 It turns out Google Chrome ships a default, hidden extension that allows code on `*.google.com` access to private APIs, including your current CPU usage You can test it out by pasting the following into your Chrome DevTools console on any Google page: chrome.runtime.sendMessage( More notes here: https://simonwillison.net/2024/Jul/9/hangout_servicesthunkjs/ 164 comments
@djh yeah, I imagine the fingerprinting risk is why they don't expose this functionality to everyone else   @fallenhitokiri Or google could just remove their backdoor. @webology I think a major problem here is that the same API also works in Incognito mode. This would allow Google to fingerprint you even if signed out of your account and track you across incognito sessions. And that's not to mention the fact that the API works even if you're signed out of a Google account so fingerprinting can be performed even without an account.   @simon Reminds me of my blog post about How Firefox gives special permissions to *some* domains. https://frederikbraun.de/special-browser-privileges-for-some-domains.html   That's the reason I mentioned brave, to let them know of the issue so they can take the step to prevent this.   @simon i can confirm this also works in chromium, where it is enabled in Arc Browser @ShadowJonathan @simon I was on google.com. Not signed in, though; maybe it only works if you're signed in to a Google account? The error message is: Uncaught TypeError: Cannot read properties of undefined (reading 'sendMessage') at <anonymous>:1:16 That's from the console I get with from "Inspect" in the context menu, then Console. If I use the hamburger menu More Tools->Developer Tools console, I get: Uncaught TypeError: chrome.runtime.sendMessage is not a function at <anonymous>:1:16 @akkana @ShadowJonathan @simon Funny. I saw the same error, at first. Turns out I had to be literally be on google.com, not a blank tab that shows a google search box. I'm not signed in to anything and it worked. @akkana @ShadowJonathan @simon I haven't updated lately, maybe they snuck it out? @Terci @ShadowJonathan @simon I typed google.com into the urlbar and hit return; the urlbar shows "google.com" but if I copy it it pastes as https://www.google.com/ which seems about as googly as I can get. I'm using chromium from Debian unstable's package; the about box says Version 126.0.6478.126 (Official Build) built on Debian trixie/sid, running on Debian trixie/sid (64-bit) Possibly Debian is doing something that disables this extension?   @simon There's plenty of Google-only or $bigco special-case code in Chromium, unfortunately. IIUC they only implement things like this as last resort. A lot of these predate modern Web APIs that provide access to the same data/functions, others are needed for complex auth stuff (like smartcards or zero-trust auth), others are needed by ChromeOS components for the OS to work. Many hardcoded allowlists are for third-party extensions by big companies for certain code paths.  @AlesandroOrtiz @simon But either itโs ok for general consumption, and then it should be allowed everywhere, or itโs not ok for general consumption, and then it shouldnโt be allowed for Google domains either. Why should Google domains be treated differently when it comes to smartcard access? And why should Google get a pass on updating their code to newer APIs when everyone else is forced to? @simon@fedi.simonwillison.net There's a list of methods you can try here: @simon Hmm, the code doesn't do anything on Cromite (github.com/uazo/cromite), perhaps the extension is removed? Because the error I get is: @simon It's such a 'mundane' thing to have a built-in advantage over your competitors when you're working at Google...๐ค Who gives a fuck about fairness, amirite?   I have no way to test this on desktop. /s Does this misfeature exist on old chrome on Android? I am guessing yes because likely Chrome always had a backdoor. But, maybe not. @simon Microsoft tried to warn us. They told us we'd be scroogled. Now look at us? We've all been scroogled... Ah well. Firefox  @tehstu @jilotta @hopland There is Librewolf for Raspberry Pi, look in Pi-Apps. https://pi-apps.io/  @simon chrome is essentially a massive spy tool for Google to Hoover up all possible information on you.  @simon time to complain to the EU commission about their abuse of monopoly and power such that Google will force them to open access to those APIs to any site.  @simon Not knowing how '*' is implemented, I'm concerned that it might it used on other websites matching `*.google.com`, such as https://my.malevolence.site/.google.com.  @simon That is, of course, if one still has Chrome installed in the first place. Which... no one really should.  @simon For what it's worth, Edge is sufficiently 'Chromed' that it does the same there too ...  @simon Yet another reason why NOBODY SHOULD BE USING THAT MULTICOLOURED PIECE OF SHIT! @jsparknz @simon @Vivaldi I did some testing and found that you can disable it in Vivaldi by turning off the Google Meet support in Vivaldi's Privacy and Security settings. https://notes.kvibber.com/@kelson/statuses/01J2CQHARWXZ957D8RJ2Z4NNRH Mine was already turned off, but I don't know what the default is, since I installed it so long ago and don't remember what settings I changed at the time.    @simon@fedi.simonwillison.net huuuuh. I wonder if Edge has an equivalent for Bing or MS domains?  @simon Iโm old enough to remember when Microsoft got consent decreeโd for this sort of thing. I suppose thatโs a quaint idea these days.  