites full access to system / tab CPU usage, GPU usage, and memory usage. It also gives access to detailed processor information, and provides a logging backchannel. Those things can absolutely be used to "improve" fingerprinting. I don't think it's fair to assume it's being used for that though, without any further evidence. But it certainly could be used for it. Anyone have any further context? As it stands right now, it's just a random claim without any proof what so ever? There is link in another comment, but how is that related to the tweet?
- CoastalCoder 2y ago> I don't think it's fair to assume it's being used for that though, without any further evidence. Maybe in this situation we should distinguish "fair" vs. "probable". I'd guess it's improbable that Google is trying to use this for fingerprinting. But if we've previously found them with their hand in the cookie jar, then maybe it's fair to treat them as guilty until proven innocent?
- rolph 2y agoperhaps a measure to determine if the owners devices can tolerate one more web app or ad stream before it runs out of resources
- deleted 2y ago[deleted]
- plorkyeran 2y agoGoogle doesn't need any extra help to track users who are browsing Google sites in the Google browser. It is probably instead anticompetitive functionality that lets Google sites work better in Chrome in ways that other sites can't replicate.
- account42 2y ago> Google doesn't need any extra help to track users who are browsing Google sites in the Google browser. I would not be surprised if there are cases where this would let them track users they otherwise couldn't. Like someone running two isolated Chrome instances with separate network connections but on the same PC.
- MisterDizzy 2y agoHardly surprising. This is very Google-like behavior. The question is do other Chromium browsers have this? Edge? Brave? Chromium? Ungoogled Chromium?
- bakugo 2y agoDon't know about the rest, but ungoogled chromium scrambles every occurrence of the string "google" in the code specifically to avoid things like this, so probably not.
- idunnoman1222 2y agoScrambles to a static unpurchased domain?
- doctorpangloss 2y agoYou’d hope so right? If you don’t want to use Google’s browser, don’t use Google’s browser.
- scrollaway 2y agoI don’t think you understand the security implication of what you just said. Edit, if it’s not obvious: an unclaimed domain with special permissions is a massive security hole.
- 8organicbits 2y agoPerhaps you could explain.
- doctorpangloss 2y agoI understood what the commenter was saying and the "security implication." I am mocking the thing that people want: to use Google Chrome but with the "googly" bits removed. It isn't super practicable. Just use Firefox.
- pcwalton 2y agoGoogle has done this sort of thing before. My memory is fuzzy as to the details, but I think it was Native Client being allowlisted at the domain level to only work on Hangouts, or something like that.
- deleted 2y ago[deleted]
- beardyw 2y agoWhat has an hidden API where? I have no idea what this is trying to say. Can anyone make sense of it?
- emilsedgh 2y agoGoogle allows web pages from *.google.com to read a user's cpu usage, gpu usage, etc. Other web pages don't have such access.
- sophiebits 2y agoWebsites hosted on the google.com domain can access more data about the device than websites hosted on any other domain.
- josephcsible 2y agohttps://source.chromium.org/chromium/chromium/src/+/main:chrome/browser/resources/hangout_services/ https://source.chromium.org/chromium/chromium/src/+/main:chr... That API is baked into Google Chrome. It's hardcoded to only let google.com use it.
- jeffbee 2y agoI don't think that is an accurate description. The APIs are available in Chrome to anyone: https://developer.chrome.com/docs/extensions/reference/api/system/cpu https://developer.chrome.com/docs/extensions/reference/api/s... The allowlisting going on here is that normally when you install an extension in Chrome it asks you to confirm the access to those APIs on the sites where the extension wants to run, but this one comes pre-confirmed from the factory. A quick GitHub search finds ~1000 manifest files that list system.cpu, possibly because that API is also in the boilerplate example chrome extension manifest.
- josephcsible 2y agoThat's still just as unfair, though. Google always has access to that information because their extension is preinstalled and you can't disable it, but other websites have no access to that information unless you go out of your way to install a third-party extension to do so.
- jeffbee 2y agoYou can build Chrome without this by setting `enable_hangout_services_extension` to false. Of course, then none of the WebRTC stuff on google.com will work.
