13 ms·

Google listening in to your room shows importance of privacy defense in depth

178 points by arto 11y ago

uptown 11y ago
Type this into your Chrome address bar to see the extension status: chrome://voicesearch/
- nakedrobot2 11y ago
  NaCl Enabled Yes Microphone Yes Audio Capture Allowed Yes Current Language en-US Hotword Previous Language en-US Hotword Search Enabled No Always-on Hotword Search Enabled No Hotword Audio Logging Enabled No What now?
  - AdmiralAsshat 11y ago
    If you're running Chromium: Re-install with the opt-out flag. If you're runnning Google Chrome: Weep.
    - bhauer 11y ago
      > If you're runnning Google Chrome: Weep. I metaphorically did. Then I closed Chrome and tabbed back to my Firefox window. This feels like I had an Amazon Echo dropped by my house, plugged in, and then shoved behind a book on the shelf so that I wouldn't see it. Ethics be damned.
  - thestepafter 11y ago
    Go to chrome://settings/ Uncheck: Enable "Ok Google" to start a voice search.
    - joesmo 11y ago
      Which is no longer an option.
      - feld 11y ago
        What version are you running? Do you have Google as your default search engine? If not, the toggle disappears.
        joesmo 11y ago
        Thanks. I didn't realize this was the case.
    - disposition2 11y ago
      So I have Chrome installed (although I don't use it as my primary) and I checked... NaCl Enabled Yes Microphone Yes Audio Capture Allowed Yes In Settings my 'Ok Google' is (and was) unchecked. What gives?
      - lsaferite 11y ago
        "Hotword Search Enabled" is the one you are interested in.
    - 300bps 11y ago
      I have the exact same settings in chrome://voicesearch/ as nakedrobot2 but my "Ok Google" setting was already off. From chrome://voicesearch/: NaCl Enabled Yes Microphone Yes Audio Capture Allowed Yes From chrome://settings/ under the Search heading, "Enable 'Ok Google' to start a voice search" is unchecked and has always been unchecked.
    - fweespeech 11y ago
      That doesn't work, it is still enabled under the voice search ;)
    - declan 11y ago
      FYI I'm running Chrome 43.0.x on OS X 10.10.3 and Enable "Ok Google" is disabled under chrome://settings. I don't remember ever enabling it, so this behavior is correct.
- anaptdemise 11y ago
  I have never had the "OK Google" voice search option enabled and chrome://voicesearch/ shown below. I deleted the hotword file specified as the extension path and also `rm rf` directories under the "Extensions/lccekmodgklaepjeofjdjpbminllajkg" specified as the Shared Module path. I also changed owner of the directory "lccekmodgklaepjeofjdjpbminllajkg" to root and the permission to read only. After restarting chrome, the extension/module still shows up in the chrome://voicesearch/ and Enabled in the chrome://extensions/ when --show-component-extension-options is used. Further, chrome://extensions/ shows "Hotword triggering" as allowed in Incognito Mode. Unchecking the box is automatically re-enabled. Google Chrome 43.0.2357.124 () OS Mac OS X NaCl Enabled Yes Microphone Yes Audio Capture Allowed Yes Current Language en-US Hotword Previous Language en-US Hotword Search Enabled No Always-on Hotword Search Enabled No Hotword Audio Logging Enabled No Field trial Install Start Page State No Start Page Service Extension Id nbpagnldghgfoolbancepceaanlmhfmd Extension Version 0.0.1.4 Extension Path /Applications/Google Chrome.app/Contents/Versions/43.0.2357.124/Google Chrome Framework.framework/Resources/hotword Extension State ENABLED Shared Module Id lccekmodgklaepjeofjdjpbminllajkg Shared Module Version 0.3.0.5 Shared Module Path <user path redacted>/Application Support/Google/Chrome/Default/Extensions/lccekmodgklaepjeofjdjpbminllajkg/0.3.0.5_0 Shared Module State ENABLED
Mithaldu 11y ago
This is pretty funny. He complains that Chromium managed to "bypass this audit-then-build process", by downloading stuff afterwards, while ignoring that this happening already shows that the audit process is completely useless since it failed to recognize and reject the code that would do this. There's a TSA joke somewhere in this.
- fweespeech 11y ago
  The audit process assumes the upstream maintainers aren't malicious actors attempting to actively bypass the process: > After upgrading chromium to 43, I noticed that when it is running and immediately after the machine is on-line it silently starts downloading "Chrome Hotword Shared Module" extension, which contains a binary without source code. There seems no opt-out config. They don't have the resources to do a full audit on all the packages: https://www.debian.org/security/audit/ https://www.debian.org/security/audit/ > Due to the sheer size of the current Debian release it is infeasible for a small team to be able to audit all the packages, so there is a system of prioritizing packages which are more security sensitive.
lfender6445 11y ago
if you goto chrome://settings/content it appears you can disable mic + camera access for all pages
- rasz_pl 11y ago
  I bet this is for something else, probably html5, just like Flash has mic/camera access permissions.
- markbnj 11y ago
  I imagine that will break hangouts... not that hangouts on the desktop isn't already broken.
rasz_pl 11y ago
I wonder if European Commission would be interested in adding this to their investigation, couple of hundred million dollars should be enough penalty for violating users privacy.
- deoptimo 11y ago
  I agree with the sentiment, but I don't think a competition investigation is the appropriate forum to deal with this. There should be a fine, perhaps through a class action or criminal conviction. I certainly hope the penalty for illegally wiretapping hundreds of millions of people is more than $1 per head. I value the privacy of my conversations (and life) way more than that. Besides, if I opt-in to this service, why should everyone who ever walks into my home or office be presumed to have made the same choice? What if I am a doctor or lawyer who is not legally allowed to make that choice?
  - deoptimo 11y ago
