Can someone explain this to me like I’m 5. I understand it’s not good but I don’t know why and I would like to understand it.
Effectively Google has a browser extension (just like the ones you’d install from the Chrome Web Store like uBlock Origin) that comes with the browser that’s hidden.
This extension allows Google to see additional information about your computer that extensions and websites don’t normally have access to, such as checking how much load your PC has or directly handing over hardware information like the make and model of your professor.
The big concern in the comments is that this could be used for fingerprinting your browser, even in Incognito mode.
What this essentially means is that even though the browser may not have any cookies saved or any other usual tracking methods, your browser can still be recognised by how it behaves on your machine in particular, and this hidden extension allows Google to retrieve additional information to further narrow down your browser and therefore who you are (as they can link this behaviour and data to when you’ve used Google with that browser signed in), even in Incognito mode.
So since they only just seem to have discovered this, does that mean this invisible extension also likely to be present on Chromium based browsers such as Brave and Thorium etc…?
Yes, though they could remove it. If they’re open source then you could check easily.
information like the make and model of your professor
Oh no, not my professor :( (/s)
Oh that’s a good typo, I’m leaving that! I look forward to the LLMs in 2030 telling you to watch the temps on your professor and make sure it doesn’t get exposed by Chrome.
even in Incognito mode.
I thought extensions don’t run in incognito mode?
I know Firefox doesn’t run them by default - you can specify which extensions you’d like to run in incognito mode.
I thought extensions don’t run in incognito mode?
They don’t. Unless you check the box that allows them to. And I’m sure Google has already checked that box by default.
I tested it with a stock install of chrome/windows 11. Works.
Fingerprinting.
Bingo! Google wants to go cookieless and fingerprinting has been
one ofthe solvesI’ve always read about in the SEO world.Thank you for this info. If this is just an extension, can we just uninstall it or turn it off?
This is not a typical extension and it cannot be removed. It doesn’t even show up in the list of installed extensions.
Maybe recompiling? But I suspect that Chrome as it is, is closed source?
Seems like a great option. Can anyone more familiar with the code confirm this removes the aforementioned CPU-fingerprinting plugin?
It does. You can even try it out yourself. Install Ungoogled Chromium, go to google.com and paste the following code in the Developer console (which you can bring up by pressing F12 and clicking on ‘Console’ at the top of the DevTools interface):
chrome.runtime.sendMessage( "nkeimhogjdpnpccoofpliimaahmaaome", { method: "cpu.getInfo" }, (response) => { console.log(JSON.stringify(response, null, 2)); }, );If it returns nothing or an error, you’re good. If it returns something like this:
{ "value": { "archName": "arm64", "features": [], "modelName": "Apple M2 Max", "numOfProcessors": 12, "processors": [ { "usage": { "idle": 26890137, "kernel": 5271531, "total": 42525857, "user": 10364189 } }, ...it means that the hidden extension is present, and *.google.com sites have special access in your browser.
Chromium is open source. Google Chrome is not open source.
This that and the article are very light on details, but I couldn’t find an article deeper in details
My laptop, that I own and runs Linux that I installed, has chrome in it. I’m order to log into Gmail for work, it installs an extension that is capable of telling Gmail if my disk is encrypted. I know because you get an error message until my disk was actually encrypted. It was a big surprise to me, and I wonder if this is done by the same piece of code.
Btw would there be a way to do virtualization through perhaps docker or flat pack or chroot that can isolate chrome in a sandbox and prevent it from a) reading and writing files anywhere on any disk and b) get other data such as CPU, disk encryption etc?
My laptop, that I own and runs Linux that I installed, has chrome in it. I’m order to log into Gmail for work, it installs an extension that is capable of telling Gmail if my disk is encrypted. I know because you get an error message until my disk was actually encrypted. It was a big surprise to me, and I wonder if this is done by the same piece of code.
That’s strange, I’ve never heard of that before
Btw would there be a way to do virtualization through perhaps docker or flat pack or chroot that can isolate chrome in a sandbox and prevent it from a) reading and writing files anywhere on any disk and b) get other data such as CPU, disk encryption etc?
