There have been multiple accounts created with the sole purpose of posting advertisement posts or replies containing unsolicited advertising.

Accounts which solely post advertisements, or persistently post them may be terminated.

fedi.simonwillison.net

boonhet , to technology in Google Chrome ships a default, hidden extension that allows code on *.google.com access to private APIs, including your current CPU usage

Chrome cryptominer when

Pechente ,

Probably already installed. That would at least explain the high resource usage of chrome

AlexWIWA ,

I’m willing to be we’ll see something to train language models on the user’s hardware soon enough. Folding at home, but instead of helping science, Google steals your electricity.

vvv ,

I really think that’s the secret end game behind all the AI stuff in both Windows and MacOS. MS account required to use it. (anyone know if you need to be signed in to apple ID for apple ai?) “on device” inference that sometimes will reach out to the cloud. when it feels like it. maybe sometimes the cloud will reach out to you and ask your cpu to help out with training.

that, and better local content analysis. “no we aren’t sending everything the microphone picks up to our servers, of course not. just the transcript that your local stt model made of it, you won’t even notice the bandwidth!)”

zqwzzle ,

The shitty reboot of Office Space where some low level Google employee realizes they can stick a crypto miner in every browser and generate a couple cents from everyone’s browser.

Tolookah ,

G Suite Space?

nyan , to technology in Google Chrome ships a default, hidden extension that allows code on *.google.com access to private APIs, including your current CPU usage

Would everyone who is surprised by this please raise your hand? . . . That’s what I thought.

gofsckyourself ,

I am

homesweethomeMrL ,

License and registration, sir

11111one11111 ,

Really? That’s not what the data from your api says /s

littlewonder ,

Keep your hand raised because I’m coming in for a perfectly-landed high-five!

moriquende ,

perfectly-landed never happened before, and never will

gjoel ,

You don’t need to actually write it, just raise your hand and we have registered your vote, either via your computer’s camera, Google Nest, Google Assistant or inferred it by analysing the WiFi data returned by your Google Mesh network.

victorz ,

Not surprised, but still disappointed.

kakes , to technology in Google Chrome ships a default, hidden extension that allows code on *.google.com access to private APIs, including your current CPU usage

It baffles me that they sell Chrome as private and/or secure, and baffles me even more that people believe them.

sudo ,

It baffles me people use chrome.

SorryQuick ,

Why? There was a time when chrome was significantly better, and most people hate change.

kava ,

I remember back in the day everyone used Firefox. Then Chrome came out and there was a nice ad campaign and it was actually way faster.

Then slowly everyone switched to Chrome. At some point in the last 15 years, it switched to Firefox being superior.

I switched back to Firefox maybe like 7~ years ago? But I did it for open source reasons.

Andromxda OP , to technology in Google Chrome ships a default, hidden extension that allows code on *.google.com access to private APIs, including your current CPU usage
@Andromxda@lemmy.dbzer0.com avatar

Yet another reason to switch to Firefox, or even better, a hardened fork like LibreWolf !librewolf

sigmaklimgrindset ,

What functionality would I lose/gain if I switch from Firefox to Librewolf? I’m admittedly an amateur in the privacy space, and I’ve been pretty content with Firefox + Ublock and container tabs for different profiles, but I consistently get the issue that my browser fingerprint is pretty unique, and I have no idea how to or even if I can anonymize that anymore.

calamitycastle ,

Yes, why to do this?

Imgonnatrythis ,

Librewolf is not associated with Mozilla and does not receive their primary source of funding from Google like Mozilla does. I really like having the same browser and browser synchronization between my phone and desktop/laptop, so librewolf is out for me. They have no interest or resources to build an Android version. Waterfox does at least have desktop / android option and takes things at least one small step further away from Google.

sigmaklimgrindset ,

Thanks for the answer! I run Windows, iOS and Linux across multiple devices, and sync is definitely needed for me as well. I’ll look into Waterfox!

