4 ms·

I think the submission is a bit wrong in editing the title from the original. I understood it like this: Chrome has a built-in extension that uses public Chrom

I think the submission is a bit wrong in editing the title from the original. I understood it like this: Chrome has a built-in extension that uses public Chrome APIs that are easily available to other Chrome extensions. The issue described is that this extension shares this information to Google's own domains when they're communicating with the extension, while other websites can't do this. There's no "special hidden API".

Cyphus 2y ago
"special" in the sense that unlike other extensions which are user-installed, this one is built into Chrome. "hidden" in the sense that when I go to chrome://extensions it is not listed. And as you already mentioned, it's a Chrome API.
danans 2y ago
There is potentially an innocuous and straightforward explanation for this. Imagine the browser comes with some functionality implemented as a google.com-signed web app (as opposed to compiled/linked C++ as a lot of the older Chrome UI). It would be silly if that PWA-implemented browser code would need permission to access the system information, since it is part of the browser's functionality itself. Another use case for a private API (that has long existed) is integration of the Chrome browser with Google-specific websites that provide core functionality, like the Chrome Web store, to allow for installation/removal of extensions from a web page.
- ranger_danger 2y ago
  Any time things like this are needed, I think it should ask the user for permission first.
  - danans 2y ago
    My examples are of core browser functionality, just implemented with a different tool chain (a web app instead of C++). Should the user be asked for permission for C++ to send an IPC to another C++ component? Should the Chrome Web store ask for permission to install extensions in Chrome? Down-thread I see that this is being used for Google Meet functionality, for which I agree it should ask for the user's permission.
    - ranger_danger 2y ago
      > Should the user be asked for permission Yes. We need much more of this on the desktop.
      - danans 2y ago
        In any multi-process software (of which Chrome is on the more complex end of the spectrum), there are dozens if not hundreds of different IPC message types sent between different components of the software. To prompt the user for every type of IPC would make the software unusable. No desktop software does that on any platform. It would be like a car asking the user for permission for the steering wheel to access the front axle.
- runarberg 2y ago
  I think it is a mistake to give a company like Google the benefit of the doubt. Consumer protection is a lot like security, we should theorize the worst case scenario, and assume the company is willing to work against consumer interest if it serves their own interests. If there exists a mundane and reasonable explanation for this, that doesn’t matter if there also exists a potential to exploit it in a way that harms consumers’ interests.
  - account42 2y ago
    Well said. Hanlon's razor doesn't work for corporations (or with people that have already shown their willingness to do the unethical).
    - runarberg 2y ago
      I actually prefer Marx’s razor over Hanlon’s: “Never attribute to stupidity that which is adequately explained by class-interest.”
parhamn 2y ago
Same thing with more steps?
silverwind 2y ago
A "built-in extension" is still part of the browser unless it can be disabled.
lwansbrough 2y ago
This is functionally equivalent.
simonw 2y ago
Paste this into a Chrome DevTools console on a Google site - sure looks like a special API to me: chrome.runtime.sendMessage( 'nkeimhogjdpnpccoofpliimaahmaaome', { method: 'cpu.getInfo' }, response => { console.log('CPU Info:\n', JSON.stringify(response, null, 2)); } );
- Jcampuzano2 2y ago
  For what its worth, I'm on Brave (chromium based) and this also works there, so it appears to not necessarily be only Chrome but potentially any chromium browser where they haven't specifically blocked/disabled this
  - cassianoleal 2y ago
    Arguably, Chromium is more important to Google than Chrome is. By controlling the engine, they have de facto control over the standards. By keeping Chromium open, they incentivise forks. Most people who don't want to use Chrome because it's Google's or for some other reason will use one of the forks or Chromium-based browsers. By keeping this illusion of choice, Google extends its control.
- rundev 2y ago
  [flagged]
  - simonw 2y ago
    You're welcome to read the five lines of code I shared yourself before you run it!
  - ikiris 2y ago
    You're literally running their program already. They're already running arbitrary code on your machine.
    - lnxg33k1 2y ago

Cyphus 2y ago

"special" in the sense that unlike other extensions which are user-installed, this one is built into Chrome. "hidden" in the sense that when I go to chrome://extensions it is not listed. And as you already mentioned, it's a Chrome API.

danans 2y ago

There is potentially an innocuous and straightforward explanation for this. Imagine the browser comes with some functionality implemented as a google.com-signed web app (as opposed to compiled/linked C++ as a lot of the older Chrome UI). It would be silly if that PWA-implemented browser code would need permission to access the system information, since it is part of the browser's functionality itself. Another use case for a private API (that has long existed) is integration of the Chrome browser with Google-specific websites that provide core functionality, like the Chrome Web store, to allow for installation/removal of extensions from a web page.

ranger_danger 2y ago
Any time things like this are needed, I think it should ask the user for permission first.
- danans 2y ago
  My examples are of core browser functionality, just implemented with a different tool chain (a web app instead of C++). Should the user be asked for permission for C++ to send an IPC to another C++ component? Should the Chrome Web store ask for permission to install extensions in Chrome? Down-thread I see that this is being used for Google Meet functionality, for which I agree it should ask for the user's permission.
  - ranger_danger 2y ago
    > Should the user be asked for permission Yes. We need much more of this on the desktop.
    - danans 2y ago
      In any multi-process software (of which Chrome is on the more complex end of the spectrum), there are dozens if not hundreds of different IPC message types sent between different components of the software. To prompt the user for every type of IPC would make the software unusable. No desktop software does that on any platform. It would be like a car asking the user for permission for the steering wheel to access the front axle.
runarberg 2y ago
I think it is a mistake to give a company like Google the benefit of the doubt. Consumer protection is a lot like security, we should theorize the worst case scenario, and assume the company is willing to work against consumer interest if it serves their own interests. If there exists a mundane and reasonable explanation for this, that doesn’t matter if there also exists a potential to exploit it in a way that harms consumers’ interests.
- account42 2y ago
  Well said. Hanlon's razor doesn't work for corporations (or with people that have already shown their willingness to do the unethical).
  - runarberg 2y ago
    I actually prefer Marx’s razor over Hanlon’s: “Never attribute to stupidity that which is adequately explained by class-interest.”

parhamn 2y ago

Same thing with more steps?

silverwind 2y ago

A "built-in extension" is still part of the browser unless it can be disabled.

lwansbrough 2y ago

This is functionally equivalent.

simonw 2y ago

Paste this into a Chrome DevTools console on a Google site - sure looks like a special API to me: chrome.runtime.sendMessage( 'nkeimhogjdpnpccoofpliimaahmaaome', { method: 'cpu.getInfo' }, response => { console.log('CPU Info:\n', JSON.stringify(response, null, 2)); } );

Jcampuzano2 2y ago
For what its worth, I'm on Brave (chromium based) and this also works there, so it appears to not necessarily be only Chrome but potentially any chromium browser where they haven't specifically blocked/disabled this
- cassianoleal 2y ago
  Arguably, Chromium is more important to Google than Chrome is. By controlling the engine, they have de facto control over the standards. By keeping Chromium open, they incentivise forks. Most people who don't want to use Chrome because it's Google's or for some other reason will use one of the forks or Chromium-based browsers. By keeping this illusion of choice, Google extends its control.
rundev 2y ago
[flagged]
- simonw 2y ago
  You're welcome to read the five lines of code I shared yourself before you run it!
- ikiris 2y ago
  You're literally running their program already. They're already running arbitrary code on your machine.
  - lnxg33k1 2y ago