Google Chrome 67 Released for Windows, Mac, and Linux (bleepingcomputer.com) 85
An anonymous reader shares a report: Google released earlier today Chrome 67, the latest stable release of its web browser. According to changelogs released with Chrome 67, this version adds support for a Generic Sensors API, improves AR and VR experiences, and deprecates the HTTP-Based Public Key Pinning (HPKP) security feature. Probably the biggest change in Chrome 67 is the addition of the Generic Sensors API. As the name implies, this is an API that exposes data from device sensors to public websites. The new API is based on the Generic Sensor W3C standard. This API is meant primarily for mobile use, and in its current version, websites can use Chrome's Generic Sensors API to access data from a device's accelerometer, gyroscope, orientation and motion sensors. Another API that shipped with Chrome is the WebXR Device API. Developers can use this API to build virtual and augmented reality experiences on Chrome for mobile-based VR headsets like Google Daydream View and Samsung Gear VR, as well as desktop-hosted headsets like Oculus Rift, HTC Vive, and Windows Mixed Reality Headsets.
Re: (Score:2)
OK, well...
According to this Chrome has supported these things since version 7, that's eight years ago...
https://caniuse.com/#search=de... [caniuse.com]
More control for Google? (Score:2)
Does Google Chrome browser still install system services? If so, I would never use it.
Re:More control for Google? (Score:5, Informative)
I never would have guessed. (Score:2)
I never would have guessed that. I thought if I didn't say yes to a UAC request, Google Chrome browser would not install.
My opinion: Google is becoming more and more badly managed. Now, when a Google map is displayed, the map shows hotels! To me, that might be useful: I know that any CEO of a hotel that displays on Google maps is not a sensible person. I would never stay at that hotel, no matter where it is located.
Re: (Score:2)
Please remember that whatever your choice, Google makes the bucks; when hotels are displayed as in the case you mention.
What you do with your knowledge, (the knowledge that such and such a hotel has been displayed), is immaterial.
I will give you some advice:
If you want to be of consequence, you and those who think like you do, will need to stop using the damn browser in big enough numbers, and from critical markets.
Re: (Score:3)
For a long period of time Google was exploiting vulnerabilities to install Chrome with admin privileges despite the user not having admin privileges or not granting them to the installation process.
Re: (Score:2)
Source?
Re: (Score:3)
What about in Mac OS with its annoying background self updater?
Re: (Score:2)
Chromium browser has Google's spyware also? (Score:2)
Google is so wackily managed, in my opinion, that I would not trust that there is no spyware in the Chromium browser. If there is no spyware now, maybe it would be added later. And, how would I know? I don't want to spend hours dealing with those details.
A better analogy: (Score:2)
Also, the poison may be extremely well-disguised as a typical hamburger.
Also, if the poison is found, a new version of the book may be released that disguises the poison in a different way.
The answer? Stay away from those who have demonstrated an intention to harm you.
Google and Microsoft: In the spyware business? (Score:2)
Many articles say Microsoft and Windows cannot be trusted. Two of those articles: Windows 10 is possibly the worst spyware ever made. [networkworld.com]
And: 7 ways Windows 10 pushes ads at you... [pcworld.com]
So, it seems to me that Google and Microsoft are, more and more, poorly managed. They are in the abuse business, not in any real business.
Several years ago, I talked with a mid-level Google manager who said that Google had more money than it knew how to mana
Being more complete is easier for some readers. (Score:2)
Re: (Score:3)
Does Google Chrome browser still install system services? If so, I would never use it.
Or you could educate yourself on what it means to have a system service vs a normal program, what they do, and why they run as a service. But no ignorance is far easier.
A system service could possibly do anything, (Score:2)
This is the issue: A system service could possibly do anything, including changing what it does at any time. Most people don't want to spend the time to investigate.
There is NO good reason why a browser should include a system service. If there is a system service, there is no certainty of privacy or control over the entire computer by the owner and user. Somewhat like Google's Android operating system.
Re: (Score:2)
All Google programs seems to do this like Earth. :(
Mission creep, featuritus syndrome (Score:5, Funny)
Virtual reality? It's a web browser, not Emacs.
Comment removed (Score:5, Insightful)
Re: (Score:2)
Re: (Score:2)
Also, since the browser usually limits access, you can run untrusted applications with some chance that they will not successfully attack every other computer in the room.
We tried letting people download and run random programs from the internet on the bare OS. Now we're trying something different.
Re: (Score:2)
The OS is simply a support for something called a web browser in which people try to replicate what the OS does anyways but in the most complex and resource-hungry way possible.
A Brand New! plug-in coming SOON to a browser near you: SystemD.CRX (or XPI for FF).
You just THOUGHT your browser was slow and bloated now. Just wait -- for all of you that leave your browser up for weeks at a time, this will start it perhaps 1 microsecond faster while completely changing Every Single One of the native plug-in APIs and configuration files.