Andromxda OP ,
@Andromxda@lemmy.dbzer0.com avatar

The previous answer is misleading and partially just wrong. Firefox Sync works just fine in LibreWolf, you just need to enable it in the settings. I currently sync my LibreWolf browser on my Linux desktop to Firefox on iOS and Mull on Android, no issues whatsoever. The only Mozilla services that LibreWolf intentionally removes are their telemetry and Pocket.

muntedcrocodile ,
@muntedcrocodile@lemm.ee avatar

U can sync regular mobile ff and librewolf. Thats what i currently have.

Andromxda OP ,
@Andromxda@lemmy.dbzer0.com avatar

It is the same browser. LibreWolf doesn’t change much of the Firefox code, mostly just the configuration. They enable various privacy/security settings by default and remove Mozilla telemetry. You can go to the LibreWolf settings and enable Firefox Sync, and it will work just fine with your Mozilla account and other Firefox browsers.

For Android, I like to use Mull, it’s a hardened build of Firefox, similar to LibreWolf.

pathief ,
@pathief@lemmy.world avatar

You can enable Firefox sync in Librewolf, it works fine.

Danitos ,

Tangent note: I think browser fingerprinting is only a source of concern if you use VPN. Otherwise, your IP is already a good enough identifier, and quite likely doesn’t rotate often enough. Please someone correct me if I’m wrong.

kava ,

Yeah I’d only worry about it if I were trying to buy drugs on the dark net or something. I guess if torrenting became illegal I would also worry.

skybox ,

Became? 🤔

mondoman712 ,

Different places have different laws

Mongostein ,

Torrenting itself is not illegal. The distribution of copyrighted material that you don’t own is the illegal part of

kava ,

It’s sort of legally gray but generally speaking in the US downloading is a civil offense but not a criminal one. You can get sued by the copyright holder for example but you won’t end up in jail over it.

People usually never get sued for it because it’s not worth it for Comcast to pay for lawyers to try and extract any money out of regular people. Not only will they almost certainly be unable to even recoup the lawyer fees, they risk getting a lot of bad PR for no gain.

What’s usually considered an arrestable offense is uploading aka distribution. Once you start hosting seedboxes then you enter the area where you’re liable to go to prison.

Danitos ,

No. If you don’t want to be tracked and you are using a VPN, fingerprinting is a problem as well. Privacy is not concern just for drug dealers.

brbposting ,
kava ,

I appreciate the list. I’m not saying there aren’t valid concerns, just that in my day to day life it’s one of those items where the steps needed to avoid browser fingerprinting is usually more work than the value I personally get from my perspective.

I’ve looked into this, and I’m not clueless. I’ve developed websites, I’ve done a lot of stuff with Selenium / Puppeteer, and have toyed with Firefox browser extensions.

I understand the tools they use and it’s just very tricky to fully eliminate this type of thing. For example they can even use the browser window size. Are you going to randomly change window size to some novel dimension when you open up a tab?

What about the JS engine you use. For example using Firefox already narrows down your anonymity by like 95% or something because only a small amount of users use the browser. Etc etc

It’s hard to do this correctly, and I feel like VPN + private window usually takes care of the price fixing thing on the list, for example. When I’m searching for flights I usually do this.

I also use JS blockers in order to try and mess up the scripts that Facebook & Google have hidden over the internet to track you. But ironically, doing that again reduces your anonymity. They know that if their scripts don’t work on you, you get narrowed down again to a very small % of users.

It only takes a few of those pieces of data to be reasonably sure that it’s you. Browser fingerprinting is tricky to really avoid. It’s not impossible, of course. Just saying to really do it right it might be more effort than it’s worth.

brbposting ,

The depth of fingerprinting really bothers me and I have accepted that the best at it will succeed.

It is tempting to find the world’s most popular default configuration and use that :) But that’s prob be something gross like Windows 10 & Chrome! In fact, that’d be second after Android & Chrome. Wonder how detectable VMing/emulating those configurations would be.

Agree with you and appreciate the detailed response!

Mkengine ,

Switching from Firefox to Librewolf has some pros and cons. Librewolf is a fork of Firefox focused on privacy and security, with telemetry stripped out and privacy settings maxed out by default. You’ll gain better out-of-the-box privacy protections, meaning less tracking and data collection without having to tweak settings yourself.

However, you might lose some convenience. Librewolf might not support certain Firefox features like Sync, since it relies on Mozilla’s servers (not sure about that point, maybe it does work). It can also break some websites due to the stricter privacy settings. Another thing to consider is that you won’t get updates as quickly as Firefox.

