Slashdot Mirror
Chrome Bugs Lets Sites Listen To Your Private Conversations
An anonymous reader writes "Last year Google rolled out a new feature for the desktop version of Chrome that enabled support for voice recognition directly into the browser. In September, a developer named Tal Ater found a bug that would allow a malicious site to record through your microphone even after you'd told it to stop. Quoting: 'When you grant an HTTPS site permission to use your mic, Chrome will remember your choice, and allow the site to start listening in the future, without asking for permission again. This is perfectly fine, as long as Chrome gives you clear indication that you are being listened to, and that the site can't start listening to you in background windows that are hidden to you. When you click the button to start or stop the speech recognition on the site, what you won't notice is that the site may have also opened another hidden popunder window. This window can wait until the main site is closed, and then start listening in without asking for permission. This can be done in a window that you never saw, never interacted with, and probably didn't even know was there.' Ater reported this to Google in September, and they had a fix ready a few days later. But they haven't rolled it out yet — they can't decide whether or not it's the proper way to block this behavior. Thus: the exploit remains. Ater has published the source code for the exploit to encourage Google to fix it."
Chromes Bugs' Lets' Sites' Listens Tos Yours Privates Conversations'
Why in 2014 does any self respecting browser allow pop-ups or pop-unders without explicit permission?
Security issues aside there is almost nothing quite so irritating as a website opening additional windows except in the rare list of exceptions most of us are quite used to manually keeping.
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
Giving microphone access to a complex piece of software that's primarily used to render, interpret and run code fetched from random places on the Internet... what could possibly go wrong?
Assorted stuff I do sometimes: Lemuria.org
I mean, besides the few that were just rolled out? Seriously, it's getting more like IE* every day.
*The bad ol' IE, unlike the rather slow and inept IE of today, which probably still has lots of bugs, too.
A feeling of having made the same mistake before: Deja Foobar
It's not a bug; it's a *feature!
*Feature intended only for official government use. Unauthorized users will be penetrated to the full extent of gangrape.
Subcommander Tal, is that you?
Remain calm ....
I'm sure that Oogle Peep View capture / Wi-Fi mapper / porn share finder vans will be by soon to distribute a patch in the background. It would be evil to not patch that, right?
(Don't you love being able to search for your own posts within minutes from .... you know. )
much of left-wing thought is a kind of playing with fire by people who don't even know that fire is hot - George Orwell
So, Windows has voice recognition. There's Nuance too. In Windows, when you are using the feature, there's clear application on the top that shows you that it is listening. It works okay with a bit of training if you need that kind of thing.
This trend by Google to replace more and more features of an desktop OS is really annoying. Notification features in the OS? Nah, just make a really small window in the corner that doesn't go away and just pops up not and then. Of course, the Microsoft voice recognition doesn't send every bit of audio to Google servers to be stored and used for training, so for Google, that's a feature, not a bug.
I wish Google would realize that even if they don't like (or aren't good at) at desktop development on Windows, Mac, Linux isn't a excuse to put everything in Chrome.
No, this one is very definitely a bug.
"They redundantly repeated themselves over and over again incessantly without end ad infinitum" -- ibid.
You grant permission for a website to listen to you.
It opens a new window to the same domain, that window inherits those permissions.
There is more than one way to mitigate this problem
eg:
1) Don't let any window, regardless of user granted permissions listen while its in the background. This is going to break websites when you switch tabs.
2) Don't propagate this permission to child windows. That's going to break websites that popup a window for speech recognition that can persist between page navigations
3) Prompt the user every time recognition is started. That's going to piss the user off every thing they navigate to a new page, they'll need to authorise it again.
4)... use your imagination, there's bound to be many more. All of them will remove legitimate functionality
The built-in camera on my Macbook turns on a hardware light whenever it's being used. Makes it pretty hard to not realize you are potentially being seen. All OSs should display an indicator on the top layer of the display, and enlarge/flash it in a pretty unmissable way every 5 minutes, whenever your camera OR microphone is active. Failure of an OS to do so should be labeled as what it is, a security hazard.
The article isn't clear, but my first thought is that this should be simple to deal with by just revoking permission for a site to use the mic. Except that when I check in Chrome, there's no way to enable this at all. The only references involve adding the Chrome Voice Control extension, which isn't included in Chrome by default. So while this is a problem, it doesn't seem to be one that can't be easily solved. If you're truly worried about it, don't install the extension or remove it if you've got it installed. If you want the extension, be careful of which sites you grant permission to and go and manually revoke permission when you're done. You ought to be reviewing permissions regularly anyway, not just for this but for anything you're granting extra permissions for.