There are some isolation mechanisms on Linux like Firejail or Bubblewrap. The latter is used by Flatpak to sandbox applications. These are rather weak though, and Flatpak weakens the security of bwrap further. By default, Flatpak application permissions are also set in a Manifest file, which is created by the maintainer of the package. To get more control over your Flatpak sandbox, you need to use an application like Flatseal.
Docker (or containers in general) aren’t meant for isolation/sandboxing, but this approach would also work. I would create a container using Distrobox or toolbx, and install Chrome inside the container.
This will not prevent Chrome from getting your CPU information though. To protect against that, you would have to use a virtual machine (and spoof the your CPU model if you want to hide that from Chrome).
Sounds easier to switch to another browser at that point
OP apparently needs Chrome to log into an enterprise GSuite account, which has specific requirements, that are enforced by Chrome’s enterprise policy system. I don’t think this works in Chromium.
Oh I didn’t catch that my bad. I hope they get a work computer where this kind of stuff doesn’t interfere with private life!
Would everyone who is surprised by this please raise your hand? . . . That’s what I thought.
Not surprised, but still disappointed.
I am
Really? That’s not what the data from your api says /s
You don’t need to actually write it, just raise your hand and we have registered your vote, either via your computer’s camera, Google Nest, Google Assistant or inferred it by analysing the WiFi data returned by your Google Mesh network.
License and registration, sir
Keep your hand raised because I’m coming in for a perfectly-landed high-five!
perfectly-landed never happened before, and never will
It baffles me that they sell Chrome as private and/or secure, and baffles me even more that people believe them.
It baffles me people use chrome.
Why? There was a time when chrome was significantly better, and most people hate change.
I remember back in the day everyone used Firefox. Then Chrome came out and there was a nice ad campaign and it was actually way faster.
Then slowly everyone switched to Chrome. At some point in the last 15 years, it switched to Firefox being superior.
I switched back to Firefox maybe like 7~ years ago? But I did it for open source reasons.
Yet another reason to switch to Firefox, or even better, a hardened fork like LibreWolf !librewolf@lemmy.ml
What functionality would I lose/gain if I switch from Firefox to Librewolf? I’m admittedly an amateur in the privacy space, and I’ve been pretty content with Firefox + Ublock and container tabs for different profiles, but I consistently get the issue that my browser fingerprint is pretty unique, and I have no idea how to or even if I can anonymize that anymore.
Librewolf is not associated with Mozilla and does not receive their primary source of funding from Google like Mozilla does. I really like having the same browser and browser synchronization between my phone and desktop/laptop, so librewolf is out for me. They have no interest or resources to build an Android version. Waterfox does at least have desktop / android option and takes things at least one small step further away from Google.
Thanks for the answer! I run Windows, iOS and Linux across multiple devices, and sync is definitely needed for me as well. I’ll look into Waterfox!
The previous answer is misleading and partially just wrong. Firefox Sync works just fine in LibreWolf, you just need to enable it in the settings. I currently sync my LibreWolf browser on my Linux desktop to Firefox on iOS and Mull on Android, no issues whatsoever. The only Mozilla services that LibreWolf intentionally removes are their telemetry and Pocket.
You can enable Firefox sync in Librewolf, it works fine.
It is the same browser. LibreWolf doesn’t change much of the Firefox code, mostly just the configuration. They enable various privacy/security settings by default and remove Mozilla telemetry. You can go to the LibreWolf settings and enable Firefox Sync, and it will work just fine with your Mozilla account and other Firefox browsers.
For Android, I like to use Mull, it’s a hardened build of Firefox, similar to LibreWolf.
U can sync regular mobile ff and librewolf. Thats what i currently have.
Yes, why to do this?
Tangent note: I think browser fingerprinting is only a source of concern if you use VPN. Otherwise, your IP is already a good enough identifier, and quite likely doesn’t rotate often enough. Please someone correct me if I’m wrong.
Yeah I’d only worry about it if I were trying to buy drugs on the dark net or something. I guess if torrenting became illegal I would also worry.
I worry about price discrimination
I appreciate the list. I’m not saying there aren’t valid concerns, just that in my day to day life it’s one of those items where the steps needed to avoid browser fingerprinting is usually more work than the value I personally get from my perspective.