Regarding browser fingerprinting, it’s a tricky beast. Librewolf can help somewhat by making your fingerprint less unique, but it’s not a silver bullet. Tools like uBlock Origin and container tabs are great, but adding something like the CanvasBlocker extension can also help reduce fingerprinting. Ultimately, no setup is perfect, but Librewolf is a solid step towards better privacy.

JackbyDev ,

I don’t really care too too much about privacy. If they get rid of the Pocket button then I’d be happy enough.

masterofn001 ,

About:config

Extensions.pocket.enabled false

JackbyDev ,
octopus_ink ,

May I please steal this for future use?

JackbyDev ,

I stole it too lol

pathief ,
@pathief@lemmy.world avatar

Firefox sync is disabled by default but you can enable it in the settings.

PetroGuy ,

if it’s fingerprinting you care about, i’d give mullvad browser a try. it’s a firefox fork tailored to increase privacy and blend you into the crowd (as long as you don’t change any setting/install addons). it’s very very neat.

TheGrandNagus ,

Mostly it’s just FF but with more private defaults (that you can change in the settings trivially anyway), although there are one or two extras.

There is a potential issue, though. Librewolf runs behind, so security vulnerabilities, particularly for zero-day exploits, take longer to be patched.

Gloria , to technology in Google Chrome ships a default, hidden extension that allows code on *.google.com access to private APIs, including your current CPU usage
Andromxda OP ,
@Andromxda@lemmy.dbzer0.com avatar
victorz ,

Here, you forgot this: ``

mrvictory1 , to technology in Google Chrome ships a default, hidden extension that allows code on *.google.com access to private APIs, including your current CPU usage

Google Meet can show CPU usage, they aten’t trying to hide this.

faltryka , to technology in Google Chrome ships a default, hidden extension that allows code on *.google.com access to private APIs, including your current CPU usage

Is this for malicious harvesting or is this part of their chrome device trust product for enterprises?

homesweethomeMrL ,

WINK

Andromxda OP ,
@Andromxda@lemmy.dbzer0.com avatar

No, as far as I know this has nothing to do with attestation/verification for enterprise users.

empireOfLove2 , to technology in Google Chrome ships a default, hidden extension that allows code on *.google.com access to private APIs, including your current CPU usage
@empireOfLove2@lemmy.dbzer0.com avatar

Hmmm, no way this could ever turn into a security hole, I’m sure of it.

_sideffect , to technology in Google Chrome ships a default, hidden extension that allows code on *.google.com access to private APIs, including your current CPU usage

Why do people still use Chrome?

Please uninstall it from everyone’s home pc and phone that you come into contact with

Tja ,

Because it’s fast and works well enough to keep the fame acquired over the last 10 years.

4am ,

Slower than Firefox

Tja ,

I use both for my job and my subjective feeling is that chrome is faster. Js benchmarks seems to confirm it. Privately I use Firefox 95% of the time but I understand people who stay on chrome just out of inertia.

victorz ,

I’m a Firefox user on desktop and mobile, and I definitely feel like Chrome is faster on both platforms when I (have to) use it. But I prefer Firefox for the ideology and dev tools (on desktop), since I’m a web developer by trade, so the dev tools make a big difference for me.

IronKrill ,

There was a short period a few years ago after the Quantum update that I would have partially agreed, because Firefox’s renderer was much smoother. But Chrome seems to have caught up, because it’s been much faster every time I test something in it in the yesrs since.

_sideffect ,

At the cost of zero privacy, data being stolen and other fundamental issues and morals that Google lacks.

IronKrill ,

Which is invisible to users, meaning they can ignore it or handwave it with “I haven’t got anything to hide”.

RobotZap10000 ,

Or worse, “They already know everything about me, so why bother?”. One of my relatives says this. Kill me now.

cubism_pitta , to technology in Google Chrome ships a default, hidden extension that allows code on *.google.com access to private APIs, including your current CPU usage

Google does a lot of standards breaking things.