This is just another in a long line of baffling (and user hostile) decisions Google has made for Chrome. What made me uninstall Chrome was the decision not to clear session cookies after Chrome exits.
Even if you signed into a website without ticking "remember me" or "log me in automatically", Chrome would happily keep those session cookies so that on restart you find yourself still logged into those websites.
Again in response to the uproar, Google said this was the behaviour they wanted for Chrome and user should manually sign out of each and every website each and every time before closing Chrome.
It actually is a feature... The user explicitly gave the malicious website permission to use the mic until they explicitly revoke that permission. The problem is the malicious website didn't stop using them the user did something they thought would stop it, without revoking the permission.
No. Shit. Really?
Chrome recently added a speaker icon to indicate which tabs are playing sound. Why not add a corresponding microphone icon to indicate which (if any) tabs are recording it? Since this would be implemented in the browser, it shouldn't be possible for sites to bypass it.
I would consider using it if it had more plugin support and if website makers still didn't feed IE 6 specific jscript code to it. IE 11 fixed this by ignoring jscript and only supporting ECMA compliant javascript. This broke corporate apps of course reliant on ancient IE behavior.
Slashdot thanks it with a headline "IE BREAKS MORE SITES AGAIN" and the crowd hounds it for non standard behavior LOL. Even though making it act like Chrome and Firefox is what caused this.
But you can get adblock plus for it now and it scores fairly well in HTML 5 compliance tests with up to 90% of Firefox's features. It has the lowest cpu utilization and like Chrome is secure with low-rights and sandboxing which Firefox still frustratingly lacks.
But man like your post says MS created a lot of badwill from first forcing IE 6 on every computer back in the day agaisn't Netscape (another shitty browser too which was not W3C compliant), and MS let IE 6 rot for years and years and years to the point where our places of work were stuck with it for years longer.
If you put a gun to my head and forced me to use it for hte rest of my life I certainly could at this point without wanting to risk taking the bullet instead. :-)
http://saveie6.com/
"open"
People should really expect this and disconnect everything when they're done.
All my monitors since the 90's have had a WebCam built in but I didn't buy any for that reason, and have always disabled the webcam by not supplying a USB cable for it's use. Only once have I ever used one and just for a few hours.
I have a Mic pluged in now for the POS BF4, and assume I can be heard at anytime. It's not Googles fault or Windows but Flash. I always have disabled flash's Webcam and Mic. Used to be it would reset after every update, then kept the settings, now there's list of prefered (by adobe) sites that I can block but I'd rather delete them - Flash hangs if I try even one.
Found a file GTBcheck.exe (GoogleToolBar) it's from updating Flash and it trying to install Chrome as well - awhile ago.
Not to say I like Firefox, but I am currently hating it the least. All the browsers are problematic in my opinion, just in different ways. I used FF for a long time but its Flash issues were just too much, among other things, so I switched to Chrome. Now I'm back on FF. I really like a lot about IE, but it has too many problems rendering a number of websites correctly so it is out.
Nobody can seem to make a good browser, just a less bad one :P.
Giving microphone access to a complex piece of software that's primarily used to render, interpret and run code fetched from random places on the Internet... what could possibly go wrong?
The world wide web and web browser has been a two-way means of communication for quite some years now.
That is all.
"If any question why we died, Tell them because our fathers lied."
It's completely legit, after all you read the TOS and clicked agree right?
"If any question why we died, Tell them because our fathers lied."
ie was first with the process per tab thing.
Wealth is the gift that keeps on giving.
Why don't laptops have a physical shutter so the user can block both camera and mic? I don't like these hackable electronic switches for mic and camera. And I have to wonder whether not having a physical shutter is a feature or a bug?
Mine does, its an Asus EEE 1215B netbook, but from what I've seen most of the Asus laptops have it as well. Its nice to be able to just look up and know with 100% certainty that the camera isn't doing squat, so maybe you should look at whether the camera has a shutter before you purchase?
ACs don't waste your time replying, your posts are never seen by me.
> Google dismisses eavesdropping threat in Chrome feature
> Google said there's no threat from a speech recognition feature in its Chrome browser that a developer said could be used to listen in on users.
http://www.techworld.com.au/article/536592/google_dismisses_eavesdropping_threat_chrome_feature/