Chromium calls home even in incognito mode with safe browsing turned off
bugs.debian.org
bugs.debian.org
If we remember the hotword detection issue from a few months ago, once the issue was filed, Chrome engineers responded rather quickly. (As of today, hotword detection is 100% removed not just from Chromium but Chrome as well).
If anyone can reproduce this issue, I'd like to help getting it filed so we can determine what's going on.
Edit: We've found the upstream issue: http://crbug.com/498272 In it, we've isolated two separate pings in this scenario. One is to grab an experiment status; we're looking into if this is neccessary. The other ping is for the component updater, to evaluate if your Chrome extensions should be updated. Neither of these pings report what sites you are visiting to Google.
No more.
This might carry the expectation that unintentional interactions with other systems should be eliminated, since, the fewer systems touched, means the fewer traces of said activity there are in the entire world, no?
Thus the point is to avoid leaving traces on the computer, not the server.
What you mentioned, "minimize traces of activity left behind on other computers as well", is a difficult task. Attempting to do so requires more advanced techniques that entail tough compromises. Consider using Tor, you are anonymous to the endpoint (e.g. the website you visit does not have your IP), but confidential data is not safe from prying eyes in the process. Alternatively you can use some sort of crypt to sign and encrypt your connection... your data is safe from prying eyes (potentially verified as well) but you are no longer anonymous. This can all be mitigated to some extent, but it is well outside the scope of a browser.
Count the motivations to resist alterations that would doubtless improve Chromium's respect for privacy.
That's a very indirect way of explaining motivations. I am certain that there are conflicting requirements that have tradeoff and not as black-and-white as you make it seem.
Firefox is a great contrast to Chromium since they are likely to have greater respect for privacy. Is there a privacy aspect that Chromium lags significantly behind Firefox? If not, then your hypothesis (on motivation) is wrong (proof by contradiction: Mozilla doesn't have the same motivations)
Maybe Iridium is what you're looking for. From their fp:
> Iridium is a free, open, and libre browser modification of the Chromium code base, with privacy being enhanced in several key areas. Automatic transmission of partial queries, keywords, metrics to central services inhibited and only occurs with consent. In addition, all our builds are reproducible, and modifications are auditable, setting the project ahead of other secure browser providers.
https://plus.google.com/+JustinSchuh/posts/69qw9wZVH8z
Maybe Iridium has a better record but with so few eyes on them it's hard to have much confidence.
Probably the best thing to do if you're worried about Chromium spying on you is to use Firefox.
Uh, what?
>Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web. [0]
http://blog.chromium.org/2008/10/google-chrome-chromium-and-...
$ whois 2a00:1450:4009:80c::200d
[snip]
inet6num: 2a00:1450::/29
netname: IE-GOOGLE-20091005
descr: Google Ireland Limited
country: IE
org: ORG-GIL4-RIPEThe link doesn't contain any useful information besides that Chromium was somehow opened "in incognito mode" (there's no such thing, incognito mode applies to windows, not browser itself) and there are some connections spotted. No information whenever Chromium had sync enabled, whenever it has Google account associated, whenever it has any extensions installed, etc.
Say, I see a C2DM connection to get push notifications about updates. Whenever it's legit or not depends on the context. If browser's core has logged in user and a bunch of extensions installed, I'd say it's a bug if said connection is not present, even if no non-incognito windows are open at the moment.
It's good to be transparent about this, but maybe this is something legitimate and safe that's already documented, and the Debian user and maintainer just haven't found the documentation yet.
https://productforums.google.com/forum/#!topic/chrome/6wIqlx...
I was hoping mozilla would have their users' back, but a default install of Firefox also makes multiple connections to mozilla, google and other domains when started. Some extensions (notably NoScript and Ghostery) ping the mothership.
Safari connects to configuration.apple.com and the google website blacklist. uBlock for Safari tries to update itself even if no one asked it to.
Later edit: I have been told that I am perhaps being unfair to Mozilla. Let's see - I started reading https://support.mozilla.org/en-US/kb/how-stop-firefox-making..., to see how I can stop Firefox from connecting to servers without being requested to. While it's nice that they provide this page, this article's breadth only serves to prove that this browser is out of control when it comes to making connections to servers by itself.
