Google Chrome will add the possibility of rejecting automatic profile synchronization when logging in to company services *
* This feature was introduced with version 69 and caused a mixed community response. The fix will be released only with patch 70 in mid-October.
One of the main scandals around Google over the last week is associated with the inconspicuous, but potentially extremely unpleasant function of automatically connecting a Chrome user profile after logging in to any of the company's resources. At the same time Cookies associated with Google services, it is impossible to delete using browser tools even through advanced browser settings.
A new “feature” of Chome appeared with the latest update to version 69, which, in addition to significant visual changes, brought the audience also a “new UX” in terms of login. Most users do not turn off the use of cookies, preferring security to comfort, but people who are more conscious are in a bad position, as well as all those who need to log in to their Google mail or YouTube account on other people's machines and then clear their browser history.
A few days ago, security specialist Matthew Green posted on his blog an entry “Why I'm done with Chrome,” in which he gives not only a retrospective of browser development, but also a detailed explanation of why “he won't use chrome and use it anymore.”
We need to step back a little and give an understanding of the situation for those who use other browsers, from firewalls to Safari. Google Chrome has a user profile feature that is linked to a gmail email address. This profile stores a lot of user data that is in the cloud and synchronized with the browser at the time of login (if the operation is performed for the first time on this device). At the same time, the user can continue to manually enter his login passwords on Google services (such as Gmail, YouTube and others) without logging into his Google Chrome profile. It seems adequate and convenient, yes?
With update 69, which the company recently delivered to users, everything changed radically, as Matthew noticed: now login on any Google service led to synchronization of the browser with the profile that was associated with this service.
That is, the manual login to the email address pulled the entire user profile of this mail to the browser.
In this case, everything happens in a “quiet” mode and the only thing that visually changes is the user's avatar in the upper right corner of the screen:
Officially, the function is called “Identity consistency between browser and cookie jar” and, according to the company’s experts, is not something criminal or potentially dangerous.
Once the community has more or less understood what is happening, onHacker News and Reddit hit by a storm of criticism. The topic was discussed on other platforms.
After a few days of silence, Google representatives said that they had “heard the community” and a new “feature” would be finalized. Google does not abandon its plans to pull up a user profile in Chrome by logging in to any of the Google services, but now it will make this process more obvious and controllable. Thus, in an official letter from Google, which was published today on the Chrome blog , it says that the company’s agreed-upon entry function is a good decision that will benefit the audience, that is, they don’t intend to abandon it at Google.
At the same time, the company claims that autologin user profile in the browser does not pose a danger, since the synchronization of user data is disabled by default. But, in fact, it depends solely on the browser settings on a particular machine. That is, now, to ensure its own security, the user needs to check whether profile synchronization is enabled in the browser settings or not, and only after that log in to Google services.
In update 70, which will be released in mid-second half of October, promises to make changes to the UI for greater visibility of the new browser features:
According to the Chrome team representative, the data synchronization will be manually started by the user (see the image above and the corresponding button) to ensure an adequate level of security. In fact, now Google is trying to convince everyone around that the new feature “is cool and right,” and everyone else simply doesn’t understand anything in UX and UI.
The only real change that will occur with the release of version 70 will be due to nailing Google’s cookies to the browser. Here the company really went to meet the community and promised to add the ability to delete these files from the browser, which is impossible at the moment.
One of the main scandals around Google over the last week is associated with the inconspicuous, but potentially extremely unpleasant function of automatically connecting a Chrome user profile after logging in to any of the company's resources. At the same time Cookies associated with Google services, it is impossible to delete using browser tools even through advanced browser settings.
A new “feature” of Chome appeared with the latest update to version 69, which, in addition to significant visual changes, brought the audience also a “new UX” in terms of login. Most users do not turn off the use of cookies, preferring security to comfort, but people who are more conscious are in a bad position, as well as all those who need to log in to their Google mail or YouTube account on other people's machines and then clear their browser history.
The essence of the conflict
A few days ago, security specialist Matthew Green posted on his blog an entry “Why I'm done with Chrome,” in which he gives not only a retrospective of browser development, but also a detailed explanation of why “he won't use chrome and use it anymore.”
We need to step back a little and give an understanding of the situation for those who use other browsers, from firewalls to Safari. Google Chrome has a user profile feature that is linked to a gmail email address. This profile stores a lot of user data that is in the cloud and synchronized with the browser at the time of login (if the operation is performed for the first time on this device). At the same time, the user can continue to manually enter his login passwords on Google services (such as Gmail, YouTube and others) without logging into his Google Chrome profile. It seems adequate and convenient, yes?
With update 69, which the company recently delivered to users, everything changed radically, as Matthew noticed: now login on any Google service led to synchronization of the browser with the profile that was associated with this service.
That is, the manual login to the email address pulled the entire user profile of this mail to the browser.
In this case, everything happens in a “quiet” mode and the only thing that visually changes is the user's avatar in the upper right corner of the screen:
Officially, the function is called “Identity consistency between browser and cookie jar” and, according to the company’s experts, is not something criminal or potentially dangerous.
Once the community has more or less understood what is happening, onHacker News and Reddit hit by a storm of criticism. The topic was discussed on other platforms.
It will be fixed, but then
After a few days of silence, Google representatives said that they had “heard the community” and a new “feature” would be finalized. Google does not abandon its plans to pull up a user profile in Chrome by logging in to any of the Google services, but now it will make this process more obvious and controllable. Thus, in an official letter from Google, which was published today on the Chrome blog , it says that the company’s agreed-upon entry function is a good decision that will benefit the audience, that is, they don’t intend to abandon it at Google.
At the same time, the company claims that autologin user profile in the browser does not pose a danger, since the synchronization of user data is disabled by default. But, in fact, it depends solely on the browser settings on a particular machine. That is, now, to ensure its own security, the user needs to check whether profile synchronization is enabled in the browser settings or not, and only after that log in to Google services.
In update 70, which will be released in mid-second half of October, promises to make changes to the UI for greater visibility of the new browser features:
According to the Chrome team representative, the data synchronization will be manually started by the user (see the image above and the corresponding button) to ensure an adequate level of security. In fact, now Google is trying to convince everyone around that the new feature “is cool and right,” and everyone else simply doesn’t understand anything in UX and UI.
The only real change that will occur with the release of version 70 will be due to nailing Google’s cookies to the browser. Here the company really went to meet the community and promised to add the ability to delete these files from the browser, which is impossible at the moment.
Only registered users can participate in the survey. Sign in , please.