5 ms·

Maybe the solution is to have the automatic downloads of chrome be anonymous and build the system in such a way that changing it would not be possible. Basical

Maybe the solution is to have the automatic downloads of chrome be anonymous and build the system in such a way that changing it would not be possible. Basically, change the chrome automatic updater to not send any identifying information when it requests a update. That way, you can be sure that Google couldn't just target 'you' with a update. Then, you just need to rely on the fact that people would be watching the chromium code for any changes which would negate the above anonymity. The real challenge would be for Google to develop a way where they could not still identify people from their other data (IP, cookies, etc..) when they were requesting a update. Maybe have a third party host/store chrome update binaries? Something like amazon S3 or something which would not data share with Google.

AnthonyMouse 12y ago
> Maybe have a third party host/store chrome update binaries? Something like amazon S3 or something which would not data share with Google. Obvious problem there is that whoever is putting pressure on Google could put the same pressure on Amazon. Solution is to use P2P. If your device has uploaded the new code to two other devices (and so on) before installing it, targeting specific devices becomes much more difficult.
- DanBlake 12y ago
  using tor to download it should work pretty well, yes.
  - AnthonyMouse 12y ago
    Just using tor doesn't necessarily fix it. If you're still getting the update directly from Google then there is still the possibility that they can fingerprint your device -- this is one of the hard problems with using tor and one of the reasons you have to be so careful when using it for anything important. Also, if large companies start using tor for software updates it's liable to fall over from the load. The advantage of using P2P (meaning something in the nature of BitTorrent) is that you can't limit the scope of the update. If you upload it to the target, the target will give it to everybody else.
- danielweber 12y ago
  If a hostile party can get code onto your computer, it doesn't matter much whether the hostile code is living inside chrome.exe or some other program. If I am quietly targeting you to get malware onto your machine to capture your key, trying to sabotage Google Updater even in the current format is the wrong way.
  - AnthonyMouse 12y ago
    If you want to be secure against an attack you have to close all the attack vectors. If whatever the "right way" is supposed to be is patched but this method remains exploitable then you're not finished.
    - danielweber 12y ago
      Trying to secure a self-updating program pulling updates from an untrusted source that it's explicitly designed to trust via its threat model is not "closing an attack vector." It's "impossible." If you think Google's update mechanism is compromised, you need to turn off automatic updates, and then only update via Chrome's offline installer after verifying checksums. Of course, the question is "compare against what?" If Google Chrome is actively hostile, it isn't going to be turned up by Joe Random decompiling every single version and inspecting all the routines. You are slightly better off if you build it yourself, but now you have opened a turtles-all-the-way rat's nest of Trusting Trust and your entire toolchain. And who are you paying to review google's source code against accidental memory leakage each time a new version comes out? If Google is hostile against you, you shouldn't even be using their browser in any way.
      - AnthonyMouse 12y ago
        > If Google is hostile against you, you shouldn't even be using their browser in any way. The problem with this statement is that it generalizes. Unless your solution is to not use any browser, you have to trust somebody. The traditional way to solve this problem is checks and balances. You don't trust just Google, you make them show their work. Because if the source code is sitting there on the web for everybody to see it, and anyone can verify that the binary being distributed to everyone matches the one they get when they compile it themselves, inserting a backdoor is a lot more dangerous because of the risk that you get caught and ruin your reputation. But for any of that to be possible, the code running on your computer has to be the same as the code running on everybody else's computer. The fact that somebody could inspect the code that isn't running on your computer does you no good.

AnthonyMouse 12y ago

> Maybe have a third party host/store chrome update binaries? Something like amazon S3 or something which would not data share with Google. Obvious problem there is that whoever is putting pressure on Google could put the same pressure on Amazon. Solution is to use P2P. If your device has uploaded the new code to two other devices (and so on) before installing it, targeting specific devices becomes much more difficult.

DanBlake 12y ago
using tor to download it should work pretty well, yes.
- AnthonyMouse 12y ago
  Just using tor doesn't necessarily fix it. If you're still getting the update directly from Google then there is still the possibility that they can fingerprint your device -- this is one of the hard problems with using tor and one of the reasons you have to be so careful when using it for anything important. Also, if large companies start using tor for software updates it's liable to fall over from the load. The advantage of using P2P (meaning something in the nature of BitTorrent) is that you can't limit the scope of the update. If you upload it to the target, the target will give it to everybody else.
danielweber 12y ago
If a hostile party can get code onto your computer, it doesn't matter much whether the hostile code is living inside chrome.exe or some other program. If I am quietly targeting you to get malware onto your machine to capture your key, trying to sabotage Google Updater even in the current format is the wrong way.
- AnthonyMouse 12y ago
  If you want to be secure against an attack you have to close all the attack vectors. If whatever the "right way" is supposed to be is patched but this method remains exploitable then you're not finished.
  - danielweber 12y ago
    Trying to secure a self-updating program pulling updates from an untrusted source that it's explicitly designed to trust via its threat model is not "closing an attack vector." It's "impossible." If you think Google's update mechanism is compromised, you need to turn off automatic updates, and then only update via Chrome's offline installer after verifying checksums. Of course, the question is "compare against what?" If Google Chrome is actively hostile, it isn't going to be turned up by Joe Random decompiling every single version and inspecting all the routines. You are slightly better off if you build it yourself, but now you have opened a turtles-all-the-way rat's nest of Trusting Trust and your entire toolchain. And who are you paying to review google's source code against accidental memory leakage each time a new version comes out? If Google is hostile against you, you shouldn't even be using their browser in any way.
    - AnthonyMouse 12y ago
      > If Google is hostile against you, you shouldn't even be using their browser in any way. The problem with this statement is that it generalizes. Unless your solution is to not use any browser, you have to trust somebody. The traditional way to solve this problem is checks and balances. You don't trust just Google, you make them show their work. Because if the source code is sitting there on the web for everybody to see it, and anyone can verify that the binary being distributed to everyone matches the one they get when they compile it themselves, inserting a backdoor is a lot more dangerous because of the risk that you get caught and ruin your reputation. But for any of that to be possible, the code running on your computer has to be the same as the code running on everybody else's computer. The fact that somebody could inspect the code that isn't running on your computer does you no good.