Chrome 69 logs you in whenever you visit a Google website whether you like it or not
The 'feature' raises privacy concerns and Google's rationale for it makes no sense
By Cal Jeffrey,
Facepalm: To prevent multiple users' data from being mixed up while
using Chrome, developers made it so that whenever a Google owned site is
accessed, Chrome switches to that account. However, this means if you
prefer browsing logged out, you are automatically logged into Chrome
when you access things like Google Docs or Gmail. Worst of all you can't
opt out.
Chrome 69, released earlier this month, is a major overhaul of Google’s
web browser. It offers a sleek new look and a host of new features
including a revamped password manager and a “smart answer” tool.
Another feature added to Chrome is automatic login. Whenever you log
into a Google website like Gmail or YouTube, Chrome 69 will
automatically sign you into the browser. At first glance, it seems an
easy and quick way to utilize Chrome’s personalization features, but it
is more intrusive than helpful according to security researchers.
For one thing, it removes the ability for the user to choose whether or
not he or she wants to log into the browser. Forcing users to browse
logged in is bad form no matter how helpful the function is perceived to
be, but security experts say that it goes beyond that and is a
violation of your privacy.
Professor of Cryptography Matthew Green at John Hopkins University says
that the feature has completely turned him off of using Chrome, which he
says he once loved.
“For many years, Google offered an optional ‘sign in’ feature for
Chrome, which presumably vacuumed up your browsing data and shipped it
off to Google, but that was an option,” said Green in his blog. “[Now]
Chrome will automatically sign the browser into your Google account for
you. It’ll do this without asking, or even explicitly notifying you.”
Green called the developers out on Twitter, but the company defended the
move saying that it's more like a "FYI" notification than actually
signing in. No, really, they did.
Green notes that developers are saying that this auto login will not
sync your data with Google servers — at least not yet. You still have to
opt-in to the service for syncing to occur. However, Green takes issue
with Google’s rationale for the feature.
Devs are concerned about what happens when Chrome is signed into one
account, but then a different user logs into a Google-based website to
say, check his or her email on the same computer. Presumably, account A
will end up syncing account B’s data. This concern is legitimate.
However, Green notes that the precautionary measure only pertains to
users who prefer logging into Chrome. It does not apply to those who
would rather browse logged out. To put it another way, all users are
being forced to sign into Chrome when they access Google sites because
the devs cannot figure out a way to keep data from two accounts
separate.
Green is not alone in his misgivings. Cloudflare CTO John Graham-Cumming
and Intel security expert Ryan Naraine voiced their concerns and said
they would be switching browsers.
“The Chrome guys get a lot right. This isn’t one of them,” Naraine said on Twitter.
Attempting to keep user data separate on a shared computer is a valid
concern. It is Google's approach to the problem that failed. Not giving
the user a choice in the matter is the wrong way to go regardless of
whether or not data collection is occurring.
https://www.geezgo.com/sps/40535
Join Geezgo for free. Use Geezgo's end-to-end encrypted Chat with your Closenets (friends, relatives, colleague etc) in personalized ways.>>
No comments