    Why the down vote?
- gress 11y ago
  A couple of hundred million dollars is a trivial write off for google. It should be a 5% of revenue.
  - mondoshawan 11y ago
    Can we stop with the witch hunts and the desire to maim folks over minor infractions like this? Consider that you're one of the developers that wrote this feature. You try very hard to make sure your users privacy rights are respected. Normally your work is strong and you catch all of the corner cases, but this one you missed. You've fixed it upstream, but folks are demanding 5% of the company's bottom line because of a mistake /you/ made. The code isn't even used unless the user ticks a box to turn it on in the first place, which is even verifiable with a cursory use of system monitoring tools like fuser, lsof, etc. You've been marked as costing a company a major stake of their income. You'll likely never live that down. If you don't like the company's behavior, /don't use the software/. Simple, clean, and effective in large numbers -- more so than regulation action. Chromium is an open source first browser, we as a community actually have a hand in its development. If you don't like this, fix it.
ape4 11y ago
I always assumed the purpose of Chrome was to spy on us. So I don't use it.
derptron 11y ago
Wow, is there really no way to disable this? I guess I'm going back to Firefox.
- jonknee 11y ago
  Of course there is a way to disable this, it's in the settings with all the other settings.
  - plorkyeran 11y ago
    Where? You can turn off voice-activated search, but that doesn't actually disable the extension.
    - jonknee 11y ago
      It requires Native Client, turn it off and it can't function regardless of your other settings.
    - McGlockenshire 11y ago
      The extension is only used by voice search. If voice search is disabled, the extension isn't used by anything. A mountain is being made out of this molehill. If the extension was only downloaded at the time that the option was enabled by the user, nobody would care. Instead, they chose to have the extension always available and as a result people are having paranoid over-reactions.
feld 11y ago
Is there a GPO to control this setting in Windows? edit: This might work http://www.chromium.org/administrators/policy-list-3#AudioCaptureAllowed http://www.chromium.org/administrators/policy-list-3#AudioCa...
jmnicolas 11y ago
I think this is the last straw for me : enough is enough. I need to sit and reflect a bit on this, but I'm contemplating abandoning every bit of non free software I currently use (and there's a lot of it since I'm using Windows and Android).
- kiba 11y ago
  It appears that we're stuck in a tradeoff regarding software: Libre, high quality, and user friendly. Pick two.
  - mrj 11y ago
    Firefox is open, high quality and user friendly.
    - Retra 11y ago
      Firefox's success often seems to be the exception that proves the rule.
      - 6d6b73 11y ago
        So is, Postresql, Apache, Nginx, Blender, VLC etc..
      - noir_lord 11y ago
        postgres, python, inkscape, XFCE, various shells, GTK, Qt, even libreoffice (which has gone through astounding refactoring), vim, emacs, apache, nginx. I don't think there is a rule.
        Retra 11y ago
        That's a good point. Maybe it is a matter of perspective: none of those are consumer programs, they are developer tools. (Except libreoffice, but that has had its problems.) So you could argue that they are not all that user friendly.
metric10 11y ago
Has anyone actually confirmed that Chrome is continuously sending audio back to Google? I highly doubt that this is the case. Instead, the plug in knows how to recognize "OK Google" all by itself. Once activated, then it starts sending audio data. IF it where really listening even when inactive, then people would be complaining about it sucking up bandwidth and data allotments.
- 51Cards 11y ago
  I was thinking something similar... that would be a LOT of data being sent back continuously while Chrome was running, which for many people is 24/7. If you had an office of Chrome users the entire office pipe could be eaten up by what is essentially X number continuous VOIP calls.
  - metric10 11y ago
    Right. There's no way this would go unnoticed on any enterprise or government network, and once noticed it would end the use Chrome in those environments. In fact it would have unimaginably huge consequences. It would mean huge numbers of CEOs and government officials in all countries where being bugged, all dependent on Google securely keeping millions of audio streams private. This doesn't pass the giggle test.
    - dreamfactory2 11y ago
      Talking of the giggle test, millions of audio streams is just the kind of thing this was designed to snack on - https://en.wikipedia.org/wiki/Utah_Data_Center https://en.wikipedia.org/wiki/Utah_Data_Center Regardless, the black box aspect means this can be targeted to high value individuals and could even be limited to their home or mobile networks. Then again, it's somewhat irrelevant since all sysadmins are already legally owned by security services and sworn to secrecy by the current legal frameworks, no cloak and dagger required. And it would be hard to believe that any competent foreign intelligence org hadn't fully infested such juicy targets as google and high value corporate networks long ago. There's an old rule that you shouldn't write down anything you wouldn't want to hear read out in a court of law. Same goes for online, and now for when you are in the vicinity of a mobile device.
turk- 11y ago
How does he know Chrome is transmitting ALL conversations that it hears? His arguments aren't valid: "(Ok, so how does it know to start listening just before I’m about to say ‘Ok, Google?’)" This could easily be achieved offline. The same argument could be made for Siri, a wiretapping device which you carry with you all the time. In fact wiretapping your phone would be much more effective then wiretapping a computer browser application. Before making such accusations he should present some solid data, like network traffic from an idle chrome application during conversations (with and without saying "Okay Google"). If an idle chrome application was always transmitting data to google, he would have a solid argument.
