Google Chrome's Alleged Private API for Google Sites

Description

A screenshot of a tweet from developer Luca Casonato (@lcasdev) that makes a serious allegation against Google Chrome. The tweet, posted on July 9, 2024, claims that the Chrome browser provides all '*.google.com' domains with special, privileged access to sensitive system information, including CPU, GPU, and memory usage, detailed processor info, and a 'logging backchannel'. Casonato explicitly states, 'This API is not exposed to other sites - only to *.google.com.' The image captures a viral moment in the tech community, sparking a significant conversation about browser security, user privacy, and potential antitrust behavior. For developers, this raises concerns about the web's level playing field and whether a browser vendor is giving its own services an unfair, hidden advantage

Common Tags

Google BrowserSecurity SecurityVulnerabilities PrivacyConcerns API ApplicationProgrammingInterface WebSecurity

Comments

Anonymous ★ Top Pick It's not a 'logging backchannel,' it's a 'proactive performance telemetry service' that just happens to pipe directly into the ads division's revenue dashboard

Anonymous ★ Top Pick

It's not a 'logging backchannel,' it's a 'proactive performance telemetry service' that just happens to pipe directly into the ads division's revenue dashboard
Anonymous

SOP apparently now stands for 'Special Origin Privilege' - as long as your CNAME resolves to google.com
Anonymous

Ah yes, the classic 'it's not a backdoor, it's a feature' - except this time Google didn't even bother with the pretense. Nothing says 'Don't be evil' quite like giving your own domains the kind of system access that would make a rootkit jealous, while telling everyone else they need to respect the sandbox for 'security reasons.'
Anonymous

Ah yes, the classic 'do as I say, not as I do' approach to web standards. Google Chrome essentially gave itself root access to the browser while everyone else is stuck in userland. It's like being the only developer with production SSH keys because you also happen to own the data center. Nothing says 'open web' quite like a hardcoded whitelist of your own domains getting privileged system APIs. At least when Microsoft did this with IE and ActiveX, they had the decency to make it exploitable by everyone equally
Anonymous

Chrome's genius: Your tabs' CPU confessions go straight to Google, but only if the site's wearing the right domain badge
Anonymous

Chrome’s idea of origin privacy: google.com gets /proc; everyone else gets navigator.hardwareConcurrency and hope
Anonymous

New web primitive: navigator.syscalls() - works when eTLD+1 === 'google.com'; everyone else gets NotAllowedError and a lecture about the open web
@Sp1cyP3pp3r 2y

That's a Firefox propaganda
1. @maximilionus 2y
  
  Except that Mozilla slowly becomes what it "fights" with
  
  @Hollow_Arigo 2y
  
  examples plz
  
  @Infinitelineman 2y
  
  Anonymous advertisement using "anonymous identifier"
  
  @Hollow_Arigo 2y
  
  You mean in thr anonys tabs?
  
  @Infinitelineman 2y
  
  No, i mean literally "mozilla" adsense
  
  @Bitals 2y
  
  They fight privacy violations. So far this ad method was not proven privacy-invasive. WTF are you talking about?
  
  @Infinitelineman 2y
  
  so far
  
  @Bitals 2y
  
  Everything is so far. Innocent until proven guilty, you know? If it will be at some time, I will gladly join you with pitchforks.
  
  @Infinitelineman 2y
  
  you have missed the part with words "slowly becomes"
  
  @Infinitelineman 2y
  
  https://blog.mozilla.org/en/mozilla/mozilla-anonym-raising-the-bar-for-privacy-preserving-digital-advertising/
  
  dev_meme 2y
  
  But you know, they have to pay those bills somehow
  
  @Infinitelineman 2y
  
  (c) CEO i am perfectly fine with buying subscription for this browser, can't find one
  
  @maximilionus 2y
  
  - The latest one was the removal of censorship circumventing extensions regionally from Russia. I do highly believe stuff like this also happens in other places, where actually fighting for freedom may lead you to some undesirable situations with a big fist up your arse. This was resolved with extension access restored, but only because the community started the fire. - Firefox client on every platform is filled with various telemetry features, that only can be disabled with editing values in about:config. Opting out from the main GUI doesn't disable them all. - Mozilla does everything it can, instead of actually improving the browser stability and performance (especially on Android). A good example of that will be the acquisition of Anonym, "privacy preserving" ad tracking company. And guess what? It's already opt-out integrated in 128.0 release. Mozilla points their fingers at any easy target to gain "respect", but completely ignores their own actions.
  
  dev_meme 2y
  
  Now this is a bit better finger pointing
  
  @qtsmolcat 2y
  
  People choose Firefox because at least it's not Google
  
  @maximilionus 2y
  
  Yet they should not consider Mozilla the messiah of internet privacy and freedom. Or this will end up with yet another addition to Alphabet.
  
  @Bitals 2y
  
  When did Mozilla fight adds?
2. @plusdanshi69 2y
  
  Sure, no other browser would do the same
@theodolu 2y

Попался
1. @timopheym 2y
  
  Ага)))
@trainzman 2y

Никогда такого не было и вот опять Literally what this posts text says
@timopheym 2y

Колись админ, куришь?) (с)
@RustyOtter 2y

https://fxtwitter.com/simonw/status/1810731216796324080
1. @Danich 2y
  
  Wait wait wait! Did he just used chatgpt answer as a solid proof?
2. @qtsmolcat 2y
  
  So let me get this straight - people are freaking out because Google has an extension preinstalled to enhance certain first party sites in their own browser and said extension uses a standard API to get CPU info?
  
  @maximilionus 2y
  
  Yes. And this feature has been in the source code for the last ~10 years.
  
  @qtsmolcat 2y
  
  Wait til they hear how Vivaldi and brave implement a lot of their features
  
  @Agent1378 2y
  
  You mean that essentially it all is just JS?
  
  @qtsmolcat 2y
  
  That and a background page. Some UI customization can't be done that way but a lot of other customization they do with extensions
  
  @Agent1378 2y
  
  Knowing that gnome desktop devs use JS as main language for gnome client apps....info that a browser uses JS to render all it "outside the page" interface is less scandalous
  
  @qtsmolcat 2y
  
  Also it's easier to maintain across chromium upgrades
  
  @Agent1378 2y
  
  Yes. So we are going to allow it. Especially for a browser that retained iconic Opera 12 interface and functions
  
  @ZgGPuo8dZef58K6hxxGVj3Z2 2y
  
  Imo it's more about browser fingerprinting which only google is allowed to do, nobody else. And yeah ff has lots of things I dont like like DRM plugin by Google, and other crap I can't remember rn. But who knows how much more hidden gems the 80GB google source code has that benefits only threm...
@Aqualon 2y

there are actually some rather eery permissions that, if i inderstand correctly, are given by default, without asking the user
@ZgGPuo8dZef58K6hxxGVj3Z2 2y

You forgot to mention; its built into chromium, and accidentally edge left the cade in there too.
1. @ZgGPuo8dZef58K6hxxGVj3Z2 2y
  
  POV Microsoft: "let's avoid getting another anti trust lawsuit and help google this time"

Use J and K for navigation

Google Chrome's Alleged Private API for Google Sites

Description

Categories

Common Tags

Comments

More like this

Stolen Gemini API Key Turns $180 Bill into $82,000

Google Pays $68M Because the Thing Was, In Fact, Listening

Talking to the Chatbot Trapped Inside Google Translate