Hacker News Reader

Comment by jklinger410 | Hacker News Reader

Maybe for some people Google owning their data is worse than the odds that they will be targeted by the latest exploits.

View on HN

Given current ransomware trends, that seems like setting up a bunker but crossing a highway on foot daily. Sure, the nukes won't get you, but those cars will.

It's not that you're not allowed to worry about google holding your data (of course it is!), but it's pretty unsafe to be on the 'net without being properly patched.

If I had to set about this, I would have an upstream fork of Chromium that would patch the various networking functions to blacklist known google domains, and then offer a flag to ignore the blacklist in the "obvious" spots (like when you go to google.com). Probably not perfect, but a bit safer.

If you're super serious, you could just 404 all access to google.

> Given current ransomware trends, that seems like setting up a bunker but crossing a highway on foot daily. Sure, the nukes won't get you, but those cars will.

I haven't updated Chrome in quite a while. My computer's been running just fine. I'm pretty sure I would've died if I'd tried to cross highways as you mentioned all this time. So I think something about the comparison doesn't smell right.

Hey some people win the lottery, right?

The relative odds aren't quite right, but consider how many people you might know who lost their PCs to virii, compared to people compromised by their Google searches.... Maybe it's a wash ;)

I think your likelyhood of getting your PC messed up is pretty dependant on habits too. You're much more likely to get hit by drive-by adware if you're (on Windows and) going to those random illegal streaming sites to watch some show than if you're reading HN.

An example: I was on a less than stellar video hosting site, and a bunch of pop-ups got me to accidentally download "FlashPlayer.dmg"

I'm pretty well versed in this stuff! And they got me to download this right as I was going to watch this video. If I didn't know better, it would have been like all those other plugin updaters (of course you need root to install flash right?)

Of course, updated Chrome didn't prevent this case for me...

> I think your likelyhood of getting your PC messed up is pretty dependant on habits too.

Indeed...

> You're much more likely to get hit by drive-by adware if you're (on Windows

Indeed I am on Windows... without security software, etc.

> and) going to those random illegal streaming sites to watch some show

Indeed I am not...

> than if you're reading HN

Indeed I am...

> An example: I was on a less than stellar video hosting site, and a bunch of pop-ups got me to accidentally download "FlashPlayer.dmg" I'm pretty well versed in this stuff! And they got me to download this right as I was going to watch this video.

Even if you downloaded that, you have to do some extra clicks to make it run. It's not something that I can see happening by accident to the average HN reader.

> If I didn't know better, it would have been like all those other plugin updaters (of course you need root to install flash right?)

But you did know better.

> Of course, updated Chrome didn't prevent this case for me...

Well there you go, I'm out of arguments.

I think you quite beautifully narrowed down where the real problems lie and proved my point, so I'm just going to leave it at that. ;)

I might revise my original post.

On the other hand, looking over CVEs for chrome[0], I'd be a bit worried. Chromes before 47 included remote code execution via the MIDI subsystem! If someone could play a MIDI, they could compromise your system!

Yikes

[0] http://www.cvedetails.com/vulnerability-list/vendor_id-1224/...

My Chrome isn't that old, though I don't play MIDI on Chrome either...

I'm a lottery winner too, I guess - I often keep Chrome running weeks at a time on a Windows machine, because I tend to suspend the system instead of shutting the computer off...

Anyway, I came here for a tangent about those "less than stellar video hosting" sites: I have an idea how to kill two birds with one stone - getting rid of them, and fixing the Internet. Can we convince MAFIAA to go after ads on the web? After all, that's what keeps illicit streaming alive.

(Torrents will obviously survive, but at least right now, most people don't know how to use them.)

I think you're oversimplifying the concern people have about google hoarding their data. It's an entirely separate concern from your computer being infected.

Users should absolutely use the latest version of a browser, and it is dangerous on the web, but I'd agree with wfunction that your analogy veers slightly into the hyperbolic.

I'm currently doing work in an office of ~30 people where the IT support company (supposedly accidentally) set up this lovely policy https://i.ytimg.com/vi/rC4FQwYXIok/maxresdefault.jpg which was in place for about a year before I noticed it on a colleague's computer. Pretty terrible security-wise, but no-one's been hit by a car to my knowledge.

This exists and is called Ungoogled Chromium[1]. As you'd expect from the name, it blocks all background communication with Google servers. I use it as my main browser and find it faster and more stable than both standard Chrome and Firefox, YMMV.