I’ve looked into this, and I’m not clueless. I’ve developed websites, I’ve done a lot of stuff with Selenium / Puppeteer, and have toyed with Firefox browser extensions.
I understand the tools they use and it’s just very tricky to fully eliminate this type of thing. For example they can even use the browser window size. Are you going to randomly change window size to some novel dimension when you open up a tab?
What about the JS engine you use. For example using Firefox already narrows down your anonymity by like 95% or something because only a small amount of users use the browser. Etc etc
It’s hard to do this correctly, and I feel like VPN + private window usually takes care of the price fixing thing on the list, for example. When I’m searching for flights I usually do this.
I also use JS blockers in order to try and mess up the scripts that Facebook & Google have hidden over the internet to track you. But ironically, doing that again reduces your anonymity. They know that if their scripts don’t work on you, you get narrowed down again to a very small % of users.
It only takes a few of those pieces of data to be reasonably sure that it’s you. Browser fingerprinting is tricky to really avoid. It’s not impossible, of course. Just saying to really do it right it might be more effort than it’s worth.
The depth of fingerprinting really bothers me and I have accepted that the best at it will succeed.
It is tempting to find the world’s most popular default configuration and use that :) But that’s prob be something gross like Windows 10 & Chrome! In fact, that’d be second after Android & Chrome. Wonder how detectable VMing/emulating those configurations would be.
Agree with you and appreciate the detailed response!
Became? 🤔
Torrenting itself is not illegal. The distribution of copyrighted material that you don’t own is the illegal part.
Different places have different laws
Mostly it’s just FF but with more private defaults (that you can change in the settings trivially anyway), although there are one or two extras.
There is a potential issue, though. Librewolf runs behind, so security vulnerabilities, particularly for zero-day exploits, take longer to be patched.
Switching from Firefox to Librewolf has some pros and cons. Librewolf is a fork of Firefox focused on privacy and security, with telemetry stripped out and privacy settings maxed out by default. You’ll gain better out-of-the-box privacy protections, meaning less tracking and data collection without having to tweak settings yourself.
However, you might lose some convenience. Librewolf might not support certain Firefox features like Sync, since it relies on Mozilla’s servers (not sure about that point, maybe it does work). It can also break some websites due to the stricter privacy settings. Another thing to consider is that you won’t get updates as quickly as Firefox.
Regarding browser fingerprinting, it’s a tricky beast. Librewolf can help somewhat by making your fingerprint less unique, but it’s not a silver bullet. Tools like uBlock Origin and container tabs are great, but adding something like the CanvasBlocker extension can also help reduce fingerprinting. Ultimately, no setup is perfect, but Librewolf is a solid step towards better privacy.
Firefox sync is disabled by default but you can enable it in the settings.
I don’t really care too too much about privacy. If they get rid of the Pocket button then I’d be happy enough.
About:config
Extensions.pocket.enabled false
May I please steal this for future use?
I stole it too lol
if it’s fingerprinting you care about, i’d give mullvad browser a try. it’s a firefox fork tailored to increase privacy and blend you into the crowd (as long as you don’t change any setting/install addons). it’s very very neat.
Google Meet can show CPU usage, they aten’t trying to hide this.
#UninstallChrome
#SwitchToFirefox
Here, you forgot this:
\
Hmmm, no way this could ever turn into a security hole, I’m sure of it.
i think it’s used for the performance testing feature in google meet n stuff like that…
Of course there’s some legitimate use case to it. Just like every privacy rights undermining bill helps “the children”. Doesn’t mean that’s the only or even the main goal.
Not a legal mastermind by a long shot but it seems like a DMA violation. Someone needs to get the EU on their ass.
EU: [RELEASES THE HOUNDS]
Just make sure it isn’t the Pomeranians this time
Make sure it isn’t just the Pomeranians. Some Pomeranians are definitely going to be in the mix.
Ok, I’m good with that.
I had to look up what the Pomeranian dog breed is, because I’m not good with dog breeds. Soon as the page of images loaded I burst out laughing. 😆 Thank you. Good start to my day.
