Chrome Bugs Lets Sites Listen To Your Private Conversations 109
An anonymous reader writes "Last year Google rolled out a new feature for the desktop version of Chrome that enabled support for voice recognition directly into the browser. In September, a developer named Tal Ater found a bug that would allow a malicious site to record through your microphone even after you'd told it to stop. Quoting: 'When you grant an HTTPS site permission to use your mic, Chrome will remember your choice, and allow the site to start listening in the future, without asking for permission again. This is perfectly fine, as long as Chrome gives you clear indication that you are being listened to, and that the site can't start listening to you in background windows that are hidden to you. When you click the button to start or stop the speech recognition on the site, what you won't notice is that the site may have also opened another hidden popunder window. This window can wait until the main site is closed, and then start listening in without asking for permission. This can be done in a window that you never saw, never interacted with, and probably didn't even know was there.' Ater reported this to Google in September, and they had a fix ready a few days later. But they haven't rolled it out yet — they can't decide whether or not it's the proper way to block this behavior. Thus: the exploit remains. Ater has published the source code for the exploit to encourage Google to fix it."
Fixeds thats (Score:5, Funny)
Re: (Score:2)
Linguo dead? [ytmnd.com]
Re: (Score:2)
Toki Wartooth http://en.wikipedia.org/wiki/Toki_Wartooth#Toki_Wartooth/ [wikipedia.org]
Re: (Score:1)
das dildos,...
2014 (Score:5, Insightful)
Why in 2014 does any self respecting browser allow pop-ups or pop-unders without explicit permission?
Security issues aside there is almost nothing quite so irritating as a website opening additional windows except in the rare list of exceptions most of us are quite used to manually keeping.
Re: (Score:2)
That said, uninstalling Chrome Browser and returning to firefox has been a great release.
Re: (Score:3)
They do something. They click on the page.
Popups are allowed from a valid onclick event so the ads put a onclick event on the entire page.
Re:2014 (Score:4, Interesting)
They do something. They click on the page.
Popups are allowed from a valid onclick event so the ads put a onclick event on the entire page.
Not the whole story. Internet Explorer, that ol' browser none of us use when idle, is pretty aggressive blocking even onclick.
It makes little sense that it's a default setting, and I can't recall.
My first sense that browsers were in bed with the bad guys was 10+ years ago. I found some alt browser that expressly allowed me to block annoying behaviors:
* scripted window movement and resizing
* status bar text changes (crudely obfuscating hover text when you want to see where you'll land)
* hide the menu bar, navigation bar and url so as to give a small HTML window popup (so you can't tell what url it loaded, how to turn back without keyboard [obscure to Joe Sixpack], and what domains to ban)
All three of those may have had true uses before web 2.0 during your banking or e-commerce session. But today, css and floating divs can be used to blur the window selectively as to highlight the necessary context. They are vestiges that are not needed by legit sites, and yet are overused by sneaky sites. Browsers phased out blink tags, http + https iframe mix, urlbar javascript execution and other stuff, but don't get rid of pop unders, even as an option somewhere? intentional
Re: (Score:2)
Re: (Score:1)
that your tablet browser doesn't support middle click or right click elegantly, is your tablet browser's bug. website designers should not be expected to cater to every stupid tablet limitation.
Re: 2014 (Score:2)
Technically, target="_blank" is deprecated as-of HTML 5.
Re: (Score:2)
The alt browser with the restriction options I mentioned was either iCab or Opera, btw.
-vlueboy
Re: (Score:2)
I found some alt browser that expressly allowed me to block annoying behaviors:
* scripted window movement and resizing
* status bar text changes (crudely obfuscating hover text when you want to see where you'll land)
* hide the menu bar, navigation bar and url so as to give a small HTML window popup
Firefox used to have options to do all that, but they were removed. No Javascript simply can't hide the URL bar or move windows (it can select where to open them, within some limits).
Re: (Score:1)
Of course the problem is that a web page can hook a legitimate button (like, say, "Show me the porn!") and add an action, like opening a new window. There's no way for the browser to know if that wasn't a legitimate request by the user, so you get LiveJasmin.com and such.
The real quest
Re:2014 (Score:4, Insightful)
: after all it wouldn't be a whole lot of use to display dialogs to users if you then couldn't handle the subsequent action.
Web pages don't need dialogs in separate windows. Seriously, they don't. That's an old-school UI concept dragged to an inappropriate place. You can present a dialog within the page, in a variety of ways. And if you really need to open a separate, permanent window, that's a new tab, and only if the user has explicitly granted permission for such.
There's simply no legitimate requirement for a web browser to ever open another desktop UI window - render what you need to within the tabs you present.