- ramesh31 2y agoOne does not simply "build chrome".
- tgv 2y agoChromium has ungoogled builds: https://chromium.woolyss.com/ https://chromium.woolyss.com/
- ranger_danger 2y agoyes but that's Chromium, not Chrome (which is proprietary). I think that's what OP was saying
- mananaysiempre 2y agoNot necessarily. Building even Chromium can be... unpleasant[1]. [1] https://liberda.nl/weblog/heres-your-copium/ https://liberda.nl/weblog/heres-your-copium/
- lifesaverluke 2y agoThe process is well documented :-)
- dudus 2y agoFWIW I once tried and failed to compile Chrome. My machine didn't have enough RAM to compile chrome at the time. Even though it was able to fully compile any other software I threw at it.
- 2y ago
- htrp 2y ago> So, Google Chrome gives all *.google.com sites full access to system / tab CPU usage, GPU usage, and memory usage. It also gives access to detailed processor information, and provides a logging backchannel. So I guess the question becomes how quickly you can spoof this ?
- justo-rivera 2y agoYou just need to "register" a subdomain. So basically any google employee has potentially full access to your system?
- sophiebits 2y agoYou’re likely severely underestimating the amount of internal paperwork and review that is required to launch a new google.com subdomain.
- isodev 2y agoMaybe they don't need a new subdomain, something unused could do the trick.
- riccardomc 2y agoProbably a 'something.google.com'... But you could have teams with DNS zone delegation who can.create.anything.like.this.google.com
- drpossum 2y agoI did one on my local network and didn't fill out anything
- block_dagger 2y agoBut only you have access to your local network.
- 2y ago
- bastien2 2y agoThis just in: Google Spyware has features accessible only to Google.
- deleted 2y ago[deleted]
- blackeyeblitzar 2y agoSo this is a lot like Microsoft using specialized formats or APIs in Windows that competitors cannot access, which was a problem throughout the 90s. The problem never went away - it has just changed appearance.
- Brian_K_White 2y agoThis is a little different than Office being able to use some useful OS integration feature that LibreOffice can't use. This is allowing Google to do something TO you that no one else can do to you, and that you assumed no one could do to you.
- kristjank 2y ago[flagged]
- deleted 2y ago[deleted]
- ethanppl 2y agoI wonder how Chromium, Brave or Edge handle this?
- newzisforsukas 2y agoIts in the chromium repo: https://source.chromium.org/chromium/chromium/src/+/main:chrome/browser/resources/hangout_services/ https://source.chromium.org/chromium/chromium/src/+/main:chr... https://source.chromium.org/chromium/chromium/src/+/main:chrome/browser/resources/hangout_services/manifest_v2.json https://source.chromium.org/chromium/chromium/src/+/main:chr...
- newzisforsukas 2y agoYou also could probably block this with a policy file. The extension ID is: nkeimhogjdpnpccoofpliimaahmaaome https://chromeenterprise.google/policies/?policy=ExtensionInstallBlocklist https://chromeenterprise.google/policies/?policy=ExtensionIn...
- teaearlgraycold 2y ago[flagged]
- deleted 2y ago[deleted]
- baggy_trough 2y agoWonder if Edge renames this to *.microsoft.com or bing.com.
- FateOfNations 2y agoProbably not. It's part of a bundled extension used to support Google Hangouts.
- mcpar-land 2y agoGoogle spent billions muscling their way into their majority market share of web browsers, now they're going to keep on cashing out with unfair practices like these.
- jgalt212 2y agoIt's like Google relishes in giving the FTC all the help it could ever want.
- deleted 2y ago[deleted]
- ranger_danger 2y agologin-walled
- madeofpalk 2y agoI'm not sure what these APIs are exactly and why they're there, but Firefox also does something similar. It has special APIs available only to Mozilla and/or Firefox domains, for things like installing extensions, or helping with first-run experience. A blog post about it was shared here on Hacker news <12 months ago, but I'm having trouble finding it...