- dreamfactory2 11y ago
  listening doesn't necessarily mean recording and recording doesn't necessarily mean sending
- fstutzman 11y ago
  Agreed - there is a lot of speculation here. In the U.S., implementation of a wiretapping scheme like this would be a significant civil and criminal violation. Google is already under a FTC consent degree for privacy violations, which would make it doubly egregious. So I'll give Google the benefit of the doubt - and assume there are privacy-protective mechanisms designed in to the system. In the age of ambient technology, where anything can be recorded, the onus is now on developers to create systems that internally suppress mass privacy violation. The "Privacy by Design" approach (disclosure, I have an evangelist of PbD) can provide solid guidance as to how to build privacy-protective mechanisms (e.g. data minimization, data scrubbing) into ambient technologies.
jonstokes 11y ago
Not surprised. I was a die-hard android user, but I kept having stuff like this happen to me, over and over again: http://www.reddit.com/r/technology/comments/2kwbl2/im_convinced_my_android_phone_listens_to_me_and/ http://www.reddit.com/r/technology/comments/2kwbl2/im_convin... It also happens to my android-using friends. I've become convinced that Android phones are listening all the time so that they can figure out what we're about to search for and what to advertise to us. Given that this has been my (admittedly anecdotal) experience with Android, I wouldn't be surprised at all if Google was trying to take this type of thing to the desktop with Chrome. I love Google and have historically just not cared about my privacy as far as they're concerned, but I'm getting more creeped out as this kind of stuff becomes more pervasive.
- Oletros 11y ago
  Can you provide any proof of that? No, Android phones are not listening all the time
  - jonstokes 11y ago
    Nope, I have no proof, and of course I'd be happy to learn that they aren't listening. I just hypothesize that they are based on my experience, but I've not tried to test it in any systematic way.
    - Oletros 11y ago
      Listening all the time and sending the audio to Google would kill an smartphone in a moment. Apaty of the bandwith used
      - runjake 11y ago
        <tinfoil> That's presuming it just doesn't cue up a text or audio[1] log on the device and upload it to Google the next time it's on wi-fi and plugged into a charger. </tinfoil> 1. 4khz mono audio is sufficient for human voice recognition and tiny in terms of storage.
bhauer 11y ago
I want my desktop operating system to offer fairly fine-grained control of permissions I selectively grant to processes/applications. I would like the ability to easily revoke Chrome's ability to use my audio inputs, and then—if the use case comes up, such as a WebRTC conference—I can grant permission either on a one-time basis or until I revoke. This would be the operating system controlling the application's capability. I'm guessing a rough approximation is possible on some operating systems. Given the sprawling management infrastructure in Windows, I wouldn't be surprised if it has some "policy" framework in place that allows devices to be declared off-limits at a process granularity. The missing piece, then, is a viable user interface on top of that. I'm not asking for something akin to the simplified permissions model of mainstream sandboxed mobile operating systems. Not set-and-forget; and certainly not all-or-nothing ("accept these required permissions or don't install the app.") Rather, something quite a bit finer grained and with the necessary infrastructure to have the OS prompt for privileged access if the application wants something I've disallowed, in a manner akin to Windows UAC prompts for admin credentials. Imagine starting Chrome one day to have your operating system prompt you, "Chrome would like access to audio input 1 (microphone). Allow for now, permanently, or deny?"
- ionised 11y ago
  An HIPS can do much of this on Windows. It takes some training though. I use the free one that comes with Comodo Firewall, but I am unaware of any free, quality, stand alone alternatives.
spdustin 11y ago
Okay, I'm going to put on my tin foil hat for a bit here. Think of the corporate boardrooms with Chromebox for meetings, listening in even when not actively used for meetings. An exec at the Better Business Bureau [0] who chose Chromebox because they were excited to, "[reduce] the time [they spend] ... worrying about security concerns," is discussing the growing complaints the BBB has received about a competitor to a company owned by Google. He says, "Ok, Google owns their primary competitor, and they may have insight to offer us." Wait, that's just my tin foil beanie. Let me put on the tin foil balaclava. The U.S. Department of State [1] is in an all-hands-on-deck crisis meeting over a deeply divisive political situation involving a first-world ally. Chrome is updated with the eavesdropping feature (remember, it's just my tin foil that's making me choose that word, I know it's hyperbole), and it's already been "deployed to production immediately, bypassing cumbersome testing." Someone in the meeting says, "OK, Google News has been trending a lot of stories about this issue." Sensitive things are then said about this ally, things that are now being heard by an enemy of the state, because they were able to use their previously embedded network sniffers to capture and forward interesting network traffic. It's frightening that a feature is enabled by default, and difficult to disable, that could capture sensitive conversations without the knowledge of the parties speaking because they innocently started a sentence with, "OK, Google." Certainly this violates wiretapping laws? Let's pile on. Hospitals and medical centers are using this too, according to the Chrome for Work pages. A doctor says, "Ok, Google had a lot of results about new HLA-B27 research," when discussing a patient's arthritic concerns, while proceeding to outline the patient's symptoms and how treatment should proceed and now we're looking at a potential HIPAA Privacy Rule violation. As I type this, I look over at my Amazon Echo, and I'm reminded of something I heard once. If you're not paying, you're not the customer, you're the product. Is that hypocritical of me to accept my Amazon Echo but not the behavior of Google Chrome? [0]: https://www.google.com/work/chrome/resources/customer-stories/better-business-bureau/index.html https://www.google.com/work/chrome/resources/customer-storie... [1]: https://www.google.com/work/chrome/resources/customer-stories/us-state-department/index.html https://www.google.com/work/chrome/resources/customer-storie...