Re: 2014 (Score:3)
One advantage of Microsoft standardizing on the metro interface is that popups and dialogues will become a thing of the past.
Re: (Score:2)
Hmmm, I can't immediately spot the flaw in your claim, but since I take it on faith that nothing good can come from Metro, that just means I'm not looking hard enough. ;)
Re: (Score:3)
The real question is: why do browser still allow windows to pop under? There's literally no legitimate use for it.
Site satisfaction surveys typically pop under so that when you close the main window you see the site satisfaction survey, it refreshes, and asks you shit about your visit.
Same for a ton of those "eLearning" shits that make you sit through a video, click through pages of shit you're pretending to read, etc. while timing you, tracking your clicks and progress, etc. Often used for employer-mandated training sessions on shit like how not to rape people at work or how to properly walk so you don't trip and sue
Re:2014 (Score:4, Informative)
I don't quite understand why auto popups like Livejasmin or 888casino can be allowed to popunder (I find them on client machines all the time) but when ever I ask one of my firewall to display me a log, update firmware or whatever (sophos & pfsense) the browser blocks it. I 'king clicked a button and the browser blocks it. Users do apparently 'nothing' and gambling and porn appear.
That said, uninstalling Chrome Browser and returning to firefox has been a great release.
I've had to return to Firefox just to get away from recent bugs in Chrome. Chrome as a pretty good browser in its time, but it's heading towards the shark on greased water skis.
Re: (Score:1)
Firefox with noscript and ghostery is a joy to use in comparison (though it doesn't handle memory / scrolling very well with large pictures - even on an i7 with 24GB ram and twin GTX 690's) Add adblock on a firewall like untangle and even the tablets and phones in the house can get a decent internet boost.
I've switched recently as well (Score:5, Interesting)
Not to say I like Firefox, but I am currently hating it the least. All the browsers are problematic in my opinion, just in different ways. I used FF for a long time but its Flash issues were just too much, among other things, so I switched to Chrome. Now I'm back on FF. I really like a lot about IE, but it has too many problems rendering a number of websites correctly so it is out.
Nobody can seem to make a good browser, just a less bad one :P.
Re: (Score:3)
Re: (Score:2)
Because the 888casino popup was triggered directly from a user action. You may have clicked something or pressed a button.
Like when you go to thepiratebay, no popups come up until you click in the search box.
Your firewall must be doing it a different way.
Re: (Score:2)
I think it's prudent to question whether this bug in Google's browser is intentional or unintentional. The list of underhanded and outright shitty things we know about being done is pretty long.
If I bump into a person and it seems like an accident I can get away with apologizing. When I do it a second time, the apology should be taken with a grain of salt. When it happens a third time the person has the right to believe it was intentional and react. This is the point we should be at with not just the NS
Re: (Score:3)
I think it's prudent to question whether this bug in Google's browser is intentional or unintentional.
I think it is safe to assume, for any verbal discussion of importance, that all smart phones in the room have their microphones on with voice recognition running. Sure, most of the time they are not, but:
1. They are the perfect bugging tool.
2. The person you are talking to might be recording everything anyway
and 3. if you are in any kind of position that could possibly be envied, someone is bound to be doing this to you.
Re: (Score:3)
I think it's prudent to question whether this bug in Google's browser is intentional or unintentional.
Chromium is open source. If this behavior exists in both Chrome and Chromium, then it's a bug, or most likely an unintended consequence.
If it's only in Chrome, you're right, it'd be a very good idea to question Google's actions.
Re: (Score:2)
The bug being introduced in both does not show that it was not intentional. Google developers probably spend a lot of time working on the OSS version. For example, HP WebOS was open source. HP had several dozen developers working on the OSS source full time in addition to many dozens of other staff for the OSS software.
Re: (Score:1)
Because just as with all other Google services, YOU are product being sold to advertisers.
Yo Dawg (Score:1)
Re: (Score:2)
*Feature intended only for official government use. Unauthorized users will be penetrated to the full extent of gangrape.
Re: (Score:2)
No, this one is very definitely a bug [wikipedia.org].
Re: (Score:2)
It actually is a feature... The user explicitly gave the malicious website permission to use the mic until they explicitly revoke that permission. The problem is the malicious website didn't stop using them the user did something they thought would stop it, without revoking the permission.
No. Shit. Really?
Re: (Score:1)
Re: (Score:2)
surprise! (Score:5, Insightful)
Giving microphone access to a complex piece of software that's primarily used to render, interpret and run code fetched from random places on the Internet... what could possibly go wrong?
Re: (Score:2, Funny)
Re: (Score:3)
Because they're his private burps and farts!
