Google Chrome has an API accesible only from *.google.com

https://twitter.com/lcasdev/status/1810696257137959018

by develatio • 2 years ago

895 316 2 years ago

twitter.com

bonestamp2• 2 years ago

Is it fair to assume this is used for fingerprinting/tracking users?

diggan• 2 years ago

The tweet says:

So, Google Chrome gives all *.google.com sites full access to system / tab CPU usage, GPU usage, and memory usage. It also gives access to detailed processor information, and provides a logging backchannel.

Those things can absolutely be used to "improve" fingerprinting. I don't think it's fair to assume it's being used for that though, without any further evidence. But it certainly could be used for it.

Anyone have any further context? As it stands right now, it's just a random claim without any proof what so ever? There is link in another comment, but how is that related to the tweet?

CoastalCoder2• 2 years ago

I don't think it's fair to assume it's being used for that though, without any further evidence.

Maybe in this situation we should distinguish "fair" vs. "probable".

I'd guess it's improbable that Google is trying to use this for fingerprinting.

But if we've previously found them with their hand in the cookie jar, then maybe it's fair to treat them as guilty until proven innocent?

rolph• 2 years ago

perhaps a measure to determine if the owners devices can tolerate one more web app or ad stream before it runs out of resources

plorkyeran• 2 years ago

Google doesn't need any extra help to track users who are browsing Google sites in the Google browser. It is probably instead anticompetitive functionality that lets Google sites work better in Chrome in ways that other sites can't replicate.

account425• 2 years ago

Google doesn't need any extra help to track users who are browsing Google sites in the Google browser.

I would not be surprised if there are cases where this would let them track users they otherwise couldn't. Like someone running two isolated Chrome instances with separate network connections but on the same PC.

MisterDizzy• 2 years ago

Hardly surprising. This is very Google-like behavior. The question is do other Chromium browsers have this? Edge? Brave? Chromium? Ungoogled Chromium?

bakugo• 2 years ago

Don't know about the rest, but ungoogled chromium scrambles every occurrence of the string "google" in the code specifically to avoid things like this, so probably not.

idunnoman1222• 2 years ago

Scrambles to a static unpurchased domain?

xigoi• 2 years ago

What if it’s checking a hash of the domain name?

yreg• 2 years ago

Unless Chromium does something like atob("Z29vZ2xlLmNvbQ==")

burkaman2• 2 years ago

It is disabled: https://github.com/ungoogled-software/ungoogled-chromium/blo...

If this flag is true then the extension is added: https://source.chromium.org/chromium/chromium/src/+/main:chr... and https://source.chromium.org/chromium/chromium/src/+/main:chr...

burkaman2• 2 years ago

Yes, Edge has it enabled. If you open Google Meet troubleshooting in Edge you can see your system CPU. If you try it in Firefox it says "Try Google Chrome to see your CPU usage".

pcwalton• 2 years ago

Google has done this sort of thing before. My memory is fuzzy as to the details, but I think it was Native Client being allowlisted at the domain level to only work on Hangouts, or something like that.

beardyw• 2 years ago

What has an hidden API where? I have no idea what this is trying to say. Can anyone make sense of it?

emilsedgh• 2 years ago

Google allows web pages from *.google.com to read a user's cpu usage, gpu usage, etc.

Other web pages don't have such access.

sophiebits4• 2 years ago

Websites hosted on the google.com domain can access more data about the device than websites hosted on any other domain.

josephcsible2• 2 years ago

https://source.chromium.org/chromium/chromium/src/+/main:chr...

That API is baked into Google Chrome. It's hardcoded to only let google.com use it.

jeffbee4• 2 years ago

I don't think that is an accurate description. The APIs are available in Chrome to anyone: https://developer.chrome.com/docs/extensions/reference/api/s...

The allowlisting going on here is that normally when you install an extension in Chrome it asks you to confirm the access to those APIs on the sites where the extension wants to run, but this one comes pre-confirmed from the factory. A quick GitHub search finds ~1000 manifest files that list system.cpu, possibly because that API is also in the boilerplate example chrome extension manifest.

ranger_danger6• 2 years ago

That is the source code of Chromium, not Chrome.