- jhdifdhsak 2y agoHardly the same. apis are public, documented and the domain allowlist is both included in the UI and about:config (save from android playstore version where they hide everything to make the browser pure garbage for whatever reason) and I'm pretty sure devs would at least think about adding your domain by default if you ask nicely with a great use case on bugzilla.
- nightpool 2y agoWhat? You think that Mozilla devs would think about adding your domain to the whitelist of domains allowed to install extensions if you just asked nicely? That would be insane from a security perspective.
- Osmose 2y agoI wrote a post about the UITour parts a long time ago: https://www.mkelly.me/blog/content-uitourjs/ https://www.mkelly.me/blog/content-uitourjs/ It's pretty standard among browsers. The risk should be about equal to someone spoofing the domains that the browser downloads software updates from, and you can turn it off via prefs if you really don't want it.
- xxmarkuski 2y agoA commit to Webkits Quirks.cpp was shared last month [0]. Probably not what you are referring to but has a similar vibe. [0] https://news.ycombinator.com/item?id=40631439 https://news.ycombinator.com/item?id=40631439
- kelnos 2y ago
- Tiberium 2y agoI think the submission is a bit wrong in editing the title from the original. I understood it like this: Chrome has a built-in extension that uses public Chrome APIs that are easily available to other Chrome extensions. The issue described is that this extension shares this information to Google's own domains when they're communicating with the extension, while other websites can't do this. There's no "special hidden API".
- Cyphus 2y ago"special" in the sense that unlike other extensions which are user-installed, this one is built into Chrome. "hidden" in the sense that when I go to chrome://extensions it is not listed. And as you already mentioned, it's a Chrome API.
- danans 2y agoThere is potentially an innocuous and straightforward explanation for this. Imagine the browser comes with some functionality implemented as a google.com-signed web app (as opposed to compiled/linked C++ as a lot of the older Chrome UI). It would be silly if that PWA-implemented browser code would need permission to access the system information, since it is part of the browser's functionality itself. Another use case for a private API (that has long existed) is integration of the Chrome browser with Google-specific websites that provide core functionality, like the Chrome Web store, to allow for installation/removal of extensions from a web page.
- ranger_danger 2y agoAny time things like this are needed, I think it should ask the user for permission first.
- danans 2y agoMy examples are of core browser functionality, just implemented with a different tool chain (a web app instead of C++). Should the user be asked for permission for C++ to send an IPC to another C++ component? Should the Chrome Web store ask for permission to install extensions in Chrome? Down-thread I see that this is being used for Google Meet functionality, for which I agree it should ask for the user's permission.
- chrsig 2y agoIs there more of an explanation? I see a baseless claim without any specificity. I'm not saying it's right/wrong, just that no evidence was presented.
- develatio 2y agoThere is a link pointing out the exact place in Chrome's code.
- FateOfNations 2y agoChrome extensions can access CPU and GPU statistics via a public API that any extension developer can use. Google Chrome comes bundled with a hidden "Hangouts Services" extension, which has permissions for *.google.com (that extension's ID is the 'nkeimhogjdpnpccoofpliimaahmaaome' referenced in the examples). That extension has a function that will return those stats when called from JavaScript running on a webpage. As a result, any JavaScript running on *.google.com can get the current CPU and GPU utilization.
- mmsc 2y agoAnd? Google uses Chrome to retrieve data about the user. Every Chromium-based browser has 'hidden' APIs only accessible on certain domains. That's how the custom (read: closed source) extensions work. "Component extensions" are used to interact with them normally: https://chromium.googlesource.com/chromium/src/+/main/extensions/docs/component_extensions.md https://chromium.googlesource.com/chromium/src/+/main/extens... See https://blogs.opera.com/security/2021/09/8000-bug-bounty-highlight-xss-to-rce-in-the-opera-browser/ https://blogs.opera.com/security/2021/09/8000-bug-bounty-hig... and https://blogs.opera.com/security/2021/09/bug-bounty-guest-post-local-file-read-via-stored-xss-in-the-opera-browser/ https://blogs.opera.com/security/2021/09/bug-bounty-guest-po... for examples of when there are vulnerabilities in those extensions, and how they can be abused for remote code execution. Any whitelisted domains for these APIs cannot be written to using user-installed extensions, in order for a malicious extension to not be able to inject a script and execute the special API. At Opera, we previously tried attacking the underlying implementation about how these 'hidden' APIs are accessible. Although we found a lot of Opera-specific issues, the Chromium logic seems sound and a "bypass" for other websites accessing the API is unlikely. It also seems that the developer here was just a bit overzealous in allowing this API to be accessed from all google.com subdomains.