Re: (Score:2, Informative)
Re: (Score:1)
Re: (Score:1)
The post I replied to was a semi-sarcastic question about what could go wrong.
My reply was an (imho) funny example of what can go wrong when a system is always listening, unintentionally or otherwise ( a little bit similar to the title, and the post, wouldn't you agree?). And the example of was a damnsight less serious or scary than the possi
Re: (Score:2)
Loved this. And no, it's totally on topic, because it's the same thing. Voice-control active during gaming which includes team chat. Yeah, what could possibly go wrong? ;-)
(loved the girls reaction. she was the only one with enough cool to laugh about it)
Re: (Score:1)
I'm sure he does do RTC, pdfs, video playback, and screensharing, with appropriate client applications.. doing them in a browser is what's stupid.
No turning back the clock. (Score:2)
Giving microphone access to a complex piece of software that's primarily used to render, interpret and run code fetched from random places on the Internet... what could possibly go wrong?
The world wide web and web browser has been a two-way means of communication for quite some years now.
Re: (Score:2)
I believe the voice recognition feature was added as a user interface for the browser, not the web pages themselves. Why or how the audio could get captured by another listener is the question.
Re: (Score:3)
Re: (Score:1)
It's news like this that makes me point my webcam at the wall when i'm not using it.
Bugs in Chrome?!? (Score:3)
I mean, besides the few that were just rolled out? Seriously, it's getting more like IE* every day.
*The bad ol' IE, unlike the rather slow and inept IE of today, which probably still has lots of bugs, too.
Re:Bugs in Chrome?!? (Score:4, Informative)
Re: (Score:3)
Part of Google's response (or lack of one) includes that this isn't so much a bug as a feature, and the feature is being misused.
If you authorize your microphone for evil.site, and evil.site opens another window, your microphone is still authorized for it -- because you (a) permanently authorized evil.site microphone access and (b) because you clicked on the microphone this session.
Google will likely have to reduce the functionality of the microphone.
Ideally they'll also use this as an opportunity to give m
Re:IE isn't bad anymore (Score:2)
I would consider using it if it had more plugin support and if website makers still didn't feed IE 6 specific jscript code to it. IE 11 fixed this by ignoring jscript and only supporting ECMA compliant javascript. This broke corporate apps of course reliant on ancient IE behavior.
Slashdot thanks it with a headline "IE BREAKS MORE SITES AGAIN" and the crowd hounds it for non standard behavior LOL. Even though making it act like Chrome and Firefox is what caused this.
But you can get adblock plus for it now an
a developer named Tal? (Score:3)
What, me worry? (Score:4, Funny)
Remain calm ....
I'm sure that Oogle Peep View capture / Wi-Fi mapper / porn share finder vans will be by soon to distribute a patch in the background. It would be evil to not patch that, right?
(Don't you love being able to search for your own posts within minutes from .... you know. )
Re: (Score:3)
ie was first with the process per tab thing.
Replace all the features... (Score:2)
So, Windows has voice recognition. There's Nuance too. In Windows, when you are using the feature, there's clear application on the top that shows you that it is listening. It works okay with a bit of training if you need that kind of thing.
This trend by Google to replace more and more features of an desktop OS is really annoying. Notification features in the OS? Nah, just make a really small window in the corner that doesn't go away and just pops up not and then. Of course, the Microsoft voice recognition
Seems like reasonable behaviour. (Score:2)
You grant permission for a website to listen to you.
It opens a new window to the same domain, that window inherits those permissions.
There is more than one way to mitigate this problem
eg:
1) Don't let any window, regardless of user granted permissions listen while its in the background. This is going to break websites when you switch tabs.
2) Don't propagate this permission to child windows. That's going to break websites that popup a window for speech recognition that can persist between page navigations
3) P
Hardware/OS level indicator (Score:1)
Re: (Score:2)
The built-in camera on my Macbook turns on a hardware light whenever it's being used. Makes it pretty hard to not realize you are potentially being seen. All OSs should display an indicator on the top layer of the display, and enlarge/flash it in a pretty unmissable way every 5 minutes, whenever your camera OR microphone is active. Failure of an OS to do so should be labeled as what it is, a security hazard.
There was a slashdot article about an exploit for this not so long ago, camera on, led off.
Best way to secure the camera is with a piece of black electrical tape, to secure the microphone unplug it or turn it off. Laptop mics are a bit trickier.
Re: (Score:2)
No, just no. Several places will remove cameras from laptops for less than $250. The one we now use at work is Mission:Repair (http://www.missionrepair.com). They do a great job, and have only ruined about 5% of the devices we've sent in for camera removal
I can't tell if that is sarcasm or not, but $250 to remove something, and 5% "ruined-device" rates are obscenely high IMHO.
