Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I noticed that in Google Chrome, if I type in file:///C:/Users/MyUsername/Desktop/ it shows me all of the folders on my Desktop, and I can type open up PDFs and such in chrome just by typing in the file path.
What processes and systems are in place so that Google is not able to copy data stored on my computer? What processes and systems are in place so that someone who writes a Chrome extension is not able to copy files stored on my computer?
What processes and systems are in place so that Google is not able to copy the data on my computer?
None. Google Chrome usually runs with the permissions of your user account. The application can then read and modify local files to the same extent your user account can. (These permissions apply to most of the programs you're using.) So you need to trust Google in that they don't ship a malicious update that spies on you, or keep sensitive files inaccessible to the account you're running the browser with. Alternatively, there are most likely sandbox implementations for your OS that let you run Chrome in an isolated environment with restricted access to the filesystem.
What processes and systems are in place so that someone who writes a Chrome extension is not able to copy files on my computer?
Chrome extensions have limited privileges by default. An extension needs to explicitly request (declare) a permission to interact with documents on the file:// scheme.
Also note that your browser disallows ordinary websites to read or even redirect to file:// URIs. So while your local files are accessible to the Chrome process, they are not exposed to the web.
<a href="file://. It is just so that all current browsers of notable market share are smart and kind enough to not fall for the obvious security trap. They may be (mis)configured otherwise, e.g. FireFox (historically?) via Security.fileuri.strict_origin_policy
Jun 11, 2018 at 20:47
A piece of unsandboxed software running on a PC/Mac has (generally) the same privileges as the user running it and therefore can access any data that can be accessed by the user.
You are trusting Google (and any other software vendor whose code you execute) not to do anything malicious with that access.
If you don't trust Google, your only option as a general user of software is not to run their code.
The situation with Chrome extensions in somewhat different. Google places restrictions on what the extension vendor is able to do, and when you install an extension it will tell you what permissions you are providing it.
Obviously you are still trusting Google to have coded these restrictions correctly, and you are still potentially trusting the extension authors with some permissions that could be used to take malicious actions.
If you are running a Linux distribution with SELinux, it is possible to have an additional layer of security. SELinux is an OS-level technology which allows tight restrictions on what processes — like your browser process — can access. In fact, in Fedora and in Red Hat Enterprise Linux (disclaimer: I work for Red Hat, on Fedora!), there is a light confinement by default for Firefox and Chrome. This turns out to be difficult and inconvenient to make more strict for most users — see this blog post by SELinux guru Dan Walsh for more.
There is ongoing work in Linux in general to run more user-level applications with greater restrictions (see for example Flatpak).
Lawyers. You have a contract with Google stating what they will do / you allow them to do. This is called the Google Chrome Terms of Service . And obviously, you have carefully read it before installing it.
This includes¹ excerpts like this (emphasis by me):
By default, usage statistics and crash reports are sent to Google (…). Usage statistics contain information such as preferences, button clicks, and memory usage. In general, usage statistics do not include web page URLs or personal information, but, if you are signed in to Chrome and syncing your browsing history in your Google Account without a Sync passphrase, then Chrome usage statistics include information about the web pages you visit and your usage of them. For example, we may collect statistics to identify web pages that load slowly. (…) Crash reports contain system information at the time of the crash, and may contain web page URLs or personal information, depending on what was happening at the time the crash report was triggered. We may share aggregated, non-personally identifiable information publicly and with partners — like publishers, advertisers or web developers. You can change whether usage statistics and crash reports are sent to Google at any time. Learn more. If Google Play apps are enabled on your Chromebook and Chrome usage statistics are enabled, then Android diagnostic and usage data is also sent to Google.
Thus, by installing Google Chrome (and not disabling these options), you are granting consent for giving this information to Google.
Would they be technically able to gather more information than what they stated? Yes. Are they purposefully doing it? That's unlikely, as it would place the company in a precarious position should they get caught stealing users data. It is preferable for them to add a note in their policy that covers their gathering (probably including an acceptable rationale like "this will allow us to provide you content more suited to your interests", in an attempt to make it less daunting), as legitimates their practice, and few people read the legal terms, anyway.
Although a story about Google Chrome privacy statements wouldn't be complete without telling how, when Google Chrome launched, its terms of use originally made the user
“give Google a perpetual, irrevocable, worldwide, royalty-free, and non-exclusive license to reproduce, adapt, modify, translate, publish, publicly perform, publicly display and distribute any Content which you submit, post or display on or through” ²
a sentence they were using on other services. After an uproar with this seemingly abusive terms, they updated their terms the next day, stating that for whatever content the user produces using Google Chrome, he retains his rights.
¹ Actually in the Google Chrome Privacy Notice, incorporated by the eula.
² https://www.mattcutts.com/blog/google-chrome-license-agreement/
What processes and systems are in place so that Google is not able to copy the data on my computer?