- jhdifdhsak 2y agotechnically correct. google chrome should forever be called "Tainted Chromium" to use the same nomenclature as the Linux Kernel when you load blobs.
- CMYKninja 2y agoI can hear the regulators in Strasbourg typing up complaints and fines now.
- hpen 2y ago[flagged]
- deleted 2y ago[deleted]
- lashkari 2y agoIf it's really accessible from *.google.com, wouldn't this be simple to verify/exploit by using Google Sites (they publish your site to sites.google.com/view/<sitename>)?
- DownrightNifty 2y agoJS on Google Sites, Apps Script, etc. runs on *.googleusercontent.com, otherwise cookie-stealing XSS happens.
- _9yre 2y agoDisclaimer: I work at Google, but not on Chrome or on these APIs. I think the explanation is quite mundane. An example usage: open google meet, start an empty meeting (an “instant meeting”), click the “…” menu, click “troubleshooting and help”. There’ll be plots of various stats, including CPU utilization. I think meet will also helpfully suggest closing tabs if your machine is overloaded during a meet call, too. It’s very helpful, I check it from time to time. Edit: now that I think about it, I’m not sure about the suggestion to close tabs is actually a thing. I’ve only actually used the stats view.
- trickstra 2y agoSo helpful that no other website and no other browser can use it?
- john-n 2y agoI believe this is the point, rather than being mundane. Other video conference tools are not able to offer this debugging option - which you have pointed out is useful.
- tantalor 2y agoThe user could easily install an extension that provides the same debugging capability. Most users don't care, so they won't need it.
- elicksaur 2y agoDefaults are powerful.
- lucacasonato 2y agolike 90% of the DMA is just this haha
- yjftsjthsd-h 2y agoThen why did Google build it into the browser?
- toenail 2y agoHm, I guess it's good I have a firewall?
- aflag 2y agoHow does that help?
- simonw 2y agoLooks like they added this in October 2013: https://github.com/chromium/chromium/commit/422c736b82e7ee763c67109cde700db81ca7b443 https://github.com/chromium/chromium/commit/422c736b82e7ee76... Bundle Hangouts Services extension with Chrome BUG=291271 Review URL: https://codereview.chromium.org/35873003 Here's that review URL: https://codereview.chromium.org/35873003 https://codereview.chromium.org/35873003
- simonw 2y agoIf you want to see what this does, navigate to https://www.google.com/ https://www.google.com/ in Chrome and paste this into your DevTools console: chrome.runtime.sendMessage( 'nkeimhogjdpnpccoofpliimaahmaaome', { method: 'cpu.getInfo' }, response => { console.log('CPU Info:\n', JSON.stringify(response, null, 2)); } ); I got this: { "value": { "archName": "arm64", "features": [], "modelName": "Apple M2 Max", "numOfProcessors": 12, "processors": [ { "usage": { "idle": 26879793, "kernel": 5270058, "total": 42511068, "user": 10361217 } }, { "usage": { "idle": 27925505, "kernel": 5045974, "total": 42900999, "user": 9929520 } }, { "usage": { "idle": 29153545, "kernel": 4688719, "total": 43152989, "user": 9310725 } }, { "usage": { "idle": 30140852, "kernel": 4360719, "total": 43319960, "user": 8818389 } }, { "usage": { "idle": 34426211, "kernel": 2169516, "total": 43433582, "user": 6837855 } }, { "usage": { "idle": 38586206, "kernel": 1338183, "total": 43658789, "user": 3734400 } }, { "usage": { "idle": 41067872, "kernel": 598226, "total": 43874597, "user": 2208499 } }, { "usage": { "idle": 41795321, "kernel": 412479, "total": 43965499, "user": 1757699 } }, { "usage": { "idle": 34484688, "kernel": 2180147, "total": 43500079, "user": 6835244 } }, { "usage": { "idle": 38604714, "kernel": 1340358, "total": 43680869, "user": 3735797 } }, { "usage": { "idle": 41086212, "kernel": 599273, "total": 43883401, "user": 2197916 } }, { "usage": { "idle": 41802500, "kernel": 411499, "total": 43970596, "user": 1756597 } } ], "temperatures": [] } } This won't work on non-Google URLs.
