5 ms·

I tend to agree with you. But in your hypothetical case, what's different about a someone (the NSA, etc) installing Chrome and enabling the RA extension vs just

by isaacdl 12y ago

I tend to agree with you. But in your hypothetical case, what's different about a someone (the NSA, etc) installing Chrome and enabling the RA extension vs just installing another remote access tool?

thefreeman 12y ago
Well in the second scenario, they would hypothetically still need to infect you with the RAT. In his scenario, you're already installed version of Chrome will infect you without your knowledge when it silently syncs the new Remote Desktop extension into your existing installation. Obviously if they have your Google credentials you are in a world of trouble, and I have no doubt if a 3 letter agency wanted to infect me they could, but the scenario he brings up is still troublesome and not at all restricted to highly technical attackers.
- comex 12y ago
  Judging from this help page[1], you have to actually install Chrome Remote Desktop on the computer to be controlled - it won't just silently install.
  - thefreeman 12y ago
    I think you meant to link here: https://support.google.com/chrome/answer/1649523?hl=en https://support.google.com/chrome/answer/1649523?hl=en I see what you are saying. But the help page basically describes the steps to install a chrome extension. It doesn't say that this extension is specifically prevented from syncing like other extensions. It mentions an authorization dialogue on first run, but it is unclear whether that is the first run per account or the first run per installation of the extension. I would actually lean towards the latter, as it is in line with extension syncing behavior I have seen in the past. Usually when I am on a new setup of Chrome, and extensions sync and install, they do pop up some sort of installation or setup window notifying you. So there may indeed be no issue at all.
    - AaronFriel 12y ago
      Is the user prompted to understand how the extension can affect them, when it was installed, and where it is syncing from? To put it another way: if I am a regular end-user and Chrome pops up a dialog asking me to allow the official sounding "Google Remote Desktop App", then why wouldn't I? That doesn't sound scary at all - it's from Google!
    - yohui 12y ago
      Why are we guessing when you can just install Chrome Remote Desktop and try it out? I've used Chrome Remote Desktop, and the speculation in this thread about automatic extension sync is absolutely baseless: you need someone at the keyboard to actually install the remote desktop features, the extension by itself is not enough. Is this really the state of HN discussion? It's great that a Google engineer was able to chime in and dispel the wild fears (thanks Sergey), but it shouldn't have been necessary in the first place.
- mrinterweb 12y ago
  FTA: sudo /etc/init.d/chrome-remote-desktop stop sudo /etc/init.d/chrome-remote-desktop start You have to install chrome remote desktop on linux and start the service on the machine before you can connect to it elsewhere. I don't see how this is any different than any other remote desktop other than the client is built into chrome now.
ossreality 12y ago
Yeah, this is a silly paranoid comment.

by isaacdl 12y ago

I tend to agree with you. But in your hypothetical case, what's different about a someone (the NSA, etc) installing Chrome and enabling the RA extension vs just installing another remote access tool?

thefreeman 12y ago

Well in the second scenario, they would hypothetically still need to infect you with the RAT. In his scenario, you're already installed version of Chrome will infect you without your knowledge when it silently syncs the new Remote Desktop extension into your existing installation. Obviously if they have your Google credentials you are in a world of trouble, and I have no doubt if a 3 letter agency wanted to infect me they could, but the scenario he brings up is still troublesome and not at all restricted to highly technical attackers.

comex 12y ago
Judging from this help page[1], you have to actually install Chrome Remote Desktop on the computer to be controlled - it won't just silently install.
- thefreeman 12y ago
  I think you meant to link here: https://support.google.com/chrome/answer/1649523?hl=en https://support.google.com/chrome/answer/1649523?hl=en I see what you are saying. But the help page basically describes the steps to install a chrome extension. It doesn't say that this extension is specifically prevented from syncing like other extensions. It mentions an authorization dialogue on first run, but it is unclear whether that is the first run per account or the first run per installation of the extension. I would actually lean towards the latter, as it is in line with extension syncing behavior I have seen in the past. Usually when I am on a new setup of Chrome, and extensions sync and install, they do pop up some sort of installation or setup window notifying you. So there may indeed be no issue at all.
  - AaronFriel 12y ago
    Is the user prompted to understand how the extension can affect them, when it was installed, and where it is syncing from? To put it another way: if I am a regular end-user and Chrome pops up a dialog asking me to allow the official sounding "Google Remote Desktop App", then why wouldn't I? That doesn't sound scary at all - it's from Google!
  - yohui 12y ago
    Why are we guessing when you can just install Chrome Remote Desktop and try it out? I've used Chrome Remote Desktop, and the speculation in this thread about automatic extension sync is absolutely baseless: you need someone at the keyboard to actually install the remote desktop features, the extension by itself is not enough. Is this really the state of HN discussion? It's great that a Google engineer was able to chime in and dispel the wild fears (thanks Sergey), but it shouldn't have been necessary in the first place.
mrinterweb 12y ago
FTA: sudo /etc/init.d/chrome-remote-desktop stop sudo /etc/init.d/chrome-remote-desktop start You have to install chrome remote desktop on linux and start the service on the machine before you can connect to it elsewhere. I don't see how this is any different than any other remote desktop other than the client is built into chrome now.

ossreality 12y ago

Yeah, this is a silly paranoid comment.