Just imagine what you can do with all of that time saved! Soon we'll ALL have the same identically-responding browser. A glorious utopia will have
Re: (Score:1)
The CEO of Mozilla was fired for donating his own money in his personal time to a conservative cause. It had nothing to do with his performance as CEO, just a SJW lynching. Companies should not be run by mob rule.
Re: (Score:2)
He was not fired.
Re: (Score:2)
Virtual reality? It's a web browser, not Emacs.
What is this a post from the 90s? The web browser stopped being used to display generic graphical and text based content some 20 years ago. Get with the times.
Unlike using Emacs as an OS, Chrome OS actually is a thing.
Re: (Score:1)
Chrome's claim to fame used to be simplicity and a light footprint. That's largely why people ditched IE and Firefox for it. It was sort of predictable Google would start using their browser market share for bloatWare and lockinWare.
Re: (Score:2)
Chrome's claim to fame used to be simplicity and a light footprint.
The computer's claim to fame used to be it's ability to spit out number on an orange and black screen able to run accounting software. Should we go back to that too because that was the claim to fame?
It was sort of predictable Google would start using their browser market share for bloatWare and lockinWare.
So to be clear you don't want Google to support web standards and prefer the days of IE6 where a website may or may not work in your browser? Got it.
You have a very screwed view of both bloatWare and lockin, neither of which have anything to do with Chrome.
Re: (Score:1)
I'm just saying why it gained market share. Whether those consumer choices were wise is a different issue.
From a marketing standpoint, they gained popularity by doing X; but once popular, stopped doing X. Sounds like a risky strategy. Firefox took a hit when it wandered too far from its roots.
My opinion is many of these side features not directly related to browsing or niche preferences should be add-ons, not hard-wired into the base browser.
Re: (Score:2)
I'm just saying why it gained market share.
Nope, You're assuming why it gained market share / popularity. And you'd be wrong. The reason it gained market share was aggressive adherence to standards, providing very good functionality and impressive speed (all the while actually being a very heavy browser from the onset), combined with aggressive advertising across the entire Google platform, combined with woeful mismanagement by both its main competitors. It was never very good on resources, and has been pumping in more and more features even back in
Re: (Score:1)
Hogwash, consumers don't know standards from a hole in the wall. (Plus, many of the standards are ambiguous and confusing. The standards bodies are shitty writers. Their "reason" for deprecating "b" tag is some of the worse {intended} technical writing I have ever seen.)
Re: (Score:2)
Now, It is way easier to recommend Linux or even tablets to companies, because most things will simply just work. No hassles with permissions, interoperability and cross-platform-ness.
HTML5, and IE's deserved demise makes it completely acceptable to simply require Firefox or Chrome/Chromium (or maybe Safari), and send other people away to get wi
Encrypted ads (Score:2)
What? (Score:1)
Why the fuck would I want a web browser to do any of that shit?
I want websites to have less information about me, not more.
Honestly, make a fucking web browser, the rest is just bullshit we don't want.
Re: (Score:2, Insightful)
Why the fuck would I want a web browser to do any of that shit?
When did you become the spokesperson for the human race?
Don't like it? Don't use it.
Re: (Score:2)
Another API, another Advertising Opportunity. (Score:2)
Getting close to... (Score:2)
NSA objects to HPKP, Google relents (Score:2)
Certificate transparency = Lifelock commercial.
There is no equivalence between the two systems.
Re: (Score:3)
Certificate transparency = distributed HPKP
HPKP allows the operator to declare this certificate or bust to regular users. Certificate transparency offers no such capability.
Certificate transparency only provides "transparency". It doesn't allow operators to set declarative limits on what is acceptable.
If your website was gearing up for protest against local dictator and chief and they conspired against you obtaining a MITM cert from your CA and properly logged it to transparency log accordingly that information sure as hell won't do your users any
Re: (Score:2)
We don't need that ability if lack of CT causes the connection to bust.
I offered an example why CT is insufficient even assuming it is fully deployed and made mandatory.
There's DNS CAA
Have a feeling when DNS CAA means something from a security perspective everyone will be using DANE anyway rendering DNS CAA redundant.
Again not that CAA is worthless or not worth doing but it's fundamentally toothless from a security perspective so long as DNS as actually deployed remains insecure.
In the situation where a single entity has complete packet rewrite ability for the connection to a user at all times, then neither HPKP nor CT will help you.
This is widely known. Similar to HSTS having the latch in practice useful or at least better than nothing. Heck virtually the entire constellation of DV certs currently deployed is based on the same leap of faith as certificates are initially provisioned automatically relying on insecure responses from insecure protocols over insecure transports.
It's the flip side to another problem though. Suppose that the dictator suborns the regional web host for my site and steals its key. I can set up a host elsewhere but I need to rotate the key. With HPKP, users will reject my new key and continue to use the old key to connect to the dictator-owned system
I don't accept this argument. Your users trust you. Should it turn out that trust was misplaced it isn't the falling of technology. It's a failing of yourself and a price MUST unavoidably be paid for that failing. Attempting to weasel out of paying MUST only lead to more insecurity. After all technology is only a means of conveying trust. It doesn't turn people into paragons of integrity and mindfulness.