- leros 2y agoI briefly worked on Internet Explorer in ages past. They would develop APIs with the Windows team for use in IE to give IE special features that other browsers couldn't implement.
- kelnos 2y agoAnd isn't this one of the many things Microsoft got in trouble for with the DoJ's antri-trust enforcement division in the 90s?
- leros 2y agoMy experience was well after that.
- asadotzler 2y agoMore time has passed since the Consent Decree ended than while it was in effect.
- tantalor 2y agoLooks like this is accessing "chrome.system.cpu" API, which any extension can access (given the "system.cpu" permissions). https://developer.chrome.com/docs/extensions/reference/api/system/cpu https://developer.chrome.com/docs/extensions/reference/api/s... You can see all the permissions requested by this extension here: https://source.chromium.org/chromium/chromium/src/+/main:chrome/browser/resources/hangout_services/manifest_v3.json;l=23-31 https://source.chromium.org/chromium/chromium/src/+/main:chr...
- kelnos 2y agoYes, and that's the issue: Google is bundling an extension into Chrome that is unrelated to the operation of the browser itself, which gives another one of its products (Hangouts) privileged access that no other videoconferencing app has, at least not without the big step of getting users to manually install another extension.
- Palmik 2y agoPeople arguing that this is "just extension" are ignoring the fact that extensions have special priviledges compared to websites, and you would not want all websites to have the full power of arbitrary extension. If it's "just extension", make it available to all domains.
- deleted 2y ago[deleted]
- deleted 2y ago[deleted]
- FateOfNations 2y agoThe primary "special privilege" is that the extension is shipped with the browser and hidden. The API itself is available to any extension developer. https://developer.chrome.com/docs/extensions/reference/api/system/cpu https://developer.chrome.com/docs/extensions/reference/api/s...
- lwansbrough 2y agoFor anyone having trouble with the logic here, which seems like a lot of people in this thread for some reason: [Google's browser] comes with [code] that [does things] in a default installation of [Google's browser] that [Google's competitors] can't do in a default installation of [Google's browser].
- SahAssar 2y agoDidn't you leave out that [Google's browser] allows [Google's websites] to do things [other websites] cannot? Ostensibly [Google's websites] are websites like any other, but [Google's browser] treats them differently. IIRC Mozilla does similar things for addons.mozilla.org, but googles seem more broad since they are not as clearly linked to browser functionality.
- lwansbrough 2y agoWe’re saying the same thing. There are some who believe this is okay. But it is clearly monopolistic behaviour that should be regulated.
- SahAssar 2y agoMy reading of your comment was defensive of google, basically "google ships a software package so of course they should be able to do stuff others can't" where I tried to highlight "google ships a browser which should of course treat websites equally". Seems like I misunderstood the intent behind your comment.
- kristjansson 2y ago[does relatively innocuous, relatively boring things]
- some_random 2y agoThat only Google can do, which makes competing with them harder. This isn't difficult to understand.
- mike_hearn 2y agoThe name hangout_services suggests this is some old tech debty hack intended to make developing Google Hangouts easier by giving that team a direct stream of telemetry. For those who have forgotten, Hangouts was the first app that did video calling in the browser using what became WebRTC. If you look at what this module is doing it's exposing stuff like CPU/GPU/RAM usage/hardware details back to the app that it wouldn't normally have. My guess is that Google will react to this Twitter thread by simply deleting it. Hangouts has been a dead product for a while; if their server side code still uses it they can surely remove it as presumably the Chrome team monitor WebRTC performance themselves in a multi-site way now, given the much wider usage.
