Slashdot Mirror
Chrome Bugs Lets Sites Listen To Your Private Conversations
An anonymous reader writes "Last year Google rolled out a new feature for the desktop version of Chrome that enabled support for voice recognition directly into the browser. In September, a developer named Tal Ater found a bug that would allow a malicious site to record through your microphone even after you'd told it to stop. Quoting: 'When you grant an HTTPS site permission to use your mic, Chrome will remember your choice, and allow the site to start listening in the future, without asking for permission again. This is perfectly fine, as long as Chrome gives you clear indication that you are being listened to, and that the site can't start listening to you in background windows that are hidden to you. When you click the button to start or stop the speech recognition on the site, what you won't notice is that the site may have also opened another hidden popunder window. This window can wait until the main site is closed, and then start listening in without asking for permission. This can be done in a window that you never saw, never interacted with, and probably didn't even know was there.' Ater reported this to Google in September, and they had a fix ready a few days later. But they haven't rolled it out yet — they can't decide whether or not it's the proper way to block this behavior. Thus: the exploit remains. Ater has published the source code for the exploit to encourage Google to fix it."
Chromes Bugs' Lets' Sites' Listens Tos Yours Privates Conversations'
Why in 2014 does any self respecting browser allow pop-ups or pop-unders without explicit permission?
Security issues aside there is almost nothing quite so irritating as a website opening additional windows except in the rare list of exceptions most of us are quite used to manually keeping.
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
Giving microphone access to a complex piece of software that's primarily used to render, interpret and run code fetched from random places on the Internet... what could possibly go wrong?
Assorted stuff I do sometimes: Lemuria.org
I mean, besides the few that were just rolled out? Seriously, it's getting more like IE* every day.
*The bad ol' IE, unlike the rather slow and inept IE of today, which probably still has lots of bugs, too.
A feeling of having made the same mistake before: Deja Foobar
Subcommander Tal, is that you?
Remain calm ....
I'm sure that Oogle Peep View capture / Wi-Fi mapper / porn share finder vans will be by soon to distribute a patch in the background. It would be evil to not patch that, right?
(Don't you love being able to search for your own posts within minutes from .... you know. )
much of left-wing thought is a kind of playing with fire by people who don't even know that fire is hot - George Orwell
This is just another in a long line of baffling (and user hostile) decisions Google has made for Chrome. What made me uninstall Chrome was the decision not to clear session cookies after Chrome exits.
Even if you signed into a website without ticking "remember me" or "log me in automatically", Chrome would happily keep those session cookies so that on restart you find yourself still logged into those websites.
Again in response to the uproar, Google said this was the behaviour they wanted for Chrome and user should manually sign out of each and every website each and every time before closing Chrome.
The built-in camera on my Macbook turns on a hardware light whenever it's being used.
That is an assumption.
Mac's are now shipping with the camera power led on a separate software controlled circuit so its no longer the case that the light must be on for the camera to be on (or vice versa).
Complete failure of secure hardware design. Way to go Apple.
Not to say I like Firefox, but I am currently hating it the least. All the browsers are problematic in my opinion, just in different ways. I used FF for a long time but its Flash issues were just too much, among other things, so I switched to Chrome. Now I'm back on FF. I really like a lot about IE, but it has too many problems rendering a number of websites correctly so it is out.
Nobody can seem to make a good browser, just a less bad one :P.
I wondered why they were pushing Dragon on infomercials like it was going out of style.
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
ie was first with the process per tab thing.
Wealth is the gift that keeps on giving.