Loic• 2 years ago

If correct, once you access a `.google.com` website, the browser makes available through javascript an API allowing the querying of a lot of information about all the open tabs (if open, for example, your banking website) and can send the collected information to the "mother ship".

If true, as usually, a lot of people have a Google tab open, you can easily deduct what it means.

This is definitely something to be investigated, for the moment, we only have a tweet.

happyopossum• 2 years ago

an API allowing the querying of a lot of information about all the open tabs (if open, for example, your banking website)

No. It uses the chrome.system.cpu API, that any extension can access, which gives CPU and RAM utilization info about your tabs. It doesn't give anyone "a lot of information about all the open tabs", and does nothing to expose your banking website...

https://developer.chrome.com/docs/extensions/reference/api/s...

jeffbee4• 2 years ago

You can build Chrome without this by setting `enable_hangout_services_extension` to false. Of course, then none of the WebRTC stuff on google.com will work.

ramesh312• 2 years ago

One does not simply "build chrome".

tgv• 2 years ago

Chromium has ungoogled builds: https://chromium.woolyss.com/

lifesaverluke2• 2 years ago

The process is well documented :-)

daft_pink• 2 years ago

i just want to know if this is built into arc to be honest.

autoexec2• 2 years ago

No WebRTC would be a win, but people can just use firefox and disable WebRTC globally.

htrp• 2 years ago

So, Google Chrome gives all *.google.com sites full access to system / tab CPU usage, GPU usage, and memory usage. It also gives access to detailed processor information, and provides a logging backchannel.

So I guess the question becomes how quickly you can spoof this ?

justo-rivera• 2 years ago

You just need to "register" a subdomain. So basically any google employee has potentially full access to your system?

sophiebits4• 2 years ago

You’re likely severely underestimating the amount of internal paperwork and review that is required to launch a new google.com subdomain.

drpossum5• 2 years ago

Or anyone who controls your DNS resolution which has a number of paths (for example a local hosts file, possibly a router, changing your config or how you get your config to a malicious DNS server, etc)

mywittyname• 2 years ago

Is it really that easy? I just kind of assumed that devs could create subdomains under a dev TLD like googdev123.com, but not google.com until it was a fully-fledged product release.

Tiberium2• 2 years ago

In what world does "system / tab CPU usage, GPU usage, and memory usage" mean "full access to the system"? Any Chrome extension can access this info easily, the point that the tweet makes is that there's a built-in Chrome extension that shares this info with Google's own websites without any confirmation.

nashashmi• 2 years ago

Drive.google.com links also work

mysterydip• 2 years ago

What about anything on sites.google.com?

lyu072823• 2 years ago

full access to your system

Only to leak your CPU/GPU utilization though as far as I understand it. Those can also be exposed in other ways by legitimate JS/WebGPU by measuring/profiling shader runs/etc.

sophiebits4• 2 years ago

If you mean can another domain trick Chrome into letting it access those APIs… probably not; it seems it’s based on the browser extension architecture which is already somewhat hardened and I believe doesn’t even load the code for the extension if you’re not on a matching domain (though the typical protection goes the other way around — preventing extensions from accessing website data without permission).

darby_nine• 2 years ago

It seems bad enough that Google has access to it to justify ripping it out.

lyu072823• 2 years ago

Pretty much impossible, would need to defeat https/ct. You would have to spoof *.google.com within chrome.

jandrese• 2 years ago

So if you install your own certificate authority and then spoof the DNS it might be possible? Not so useful as an attack vector, but potentially useful for people who want to do fun things with the browsers they own.

