Google has been stealth downloading audio listeners onto every computer that runs Chrome

[Shelley]

----------
On June 21, 2015 1:14:32 PM Seth <list at sysfu.com> wrote:

>  from
> https://www.privateinternetaccess.com/blog/2015/06/google-chrome-listening-in-to-your-room-shows-the-importance-of-privacy-defense-in-depth/
>
>
> Posted on June 18, 2015 by Rick Falkvinge
>
> Google Chrome Listening In To Your Room Shows The Importance Of Privacy
> Defense In Depth


Wow, this is exactly the kind of bullshit- and bullshit response- I'd 
expect from this duplicitous NSA asset.

I keep a seldom-used, older version of chromium on one of my debian laptops 
so I'll check for this.  My webcam and microphone are physically 
disconnected anyway, but I still want to see if their spyware has infected 
my system.  Fuckers.

Thanks for posting this; I've been out of the news loop for a couple of days.

-S


>
> Yesterday, news broke that Google has been stealth downloading audio
> listeners onto every computer that runs Chrome, and transmits audio data
> back to Google. Effectively, this means that Google had taken itself the
> right to listen to every conversation in every room that runs Chrome
> somewhere, without any kind of consent from the people eavesdropped on. In
> official statements, Google shrugged off the practice with what amounts to
> “we can do that”.
>
> It looked like just another bug report. "When I start Chromium, it
> downloads something." Followed by strange status information that notably
> included the lines "Microphone: Yes" and "Audio Capture Allowed: Yes".
>
> chrome-voicesearch
>
> Without consent, Google’s code had downloaded a black box of code that –
> according to itself – had turned on the microphone and was actively
> listening to your room.
>
> A brief explanation of the Open-source / Free-software philosophy is
> needed here. When you’re installing a version of GNU/Linux like Debian or
> Ubuntu onto a fresh computer, thousands of really smart people have
> analyzed every line of human-readable source code before that operating
> system was built into computer-executable binary code, to make it common
> and open knowledge what the machine actually does instead of trusting
> corporate statements on what it’s supposed to be doing. Therefore, you
> don’t install black boxes onto a Debian or Ubuntu system; you use software
> repositories that have gone through this source-code audit-then-build
> process. Maintainers of operating systems like Debian and Ubuntu use many
> so-called “upstreams” of source code to build the final product.
>
> Chromium, the open-source version of Google Chrome, had abused its
> position as trusted upstream to insert lines of source code that bypassed
> this audit-then-build process, and which downloaded and installed a black
> box of unverifiable executable code directly onto computers, essentially
> rendering them compromised. We don’t know and can’t know what this black
> box does. But we see reports that the microphone has been activated, and
> that Chromium considers audio capture permitted.
>
> This was supposedly to enable the “Ok, Google” behavior – that when you
> say certain words, a search function is activated. Certainly a useful
> feature. Certainly something that enables eavesdropping of every
> conversation in the entire room, too.
>
> Obviously, your own computer isn’t the one to analyze the actual search
> command. Google’s servers do. Which means that your computer had been
> stealth configured to send what was being said in your room to somebody
> else, to a private company in another country, without your consent or
> knowledge, an audio transmission triggered by… an unknown and unverifiable
> set of conditions.
>
> Google had two responses to this. The first was to introduce a
> practically-undocumented switch to opt out of this behavior, which is not
> a fix: the default install will still wiretap your room without your
> consent, unless you opt out, and more importantly, know that you need to
> opt out, which is nowhere a reasonable requirement. But the second was
> more of an official statement following technical discussions on Hacker
> News and other places. That official statement amounted to three parts
> (paraphrased, of course):
>
> 1) Yes, we’re downloading and installing a wiretapping black-box to your
> computer. But we’re not actually activating it. We did take advantage of
> our position as trusted upstream to stealth-insert code into open-source
> software that installed this black box onto millions of computers, but we
> would never abuse the same trust in the same way to insert code that
> activates the eavesdropping-blackbox we already downloaded and installed
> onto your computer without your consent or knowledge. You can look at the
> code as it looks right now to see that the code doesn’t do this right now.
>
> 2) Yes, Chromium is bypassing the entire source code auditing process by
> downloading a pre-built black box onto people’s computers. But that’s not
> something we care about, really. We’re concerned with building Google
> Chrome, the product from Google. As part of that, we provide the source
> code for others to package if they like. Anybody who uses our code for
> their own purpose takes responsibility for it. When this happens in a
> Debian installation, it is not Google Chrome’s behavior, this is Debian
> Chromium’s behavior. It’s Debian’s responsibility entirely.
>
> 3) Yes, we deliberately hid this listening module from the users, but
> that’s because we consider this behavior to be part of the basic Google
> Chrome experience. We don’t want to show all modules that we install
> ourselves.
>
> If you think this is an excusable and responsible statement, raise your
> hand now.
>
> Now, it should be noted that this was Chromium, the open-source version of
> Chrome. If somebody downloads the Google product Google Chrome, as in the
> prepackaged binary, you don’t even get a theoretical choice. You’re
> already downloading a black box from a vendor. In Google Chrome, this is
> all included from the start.
>
> This episode highlights the need for hard, not soft, switches to all
> devices – webcams, microphones – that can be used for surveillance. A
> software on/off switch for a webcam is no longer enough, a hard shield in
> front of the lens is required. A software on/off switch for a microphone
> is no longer enough, a physical switch that breaks its electrical
> connection is required. That’s how you defend against this in depth.
>
> Of course, people were quick to downplay the alarm. “It only listens when
> you say ‘Ok, Google’.” (Ok, so how does it know to start listening just
> before I’m about to say ‘Ok, Google?’) “It’s no big deal.” (A company
> stealth installs an audio listener that listens to every room in the world
> it can, and transmits audio data to the mothership when it encounters an
> unknown, possibly individually tailored, list of keywords – and it’s no
> big deal!?) “You can opt out. It’s in the Terms of Service.” (No. Just no.
> This is not something that is the slightest amount of permissible just
> because it’s hidden in legalese.) “It’s opt-in. It won’t really listen
> unless you check that box.” (Perhaps. We don’t know, Google just
> downloaded a black box onto my computer. And it may not be the same black
> box as was downloaded onto yours. )
>
> Early last decade, privacy activists practically yelled and screamed that
> the NSA’s taps of various points of the Internet and telecom networks had
> the technical potential for enormous abuse against privacy. Everybody else
> dismissed those points as basically tinfoilhattery – until the Snowden
> files came out, and it was revealed that precisely everybody involved had
> abused their technical capability for invasion of privacy as far as was
> possible.
>
> Perhaps it would be wise to not repeat that exact mistake. Nobody, and I
> really mean nobody, is to be trusted with a technical capability to listen
> to every room in the world, with listening profiles customizable at the
> identified-individual level, on the mere basis of “trust us”.
>
> Privacy remains your own responsibility.
>
> Rick Falkvinge
> ABOUT RICK FALKVINGE
> Rick is the founder of the first Pirate Party and is a political
> evangelist, traveling around Europe and the world to talk and write about
> ideas of a sensible information policy. He has a tech entrepreneur
> background and loves whisky. Read more of his articles on his website.
>
> Twitter |More Posts (91)
>