Google Criticized for Automatic Chrome Sign-In

Credit: GoogleCredit: GoogleThe latest version of Google Chrome brought significant changes to the browser. It received a new design, improved password management, and many other tweaks released in honor of its 10th birthday. Johns Hopkins University cryptographer Matthew Green revealed that Google made another change: Chrome now automatically signs users into their Google accounts within the browser whenever they log in to a Google service.

Chrome has long allowed people to sign in to their Google accounts so they can keep their open tabs in sync across devices. This feature was optional, however, and many people chose not to use it because they didn't want their browsing history to be sent to Google. Not signing in to Chrome was an easy way to make sure the feature wasn't "accidentally" enabled.

Worse still was the fact that Chrome doesn't let people know when it's automatically signed them in to their Google account. The company didn't just remove the option to use its browser without using a Google account; it did so in a way that makes it hard to believe Google wasn't trying to escape scrutiny. There's no mention of this change in the blog posts, patch notes or even privacy policy that accompanied Chrome 69's debut.

Google should have known this change would A) be discovered and B) rankle people who care about their privacy. The company is often criticized when things people already knew, such as the fact that it lets third-party app developers scan Gmail if people connect their accounts, come back into the public eye. Secretly making a change to Chrome that at least appeared to undermine privacy was bound to be controversial.

Here's the good news: Green said in his blog post that Google engineers told him Chrome doesn't automatically enable the sync feature even when someone is signed in. He was also told Google would update Chrome's privacy policy to note the new behavior. Both of these decisions are supposed to relieve Chrome users who feared their browsing history had been secretly handed over to Google because of this change.

But neither actually resolves the main issues with this change. The fear that Google now has the potential to enable syncing without notice is still there, especially since the company remotely enabled the battery saver feature on Android smartphones by accident in mid-September. Things happen--settings are changed during the update process, bugs undermine settings, etc.

The other problem was the fact that everything about this change was kept secret from Chrome users. More information has become available since Green published his blog post, and Google has stressed that being signed in to Chrome doesn't automatically undermine someone's privacy, but the point is that people expect to know when something that could affect their privacy changes without a peep after years of use.

We asked Google for more information about this change and a spokesperson linked us to a series of tweets from Chrome engineer and manager Adrienne Porter Felt. In addition to saying that Google is working to update Chrome's privacy policy and that merely being signed in to the browser doesn't enable the sync feature so many people are worried about, Porter Felt explained the reasoning behind the change:

"My teammates made this change to prevent surprises in a shared device scenario. In the past, people would sometimes sign out of the content area and think that meant they were no longer signed into Chrome, which could cause problems on a shared device. [...] The new UI clearly reminds you whenever you're logged in to a Google account. Plus, you now only need to sign out in one place before you share your computer with someone else."

All of which means a feature that was actually supposed to help Chrome users keep their information private from people with access to a shared computer has rekindled the flame of controversy around Google's privacy practices. The company doesn't appear to be changing its mind, though, so anyone concerned about being signed in to Chrome will either have to be more vigilant or switch to a different browser.

Create a new thread in the News comments forum about this subject
6 comments
Comment from the forums
    Your comment
  • shrapnel_indie
    Quote:
    But neither actually resolves the main issues with this change. The fear that Google now has the potential to enable syncing without notice is still there, especially since the company remotely enabled the battery saver feature on Android smartphones by accident in mid-September. Things happen--settings are changed during the update process, bugs undermine settings, etc.


    It's easy to blame an executive decision on it being a bug if the decision's action is unfavorable (at best) or downright evil in nature. It follows plausible deniability quite well as long as they can keep private memos and emails out of the wrong hands.


    Quote:
    The other problem was the fact that everything about this change was kept secret from Chrome users. More information has become available since Green published his blog post, and Google has stressed that being signed in to Chrome doesn't automatically undermine someone's privacy, but the point is that people expect to know when something that could affect their privacy changes without a peep after years of use.


    ... for now it doesn't... at least until execs decide that they want it to do so... if it isn't already doing so... Chromium is the foundation of Chrome. Google is pretty much the one who is responsible for the black box permanently bolted-on extensions. Chromium itself is open-source. The bolt-ons by Google are proprietary.


    Quote:
    We asked Google for more information about this change and a spokesperson linked us to a series of tweets from Chrome engineer and manager Adrienne Porter Felt. In addition to saying that Google is working to update Chrome's privacy policy and that merely being signed in to the browser doesn't enable the sync feature so many people are worried about, Porter Felt explained the reasoning behind the change:


    The public reason behind the change sounds fine and dandy. It's the fact that Google is completely unapologetic about how it makes its money with data mining. (plus kicking their motto of doing no harm to the curb.) Plus their push (successful for a few iterations of minor changes) for NSA encryption built into the Linux kernel. Encryption that the NSA was not willing to explain in detail.
  • DotNetMaster777
    Is this has influence to the password manager ???

    I do not like this sync stuff without my permission !?
  • bit_user
    On Linux, you can get virtually all the benefits of Chrome without the spyware with the Chromium browser.

    You can also use it on Windows, but there seem to be no official binaries to download releases.

    http://www.chromium.org/Home
    https://en.wikipedia.org/wiki/Chromium_(web_browser)

    Edit: they actually do have pre-compiled Windows binaries, but no installer:

    https://www.chromium.org/getting-involved/download-chromium