AnimalMuppet• 2 years ago

Don't have to spoof it - just put something on Google Docs and send people a link.

sophiebits4• 2 years ago

Google Docs is designed to not let you run arbitrary JS in a trusted (i.e. google.com origin) context, or else the author of any doc you visit could act as you on Google properties.

fjni• 2 years ago

Wouldn't you be able to deploy an app script website, which is hosted on "script.google.com" and make use of this?

jhdifdhsak4• 2 years ago

your code do not run from that domain at all.

pixl97• 2 years ago

Does Chrome do certificate pinning checking in this case?

jeffbee4• 2 years ago

If you could spoof google.com you have much bigger fish to fry.

bastien2• 2 years ago

This just in: Google Spyware has features accessible only to Google.

blackeyeblitzar• 2 years ago

So this is a lot like Microsoft using specialized formats or APIs in Windows that competitors cannot access, which was a problem throughout the 90s. The problem never went away - it has just changed appearance.

Brian_K_White• 2 years ago

This is a little different than Office being able to use some useful OS integration feature that LibreOffice can't use.

This is allowing Google to do something TO you that no one else can do to you, and that you assumed no one could do to you.

baggy_trough• 2 years ago

Wonder if Edge renames this to *.microsoft.com or bing.com.

FateOfNations5• 2 years ago

Probably not. It's part of a bundled extension used to support Google Hangouts.

mcpar-land• 2 years ago

Google spent billions muscling their way into their majority market share of web browsers, now they're going to keep on cashing out with unfair practices like these.

ethanppl• 2 years ago

I wonder how Chromium, Brave or Edge handle this?

newzisforsukas2• 2 years ago

Its in the chromium repo:

https://source.chromium.org/chromium/chromium/src/+/main:chr...

newzisforsukas2• 2 years ago

You also could probably block this with a policy file.

The extension ID is: nkeimhogjdpnpccoofpliimaahmaaome

https://chromeenterprise.google/policies/?policy=ExtensionIn...

jgalt212• 2 years ago

It's like Google relishes in giving the FTC all the help it could ever want.

ranger_danger6• 2 years ago

madeofpalk2• 2 years ago

I'm not sure what these APIs are exactly and why they're there, but Firefox also does something similar. It has special APIs available only to Mozilla and/or Firefox domains, for things like installing extensions, or helping with first-run experience.

A blog post about it was shared here on Hacker news <12 months ago, but I'm having trouble finding it...

jhdifdhsak4• 2 years ago

Hardly the same.

apis are public, documented and the domain allowlist is both included in the UI and about:config (save from android playstore version where they hide everything to make the browser pure garbage for whatever reason)

and I'm pretty sure devs would at least think about adding your domain by default if you ask nicely with a great use case on bugzilla.

nightpool• 2 years ago

What? You think that Mozilla devs would think about adding your domain to the whitelist of domains allowed to install extensions if you just asked nicely? That would be insane from a security perspective.

Osmose• 2 years ago

I wrote a post about the UITour parts a long time ago: https://www.mkelly.me/blog/content-uitourjs/

It's pretty standard among browsers. The risk should be about equal to someone spoofing the domains that the browser downloads software updates from, and you can turn it off via prefs if you really don't want it.

xxmarkuski• 2 years ago

A commit to Webkits Quirks.cpp was shared last month [0]. Probably not what you are referring to but has a similar vibe.

[0] https://news.ycombinator.com/item?id=40631439

kelnos5• 2 years ago

Not really. Browser developers add lots of different website-specific hacks to make sites behave better in their browser. Mozilla actually used to do this a lot, when they were originally the underdog 20+ years ago and were trying to get people to switch to the Mozilla suite (and then Firefox), when the argument against switching was often related to websites not working or rendering properly in Mozilla/Firefox that behaved properly in IE.

(Not that this is not the same thing as a website developer adding browser-specific hacks to make their site behave better/worse in a particular browser.)

thayne• 2 years ago

But that is for websites directly related to operating the browser, whereas chrome is exposing APIs used by unrelated google products such as google meet.

This could possibly also be a violation of anti-trust laws since it is using a monopoly in one market (browsers) to get an advantage in another (video conferencing).

kelnos5• 2 years ago

Those are APIs related to browser functionality and onboarding. They're not there to advantage one of Mozilla's other product offerings at the expense of similar products offered by other companies.

account425• 2 years ago

Yes and they should also be criticized for it. Mozilla isn't exactly known for caring about privacy even if their marketing wants you to believe otherwise.