- lucacasonato 2y agoNo, this is used by Google Meet right now. Open the "Troubleshooting" panel in meet.google.com in Chrome, and you'll see live system wide CPU usage reporting :)
- mike_hearn 2y agoRight, Meet is derived from the Hangouts codebase, I still think they'll probably just delete it. Meet is a stable product, how valuable is this special privilege now?
- badgersnake 2y agoIt works perfectly well in Firefox without it, so I guess not much.
- ehPReth 2y agounsure how it's reported back now, but I believe (it's been a while since i've dug in there) it's also exposed as a metric for Google Workspace administrators to monitor client perf during said calls as well (but yeah it would just be easier to yoink it)
- refulgentis 2y agoThis is interesting to me because you have all the right facts and are reasoning well with them. But, we end up at: "Yeah you're right it wasn't killed, just a rebrand, so they'll probably just delete the code for it" I worked at Google, and I can guarantee ya people don't go back and change names in old code for the latest rebrand done for eyewash 4 layers above me. Not out of laziness, either, it just has 0 value and is risky. Also, video conference perf was/is a pretty big deal (c.f. variety of sibling comments pointing out where it is used, from gSuite admin to client app). It is great on ye olde dev machine but it's very, very hard on $300 WintelChromebook thrown at line-level employees FWIW, they shouldn't have hacked this in, I do not support it. And I bet they'll just delete it anyway because it shouldn't have been there in the first place. Some line-level employee slapped it in because, in the wise words of Ian Hickson: "Decisions went from being made for the benefit of users, to the benefit of Google, to the benefit of whoever was making the decision."
- kderbyma 2y agoThat was one reason I don't use Chrome. They clearly do special stuff on their sites. And spyware is guaranteed with chrome
- deleted 2y ago[deleted]
- dijit 2y agoThis kind of thing is common, there was a file called tweaks.cpp which had a list of domains that had slightly different behaviours. That file was very telling to be honest and was well commenter. Firefox has a similar file.
- cpeterso 2y agoFirefox’s website “interventions” are documented on Firefox’s about:compat page. Each intervention has a link to more information about the website issue it’s fixing and a button to turn it off.
- locallost 2y agoIs this how they implement features like pinning a live game score in your phone from the browser? I always wondered how they do that.
- Pesthuf 2y agoSafari also has some Apple specific features, like being able to show a special dialog for logging into other websites with your Apple account that works differently from passkeys or password autofill, or the redirect based flow they make other browsers go through. Always wondered how it's implemented in JS. WebAuthn with proprietary arguments...?
- oissla 2y agobot detection?
- sreejithr 2y agoIf you’re still using Chrome in 2024, you’re a fool.
- hmans 2y ago[dead]
- theshrike79 2y agoAnd this is why we should all boycott Chromium based browsers. It's turning (and mostly has already turned) into the new Internet Explorer. Use Safari or Firefox, or any other browser that's not based on Chromium.
- Hizonner 2y agoGoogle really needs to be broken up. Into 5 or 6 totally independent pieces.
- throwaway4good 2y agoIsn't Google chrome open source? It should be possible to point to the source code of whatever google.com extensions that may exist. Or is this only available in the packaged distributions of Chrome?
- throwaway4good 2y agohttps://chromium.googlesource.com/chromium/src.git https://chromium.googlesource.com/chromium/src.git
- poikroequ 2y agoI think there are a few bits and pieces which may not be open source, such as those for DRM.