1: https://github.com/Eloston/ungoogled-chromium

I've configured Chrome to not send my address bar to Google and to encrypt my sync with a custom passphrase.

What data does Google own?

Have you done any network monitoring to see if Chrome is sending anything back to Google?

No. But I use Chromium so the source code is open.

I mean if we're going to go to this level of paranoid; then we might as well look at attacks on Firefox (which have been suspected to be used by the NSA against Tor Browser).

I'm curious as to why you think checking network connections is paranoia. As a sysadmin, I routinely log and check many of my network connections, though I have not done that for my browser.

No, I meant that suspecting Chrome of covertly sending data to Google (without telling us) is paranoia. Especially since the source code is open.

I would disagree. I'd genuinely be surprised if google made it that easy to not send anything back to them. Additionally, I'd be genuinely surprised if FF made it that simple to avoid sending things back to Mozilla.

It's less about being covert, and more about having multiple settings to send different types of data back.

Have you? So what does it send back?

I think GPs point was the uncertainty, which I think is a valid point either way.

Well, "I haven't bothered to check so for all I know it could be doing tons of bad things" isn't really a valid argument.

it is if your mistrust for google outweighs your time to check these things... maybe in that case you shouldn't say "for sure google is doing bad things" but you can mistrust and not use a product for fear of the company that produces it without current evidence

who is making that argument?

For example, I noticed a while back that the Chrome/Chromium browsers send the dns lookup of every website you visit to Google's own dns servers - even though i have NOT configured them in my OS.

(You can easily check this with an app like Little Snitch, look for the browser connecting to IPs 8.8.8.8 and 8.8.4.4)

Which is why I can't use chrome at work at all. Google's services and DNS are blocked by admins, so when you try to open any site you get DNS_LOOKUP_FAILED error.

i don't think that's correct, because if you block 8.8.8.8 and 8.8.4.4 with the OSX pf firewall, then Chromium will use your OS configured DNS servers and everything still works (i do this.)

Are you certain that Chromium does this too? Because their documentation explicitly contradicts your statement: "This is done using the computer's normal DNS resolution mechanism; no connection to Google is used." Source - https://www.chromium.org/developers/design-documents/dns-pre...

Yes, see comment below... i just checked with Chromium 57.0.2983.0 (64-bit) and it's still doing it.

Interesting. I just ran a check on my own host, and chromium did not do that. Obviously there are a bunch of potential reasons why: Chromium may act differently than chrome, they may only send some dns queries instead of all of them, etc

i just checked with Chromium 57.0.2983.0 (64-bit) and it's still doing it.

I also just noticed that Little Snitch actually does NOT log the dns requests. Maybe this is caused by Chromium using ipv6 to access google-public-dns-a.google.com ?

Anyway, I then installed Vallum (1) and with this app, in the log i see many of these requests: https://i.imgur.com/lUR3Fd7.png

(1) https://vallumfirewall.com/

Interesting. I only checked for ipv4, so that may be it. I'll try again later if I remember. Thanks

I have not because I don't use chrome. Additionally, I have not done this with my browser (ff). I'm just genuinely curious if OP has done that.

There's no reason for FUD. We've always listed all potential data transmission or collection in this regularly updated whitepaper: https://www.google.com/chrome/browser/privacy/whitepaper.htm...

That's an excellent resource but the poster you're replying to simply asked if he'd done a tcpdump, accusing them of spreading FUD isn't necessary.

What did I say that was FUD? I'm legitimately curious if he's checked and seen any data being sent to google

*edit: I'd genuinely be surprised if google made it that easy to not send anything back to them. Additionally, I'd be genuinely surprised if FF made it that simple to avoid sending things back to Mozilla.

> I've configured Chrome to not send my address bar to Google and to encrypt my sync with a custom passphrase.

Remove physical microphone from your computer, Chome will turn it on randomly and send recordings to Google.

[citation needed]

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=786909 this history is long, search on your own for more.

Please don't spread misinformation. Here are the facts:

1. While the Hotword module was downloaded at startup, the feature was not activated without the user explicitly enabling it via the settings menu. <https://crbug.com/500922#c6>

2. Downloading the module in Chromium was a bug, and it was fixed after being reported. <https://crbug.com/50922#30>

3. The Hotword feature was dropped from Chrome not too long after, because it was an experiment that never really panned out (and was enabled by very few people).

Reply on news.ycombinator.com