I have the following settings:
* disabled Firefox health report
* disabled crash reporting
* never check for updates
* do not check for addon updates
* block reported attack sites
* block reported forgeries
After reading the page, it turns out that I also have to disable the following from about:config:
* the addons blocklist
* link prefetching
* DNS prefetching
* speculative pre-connections
* firefox Hello
* tiles, even if they were already disabled from the UI
* the default search engine geo-location
* the what's new page
* add-on metadata updating
* the heartbeat
For reference, here are the connections that Firefox tries to establish immediately after startup:
Outgoing to self-repair.mozilla.org (54.230.200.16), Port https (443), Protocol TCP (6), 0 B sent, 0 B received
Outgoing to shavar.prod.mozaws.net (52.26.89.67), Port https (443), Protocol TCP (6), 0 B sent, 0 B received
Outgoing to safebrowsing.google.com (2a00:1450:4001:809::1005), Port https (443), Protocol TCP (6), 0 B sent, 0 B received
Outgoing to tiles.r53-2.services.mozilla.com (52.25.98.110), Port https (443), Protocol TCP (6), 0 B sent, 0 B received
Outgoing to cmp-cdn.ghostery.com (54.152.180.212), Port https (443), Protocol TCP (6), 0 B sent, 0 B received
Outgoing to search.services.mozilla.com (54.69.18.27), Port https (443), Protocol TCP (6), 0 B sent, 0 B received
Firefox checks for updates, and will update the malware/phishing databases a bit after startup. That's actually the same SafeBrowsing the OP mentions. All of this can be toggled. I'm not sure what your vague "other domains" is.
I'm a bit puzzled at the extreme shortsightedness of a browser checking for security updates being branded as "not having their users' back".
Historically, browsers -- because of their enormous potential risk (easy to exploit) -- have done a better job of providing security updates quickly than have other tools.
Not that I'm advocating for them (I use Chrome myself), but those fit what the parent suggested.
That's not direct ad sales and Mozilla wasn't created with the specific purposes to sell ads or collect private information, nor is owned by an ad-selling company.
Besides you can change the default search engine in a heartbeat.
Honestly I'm moving to backend work and using a terminal browser. This is so fucking stupid. Wish there was at least one program on my computer that isn't trying to constantly stab me in the back.
Obviously, since all have update-check (and auto-update) features, live content (e.g. intro page), etc.
That's not the same as mining your every search, and they don't own an add company or anything.
>I need a browser that just lets me browse instead of filling me with constant "1984-esque" anxiety and paranoia for every URL I go to, and apparently all the extensions I run ALSO call home and leave a uniquely identifying finger print.
It's even worse: EVERY IP (and/or page) you visit is registered on your ISP.
About apps phoning home specifically, you can install an application firewall like Little Snitch and be warned and in control of any such attempt.
It's not something that you should trust on the browser vendors not to do, anyway...
Microsoft pulls in 11 figures a year in online advertising revenue. As of earlier this year, Apple was still earning more mobile ad revenue than any other firm. And Mozilla is funded almost entirely by companies that earn billions in online ad revenue like Yahoo and Google.
Which is neither here, not there. As I wrote those three browsers don't make money off of ad revenue and/or private data. Chrome does.
Whether the money are made directly or indirectly is beside the point for the purposes of the discussion.
>Microsoft pulls in 11 figures a year in online advertising revenue. As of earlier this year, Apple was still earning more mobile ad revenue than any other firm. And Mozilla is funded almost entirely by companies that earn billions in online ad revenue like Yahoo and Google.
Not that relevant either. Apple sells display ads (iAds etc) and that's it. They don't deal in personal data. Mozilla even less -- whether Yahoo/Google pays it to be the default search engine or not.
Im seeing more and more Error 40 every week :(
Other than elliptic curve BS Opera 12 is a perfect browser for me.
Trust, but verify.
could you explain what this means? Been using uBlockOrigin+NoScript+Ghostery combo for quite a some time now and never realized how NoScript might be unsafe
It has a whitelist supposedly to not break "top websites", but this list contained IMO some questionable choices last I checked it. It also tries to connect to the dev's website for no reason at all (addons are updated directly from Firefox) and after updates, "to show the release notes".
Last but not least, this is the same dev which got involved in a scandal for trying to underhandedly whitelist the said website into an ad-blocking addon.
Thanks for checking and sorry for my confusing initial post...
https://support.mozilla.org/en-US/kb/how-stop-firefox-making...
What was your point exactly? I fail to see any relation here.
I think the lesson to be learned here is that FOSS can be just as dangerous as commercial software if not enough people are inspecting the code and following development. It seems there are a lot of people who unconditionally trust anything that's open-source.