$25 bucks, and 0.1% ruined devices is much closer to the right ballpark.
Re: (Score:2)
I can't tell if that is sarcasm or not.
Yeah it is, this AC is two of only one in circle jerk. That very loud popping sound is the cavitation effect of their head coming out of their ass.
Re: (Score:2)
Wow, just $250 and only a 5% chance my device will break?
That's sooooo much better than just covering it with one cent's worth of tape.
Re: (Score:1)
What really interesting, in my book, is the fact that Skype only started detecting plug in devices 'on the fly' after MS took over, If I hadn't had the device plugged in I would usually have had to quit / re-open skype - or at least re-run through the video setup - nowerdays skype can
Re:Hardware/OS level indicator (Score:5, Informative)
The built-in camera on my Macbook turns on a hardware light whenever it's being used.
That is an assumption.
Mac's are now shipping with the camera power led on a separate software controlled circuit so its no longer the case that the light must be on for the camera to be on (or vice versa).
Complete failure of secure hardware design. Way to go Apple.
Re: (Score:1)
It's completely legit, after all you read the TOS and clicked agree right?
Non-Chrome functionality? (Score:2)
The article isn't clear, but my first thought is that this should be simple to deal with by just revoking permission for a site to use the mic. Except that when I check in Chrome, there's no way to enable this at all. The only references involve adding the Chrome Voice Control extension, which isn't included in Chrome by default. So while this is a problem, it doesn't seem to be one that can't be easily solved. If you're truly worried about it, don't install the extension or remove it if you've got it insta
Small steps to Total Surveillance (Score:2)
This is just another in a long line of baffling (and user hostile) decisions Google has made for Chrome. What made me uninstall Chrome was the decision not to clear session cookies after Chrome exits.
Even if you signed into a website without ticking "remember me" or "log me in automatically", Chrome would happily keep those session cookies so that on restart you find yourself still logged into those websites.
Again in response to the uproar, Google said this was the behaviour they wanted for Chrome and user
Re: (Score:2)
Again in response to the uproar, Google said this was the behaviour they wanted for Chrome and user should manually sign out of each and every website each and every time before closing Chrome.
Well I don't use Chrome, and always sign out of a site, if for nothing else to block a site's cookies (web beacons) from being active while surfing.
-cookies are deleted when I shut the browser down.
Re: (Score:2)
Even if you signed into a website without ticking "remember me" or "log me in automatically", Chrome would happily keep those session cookies so that on restart you find yourself still logged into those websites.
Again in response to the uproar, Google said this was the behaviour they wanted for Chrome and user should manually sign out of each and every website each and every time before closing Chrome.
Google's "behavior" yet again shows their twisted anti-privacy slant. I don't wanna know just how much Chrome has contributed to
1) loved ones spying us
2) lost passwords due to complacent workers who never hit log out
Just today I got yet another user who made me wonder just HOW people never learn their passwords and manage to keep logging in for 2 years, till their laptops are lost or refreshed. Between site-controlled "remember me" boxes and lazy browser culling, I think this solves the mystery. Thanks for
Easiest fix (Score:2)
Chrome recently added a speaker icon to indicate which tabs are playing sound. Why not add a corresponding microphone icon to indicate which (if any) tabs are recording it? Since this would be implemented in the browser, it shouldn't be possible for sites to bypass it.
Re: (Score:2)
Because it's in a different window not a tab?
Even simpler fix: if the user has tabbed browsing enabled (does Chrome even work any other way?) then web pages should never be allowed to open in a new window. If they ask for a new window, give them a new tab instead. 99% of the time, this is what the user wants (assuming they even want the content at all).
In conclusion (Score:2)
"open"
Don't give malicious sites permission (Score:1)
Who's fault really (Score:2)
People should really expect this and disconnect everything when they're done.
All my monitors since the 90's have had a WebCam built in but I didn't buy any for that reason, and have always disabled the webcam by not supplying a USB cable for it's use. Only once have I ever used one and just for a few hours.
I have a Mic pluged in now for the POS BF4, and assume I can be heard at anytime. It's not Googles fault or Windows but Flash. I always have disabled flash's Webcam and Mic. Used to be it would reset afte
Dumped Chrome a month ago (Score:1)
That is all.
Just more crap from the crap factory? (Score:2)
> Google dismisses eavesdropping threat in Chrome feature
> Google said there's no threat from a speech recognition feature in its Chrome browser that a developer said could be used to listen in on users.
http://www.techworld.com.au/article/536592/google_dismisses_eavesdropping_threat_chrome_feature/