Over the weekend professor and cryptographer Matthew Green noticed that in Chrome 69, signing into Google websites while using Chrome caused the browser to show him as signed in there as well. Concerned about the implications of tracking behavior across a browser session even though he had intentionally not signed into Chrome, he wrote about it. Google Chrome manager Adrienne Porter Felt explained that the change happened to remind users of who is signed in, and that it did not sync activity to the server under the Google profile unless additional steps were taken.
Now, in response to the feedback, Google has announced that in Chrome 70, users will be able to “turn off linking web-based sign-in with browser-based sign-in.” As Google Security Princess Parisa Tabriz writes, it will still default to on, but you can opt out of it and have an assurance that the browser is not syncing your data to the cloud in the background. It’s also changing a confusing blue button Green complained about, so that instead of just “Sync as (your name)” it clearly indicates that pressing it will turn syncing on or off.
Finally, one other change comes to the “clear cookies” function. Previously, it would leave Google authorization cookies behind so that the user would still be signed in, but now it will blow those away too.
Again, we appreciate the feedback. Here are some updates we have planned for Chrome 70: https://t.co/xpW8RyFiTn https://t.co/4HLCjeGfPY
— Parisa Tabriz (@laparisa) September 26, 2018
Google has responded to criticism about its browser auto-login feature, and other changes. So it’s making those features optional. The result is better, but still much invasive than it was a few weeks ago. https://t.co/LqVWdaOEz6
— Matthew Green (@matthew_d_green) September 26, 2018
It’s pretty obvious that the company has changed direction in a pretty significant way in the past couple of years. I think a few expert “don’t log me in” features are nice, but if they represent an overall privacy loss for most users, it’s hard to really get behind them.
— Matthew Green (@matthew_d_green) September 26, 2018
Anyway, it’s Google’s browser, they can do what they want. I’m gonna become one of those annoying Firefox people now. And if worse comes to worst I actually installed lynx, so I have options galore. Let’s hope it doesn’t get that bad.
— Matthew Green (@matthew_d_green) September 26, 2018
(59)