"That said, the fact that Linux distros might switch off Telemetry and [Firefox Health Report] by default causes issues right in that way: they are undercounted and [Mozilla] may disregard them completely in data-driven decisions. If you are a Linux distro package manager, think about that."
So: It connects to Mozilla itself and to Google (specifically their server for the malware/phishing DB). The fact that Ghostery is in there is because you have third party addons installed.
FWIW shavar.prod.mozaws.net is a Mozilla server which updates the blocklist for Tracking Protection. Somewhat ironic you're complaining about it given the context.
It's a major driver of Internet centralization: things must be centralized to escape the deployment nightmare. It's exponentially easier to manage deployment on a handful of servers than it is to actually ship an app to users.
With our app, we test our Windows build on Windows Vista, 2008 Server, 7, 2012 Server, 8, 8.1, and 10, on both x86 and x86_64. It always passes before we ship. Then inevitably we get bug reports: the UI won't open, device drivers won't install, the app mysteriously crashes, etc. Investigation always reveals some weird little variation or clashing piece of software on the customer's machine. Every Windows machine is a special snowflake, and as Windows machines run they accumulate 'OS rot' and gradually become less reliable (due to the mutability of the OS and dependencies). To fully test deployment you'd have to test hundreds of thousands of VMs with different software install histories, etc. In the end we have to tell people 'sorry, we tested with clean Windows installs on eight different versions, you're on your own.'
Mac is the only tolerable deployment target and that's because it's a fascist dictatorship compared to Windows: uniform hardware, strict restrictions on OS modification, and enforced software conformity. Phones aren't too bad either but that's because they're also fascist dictatorships with locked-down OSes.
Basically the modern OS is broken. Things are mutable that shouldn't be, process isolation is a joke, etc. Server OSes are broken too but at least if you own all the servers you can make sure they're all broken in the same way. Even there the trend is toward statically linked binaries (Go) and packaging apps as entire containers with their own OS (Docker) to basically deprecate the OS and achieve predictable deployment.
Their promise is that they basically solve most of the problems you mention, so I'm curious how well it stands up in practice or why you choose not to use it.
EDIT: I'm a bit confused: I just got two downvotes for asking a question. So just to be absolutely clear: I don't have any relationship with Turbo or whatsoever.
The person who replied did have a good comment with the 'chrome://net-internals/#sockets'. It will list specifically what this person is looking for.
Privacy is a concern for everyone, whether they understand that or not.
Same reason you don't use TOR on a virtual machine over a drone mesh network to starbucks for the majority of your internet browsing.
Likewise, if you use the gear all the time, people will figure out that you're probably a scuba diver.
The fault in your analogy is that you seem to think that oxygen is somehow less important in situations where it's easily available. You say, "Just when I'm diving or doing something where it is equally important." But oxygen is always equally important. It's just that in most situations it's easily available to you: all you have to do is inhale.
Your analogy isn't even internally correct, but even if it were, it still doesn't prove anything about privacy, because privacy isn't easily available, at least not over technological channels. Privacy isn't oxygen, so accurate claims about oxygen don't imply anything about privacy at all.
Analogies are for explanation, not evidence. If you can't make an argument without an analogy, you're may want to consider that you're wrong.
Privacy is readily available through https, two factor OAuth, etc. just like oxygen generally is. What's your point?
Well, it makes them useless as evidence. An argument by analogy simply isn't a valid argument. Don't you remember the "You wouldn't steal a car" ads?
> Privacy is readily available through https, two factor OAuth, etc.
HTTPS is broken by privileged man-in-the-middle attacks (attacks where the attacker has key signing power) and downgrade attacks. And that is when it's even available (it isn't always). And even against attackers with less power, it only provides privacy for what you send over the wire, not who you send it to. And finally, this all assumes that you're sending your data to an entity which won't simply sell it to whoever is willing to pay a few bucks (an uneducated user might think, for example, that data sent through GMail is private).
I'm not even gonna touch "two factor OAuth"; I'm not sure what kind of privacy you even think that provides.
In short, you clearly have no knowledge about what does and does not provide privacy. It would behoove you to not make claims on topics you are ignorant of.
It's committing a no-true-scotsman to say that "privacy isn't as easily available as oxygen" when you change it to "true privacy is is really perfect privacy" when faced with HTTPs and OAuth.
All privacy & security tools are are imperfect, but most of us find the right level, rather than live in a faraday cage in our mother's basements (that's the point). Unless of course, copsarebastards, you need that level of privacy - then I'm not going to judge.
