Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 15 down vote favorite

After i saw many people using Chrome i wanted to inform myself on this browser and everything concerning it as i am a Firefox user since it existed. However i am always afraid of Google being a "data kraken" collecting as much information as possible and i want to know how this privacy issues influence the browser and its usability. What data is actually sent to Google (usage statistics, system information, ...) and what of these issues can be disabled via "normal" options and via hacks? Am i too focused on this bad image Google has in my eyes or are my worries "allowed"?

share|improve this question
3  
one thing: even if this data isn't sent to google, it would still be a security concern. If Chrome can read the data, then other processes could too, and this would be a prime place for the next generation of adware/spyware to exfiltrate data from – Nate Koppenhaver Aug 19 '11 at 0:24
@Mike I mean local programs, not web exploits – Nate Koppenhaver Aug 20 '11 at 2:51
@Nate, ah. I think I understand now. Apologies. – Mike Samuel Aug 20 '11 at 3:57
You might find this interesting, a version of Chrome called Iron which is stripped of the tracking features: srware.net/en/software_srware_iron.php – ioSamurai Jul 30 '12 at 15:27

2 Answers

up vote 8 down vote accepted

The Google Chrome Wikipedia page details the different components that do usage tracking.

Features that can be entirely turned off:

  • clientID (unique identifier that logs usage metrics (stats and speeds, etc) and crashes)
  • Suggest (could share text typed into address bar to suggest the website you might be trying to find)
  • Page not found (could share text typed into address bar when the page isn't found)
  • Bug tracker (could share details about crashes or failures)
  • Google Updater (could share info about Chrome version)

Features that can be partially turned off:

  • RLZ identifier ("encoded string, according to Google, contains non-identifying information how Chrome was downloaded and its install week, and is used to measure promotional campaigns. Google provides the source code to decode this string.")

Features that cannot be turned off:

  • Random installation token (used to measure success rate of Google Chrome installation)

If you go to your Google Chrome preferences and turn off every feature that might "suggest" something to you or "help make Chrome better", then Chrome presents no outstanding privacy risk. Also, you have the option to log in using your Google account to sync your Chrome preferences. If privacy is an issue, choose not to do that.

If you browse using the Chrome Incognito mode, then your cookies and history will not remain on the computer you're using - even better for the privacy conscience.

share|improve this answer
This specific description of all "features" will help me find more information on these topics - top! – Christian Ivicevic Aug 19 '11 at 19:55
up vote 7 down vote

I have no conclusive answer for you, but a few suspicions that might be helpful.

When I used Chrome for myself, I used it with an app firewall (Little Snitch) that comes with popups every time a program tries to access a remote host. In Chrome, I disabled the services that looked like they would access Google services for browsing, such as the "Malware and phishing protection", "prediction services" et cetera. Those services would need to send the URL I'm surfing to, to a Google service to do their work.

After disabling those checkboxes and surfing around, I found that little snitch does not inform me of any remote access attempts other than to the websites I'm trying to browse, and the external links they contain.

share|improve this answer
Can you explain me what the prediction service represents? The "interactive" location bar to be able to immediately search in Google? – Christian Ivicevic Aug 19 '11 at 18:36
you could experiment with it by looking at the network traffic with Wireshark, but I presume it's autocompletion for URLs and search queries based on google search results. – chris Aug 19 '11 at 19:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.