ID: Pass:  
 

Posts Tagged ‘disclosure’

Chrome Hijacks 404’s & Discloses Info To Google

Sunday, September 14th, 2008

A picture tells a thousand words. Lets look at what happens when Google Chrome visits a web page that does not exist:

google chrome redirects 404s

What Are The Issues?

1. Revenue from 404 pages down. Although that depends on if you park or develop yourself.

2. Look what happens when its http://www.secure-domain-blah.com/user.php?user=john&session=12345678. Google is now in possession of my User ID and session details.

I tried it out on a non existent test script on Domainer Income. For those technical people, this is what it looked like when I ran a packet sniffer over it:

66.249.89.100    HTTP    GET /tbproxy/lh/fixurl?hl=en-US&sd=com.au&url=http%3A%2F%2Fwww.domainerincome.com%2Ftest.php%26id%3Djohn%26session%3D123&sourceid=chrome&error=http404 HTTP/1.1

Yep, its sending it to Google alright. So that got me thinking…. what if this script just blindly accepts stuff like…. the Google home page not existing for instance ? I think I’ll leave that one for the kiddies.

3. Did I just consent for this confidential information to be analyzed by Google? Did you notice how it tried to split up the domain name into words for the search box?

Matt Cuts has stated on his blog that “I believe if Google Chrome sees a very short, stock 404 page (less than 512 bytes), it talks to Google in order to try to suggest other possible pages and options.” Interesting choice of words…. I believe….

Although there has been some healthy paranoia around the licensing agreement, I believe that your:

  • Google Account: Knows your personal information.
  • Google Mail: Analyzes email you send, and email sent to you.
  • Maps: Knows where you are - even on your mobile phone.
  • Search: Knows what you are looking for.
  • Adsense: Knows what you click on = interested in.
  • Analytics: Knows what sites you visit.
  • Checkout: Knows what you buy and who you buy it from.

Can I make it any clearer than that?

When you put it all together, this is far worse than Microsoft back in the 90’s. What do you think?


Affiliate Program | Terms & Conditions | Privacy