Glad to help. 😁 Get out there with that little dog energy.
lmao is been good so far. Have to make a long trip with the kids today, so it helped. ❤️
Is this for malicious harvesting or is this part of their chrome device trust product for enterprises?
WINK
No, as far as I know this has nothing to do with attestation/verification for enterprise users.
This is hilarious! It even works on Edge, Vivaldi and even Brave 🤣. Good thing I use Firefox in almost everything or general day to day use
I’ll admit, in several places I used Edge as an effort to have at least some layer of distrust between myself and Google. I’ll have to quit that though.
I like your style. I went looking and found “switchbar” which kinda/sorta eases this bouncing between browsers idea:
https://chromewebstore.google.com/detail/open-with-switchbar/klgpknafjlhnpkppfbihchgfebbdcomd
It’s not elegant, but it supports the workflow you suggest. I kind of like the idea of using Edge for google.com and Chrome for microsoft.com. I’m not optimizing my experience (it may in fact be very sub-optimal), but I’m also using competition to neutralize potential shenanigans.
I kind of like the idea of using Edge for google.com and Chrome for microsoft.com.
Dang, just use Firefox. It’s so much easier then this
such a sensationalist article there. mozilla isnt an advertising company, they bought a company that specialises in privacy focused ad campaigns so they can provide an alternative to google for companies.
which is what they should be doing.
Welp, might as well just use w3m 🤣
Vivaldi and Brave have the option to disable the Hangouts extension in settings, which should disable this.
As linked in the article, it is indeed used for “Hangouts” (Meet) troubleshooting.
This is good news since Vivaldi is my goto chromium browser (when I need to really use it)
Firefox 🔛 🔝
🦊🦊
Why do people still use Chrome?
Please uninstall it from everyone’s home pc and phone that you come into contact with
Because it’s fast and works well enough to keep the fame acquired over the last 10 years.
Slower than Firefox
I’m a Firefox user on desktop and mobile, and I definitely feel like Chrome is faster on both platforms when I (have to) use it. But I prefer Firefox for the ideology and dev tools (on desktop), since I’m a web developer by trade, so the dev tools make a big difference for me.
I use both for my job and my subjective feeling is that chrome is faster. Js benchmarks seems to confirm it. Privately I use Firefox 95% of the time but I understand people who stay on chrome just out of inertia.
There was a short period a few years ago after the Quantum update that I would have partially agreed, because Firefox’s renderer was much smoother. But Chrome seems to have caught up, because it’s been much faster every time I test something in it in the yesrs since.
At the cost of zero privacy, data being stolen and other fundamental issues and morals that Google lacks.
Which is invisible to users, meaning they can ignore it or handwave it with “I haven’t got anything to hide”.
Or worse, “They already know everything about me, so why bother?”. One of my relatives says this. Kill me now.
Google does a lot of standards breaking things.
Like allowing a link on Google Apps Marketplace to open a new window (like popup) with POST instead of GET. (This pretty much ensures that buying an app will fail for browsers that follow the spec)
This garbage behavior is in Chromium as well?
LibreWolf, Mull, Chromium, …
It’s apparently built into chromium
I don’t think so. I haven’t had a look at the code, but executing that command from the post returns the following on my Chromium:
VM68:1 Uncaught TypeError: Cannot read properties of undefined (reading 'sendMessage') at [HTML_REMOVED]:1:16 (anonymous) @ VM68:1It turns out Google Chrome (via Chromium) includes a default extension which makes extra services available to code running on the *.google.com domains - tweeted about today by Luca Casonato, but the code has been there in the public repo since October 2013 as far as I can tell.
It looks like it’s a way to let Google Hangouts (or presumably its modern predecessors) get additional information from the browser, including the current load on the user’s CPU. Update: On Hacker News a Googler confirms that the Google Meet “troubleshooting” feature uses this to review CPU utilization
The code doesn’t do anything on non-Google domains.
Maybe it’s because you tried it on a non Google site? Idk.
Hehe, I read that sentence, tried it on google.com
But forget what I said. I have the ungoogled variant of Chromium installed. No wonder that’s not in there…