- fixermark 11y ago
  Yes it is. ;) The author wants us to remember that we live in a world that has these technological possibilities. That doctor's phone should have had a mechanical switch to disable the microphone, is the author's point.
izzydata 11y ago
My only audio recording device is my webcam and it is incapable of being in use without the light being on as far as I am aware. So how would it send them audio data without the audio device realize it is being used?
- noir_lord 11y ago
  > My only audio recording device is my webcam and it is incapable of being in use without the light being on as far as I am aware. You assume that the light isn't controlled by the same software, that's not always the case, the FBI has admitted this. https://grahamcluley.com/2013/12/webcam-spying-without-turning-led-researchers-prove-possible/ https://grahamcluley.com/2013/12/webcam-spying-without-turni... I take the view that anything under software control or the control of a chip I can't open is suspect, I've taped the webcam on laptops and physically disconnected built in microphones (I use a headset, built in ones suck). I'm not really happy about my Nexus 4 at all either, I think my next phone will be a dumb mobile. The sad thing is that I try to avoid paranoia with this stuff but the threat landscape is so large it's practically a full time job staying up to date with whats going on.
w8rbt 11y ago
One thing to keep in mind. If your friend has a Google device using Chrome, and you are close to them (in the same room) it hears your voice as well.
- Oletros 11y ago
  Any source for this?
  - alfiedotwtf 11y ago
    Physics
    - Oletros 11y ago
      What has to do physics with the claim that Android Chrome is always listening?
Oletros 11y ago
has the author really tested if Chromium is listening? Downloading a binary blob is very bad, but the accusations that author makes wihouth a single proof is more FUD than anything
- fixermark 11y ago
  It's irrelevant to the argument. The author is making an appeal to the slippery slope (even if it's not happening right now, and even if Google is not doing it.... It could easily happen tomorrow and anyone could do it. Shutter your cameras and make sure your microphones can be physically deactivated).
  - bduerst 11y ago
    Isn't an argument based solely on FUD essentially a slippery slope?
anaptdemise 11y ago
There is also a bug report from a year ago. https://code.google.com/p/chromium/issues/detail?id=381747 https://code.google.com/p/chromium/issues/detail?id=381747
zobzu 11y ago
Note that all android phones have that issue. Also all windows phones and soon windows 10. Oh and smart tvs. it is a real problem though
- McGlockenshire 11y ago
  > all android phones have that issue Citation needed. "Ok Google" functionality is an expressly required opt-in. I had to go out of my way to turn it on.
  - zobzu 11y ago
    google phones (nexuses) pretty much turn it on as u hit next next next on install thats actually pretty similar the chrome tvs also warn you usually - but nontech ppl dont notice. next next.
    - Oletros 11y ago
      No, search recognition is not in the initial setup
jimhefferon 11y ago
This is why there needs to be a switch on all computers to physically turn the microphone off. How is that hard?
- fixermark 11y ago
  Physical switches are the most common point of mechanical failure. It translates to real-world lost revenue in terms of returns and repairs to include them at all. ... but yes, they should still be included. ;)
  - nulltype 11y ago
    There's a light for the camera, they should just add one for the microphone.
    - bob-2 11y ago
      While acceptable for most paranoid users, the indicator light isn't as secure as a physical switch. For some devices (most notably 2007/2008 era MacBooks) the controller can be manipulated to enable the camera without giving any visual indication via the light.
      - nulltype 11y ago
        Yeah but what if the physical switch gets manipulated? I think if you're that paranoid you need to keep your macbook in a vacuum so it can't pick up any sound.
- Too 11y ago
  Same for wifi, camera and speakers. Preferably a real physical lid for the camera, the switches are in most cases just connected to an io pin and could potentially be overridden. Even if they are not its just very discomforting to have a camera constantly pointing at you, I feel weird when i see a lens even when I know the power is totally cut. For speakers it has happened to me a few times that something has started to play loud sounds and I can not mute it because windows is locked up somehow or im in fullscreen or whatever.
neumino 11y ago
> When you’re installing a version of GNU/Linux like Debian or Ubuntu onto a fresh computer, thousands of really smart people have analyzed every line of human-readable source code If this was true, Debian would have not build/release this version of Chromium. The author is living in the past or in another dimension. Some projects are complex, and it's hard/impossible to read/understand everything for a single human being.
wslh 11y ago
What happen if you play an audio file saying "Ok Google" ?