Agreed, that's what I've been saying all along.
So then why did you use an analogy? Did you really think the sentences "Privacy is easily available" or "People only have to use privacy tools when they are doing something that they want to keep private" needed explanation? Perhaps I assumed you were using it as evidence when you weren't, but you have to admit that's a reasonable assumption given that the analogy is completely pointless otherwise.
> It's committing a no-true-scotsman to say that "privacy isn't as easily available as oxygen" when you change it to "true privacy is is really perfect privacy" when faced with HTTPs and OAuth.
Imperfect privacy isn't privacy. Either people are able to look at your data or they aren't. If people are able to look at your data, you don't have privacy. This isn't a complicated idea or a "no true scotsman" fallacy, it's the meaning of the word "privacy".
We have plenty of evidence showing that the NSA surveils data which is "protected" by HTTPS, ergo, HTTPS does not provide privacy. And the NSA isn't the only actor with this capability.
And OAuth doesn't provide privacy. It's not even the problem that OAuth tries to solve. OAuth provides authentication, which is an element of privacy, but it takes more than simply showing that a person is who they claim to be to provide privacy.
> All privacy & security tools are are imperfect, but most of us find the right level, rather than live in a faraday cage in our mother's basements (that's the point).
That's exactly not what happens. The average user simply is not informed enough to make an educated choice about what level of privacy they want and make choices to get that level of privacy. As a result, people don't find the right level of privacy. Closeted gay people get outed by their Facebook friend graph, pregnant teenagers have their pregnancies publicized by their targeted ads, celebrities have their nude photos leaked to the public, adultery website users and corporate employees have their information leaked, women are found by their jealous law enforcement exes misusing surveillance technologies. Only a fraction of these people actually knew what risk they were taking when they friended someone on Facebook, searched for goods on Amazon, texted a nude photo to a lover, put their credit card into a website, gave their info to their employers, or made a phone call.
Obviously living in a faraday cage in your mother's basement isn't the answer: that's a straw man argument.
The answer, in my opinion, is both social and technical. Socially, we need to get people to prioritize privacy and use privacy by default, we need people in power to respect and protect the right to privacy rather than actively taking it away from people. From the technical side, we need privacy tools that are faster, more secure, and easier to use, and we need decentralization so that violating people's privacy is no longer an option.
And yes. Obviously I don't use them.
I personally prefer Firefox regardless, but that's not because of paranoia reasons (I just like it better with about:config and the available add-ons and the way the url bar works and... just usability reasons).
https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomp...
And of course the "argument" that language changes doesn't hold water. They are not merely using different words, they are de-facto eliminating the word that describes a "theory". People who actually make scientific hypothesis and scientific theories use the word correctly, it's the ignorants who can't use it, and who quite often will utter phrases like "X is just a theory!", like somehow that should lessen X.
What's hard to understand about maintaining radio silence?
Does no one understand that keeping your mouth shut, and not accidentally blabbing packets across the network is ALSO a security posture?
Anyone between you and The Mother Ship now has a shiney new target to MITM payloads at.
Why do you hate freedom?
If you want radio silence, exit the program
So, you mean to tell me that I'm not allowed presume that I might actually be in complete control of the machines my program is holding conversations with? Is that what you're saying?
But the biggest problem is that we don't (yet) _know_ exactly why and what is happening. Fortunately we can understand it by looking at the code, and somebody will do that.
Then we can discuss if this was a violation of trust, a simple error, a useful feature etc.
Obligatory *you're :)
Um, this isn't reddit. Out of all of the snark you posted you had one, tiny, possible point about creating a vector for MITM attacks but since the connection is over TLS it's not much of a concern at least at the moment plus I'd imagine they would sign such things (but I don't know for certain).
So I guess good job at taking your only point and surrounding it with nonsense which is always downvoted on HN.
It's way more reddit than it used to be. It happened to Reddit, it's already almost completely happened here. This place is basically a decent subreddit in culture now. Kind of sad.
Because based on my impressions as someone commenting or lurking here 5+ years, HN has experienced a significant uptick in quality over the past year or so. I see many older commenters making the same type of observations.
And Reddit-like comments are consistently downvoted here.
EDIT: Removed "Of that there's no question." from my statement about comments being consistently downvoted, since clearly that's not true.
In the end I think the HN and Reddit audiences are different. Yeah there is overlap but I don't think there is a ton of overlap.
