What stops Google from saving all the information on my computer through Google Chrome?

  • I noticed that in Google Chrome, if I type in file:///C:/Users/MyUsername/Desktop/ it shows me all of the folders on my Desktop, and I can type open up PDFs and such in chrome just by typing in the file path.

    What processes and systems are in place so that Google is not able to copy data stored on my computer? What processes and systems are in place so that someone who writes a Chrome extension is not able to copy files stored on my computer?

    And would we even know if Google started pulling little bits of information from our computers here and there? Or already are?

    Might be interested in reading about Qubes OS. A more practical workaround might be to install a web browser in a virtual box, e.g. in Hyper-V on Windows 10.

    I don't think this is limited to chrome, pretty much any web browser can do the same thing ... file:/// just says the URI is local to the computer it's installed on.

    @aslum Agreed, Chrome was just my particular example. In the answers and other comments it appears as though it's not even restricted to web browsers.

    @ProQ the pithy, answer that isn't an answer is: The same thing that keeps any other program from doing so: If it did, it would rapidly become known as malware/virus and blocked by AV programs.

    @aslum Chrome's already been caught scanning files. But, dunno if most folks really care that much.

    Storing the contents of everyone's hard drive would take a lot of storage space and cost a lot of money ...and what, if anything, would they stand to gain from that? Do basic business sense and a desire not to be sued out of existence qualify as process and systems?

    News flash: Any exe (not just Chrome or other browsers) has basically unrestricted access to your computer. They can also connect to other computers on the local network (or Internet). I thought this was common knowledge.

    @gre_gor Not common knowledge at all. I'm planning on majoring in computer science, and I had no idea this was possible. I assumed everything was sandboxed by default. I was talking to my dad about this question and learned about the local network connection. (If you could provide a link on how that connection works, that would be wonderful.) I think computer knowledge is being taught at a very different level nowadays, and very few people know that this is how they work. (Me included until I asked.)

    @Nat That really does sound like a bug though, if you already downloaded the files through Chrome then it could have examined them while writing it to your hard drive, it wouldn't make much sense from an espionage perspective to do it again later.

    @MrLore it was going through files that had nothing to do with Chrome (not even downloaded using Chrome). I still think it was a bug, but a weird example that fits this question quite well.

    On a side note, Windows, Word, Excel, Paint, Freecell, and World of Warcraft can all scan your files and make changes to your computer in a manner commensurate with your user permissions. Chrome is no different. It's just another program.

    @Pro Q Sandboxing is a thing with certain *mobile* devices, and with desktop apps that use a non-native framework like Java, and with special OS setups (eg Linux with apparmor). An .exe (or .scr or .dll for that matter) on a Windows PC or server is only restricted by the user permissions and UAC.

    Actually, google already knows enough about you (us) because they track every link you click on a google search. Nowadays, that's pretty much all you need, since a lot of people don't type the website address anymore but look for it on google. They also usually have all the e-mail addresses (and typically phone numbers) of your contacts, they scan the content of your e-mail, so they know about both you and the sender/recipient of the e-mail, they know which videos you watch and so on. Copying the data on your pc is not going to be worth the effort.

    As an aside, there's plenty of tooling available (albeit not necessarily anywhere near free-of-charge) for analyzing what an application is up to -- if Chrome were accessing content it couldn't be expected to, and then doing network transfers of a comparable size, that's not a hard pattern to detect from endpoint reporting that any big corporation with a large security budget will have deployed across their infrastructure.

    If you want more security, you typically run programs in a virtual machine, such that they have no access to the "outer" system.

    If you don't trust a software publisher, don't install their software on your machine.

    I agree with @gre_gor that this is common knowledge that native desktop software you run normally has the same privileges as your file browser. In fact, this question is damn silly. Downvoted.

    ANY browser will do that, though the way the data is displayed will be different. The desktop is just a directory on your hard drive, and browsers can see and display those, they've always been able to do this.