As for the anti-trust aspect, here the market share matters and Firefox is insignificant in that regard.

Tiberium2• 2 years ago

I think the submission is a bit wrong in editing the title from the original. I understood it like this:

Chrome has a built-in extension that uses public Chrome APIs that are easily available to other Chrome extensions. The issue described is that this extension shares this information to Google's own domains when they're communicating with the extension, while other websites can't do this.

There's no "special hidden API".

Cyphus• 2 years ago

"special" in the sense that unlike other extensions which are user-installed, this one is built into Chrome.

"hidden" in the sense that when I go to chrome://extensions it is not listed.

And as you already mentioned, it's a Chrome API.

danans3• 2 years ago

There is potentially an innocuous and straightforward explanation for this. Imagine the browser comes with some functionality implemented as a google.com-signed web app (as opposed to compiled/linked C++ as a lot of the older Chrome UI).

It would be silly if that PWA-implemented browser code would need permission to access the system information, since it is part of the browser's functionality itself.

Another use case for a private API (that has long existed) is integration of the Chrome browser with Google-specific websites that provide core functionality, like the Chrome Web store, to allow for installation/removal of extensions from a web page.

ranger_danger6• 2 years ago

Any time things like this are needed, I think it should ask the user for permission first.

runarberg2• 2 years ago

I think it is a mistake to give a company like Google the benefit of the doubt. Consumer protection is a lot like security, we should theorize the worst case scenario, and assume the company is willing to work against consumer interest if it serves their own interests.

If there exists a mundane and reasonable explanation for this, that doesn’t matter if there also exists a potential to exploit it in a way that harms consumers’ interests.

parhamn• 2 years ago

Same thing with more steps?

silverwind• 2 years ago

A "built-in extension" is still part of the browser unless it can be disabled.

lwansbrough4• 2 years ago

This is functionally equivalent.

simonw3• 2 years ago

Paste this into a Chrome DevTools console on a Google site - sure looks like a special API to me:

    chrome.runtime.sendMessage(
        'nkeimhogjdpnpccoofpliimaahmaaome', {
            method: 'cpu.getInfo'
        }, response => {
            console.log('CPU Info:\n', JSON.stringify(response, null, 2));
        }
    );

Jcampuzano2• 2 years ago

For what its worth, I'm on Brave (chromium based) and this also works there, so it appears to not necessarily be only Chrome but potentially any chromium browser where they haven't specifically blocked/disabled this

replete• 2 years ago

This does not work (as expected) on `ungoogled-chromium`.

chrsig2• 2 years ago

Is there more of an explanation? I see a baseless claim without any specificity.

I'm not saying it's right/wrong, just that no evidence was presented.

develatio• 2 years ago

There is a link pointing out the exact place in Chrome's code.

FateOfNations5• 2 years ago

Chrome extensions can access CPU and GPU statistics via a public API that any extension developer can use. Google Chrome comes bundled with a hidden "Hangouts Services" extension, which has permissions for *.google.com (that extension's ID is the 'nkeimhogjdpnpccoofpliimaahmaaome' referenced in the examples). That extension has a function that will return those stats when called from JavaScript running on a webpage. As a result, any JavaScript running on *.google.com can get the current CPU and GPU utilization.

chrsig2• 2 years ago

Hmm. I'm going to go ahead and blame twitter here. I don't see any additional links in the tweet or anything.

mmsc• 2 years ago

And? Google uses Chrome to retrieve data about the user.

Every Chromium-based browser has 'hidden' APIs only accessible on certain domains. That's how the custom (read: closed source) extensions work. "Component extensions" are used to interact with them normally: https://chromium.googlesource.com/chromium/src/+/main/extens...

See https://blogs.opera.com/security/2021/09/8000-bug-bounty-hig... and https://blogs.opera.com/security/2021/09/bug-bounty-guest-po... for examples of when there are vulnerabilities in those extensions, and how they can be abused for remote code execution.

Any whitelisted domains for these APIs cannot be written to using user-installed extensions, in order for a malicious extension to not be able to inject a script and execute the special API.

