Hacker News Reader

Comment by y0ghur7_xxx | Hacker News Reader

I tried to look at what chrome sends to google with wireshark, and there are quite a lot of connections made to google servers, but it's all encrypted (ssl). So I actually have no way to know what is sent to google.

Did someone make a detailed analysis of what info gets sent to google on a default install of chrome?

View on HN

I noticed awhile back that even if you disable Chrome's safe browsing feature, Google still sends data to their server. I'm not sure if this is still the case today.

http://superuser.com/questions/236637/how-to-disable-google-...

That should definitely not be happening. If you're seeing this behavior please provide file a bug with full details at the following URL: https://code.google.com/p/chromium/issues/entry?template=Pri...

Yep, this still appears to be the case. It establishes a long-lived SSL connection to one Google's servers few seconds after the start. If the connection is forcefully killed (e.g. with SysInternal's TcpView), it won't be re-established, but needing to kill it every time I need to use Chrome is really annoying.

It is also the reason why I have Chrome updates permanently disabled - I don't trust Chrome enough to let it run anything in a background.

Can you file a bug at http://new.crbug.com/ please? That doesn't sound like the behavior I'd expect.

Sorry, I can't. It wants me to log in with Google ID which I don't and won't have.

Why the hell am I at -1?

Do enlighten me how can I file a bug report against Chrome if I don't have and don't want to create a Google ID.

Ok. Would you mind dropping me an email (mkwst@chromium.org) with details? I'm happy to file the ticket for you.

Well... :) That would require setting up a dummy email account and what not, and that's a bit too much hassle. It'd be far more prudent if you'd remove Google ID requirement in front of the bug repository. I frankly don't understand why it is needed in the first place, at least for browsing the repo that is.

you can browse just fine: http://code.google.com/p/chromium/issues/list

I'm pretty sure all the browser bugtrackers require an account to file a bug.

Can you file a bug at http://new.crbug.com/ please? That doesn't sound like the behavior I'd expect.

The behavior you expect out of Chrome is just simply not what its actual behavior is.

Asa Dotzler from Mozilla corrects some of your misconceptions here: http://news.ycombinator.com/item?id=3034450.

EDIT: Oh, I see you're actually on the Chrome team. I learned the stuff Asa that describes in his comment in your privacy policy. It's pretty easy to understand.

On 2008 we published an article about this using our own hooking tool: http://blog.nektra.com/main/2008/10/15/the-truth-about-googl... don't know what's the state of this stuff on 2011.

This is hooking the application so you don't have issues with sniffing SSL.

This is the tool I use to see SSL traffic:

http://www.tcpcatcher.org/

http://www.tcpcatcher.org/monitoring_SSL.php

It effectively helps you to man-in-the-middle-yourself.

Reply on news.ycombinator.com