178 points by arto 11y ago

uptown 11y ago

Type this into your Chrome address bar to see the extension status: chrome://voicesearch/

nakedrobot2 11y ago
NaCl Enabled Yes Microphone Yes Audio Capture Allowed Yes Current Language en-US Hotword Previous Language en-US Hotword Search Enabled No Always-on Hotword Search Enabled No Hotword Audio Logging Enabled No What now?
- AdmiralAsshat 11y ago
  If you're running Chromium: Re-install with the opt-out flag. If you're runnning Google Chrome: Weep.
  - bhauer 11y ago
    > If you're runnning Google Chrome: Weep. I metaphorically did. Then I closed Chrome and tabbed back to my Firefox window. This feels like I had an Amazon Echo dropped by my house, plugged in, and then shoved behind a book on the shelf so that I wouldn't see it. Ethics be damned.
- thestepafter 11y ago
  Go to chrome://settings/ Uncheck: Enable "Ok Google" to start a voice search.
  - joesmo 11y ago
    Which is no longer an option.
    - feld 11y ago
      What version are you running? Do you have Google as your default search engine? If not, the toggle disappears.
      - joesmo 11y ago
        Thanks. I didn't realize this was the case.
  - disposition2 11y ago
    So I have Chrome installed (although I don't use it as my primary) and I checked... NaCl Enabled Yes Microphone Yes Audio Capture Allowed Yes In Settings my 'Ok Google' is (and was) unchecked. What gives?
    - lsaferite 11y ago
      "Hotword Search Enabled" is the one you are interested in.
  - 300bps 11y ago
    I have the exact same settings in chrome://voicesearch/ as nakedrobot2 but my "Ok Google" setting was already off. From chrome://voicesearch/: NaCl Enabled Yes Microphone Yes Audio Capture Allowed Yes From chrome://settings/ under the Search heading, "Enable 'Ok Google' to start a voice search" is unchecked and has always been unchecked.
  - fweespeech 11y ago
    That doesn't work, it is still enabled under the voice search ;)
  - declan 11y ago
    FYI I'm running Chrome 43.0.x on OS X 10.10.3 and Enable "Ok Google" is disabled under chrome://settings. I don't remember ever enabling it, so this behavior is correct.
anaptdemise 11y ago
I have never had the "OK Google" voice search option enabled and chrome://voicesearch/ shown below. I deleted the hotword file specified as the extension path and also `rm rf` directories under the "Extensions/lccekmodgklaepjeofjdjpbminllajkg" specified as the Shared Module path. I also changed owner of the directory "lccekmodgklaepjeofjdjpbminllajkg" to root and the permission to read only. After restarting chrome, the extension/module still shows up in the chrome://voicesearch/ and Enabled in the chrome://extensions/ when --show-component-extension-options is used. Further, chrome://extensions/ shows "Hotword triggering" as allowed in Incognito Mode. Unchecking the box is automatically re-enabled. Google Chrome 43.0.2357.124 () OS Mac OS X NaCl Enabled Yes Microphone Yes Audio Capture Allowed Yes Current Language en-US Hotword Previous Language en-US Hotword Search Enabled No Always-on Hotword Search Enabled No Hotword Audio Logging Enabled No Field trial Install Start Page State No Start Page Service Extension Id nbpagnldghgfoolbancepceaanlmhfmd Extension Version 0.0.1.4 Extension Path /Applications/Google Chrome.app/Contents/Versions/43.0.2357.124/Google Chrome Framework.framework/Resources/hotword Extension State ENABLED Shared Module Id lccekmodgklaepjeofjdjpbminllajkg Shared Module Version 0.3.0.5 Shared Module Path <user path redacted>/Application Support/Google/Chrome/Default/Extensions/lccekmodgklaepjeofjdjpbminllajkg/0.3.0.5_0 Shared Module State ENABLED

Mithaldu 11y ago

This is pretty funny. He complains that Chromium managed to "bypass this audit-then-build process", by downloading stuff afterwards, while ignoring that this happening already shows that the audit process is completely useless since it failed to recognize and reject the code that would do this. There's a TSA joke somewhere in this.

fweespeech 11y ago
The audit process assumes the upstream maintainers aren't malicious actors attempting to actively bypass the process: > After upgrading chromium to 43, I noticed that when it is running and immediately after the machine is on-line it silently starts downloading "Chrome Hotword Shared Module" extension, which contains a binary without source code. There seems no opt-out config. They don't have the resources to do a full audit on all the packages: https://www.debian.org/security/audit/ https://www.debian.org/security/audit/ > Due to the sheer size of the current Debian release it is infeasible for a small team to be able to audit all the packages, so there is a system of prioritizing packages which are more security sensitive.

lfender6445 11y ago

if you goto chrome://settings/content it appears you can disable mic + camera access for all pages

rasz_pl 11y ago
I bet this is for something else, probably html5, just like Flash has mic/camera access permissions.
markbnj 11y ago
I imagine that will break hangouts... not that hangouts on the desktop isn't already broken.

rasz_pl 11y ago

I wonder if European Commission would be interested in adding this to their investigation, couple of hundred million dollars should be enough penalty for violating users privacy.