All the more reason to move all Google services under *.google.com instead of dedicated domains like gmail.com, etc EDIT: @thomasp who is a sysadmin at Vivaldi has mentioned that this can be turned off in the Vivadi settings. See https://social.vivaldi.net/@thomasp/112758811705372022 for details. @simon I can confirm this also works on @Vivaldi. Vivaldi staff, is this the best place to report this to hopefully be fixed? Or is there a better place to do so?  @simon Not near a laptop ATM but does this CLI flag disable it --disable-component-extensions-with-background-pages IME you can see most hidden Chrome extensions via chrome://system     @simon I ain't like to speak unless I notice something is missing from a conversation. So let me say, FUCK THIS SHIT, FUCK THIS STUPID SHIT, AND FUCK THE PEOPLE WHO THOUGHT THIS WAS AN OKAY THING TO DO. If you KNOW how to do this, you KNOW why it's important that you don't. Your boss tells you do this shit, ... maybe you see what happens if you let it rot in the backlog a bit ๐  @simon Default extensions are a place where Google has done some real damage to the web, and those of us working on platform have been grumpy for more than a decade that this and the Docs Offline nonsense continues to persist. In both cases, it fell to other teams (not the Hangouts or Docs peeps) to build replacement APIs; e.g.: @mitch You know how we spent years building Service Workers and Background Sync and Periodic Background Sync and fixing storage quotas for large-volume offline data? Um, yeah. About that (latest dev channel, fresh profile): @mitch On by default, works only on Google properties, and "works around" the limits of the web platform *that we put in place to meaningfully safeguard user battery and storage and bandwidth*. At least it's not buried in `chrome://system` like the CPU monitoring extension is, but no less self-preferencing for it. @mitch The tragedy in both instances is that the teams that dropped turds in Chrome have faced no pressure to move to open, interoperable APIs, meaning other browsers (including other Chromium ecosystem browsers) feel forced to include them to make sure that Google's very popular web properties "work right". This also keeps web APIs from advancing because teams that would push them forward already have theirs, Jack. It's not Android levels of bad, but it's bad. @slightlyoff woah. Thanks for sharing. I was aware of the volume size b/c of my runaway cache at work but the rest was news to me.  @slightlyoff @mitch what does this screenshot demonstrate? that docs offline is preinstalled? @slightlyoff @mitch how does it work around web APIs? are you saying it's able to do so because it's preinstalled instead of being a real extension? @hipsterelectron @mitch Yes, it's pre-installed, and it's using Extensions capabilities (superpowers) to do high frequency data sync and other things that should be left to the browser's default heuristics about which sites you use most.   Article says "via chromium" implying it's in base chromium. Does @Vivaldi have this vulnerability as well?   @simon Can't help but wonder if UnGoogled Chromium has this taken care of...๐ค I'd like to hope so, but I can't assume. @BeAware@social.beaware.live @simon@fedi.simonwillison.net @rredball that's the Chrome extension ID, I found that here: https://github.com/chromium/chromium/blob/114ce7cc6f47e4d06bb8a5168e3ed2efd38fc0d6/chrome/browser/resources/hangout_services/manifest_v3.json#L6 @simon I tried to share the above link on my Facebook page and Facebook immediately flagged it as spam and removed it.   @simon from what I've heard on the Xitter, this is mostly used to debug performance issues. What's scummy is that they only enable it on their domain, which comes off as anti-competitive. I imagine they'll get in trouble with the court for this, because it's clearly giving them an unfair advantage. @simon slightly off-topic, but is ChatGPT using imgur to host their pictures? This is what I see when I open your shared conversation @simon I can confirm #Microsoft didn't remove this for #Edge @simon Oh Google, wasn't your motto "Don't be evil"?   @simon I reckon it's used by reCaptcha and possibly Google sign in for detecting automated traffic, particularly as reCaptcha is loaded from google.com. I know lots of bot detection scripts query the chrome.runtime APIs but never understood why. @simon Just to confirm the command line flag does disable this extension e.g. open -a "Google Chrome Canary" --args --disable-component-extensions-with-background-pages One screenshot is with the flag, one as default (Core Web Vitals Visualiser is an extension I installed rather than one that's bundled with Chrome) @simon Huh. Having worked on a product that was in many ways a YouTube competitor, I can say that this would have been modestly useful. This seems relevant: https://www.americanbar.org/content/dam/aba/publications/antitrust/magazine/2023/vol-38-issue-1/antitrust-and-self-preferencing.pdf   @simon is this surprising?
That's pretty much expected from Google. @simon note: as this is at the Chromium level it is also executable on Edge and other chromium based browsers @simon If I disable this in Brave settings it removes the fingerprinting for that profile? The settings language in Brave suggests it might break sharing in other tools like Zoom (web only?) or Teams (web only?). Thanks!  |
Gregory's Server
@simon Interesting! Can this perhaps be used for fingerprinting? ๐