At Opera, we previously tried attacking the underlying implementation about how these 'hidden' APIs are accessible. Although we found a lot of Opera-specific issues, the Chromium logic seems sound and a "bypass" for other websites accessing the API is unlikely. It also seems that the developer here was just a bit overzealous in allowing this API to be accessed from all google.com subdomains.

jhdifdhsak4• 2 years ago

technically correct. google chrome should forever be called "Tainted Chromium" to use the same nomenclature as the Linux Kernel when you load blobs.

CMYKninja• 2 years ago

I can hear the regulators in Strasbourg typing up complaints and fines now.

lashkari• 2 years ago

If it's really accessible from *.google.com, wouldn't this be simple to verify/exploit by using Google Sites (they publish your site to sites.google.com/view/<sitename>)?

DownrightNifty• 2 years ago

JS on Google Sites, Apps Script, etc. runs on *.googleusercontent.com, otherwise cookie-stealing XSS happens.

simonw3• 2 years ago

Looks like they added this in October 2013: https://github.com/chromium/chromium/commit/422c736b82e7ee76...

    Bundle Hangouts Services extension with Chrome

    BUG=291271

    Review URL: https://codereview.chromium.org/35873003

Here's that review URL: https://codereview.chromium.org/35873003

_9yre• 2 years ago

Disclaimer: I work at Google, but not on Chrome or on these APIs.

I think the explanation is quite mundane. An example usage: open google meet, start an empty meeting (an “instant meeting”), click the “…” menu, click “troubleshooting and help”.

There’ll be plots of various stats, including CPU utilization. I think meet will also helpfully suggest closing tabs if your machine is overloaded during a meet call, too.

It’s very helpful, I check it from time to time.

Edit: now that I think about it, I’m not sure about the suggestion to close tabs is actually a thing. I’ve only actually used the stats view.

john-n• 2 years ago

I believe this is the point, rather than being mundane. Other video conference tools are not able to offer this debugging option - which you have pointed out is useful.

tantalor2• 2 years ago

The user could easily install an extension that provides the same debugging capability. Most users don't care, so they won't need it.

3D30497420• 2 years ago

Are features like this available to other websites outside of Google? Say, could Zoom also add a feature like this?

RIMR2• 2 years ago

A level playing field for competition? This is Google we're talking about.

SirMaster2• 2 years ago

If Zoom makes a chrome extension, then yes.

jhdifdhsak4• 2 years ago

if we are guessing I would drawn my guess from the hyper controlled access to android play services, which do much more than what you are guessing.

my guess would also include some nifty debug info from FLoC ;)

RIMR2• 2 years ago

Very cool that Google built an anticompetitive browser that offers such useful features only to themselves.

Very cool of you as a Google employee to say the quiet part out loud for us.

danielmarkbruce• 2 years ago

Are customers better off or worse off?

miki123211• 2 years ago

I think the explanation is quite mundane
There’ll be plots of various stats, including CPU utilization. I think meet will also helpfully suggest closing tabs if your machine is overloaded

This is not mundane at all, it's a perfect example of giving your product an unfair competitive advantage.

If Meet users are told why their meeting isn't working correctly but Zoom, Teams and Slack, Meet users are going to have a better experience that Zoom, Teams or Slack has no way of replicating.

No wonder every other meeting provider pushes you aggressively into using their desktop app, Google Meet's desktop app is just Chrome!

trealira2• 2 years ago

If Meet users are told why their meeting isn't working correctly but Zoom, Teams and Slack, Meet users are going to have a better experience that Zoom, Teams or Slack has no way of replicating.

I had to re-read this a few times; did you accidentally omit a word?

If Meet users are told why their meeting isn't working correctly but Zoom, Teams and Slack aren't, Meet users are going to have a better experience that Zoom, Teams or Slack has no way of replicating.

I fully agree with you, though; it's anticompetitive for them to use Chrome to give their other products an advantage.

hot_gril8• 2 years ago

At least other video conferencing tools don't lag like Meet, so users don't need to debug ;) I think this has to do with all of them using H.264 while Meet uses VP8/9.

flanqueue• 2 years ago

Example of why this is not mundane https://x.com/fedekauffman/status/1811019707165856259

vundercind• 2 years ago

Oh wow.