deoptimo 11y ago
I agree with the sentiment, but I don't think a competition investigation is the appropriate forum to deal with this. There should be a fine, perhaps through a class action or criminal conviction. I certainly hope the penalty for illegally wiretapping hundreds of millions of people is more than $1 per head. I value the privacy of my conversations (and life) way more than that. Besides, if I opt-in to this service, why should everyone who ever walks into my home or office be presumed to have made the same choice? What if I am a doctor or lawyer who is not legally allowed to make that choice?
- deoptimo 11y ago
  Why the down vote?
gress 11y ago
A couple of hundred million dollars is a trivial write off for google. It should be a 5% of revenue.
- mondoshawan 11y ago
  Can we stop with the witch hunts and the desire to maim folks over minor infractions like this? Consider that you're one of the developers that wrote this feature. You try very hard to make sure your users privacy rights are respected. Normally your work is strong and you catch all of the corner cases, but this one you missed. You've fixed it upstream, but folks are demanding 5% of the company's bottom line because of a mistake /you/ made. The code isn't even used unless the user ticks a box to turn it on in the first place, which is even verifiable with a cursory use of system monitoring tools like fuser, lsof, etc. You've been marked as costing a company a major stake of their income. You'll likely never live that down. If you don't like the company's behavior, /don't use the software/. Simple, clean, and effective in large numbers -- more so than regulation action. Chromium is an open source first browser, we as a community actually have a hand in its development. If you don't like this, fix it.

ape4 11y ago

I always assumed the purpose of Chrome was to spy on us. So I don't use it.

derptron 11y ago

Wow, is there really no way to disable this? I guess I'm going back to Firefox.

jonknee 11y ago
Of course there is a way to disable this, it's in the settings with all the other settings.
- plorkyeran 11y ago
  Where? You can turn off voice-activated search, but that doesn't actually disable the extension.
  - jonknee 11y ago
    It requires Native Client, turn it off and it can't function regardless of your other settings.
  - McGlockenshire 11y ago
    The extension is only used by voice search. If voice search is disabled, the extension isn't used by anything. A mountain is being made out of this molehill. If the extension was only downloaded at the time that the option was enabled by the user, nobody would care. Instead, they chose to have the extension always available and as a result people are having paranoid over-reactions.

feld 11y ago

Is there a GPO to control this setting in Windows? edit: This might work http://www.chromium.org/administrators/policy-list-3#AudioCaptureAllowed http://www.chromium.org/administrators/policy-list-3#AudioCa...

jmnicolas 11y ago

I think this is the last straw for me : enough is enough. I need to sit and reflect a bit on this, but I'm contemplating abandoning every bit of non free software I currently use (and there's a lot of it since I'm using Windows and Android).

kiba 11y ago
It appears that we're stuck in a tradeoff regarding software: Libre, high quality, and user friendly. Pick two.
- mrj 11y ago
  Firefox is open, high quality and user friendly.
  - Retra 11y ago
    Firefox's success often seems to be the exception that proves the rule.
    - 6d6b73 11y ago
      So is, Postresql, Apache, Nginx, Blender, VLC etc..
    - noir_lord 11y ago
      postgres, python, inkscape, XFCE, various shells, GTK, Qt, even libreoffice (which has gone through astounding refactoring), vim, emacs, apache, nginx. I don't think there is a rule.
      - Retra 11y ago
        That's a good point. Maybe it is a matter of perspective: none of those are consumer programs, they are developer tools. (Except libreoffice, but that has had its problems.) So you could argue that they are not all that user friendly.

metric10 11y ago

Has anyone actually confirmed that Chrome is continuously sending audio back to Google? I highly doubt that this is the case. Instead, the plug in knows how to recognize "OK Google" all by itself. Once activated, then it starts sending audio data. IF it where really listening even when inactive, then people would be complaining about it sucking up bandwidth and data allotments.

51Cards 11y ago
I was thinking something similar... that would be a LOT of data being sent back continuously while Chrome was running, which for many people is 24/7. If you had an office of Chrome users the entire office pipe could be eaten up by what is essentially X number continuous VOIP calls.
- metric10 11y ago
  Right. There's no way this would go unnoticed on any enterprise or government network, and once noticed it would end the use Chrome in those environments. In fact it would have unimaginably huge consequences. It would mean huge numbers of CEOs and government officials in all countries where being bugged, all dependent on Google securely keeping millions of audio streams private. This doesn't pass the giggle test.
  - dreamfactory2 11y ago
    Talking of the giggle test, millions of audio streams is just the kind of thing this was designed to snack on - https://en.wikipedia.org/wiki/Utah_Data_Center https://en.wikipedia.org/wiki/Utah_Data_Center Regardless, the black box aspect means this can be targeted to high value individuals and could even be limited to their home or mobile networks. Then again, it's somewhat irrelevant since all sysadmins are already legally owned by security services and sworn to secrecy by the current legal frameworks, no cloak and dagger required. And it would be hard to believe that any competent foreign intelligence org hadn't fully infested such juicy targets as google and high value corporate networks long ago. There's an old rule that you shouldn't write down anything you wouldn't want to hear read out in a court of law. Same goes for online, and now for when you are in the vicinity of a mobile device.

