Slashdot Mirror
Chrome Bugs Lets Sites Listen To Your Private Conversations
An anonymous reader writes "Last year Google rolled out a new feature for the desktop version of Chrome that enabled support for voice recognition directly into the browser. In September, a developer named Tal Ater found a bug that would allow a malicious site to record through your microphone even after you'd told it to stop. Quoting: 'When you grant an HTTPS site permission to use your mic, Chrome will remember your choice, and allow the site to start listening in the future, without asking for permission again. This is perfectly fine, as long as Chrome gives you clear indication that you are being listened to, and that the site can't start listening to you in background windows that are hidden to you. When you click the button to start or stop the speech recognition on the site, what you won't notice is that the site may have also opened another hidden popunder window. This window can wait until the main site is closed, and then start listening in without asking for permission. This can be done in a window that you never saw, never interacted with, and probably didn't even know was there.' Ater reported this to Google in September, and they had a fix ready a few days later. But they haven't rolled it out yet — they can't decide whether or not it's the proper way to block this behavior. Thus: the exploit remains. Ater has published the source code for the exploit to encourage Google to fix it."
Chromes Bugs' Lets' Sites' Listens Tos Yours Privates Conversations'
Why in 2014 does any self respecting browser allow pop-ups or pop-unders without explicit permission?
Security issues aside there is almost nothing quite so irritating as a website opening additional windows except in the rare list of exceptions most of us are quite used to manually keeping.
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
I noticed it. Because I'm not an idiot and don't use a stupid OS that hides details like that from me.
Sucks if you are, though.
I herd u liked bugs...
Giving microphone access to a complex piece of software that's primarily used to render, interpret and run code fetched from random places on the Internet... what could possibly go wrong?
Assorted stuff I do sometimes: Lemuria.org
I mean, besides the few that were just rolled out? Seriously, it's getting more like IE* every day.
*The bad ol' IE, unlike the rather slow and inept IE of today, which probably still has lots of bugs, too.
A feeling of having made the same mistake before: Deja Foobar
What no javascript, video playback, screen sharing, VoIP, WebRTC or RTCWeb(How FUCKING STUPID!), PDF rendering, Dart app execution?
What luddite only looks at HTML?
Subcommander Tal, is that you?
Remain calm ....
I'm sure that Oogle Peep View capture / Wi-Fi mapper / porn share finder vans will be by soon to distribute a patch in the background. It would be evil to not patch that, right?
(Don't you love being able to search for your own posts within minutes from .... you know. )
much of left-wing thought is a kind of playing with fire by people who don't even know that fire is hot - George Orwell
i really don't understand why people like chrome. yeah, it's fast and was the first browser to run each tab in it's own process/thread and do sandboxing...but they all do that now. chrome's interface, from the visual aspects to the incessant 'do it the google way' sends me into blind rage. firefox rules!
So, Windows has voice recognition. There's Nuance too. In Windows, when you are using the feature, there's clear application on the top that shows you that it is listening. It works okay with a bit of training if you need that kind of thing.
This trend by Google to replace more and more features of an desktop OS is really annoying. Notification features in the OS? Nah, just make a really small window in the corner that doesn't go away and just pops up not and then. Of course, the Microsoft voice recognition doesn't send every bit of audio to Google servers to be stored and used for training, so for Google, that's a feature, not a bug.
I wish Google would realize that even if they don't like (or aren't good at) at desktop development on Windows, Mac, Linux isn't a excuse to put everything in Chrome.
You grant permission for a website to listen to you.
It opens a new window to the same domain, that window inherits those permissions.
There is more than one way to mitigate this problem
eg:
1) Don't let any window, regardless of user granted permissions listen while its in the background. This is going to break websites when you switch tabs.
2) Don't propagate this permission to child windows. That's going to break websites that popup a window for speech recognition that can persist between page navigations
3) Prompt the user every time recognition is started. That's going to piss the user off every thing they navigate to a new page, they'll need to authorise it again.
4)... use your imagination, there's bound to be many more. All of them will remove legitimate functionality
The built-in camera on my Macbook turns on a hardware light whenever it's being used. Makes it pretty hard to not realize you are potentially being seen. All OSs should display an indicator on the top layer of the display, and enlarge/flash it in a pretty unmissable way every 5 minutes, whenever your camera OR microphone is active. Failure of an OS to do so should be labeled as what it is, a security hazard.
Puleeeze. Google's entire business model revolves around collecting information about people through pseudo-legit spying. This is clearly a deliberate feature that someone was expected to use. Google's just covering it's ass.
The article isn't clear, but my first thought is that this should be simple to deal with by just revoking permission for a site to use the mic. Except that when I check in Chrome, there's no way to enable this at all. The only references involve adding the Chrome Voice Control extension, which isn't included in Chrome by default. So while this is a problem, it doesn't seem to be one that can't be easily solved. If you're truly worried about it, don't install the extension or remove it if you've got it installed. If you want the extension, be careful of which sites you grant permission to and go and manually revoke permission when you're done. You ought to be reviewing permissions regularly anyway, not just for this but for anything you're granting extra permissions for.
This is just another in a long line of baffling (and user hostile) decisions Google has made for Chrome. What made me uninstall Chrome was the decision not to clear session cookies after Chrome exits.