In the event of this type of subversion having no site or having to start over and build trust from scratch even if it means lighting up a different domain or subdomain may well be seen as ideal or at least acceptable.
OK. I think you understand how CT and HPKP work well enough that I don't feel the need to keep arguing. I was mostly upset about "Certificate transparency = Lifelock commercial"
Essentially that's what it is. I do not retract my comment. The security monitor and the dental monitor commercials are exactly what CT is. And this is being generous about CT because practically operationally end users have no way of reasoning about CT. Nobody is actively announcing that a bank is being robbed or a bad cavity. Was the CA subverted? Did an attacker get a cert from a different CA or did the domain holder? Users have no clue. How many CA's exist in the world today? How many are state run? By political and commercial rivals?
(and claim that this move is caused by the NSA, which is a high-school quality calumny) which you've since walked back by stating that CT is good for security.
First I walk back nothing. When I said NSA I didn't really mean NSA specifically I meant "government" in general. Stating an opinion about CT is obviously a separate matter from opinion about or cause of any possible reason for removal of HPKP.
Second yes it is a conspiracy theory of mine that may well be misplaced or wrong. After the Snowden drip, increasing coziness of Alphabet with government and fact every damn secure everything platform always manages to eventually get subverted either through sale to a bigger fish or internal policy changes I suspect there is a good chance of it ringing true.
The thing that really gets me is the sheer pointlessness of this behavior. The feature already exists, people are already using it. They knew from day one that HPKP would always be a NICHE feature used by only a few security cautious people and paranoid fools. It was never intended at any point for mass consumption. So why on earth remove it? What good does that do anyone? What is the incentive for that? I have yet to hear a reason that passes sniff test. I think the answer is more likely than not to be pressure from government. CT is simply NOT a replacement for HPKP. Simply put governments don't care about "getting caught".
Re: (Score:2)
We don't need that ability if lack of CT causes the connection to bust.
I offered an example why CT is insufficient even assuming it is fully deployed and made mandatory.
There's DNS CAA
Have a feeling when DNS CAA means something from a security perspective everyone will be using DANE anyway rendering DNS CAA redundant.
Again not that CAA is worthless or not worth doing but it's fundamentally toothless from a security perspective so long as DNS as actually deployed remains insecure.
In the situation where a single entity has complete packet rewrite ability for the connection to a user at all times, then neither HPKP nor CT will help you.
This is widely known. Similar to HSTS having the latch in practice useful or at least better than nothing. Heck
Re: (Score:2)
Certificate transparency = distributed HPKP
HPKP allows the operator to declare this certificate or bust to regular users. Certificate transparency offers no such capability.
Certificate transparency only provides "transparency". It doesn't allow operators to set declarative limits on what is acceptable.
Pretty sure CT includes an option for websites to require their certifice must be a transparent, which means it would be detected if it was false, though not necessarily in real time.
Progressive Web Apps (Score:2)
It's a huge bag of don't want. (Score:2)
Where are the features that would make the browser immune to malware? Defend from pop-under, javascript exploits, malware of all ilk. THOSE are the priorities that everybody and their dog cares about. VR, generic sensor API... it's just bloatware we didn't ask for.
Re: (Score:2)
Where are the features that would make the browser immune to malware? Defend from pop-under, javascript exploits, malware of all ilk.
In the minor, security updates, that happen all the time, aren't major feature versions, and therefore don't get articles made about them.
THOSE are the priorities that everybody and their dog cares about.
Sadly, that's not the case.
VR, generic sensor API... it's just bloatware we didn't ask for.
Maybe you didn't, but this isn't the browser solely made for blind baker.
Re: (Score:2)
but this isn't the browser solely made for blind baker.
Did you misspell my handle on purpose? Or is blindness contagious via Slashdot posts?
Re: (Score:2)
Re: (Score:2)
it's just bloatware we didn't ask for
So to be clear you want browsers to not implement standards, and not have functionality needed as more and more software moves to a browser based platform? Got it. May I interest you in Lynx? It's immune to those other things you complain about too.
Chrome 67 released for Mac (Score:2)
But you need to run OS X 10.10 for some magical reason because the new version of the browser uses... eh, what exactly?
Why does it need 10.10?
Re: (Score:2)
But you need to run OS X 10.10 for some magical reason because the new version of the browser uses... eh, what exactly?
Why does it need 10.10?
Because that is that is the oldest version still supported by Apple. Getting things to work on OS versions abandoned by their maker is difficult.
But yes, it is an entirely artificial limitation, but one mainly set by Apple.
Mostly garbage posts below .. (Score:2)
Glad I read this. (Score:2)
Probably the biggest change in Chrome 67 is the addition of the Generic Sensors API. As the name implies, this is an API that exposes data from device sensors to public websites.
HOLY F'CK! Seriously? The audacity!
I am glad I read this so I know to uninstall and never look back.