- cletus 2y agoI might be able to shed some light on this (disclaimer: Xoogler). I worked for a time on Google's internal videoconferencing platform, called GVC. This was in 2010-2011 at a time when a lot of the company's VC equipment was proprietary, specifically Cisco Tandberg units. These were expensive and would be expensive to roll out to thousands of meeting rooms. around this time a different team was developing Hangouts. It's been awhile so my memory may be off but I think it was called Google Meet at the time? or maybe that was later? It's hard to keep track. I think Hangouts was the name adopted when Google+ came along and rolled Hangouts into its product offering. There were different configurations of GVC but the most common were these All-in-One ("AIO") monitor/computer combos. It was a full Intel PC. So the GVC platform was a custom Linux distro. The system was designed so GVCs could talk to Google services, which was nontrivial, and so software updates could be rolled out. It kept old distros too in case one didn't boot. These GVCs had to be named and a whole bunch of other issues. Additionally they needed support for various hardware like a touch panel to dial. Larger units required larger PTZ camera support and support for various microphones. Anyway, Hangouts became the stack GVC was built on. This ultimately replaced virtually all Tandbergs and saved a fortune. This system was certainly still in use by 2017. I can't speak for later. Monitoring was a part of all this. So when I see there are *.google.com specific APIs, we need to be sure we're talking about this accurately. Like can Google query any Chrome instance in the world? Or is it only from/to google.com? I don't know the answer and the Tweet doesn't specify. But given the name hangouts_services and the domain restriction I consider it highly likely this is purely to support monitoring embedded Chrome for GVC. I could be wrong.
- deanCommie 2y agoFascinating! So it's possible most of Google didn't even know this was possible until know. Until know. Now there's probably DOZENS of Product Managers approaching their product's tech lead going "OK, now...hear me out...."
- kweingar 2y agoThere are zero product managers who read this Twitter thread about a random decade-old Chromium hack and will do anything about it.
- asr 2y agoSo the concern is that Google is making Hangouts better in a way that is hard for competitors to replicate? (And by "hard," I mean, "competitors have to ask users to install something," not hard in any HN-relevant sense of the word.) This forum sure has a lot of wanna-be Handicapper Generals. https://en.wikipedia.org/wiki/Harrison_Bergeron https://en.wikipedia.org/wiki/Harrison_Bergeron
- yjftsjthsd-h 2y agoIf it's easy for users to just install the extension, then obviously there's no point in Google doing this in the first place. The fact that they bothered sounds like a pretty compelling argument for it being worth caring about.
- asr 2y agoWorth caring about why?? Because you think Google shouldn’t be allowed to make things better for their users? Like I said, you are so concerned about fairness you’re missing the point.
- ascorbic 2y agoWorth caring about because they have a browser monopoly. It's not allowed for the exact same reason why in the olden days Microsoft wasn't allowed to add APIs to Windows that could only be used by IE, even if it made things better for IE users. It harmed users in the overall market by making it harder to compete.
- daitangio 2y agoI stopped using Chrome as my primary & only browser. Too much power in one hand?
- benced 2y agoThis API either shouldn’t exist or should be Google only. It would be an absolute disaster if everyone had access to it.
- poikroequ 2y agoIs it not Google only?
- benced 2y agoThere's been proposals in the thread calling for it to be opened. I also saw one on Twitter calling for it to be opened under the DMA.
- FateOfNations 2y agoIt's an API that is available to extension developers. The wrinkle here is that Google bundles a hidden "Hangouts Services" extension in Chrome with permissions for *.google.com (the extension's ID is the "nkeimhogjdpnpccoofpliimaahmaaome" referenced in the examples).
- mikeiz404 2y agoThread reader: https://twitter-thread.com/t/1810696257137959018 https://twitter-thread.com/t/1810696257137959018
- rldjbpin 2y agothrough this, at least it is now fairly well known that chrome is able to share detailed hardware details to a website. now, is it bad that it is being done at all or that only google.com host requests can access it? personally i see the value during debugging but having it forced enabled this way (also for only one company) is not great and should be remedied.
- diego_sandoval 2y agoLast time I used Google Chrome, if you logged into a Google account while using Chrome, it automatically logged you into that Google account in the browser itself. Isn't that implemented in a similar way to this? I agree with the concerns about unfair competition, and I think this auto-login "feature" could also qualify as an example.