Much like my Reddit experience - was a long-time lurker, but have a more recent account.
Both sites have gone downhill in terms of community quality.
> HN has experienced a significant uptick in quality over the past year or so
In the news articles I'd agree. In the comments? Drastically the opposite as far as I've read.
> Reddit-like comments are consistently downvoted here.
I wish. The worst meme-crap sure, I agree with that, and it's a good thing. However it's not that that's the problem: it's the community attitude and outlook; just seems to have got a lot worse - especially in the last year or two.
Case in point: down-votes for disagreement rather than lack of content. See my comment above for a great example of that.
The debate about downvotes for disagreement rather than lack of content has been going on here for years. For me, it's as clear as day that this is getting much, much better. From about 2012 to early 2014, there was some type of either bot or some very, very eager HNers who would rapidly downvote topics they didn't like, 3-4 downvotes within the first 5 minutes, even if it was a quality comment. I would regularly upvote comments even though I vehemently disagreed with the commenter just to offset those downvotes. I find myself having to do that much, much less now.
It is clear that HN is getting more "traditionally" polite as well as what many would consider politically correct, so if that pisses you off then I can definitely see how the site would seem to be worse.
But I strongly, strongly disagree with the Reddit thing. By the way, take a look at the HN guidelines:
https://news.ycombinator.com/newsguidelines.html
It says:
"If your account is less than a year old, please don't submit comments saying that HN is turning into Reddit. It's a common semi-noob illusion, as old as the hills."
If I'm not mistaken, that guideline has been in place since I got here back in 2010-2011 or so, so that should tell you something. People have been complaining about Reddit-like comments on HN since at least back then.
(As as you will have noted, people are quick to downvote comments saying HN is becoming Reddit for this very reason)
I mean... seriously. It's been a problem SINCE 2010-2011 so I'm not surprised. You're right tho - it DID get better. So did the quality of Reddit for a white - then it got a lot... LOT worse.
> people are quick to downvote comments saying HN is becoming Reddit for this very reason
Well no, mostly it's just the false sense of superiorly that this place has actively cultivated over Reddit for many years. Got to maintain that.
Awareness of a problem is the first step in combatting it after all.
> If you don't like the increasing Reddit-ness of HN, then pointing out that HN isn't Reddit is the right thing to do to stop the trend.
That "isn't" might have been a bit confusing, but, with parentheses, I meant:
> If you don't like the increasing Reddit-ness of HN, then (pointing out that HN isn't Reddit) is the right thing to do to stop the trend.
My point was that, when BinaryIdiot said "Um, this isn't Reddit", you said (https://news.ycombinator.com/item?id=10433352):
> It's way more reddit than it used to be. It happened to Reddit, it's already almost completely happened here. This place is basically a decent subreddit in culture now. Kind of sad.
I took this to mean that you thought that BinaryIdiot's chiding was inappropriate, or useless.
What's hard to understand about the fact that "radio silence" is a desirable trait in war (and that in certain circumstances only) -- not in desktop software, and even less so in one whose PRIMARY PURPOSE is connecting to thousands of addresses everyday?
And that, being up-to-date with the latest security patches, including for users who would otherwise wouldn't bother to install is better for everyone involved?
Having to assume that I am always at risk of being attacked is known as being placed under "siege mentality" and yes, it is a symptom of war. [1]
You just enjoy your browsing being automagically always update with the latest available patches...
Comparing the situation to "siege-mentality" etc is taking a far-reached association so far that it's not even on the solar system anymore...
It's not an absurd expectation that a system only does exactly what it's told to do, and only when told to do so.
Don't paint that premise as if it were some ridiculous pie-in-the-sky unattainable cadillac of desires.
Now, you listen: most simple (non techie) users don't know what they need to "tell browsers to do" in the first place, aside from loading webpages.
We had what you propose and people were stuck with 10 year old IE6 versions, tons of viruses from old exploits and plugins, etc.
Now we expect modern browsers to be evergreen and to keep themselves secure. That's part of what browser developers are implicitly "told to do" -- and people jump to those browsers (e.g. Firefox when it pioneered that evergreen thing and then Chrome).
>Going incognito doesn’t hide your browsing from your employer, your internet service provider, or the websites you visit.
They're probably a cheese eating surrender monkey and don't realise the good you are doing by trying to force your skewed version of "freedom" on to them
We detached this subthread from https://news.ycombinator.com/item?id=10433068 and marked it off-topic.