Even if you signed into a website without ticking "remember me" or "log me in automatically", Chrome would happily keep those session cookies so that on restart you find yourself still logged into those websites.
Again in response to the uproar, Google said this was the behaviour they wanted for Chrome and user should manually sign out of each and every website each and every time before closing Chrome.
Chrome recently added a speaker icon to indicate which tabs are playing sound. Why not add a corresponding microphone icon to indicate which (if any) tabs are recording it? Since this would be implemented in the browser, it shouldn't be possible for sites to bypass it.
I would consider using it if it had more plugin support and if website makers still didn't feed IE 6 specific jscript code to it. IE 11 fixed this by ignoring jscript and only supporting ECMA compliant javascript. This broke corporate apps of course reliant on ancient IE behavior.
Slashdot thanks it with a headline "IE BREAKS MORE SITES AGAIN" and the crowd hounds it for non standard behavior LOL. Even though making it act like Chrome and Firefox is what caused this.
But you can get adblock plus for it now and it scores fairly well in HTML 5 compliance tests with up to 90% of Firefox's features. It has the lowest cpu utilization and like Chrome is secure with low-rights and sandboxing which Firefox still frustratingly lacks.
But man like your post says MS created a lot of badwill from first forcing IE 6 on every computer back in the day agaisn't Netscape (another shitty browser too which was not W3C compliant), and MS let IE 6 rot for years and years and years to the point where our places of work were stuck with it for years longer.
If you put a gun to my head and forced me to use it for hte rest of my life I certainly could at this point without wanting to risk taking the bullet instead. :-)
http://saveie6.com/
it must be a featue and not a bug if they have the "fix" but don't put it in. remember if you don't pay for a commercial product (be it chrome gmail or facebook) you are the product, for sale to advertisers and whoever else want to pony up for the data
"open"
If you think a website is controlled by your enemies or the government or someone who benefits from listening to you, don't give the website permission to your microphone in the first place. Then you're safe from this exploit, since the exploit only works with sites you've already expressly approved.
This space intentionally left blank
People should really expect this and disconnect everything when they're done.
All my monitors since the 90's have had a WebCam built in but I didn't buy any for that reason, and have always disabled the webcam by not supplying a USB cable for it's use. Only once have I ever used one and just for a few hours.
I have a Mic pluged in now for the POS BF4, and assume I can be heard at anytime. It's not Googles fault or Windows but Flash. I always have disabled flash's Webcam and Mic. Used to be it would reset after every update, then kept the settings, now there's list of prefered (by adobe) sites that I can block but I'd rather delete them - Flash hangs if I try even one.
Found a file GTBcheck.exe (GoogleToolBar) it's from updating Flash and it trying to install Chrome as well - awhile ago.
Not to say I like Firefox, but I am currently hating it the least. All the browsers are problematic in my opinion, just in different ways. I used FF for a long time but its Flash issues were just too much, among other things, so I switched to Chrome. Now I'm back on FF. I really like a lot about IE, but it has too many problems rendering a number of websites correctly so it is out.
Nobody can seem to make a good browser, just a less bad one :P.
Giving microphone access to a complex piece of software that's primarily used to render, interpret and run code fetched from random places on the Internet... what could possibly go wrong?
The world wide web and web browser has been a two-way means of communication for quite some years now.
That is all.
"If any question why we died, Tell them because our fathers lied."
This is why I disabled the Google update service in system services after Chome 31, disabled the onboard microphone, and use an external mic with a manual shutoff switch.
is to have two led's - one lights up when the camera is on, the other when the microphone is on. They should be hardwired, not subject to software control.
Promised so much, but each release is bigger and bloatier. It takes a ridiculous amount of memory each page. Given the overhead, the whole idea of isolating pages to protect against crashes is a dumb idea (why not write browser code that doesn't crash instead?) and what point is all this since the plugins can serve you ads, with the blessings of Google. Buggy and slow, why would you bother? I went back to Firefox long ago.
It's supposed to clearly indicate whenever it's listening, which it is not. It's definitely a bug and the Chrome developers have acknowledged this after more than 4 months of silently ignoring it. (For them, the story is probably very annoying, because now they have to introduce a new bug equivalent to the previous one.)
In soviet Russia, something something you!
believe me
> Google dismisses eavesdropping threat in Chrome feature
> Google said there's no threat from a speech recognition feature in its Chrome browser that a developer said could be used to listen in on users.
http://www.techworld.com.au/article/536592/google_dismisses_eavesdropping_threat_chrome_feature/
This is actually the reason that Chrome tries to render numerous tabs in a single process, instead of in isolation from each other. Scripting in Chrome cannot currently be secured. The relevant documentation all but explicitly states Chrome was designed this way to help Google's AJAX communicate with itself. It apparently was never considered that there are sites less trustworthy than Google which could exploit security holes like this exactly as described by Ater.
Go to: chrome://settings/content
Scroll down to Media and select:
"Do not allow sites to access my camera and microphone"
Click Done and close all Chrome windows.
While you cannot use the voice recognition in Chrome till you change it back, this will light a fire under Google if people quit using the feature.
I could use this on a few people