  • Arminius

    Arminius Correct answer

    3 years ago

    What processes and systems are in place so that Google is not able to copy the data on my computer?

    None. Google Chrome usually runs with the permissions of your user account. The application can then read and modify local files to the same extent your user account can. (These permissions apply to most of the programs you're using.) So you need to trust Google in that they don't ship a malicious update that spies on you, or keep sensitive files inaccessible to the account you're running the browser with. Alternatively, there are most likely sandbox implementations for your OS that let you run Chrome in an isolated environment with restricted access to the filesystem.

    What processes and systems are in place so that someone who writes a Chrome extension is not able to copy files on my computer?

    Chrome extensions have limited privileges by default. An extension needs to explicitly request (declare) a permission to interact with documents on the file:// scheme.

    Also note that your browser disallows ordinary websites to read or even redirect to file:// URIs. So while your local files are accessible to the Chrome process, they are not exposed to the web.

    How would I go about making files inaccessible to the account I'm using to run the browser?

    @ProQ That depends on the access control mechanisms of your OS. Simply speaking, have a separate account and set the permissions of sensitive files so that other users can't access them.

    Chrome being able to access your hard drive is why you can upload files by dragging and dropping the filename into a webpage window. "You need to trust Google in that they don't ship a malicious updates that spies on you" Or have vulnerabilities that can be exploited.

    @Arminius wow why isn't this known by many others? I knew that google knows stuff, but this is a completely new level.

    This is also true of almost any other software you run on your PC. Just because it doesn't expose a "file://" browse function, your music player, video player, your Steam games... any or all of them are "trusted" to not scan your stuff and log it. This isn't just a "google" thing.

    @watchme - Don't conflate Google with Chrome. *Your* browser, sitting on *your* system can access your files. But (barring anything malicious) Google itself has no access to any of them.

    @Bobson Well, "barring anything malicious" kind of bypasses the point of the question.

    "ordinary web sites are never allowed to read or even link to file:// URIs" - of course no standard (of HTML) prevents a website from containing the character sequence ``Security.fileuri.strict_origin_policy`

    @DavidZ especially since Google's Code of Conduct motto is no longer "Don't be evil". ...

    @JesseM And sometimes, this trust gets abused. There's this Flight Sim plugin developer who has repeatedly been caught installing password thieving software and malware executable alongside the software, ostensibly as a way to combat piracy.

    @BruceWayne Wait, seriously? That's a bit worrying.

    @JesseM - While "also true of almost any other software you run", you can block data transfer with outbound firewall whitelists. Which is not something you can do to a web browser (without losing all its functionality).

    @BruceWayne & Nat: My understanding is that that provisor, whilst a fun addition that a couple college kids decided to add to their company, doesn't have much legal standing ("evil" not being a legal term), and it's inclusion was becoming a growing concern for much the same way. i.e. Is Chrome version 66.6r... going to be considered evil? Not to most, but some may take issue. It's not about what we think of as the big evils, but the nuisance caused by the differing concept of evil, to each person.

    Not sure where that "don't be evil is no longer Google's motto" story comes from, @BruceWayne. Just open up their Code of Conduct. It's still there, at the very bottom.

    @Bobson Actually, Chrome for Windows actively scans your computer and sends info about suspicious files to Google (and ESET, I assume). So, with that amount of orders from the mothership, it's hard to not assume that whatever Google wants from your computer, Chrome will deliver.

    @Justastudent They removed most references to it, except that single one at the bottom.

    @NigelTouch "_you can block data transfer with outbound firewall whitelists_" But then the program could just use the installed mail agent to send the information as attached file to some address. Or if no such agent is found, to open the browser and the file to a file sharing service. It might be slightly more complicated, but not much. (In may even be easier if you don't know how to use the socket API but know how to launch and interact with other programs.)

License under CC-BY-SA with attribution


Content dated before 7/24/2021 11:53 AM