This explanation was the first I read of what this actually does (yeah, yeah, I didn’t read the linked article first) and that’s a lot worse than I expected.

tamimio• 2 years ago

And they do the same thing with YouTube by slowing down the initial load in other browsers. Google is evil, and this is the least of it.

justanotheratom• 2 years ago

"don't be evil"

lucacasonato4• 2 years ago

I agree it is very useful! This is also how I discovered this in the first place.

But that is not at all my point. The point is that google.com web properties have access to an API and a browser capability that is not available to it's competitors. Google only allows reading CPU info for itself.

The reason the data is not available for everyone, is because it would be a huge tracking vector. Same reason we don't allow webpages to read the device hostname, or username, or Chrome profile name. Google exposes this to google.com because it trusts itself. That poses this antitrust issue though.

oldkinglog• 2 years ago

Monopoly leveraging is illegal, not mundane.

not2b2• 2 years ago

You have a competitor, Zoom. They have an in-browser version. Can they use this API for troubleshooting performance issues? No? The European regulators might be interested in that.

Perhaps this is one reason why Meet performs well in the browser and Zoom doesn't, meaning Zoom users use the native app if they want reasonable performance (particularly with many people in the meeting).

paledot• 2 years ago

Mind you, Zoom does everything in their power to steer users away from their web client and toward their ~~malware~~ desktop client, so I don't think they're too upset about the status quo.

FateOfNations5• 2 years ago

Apparently, this system statistics API is generally available to extension developers. The underlying issue is that they bundle a hidden "Hangouts Service Extension" with Chrome. Zoom, Teams, etc. would have access to this API through a Chrome extension, although they wouldn't have the advantage of having that extension pre-installed.

trickstra2• 2 years ago

So helpful that no other website and no other browser can use it?

heavyset_go• 2 years ago

Looking forward to seeing this comment in discovery

creatonez• 2 years ago

The monopolists' first step towards unfairly dominating a market always seems pretty mundane.

beefnugs• 2 years ago

Yeah a whole lot of things really do seem mundane... once you have already accepted the fact you are tracked down to the cpu-percentage-usage-in-time level

toenail• 2 years ago

Hm, I guess it's good I have a firewall?

aflag2• 2 years ago

How does that help?

timbit42• 2 years ago

You could block *.google.com

simonw3• 2 years ago

If you want to see what this does, navigate to https://www.google.com/ in Chrome and paste this into your DevTools console:

    chrome.runtime.sendMessage(
        'nkeimhogjdpnpccoofpliimaahmaaome', {
            method: 'cpu.getInfo'
        }, response => {
            console.log('CPU Info:\n', JSON.stringify(response, null, 2));
        }
    );

I got this:

    {
      "value": {
        "archName": "arm64",
        "features": [],
        "modelName": "Apple M2 Max",
        "numOfProcessors": 12,
        "processors": [
          {
            "usage": {
              "idle": 26879793,
              "kernel": 5270058,
              "total": 42511068,
              "user": 10361217
            }
          },
          {
            "usage": {
              "idle": 27925505,
              "kernel": 5045974,
              "total": 42900999,
              "user": 9929520
            }
          },
          {
            "usage": {
              "idle": 29153545,
              "kernel": 4688719,
              "total": 43152989,
              "user": 9310725
            }
          },
          {
            "usage": {
              "idle": 30140852,
              "kernel": 4360719,
              "total": 43319960,
              "user": 8818389
            }
          },
          {
            "usage": {
              "idle": 34426211,
              "kernel": 2169516,
              "total": 43433582,
              "user": 6837855
            }
          },
          {
            "usage": {
              "idle": 38586206,
              "kernel": 1338183,
              "total": 43658789,
              "user": 3734400
            }
          },
          {
            "usage": {
              "idle": 41067872,
              "kernel": 598226,
              "total": 43874597,
              "user": 2208499
            }
          },
          {
            "usage": {
              "idle": 41795321,
              "kernel": 412479,
              "total": 43965499,
              "user": 1757699
            }
          },
          {
            "usage": {
              "idle": 34484688,
              "kernel": 2180147,
              "total": 43500079,
              "user": 6835244
            }
          },
          {
            "usage": {
              "idle": 38604714,
              "kernel": 1340358,
              "total": 43680869,
              "user": 3735797
            }
          },
          {
            "usage": {
              "idle": 41086212,
              "kernel": 599273,
              "total": 43883401,
              "user": 2197916
            }
          },
          {
            "usage": {
              "idle": 41802500,
              "kernel": 411499,
              "total": 43970596,
              "user": 1756597
            }
          }
        ],
        "temperatures": []
      }
    }