turk- 11y ago

How does he know Chrome is transmitting ALL conversations that it hears? His arguments aren't valid: "(Ok, so how does it know to start listening just before I’m about to say ‘Ok, Google?’)" This could easily be achieved offline. The same argument could be made for Siri, a wiretapping device which you carry with you all the time. In fact wiretapping your phone would be much more effective then wiretapping a computer browser application. Before making such accusations he should present some solid data, like network traffic from an idle chrome application during conversations (with and without saying "Okay Google"). If an idle chrome application was always transmitting data to google, he would have a solid argument.

dreamfactory2 11y ago
listening doesn't necessarily mean recording and recording doesn't necessarily mean sending
fstutzman 11y ago
Agreed - there is a lot of speculation here. In the U.S., implementation of a wiretapping scheme like this would be a significant civil and criminal violation. Google is already under a FTC consent degree for privacy violations, which would make it doubly egregious. So I'll give Google the benefit of the doubt - and assume there are privacy-protective mechanisms designed in to the system. In the age of ambient technology, where anything can be recorded, the onus is now on developers to create systems that internally suppress mass privacy violation. The "Privacy by Design" approach (disclosure, I have an evangelist of PbD) can provide solid guidance as to how to build privacy-protective mechanisms (e.g. data minimization, data scrubbing) into ambient technologies.

jonstokes 11y ago

Not surprised. I was a die-hard android user, but I kept having stuff like this happen to me, over and over again: http://www.reddit.com/r/technology/comments/2kwbl2/im_convinced_my_android_phone_listens_to_me_and/ http://www.reddit.com/r/technology/comments/2kwbl2/im_convin... It also happens to my android-using friends. I've become convinced that Android phones are listening all the time so that they can figure out what we're about to search for and what to advertise to us. Given that this has been my (admittedly anecdotal) experience with Android, I wouldn't be surprised at all if Google was trying to take this type of thing to the desktop with Chrome. I love Google and have historically just not cared about my privacy as far as they're concerned, but I'm getting more creeped out as this kind of stuff becomes more pervasive.

Oletros 11y ago
Can you provide any proof of that? No, Android phones are not listening all the time
- jonstokes 11y ago
  Nope, I have no proof, and of course I'd be happy to learn that they aren't listening. I just hypothesize that they are based on my experience, but I've not tried to test it in any systematic way.
  - Oletros 11y ago
    Listening all the time and sending the audio to Google would kill an smartphone in a moment. Apaty of the bandwith used
    - runjake 11y ago
      <tinfoil> That's presuming it just doesn't cue up a text or audio[1] log on the device and upload it to Google the next time it's on wi-fi and plugged into a charger. </tinfoil> 1. 4khz mono audio is sufficient for human voice recognition and tiny in terms of storage.

bhauer 11y ago

I want my desktop operating system to offer fairly fine-grained control of permissions I selectively grant to processes/applications. I would like the ability to easily revoke Chrome's ability to use my audio inputs, and then—if the use case comes up, such as a WebRTC conference—I can grant permission either on a one-time basis or until I revoke. This would be the operating system controlling the application's capability. I'm guessing a rough approximation is possible on some operating systems. Given the sprawling management infrastructure in Windows, I wouldn't be surprised if it has some "policy" framework in place that allows devices to be declared off-limits at a process granularity. The missing piece, then, is a viable user interface on top of that. I'm not asking for something akin to the simplified permissions model of mainstream sandboxed mobile operating systems. Not set-and-forget; and certainly not all-or-nothing ("accept these required permissions or don't install the app.") Rather, something quite a bit finer grained and with the necessary infrastructure to have the OS prompt for privileged access if the application wants something I've disallowed, in a manner akin to Windows UAC prompts for admin credentials. Imagine starting Chrome one day to have your operating system prompt you, "Chrome would like access to audio input 1 (microphone). Allow for now, permanently, or deny?"

ionised 11y ago
An HIPS can do much of this on Windows. It takes some training though. I use the free one that comes with Comodo Firewall, but I am unaware of any free, quality, stand alone alternatives.

spdustin 11y ago

Okay, I'm going to put on my tin foil hat for a bit here. Think of the corporate boardrooms with Chromebox for meetings, listening in even when not actively used for meetings. An exec at the Better Business Bureau [0] who chose Chromebox because they were excited to, "[reduce] the time [they spend] ... worrying about security concerns," is discussing the growing complaints the BBB has received about a competitor to a company owned by Google. He says, "Ok, Google owns their primary competitor, and they may have insight to offer us." Wait, that's just my tin foil beanie. Let me put on the tin foil balaclava. The U.S. Department of State [1] is in an all-hands-on-deck crisis meeting over a deeply divisive political situation involving a first-world ally. Chrome is updated with the eavesdropping feature (remember, it's just my tin foil that's making me choose that word, I know it's hyperbole), and it's already been "deployed to production immediately, bypassing cumbersome testing." Someone in the meeting says, "OK, Google News has been trending a lot of stories about this issue." Sensitive things are then said about this ally, things that are now being heard by an enemy of the state, because they were able to use their previously embedded network sniffers to capture and forward interesting network traffic. It's frightening that a feature is enabled by default, and difficult to disable, that could capture sensitive conversations without the knowledge of the parties speaking because they innocently started a sentence with, "OK, Google." Certainly this violates wiretapping laws? Let's pile on. Hospitals and medical centers are using this too, according to the Chrome for Work pages. A doctor says, "Ok, Google had a lot of results about new HLA-B27 research," when discussing a patient's arthritic concerns, while proceeding to outline the patient's symptoms and how treatment should proceed and now we're looking at a potential HIPAA Privacy Rule violation. As I type this, I look over at my Amazon Echo, and I'm reminded of something I heard once. If you're not paying, you're not the customer, you're the product. Is that hypocritical of me to accept my Amazon Echo but not the behavior of Google Chrome? [0]: https://www.google.com/work/chrome/resources/customer-stories/better-business-bureau/index.html https://www.google.com/work/chrome/resources/customer-storie... [1]: https://www.google.com/work/chrome/resources/customer-stories/us-state-department/index.html https://www.google.com/work/chrome/resources/customer-storie...