There's not anything in place that makes it so they can't but there's something in place that makes it unlikely that they would: trust.
Google's product is you. They want to know everything about you and be able to predict every single decision that you will ever make. If they can do that then they can encourage you to buy Ford instead of Chevy when it comes time.
They have a social contract with us that says that they'll provide useful tools (and then kill them), like Google Drive, Chrome(ium), Blogger, Gmail, Google Photos, Maps, YouTube, Search, etc., and in return we'll let them mine our information about us with the understanding that they won't do too many terrible things, and that they'll try to make the web a more pleasant place, with more relevant advertising and none of the annoying things that make us want to break someones fingers very, very slowly for putting one of those stupid audio ads online.
Part of that trust is that if we install one of their programs that they won't put code in it that will compromise our systems, or allow them to be.
Because if we don't trust Google, then we won't give them access to the product that they are so incredibly interested in - us. The more we trust Google, the more valuable their product is (us) that they can sell to advertisers. It's in Google's best interest to do things that will enhance that trust - because the more we trust Google, the more they can charge advertisers, because they can say, "Look, we know these people, and they are willing to buy/read/listen/watch the things that we recommend. If your product matches their needs and interests then we will recommend your product to them and they will probably buy it because we were the ones who endorsed it."
That's the system that's in place to make it a very very bad idea for Google to do any kind of badness with Chrome, or any of their other software. Trust is something that's difficult to earn back once it's lost, and Google most certainly knows that.
Arminius's answer of "None" is the most correct answer... I just wanted to add an answer which was too large for a comment:
What processes and systems are in place so that Google is not able to copy the data on my computer?
If you have one, and it's properly configured, your Outgoing Firewall can hold this responsibility... the problem is, since there;s so much traffic when you're browsing the web that it quickly becomes infeasible to set up the rules properly.
As an example, here's a screen shot of what happens on my computer without a rule allowing Google Chrome network access globally:
If you knew Chrome was contacting a google domain for malicious usage, you could deny that:
The issue is that while browsing the web there's such a wide variety of domains that it would be trivial for Google to "trick" users to allowing content to a domain and bypassing this restriction. But, if you're externally careful and targeted (read: paranoid) this is one method you could employ.
google.com then you shouldn't be using Chrome in the first place! Also, if you just wanted to block access to particular domains, there are easier ways of doing that (one way is to set them to localhost IP address in your hosts file, among other methods).
google.com to 127.0.0.1 or something else in the hosts file does not block applications from accessing google, it just (probably) causes the system's DNS resolver to return that IP. And, this was an example... I use this technique with software that I don't want to call home, or limit outgoing communication to my LAN / my servers, for example... where I don't know what it will talk to but I know what I'll allow it to talk to.
There are several answers to this, including an accepted answer, but none to my judgement captures the appropriate nuance.
The nuance involves the distinction between "policy" and "mechanism." This distinction transcends technical systems, and, not to put too large a point of it, exists in all areas of regulated human endeavor.
In the large, there is no mechanism preventing your doctor from revealing your sensitive medical data, technically encoded or no. In the small, there is no mechanism preventing the garage where you park your car from giving your car to some other party. In a free society, anyone can do most anything without immediate oversight or ramifications. In other words, there are no direct, immediate mechanisms preventing bad behavior.
Instead there are policies- implicit ones usually called norms that most people learn by kindergarten, and more sophisticated explicit ones called statutes and laws and similar- which have mechanisms of enforcement, to be sure, but under which the vast, vast majority of compliance occurs without those enforcement mechanisms being exercised. This is obviously the trust point mentioned in the other answers. A free society is only possible with a culture of very, very high trust.
In software, we are used to thinking of things in terms of mechanisms- such and such is impossible because of this and that technical difficulty. What is important to understand is in software, even more so than in the real world, ALL mechanisms are transient and fungible. What was impossible yesterday becomes commonplace tomorrow.
So the ONLY thing "preventing" anything bad from happening in the use of a piece of software is ultimately policy- implicit norms and compliance with explicit rules- Privacy Policies, Terms of Service, and so on. And if you read those carefully you realize that no one makes any useful legal promises to not do anything bad.
So be careful out there. The only thing you have is your ability to make informed judgements about trust.
What stops Google from saving all the information on my computer through Google Chrome?
Unplugging your computer from the network will do this. To further secure your computer you can also turn off wifi, bluetooth, etc., and always use only manual input with no removable devices along with RF shielding to protect against EM leakage. That will protect you from everything except physical intrusion.
For that, operate in a SCIF, or encosed secure farady cage with equipment that complies with ICD 503. Require operators to remove all clothing and other objects, and perform physical searches including x-ray before physical access to prevent introduction any bugging device. Also perform the same search on egress to ensure nothing is being removed.