Like allowing a link on Google Apps Marketplace to open a new window (like popup) with POST instead of GET. (This pretty much ensures that buying an app will fail for browsers that follow the spec)

victorz ,

This garbage behavior is in Chromium as well?

abbadon420 , to technology in Google Chrome ships a default, hidden extension that allows code on *.google.com access to private APIs, including your current CPU usage

Here’s the plan. You write an extension for chrome that makes chrome think all traffic from [cryptominingcentral.com] is actually from *.google.com. Make folks install the plugin via the tried and tested methods like phishing. … profit

authorinthedark ,

couldn’t you do that anyway if you can get people to install an extension? taking advantage of this for crypto mining purposes feels like extra steps

Hirom , to technology in Google Chrome ships a default, hidden extension that allows code on *.google.com access to private APIs, including your current CPU usage

Cannot reproduce on chromium. Has anyone reproduced it?

BlueEther ,
@BlueEther@no.lastname.nz avatar

yeah:


<span style="color:#323232;">{
</span><span style="color:#323232;">  "value": {
</span><span style="color:#323232;">    "archName": "arm64",
</span><span style="color:#323232;">    "features": [],
</span><span style="color:#323232;">    "modelName": "Apple M2",
</span><span style="color:#323232;">    "numOfProcessors": 8,
</span><span style="color:#323232;">    "processors": [
</span><span style="color:#323232;">      {
</span><span style="color:#323232;">        "usage": {
</span><span style="color:#323232;">          "idle": 10841460,
</span><span style="color:#323232;">          "kernel": 611796,
</span><span style="color:#323232;">          "total": 13342920,
</span><span style="color:#323232;">          "user": 1889664
</span><span style="color:#323232;">        }
</span><span style="color:#323232;">      },...
</span>
Andromxda OP ,
@Andromxda@lemmy.dbzer0.com avatar

Did you use normal chromium or Ungoogled Chromium? I tried it on the Arc Browser (which is based on Chromium), and it worked, but it didn’t work on Ungoogled Chromium.

Hirom ,

Neither. I use a chromium package from my linux distribution.

It has many patches on top of the upstream chromium. That probably explain why that unwanted feature isn’t there.

This issue appear on Google Chrome for Windows on my other machine. Just uninstalled it, never used it anyway.

jherazob ,
@jherazob@beehaw.org avatar

Reproduced here, Chromium on Linux Mint desktop. You need to have open a Google.com site for it to work though.

hendrik , to technology in Google Chrome ships a default, hidden extension that allows code on *.google.com access to private APIs, including your current CPU usage

LibreWolf, Mull, Chromium, ...

wanderingmagus ,

It’s apparently built into chromium

hendrik , (edited )

executing that command from the post returns the following on my Chromium:

VM68:1 Uncaught TypeError: Cannot read properties of undefined (reading 'sendMessage')
    at [HTML_REMOVED]:1:16
(anonymous) @ VM68:1

wanderingmagus ,

It turns out Google Chrome (via Chromium) includes a default extension which makes extra services available to code running on the *.google.com domains - tweeted about today by Luca Casonato, but the code has been there in the public repo since October 2013 as far as I can tell.

It looks like it’s a way to let Google Hangouts (or presumably its modern predecessors) get additional information from the browser, including the current load on the user’s CPU. Update: On Hacker News a Googler confirms that the Google Meet “troubleshooting” feature uses this to review CPU utilization

The code doesn’t do anything on non-Google domains.

Maybe it’s because you tried it on a non Google site? Idk.

hendrik ,

Hehe, I read that sentence, tried it on google.com

But forget what I said. I have the ungoogled variant of Chromium installed. No wonder that's not in there...

Imgonnatrythis , to technology in Google Chrome ships a default, hidden extension that allows code on *.google.com access to private APIs, including your current CPU usage

Ianal, but this sounds like something worthy of suing their ass over. There’s not much Google would respond to and good luck beating their lawyers, but the only language they speak is $, so please try to take as much as possible away from them for this garbage.

crazyminner , to technology in Google Chrome ships a default, hidden extension that allows code on *.google.com access to private APIs, including your current CPU usage

Suprise Suprise!

  • All
  • Subscribed
  • Moderated
  • Favorites
  • random
  • lifeLocal
  • goranko
  • All magazines