fixermark 11y ago
Yes it is. ;) The author wants us to remember that we live in a world that has these technological possibilities. That doctor's phone should have had a mechanical switch to disable the microphone, is the author's point.

izzydata 11y ago

My only audio recording device is my webcam and it is incapable of being in use without the light being on as far as I am aware. So how would it send them audio data without the audio device realize it is being used?

noir_lord 11y ago
> My only audio recording device is my webcam and it is incapable of being in use without the light being on as far as I am aware. You assume that the light isn't controlled by the same software, that's not always the case, the FBI has admitted this. https://grahamcluley.com/2013/12/webcam-spying-without-turning-led-researchers-prove-possible/ https://grahamcluley.com/2013/12/webcam-spying-without-turni... I take the view that anything under software control or the control of a chip I can't open is suspect, I've taped the webcam on laptops and physically disconnected built in microphones (I use a headset, built in ones suck). I'm not really happy about my Nexus 4 at all either, I think my next phone will be a dumb mobile. The sad thing is that I try to avoid paranoia with this stuff but the threat landscape is so large it's practically a full time job staying up to date with whats going on.

w8rbt 11y ago

One thing to keep in mind. If your friend has a Google device using Chrome, and you are close to them (in the same room) it hears your voice as well.

Oletros 11y ago
Any source for this?
- alfiedotwtf 11y ago
  Physics
  - Oletros 11y ago
    What has to do physics with the claim that Android Chrome is always listening?

Oletros 11y ago

has the author really tested if Chromium is listening? Downloading a binary blob is very bad, but the accusations that author makes wihouth a single proof is more FUD than anything

fixermark 11y ago
It's irrelevant to the argument. The author is making an appeal to the slippery slope (even if it's not happening right now, and even if Google is not doing it.... It could easily happen tomorrow and anyone could do it. Shutter your cameras and make sure your microphones can be physically deactivated).
- bduerst 11y ago
  Isn't an argument based solely on FUD essentially a slippery slope?

anaptdemise 11y ago

There is also a bug report from a year ago. https://code.google.com/p/chromium/issues/detail?id=381747 https://code.google.com/p/chromium/issues/detail?id=381747

zobzu 11y ago

Note that all android phones have that issue. Also all windows phones and soon windows 10. Oh and smart tvs. it is a real problem though

McGlockenshire 11y ago
> all android phones have that issue Citation needed. "Ok Google" functionality is an expressly required opt-in. I had to go out of my way to turn it on.
- zobzu 11y ago
  google phones (nexuses) pretty much turn it on as u hit next next next on install thats actually pretty similar the chrome tvs also warn you usually - but nontech ppl dont notice. next next.
  - Oletros 11y ago
    No, search recognition is not in the initial setup

jimhefferon 11y ago

This is why there needs to be a switch on all computers to physically turn the microphone off. How is that hard?

fixermark 11y ago
Physical switches are the most common point of mechanical failure. It translates to real-world lost revenue in terms of returns and repairs to include them at all. ... but yes, they should still be included. ;)
- nulltype 11y ago
  There's a light for the camera, they should just add one for the microphone.
  - bob-2 11y ago
    While acceptable for most paranoid users, the indicator light isn't as secure as a physical switch. For some devices (most notably 2007/2008 era MacBooks) the controller can be manipulated to enable the camera without giving any visual indication via the light.
    - nulltype 11y ago
      Yeah but what if the physical switch gets manipulated? I think if you're that paranoid you need to keep your macbook in a vacuum so it can't pick up any sound.
Too 11y ago
Same for wifi, camera and speakers. Preferably a real physical lid for the camera, the switches are in most cases just connected to an io pin and could potentially be overridden. Even if they are not its just very discomforting to have a camera constantly pointing at you, I feel weird when i see a lens even when I know the power is totally cut. For speakers it has happened to me a few times that something has started to play loud sounds and I can not mute it because windows is locked up somehow or im in fullscreen or whatever.

neumino 11y ago

> When you’re installing a version of GNU/Linux like Debian or Ubuntu onto a fresh computer, thousands of really smart people have analyzed every line of human-readable source code If this was true, Debian would have not build/release this version of Chromium. The author is living in the past or in another dimension. Some projects are complex, and it's hard/impossible to read/understand everything for a single human being.

wslh 11y ago

What happen if you play an audio file saying "Ok Google" ?