This won't work on non-Google URLs.

CoastalCoder2• 2 years ago

I'm glad that, at least, CPU ID isn't part of that.

Actually, do modern Macs even allow normal software to discover the CPU ID?

leros2• 2 years ago

I briefly worked on Internet Explorer in ages past. They would develop APIs with the Windows team for use in IE to give IE special features that other browsers couldn't implement.

kelnos5• 2 years ago

And isn't this one of the many things Microsoft got in trouble for with the DoJ's antri-trust enforcement division in the 90s?

leros2• 2 years ago

My experience was well after that.

tantalor2• 2 years ago

Looks like this is accessing "chrome.system.cpu" API, which any extension can access (given the "system.cpu" permissions).

https://developer.chrome.com/docs/extensions/reference/api/s...

You can see all the permissions requested by this extension here:

https://source.chromium.org/chromium/chromium/src/+/main:chr...

kelnos5• 2 years ago

Yes, and that's the issue: Google is bundling an extension into Chrome that is unrelated to the operation of the browser itself, which gives another one of its products (Hangouts) privileged access that no other videoconferencing app has, at least not without the big step of getting users to manually install another extension.

Palmik• 2 years ago

People arguing that this is "just extension" are ignoring the fact that extensions have special priviledges compared to websites, and you would not want all websites to have the full power of arbitrary extension.

If it's "just extension", make it available to all domains.

FateOfNations5• 2 years ago

The primary "special privilege" is that the extension is shipped with the browser and hidden. The API itself is available to any extension developer.

https://developer.chrome.com/docs/extensions/reference/api/s...

lwansbrough4• 2 years ago

For anyone having trouble with the logic here, which seems like a lot of people in this thread for some reason:

[Google's browser] comes with [code] that [does things] in a default installation of [Google's browser] that [Google's competitors] can't do in a default installation of [Google's browser].

SahAssar2• 2 years ago

Didn't you leave out that [Google's browser] allows [Google's websites] to do things [other websites] cannot?

Ostensibly [Google's websites] are websites like any other, but [Google's browser] treats them differently. IIRC Mozilla does similar things for addons.mozilla.org, but googles seem more broad since they are not as clearly linked to browser functionality.

lwansbrough4• 2 years ago

We’re saying the same thing. There are some who believe this is okay. But it is clearly monopolistic behaviour that should be regulated.

kristjansson3• 2 years ago

[does relatively innocuous, relatively boring things]

ffhhj• 2 years ago

Like [slowing Youtube down] on [Firefox] [0].

[0] https://www.zdnet.com/article/youtube-is-slowing-video-loads...

some_random2• 2 years ago

That only Google can do, which makes competing with them harder. This isn't difficult to understand.

paulddraper• 2 years ago

Can you elaborate?

Is it just Google's competitors, or it is everyone?

Suppafly4• 2 years ago

I don't have a problem with the logic, I'm just not sure why I should care. I imagine Edge probably can do magic stuff on microsoft sites that it can't on the rest of the web too. It makes sense for the browser to have a higher level of trust for the company that makes it than it does for the wider web.

lupire3• 2 years ago

There was massive antitrust lawsuit about behavior like this, when browses where new.

shadowgovt5• 2 years ago

Some people remember when the government went after Microsoft for having secret APIs that only IE could use.

... but other people remember that in the time since, that entire Microsoft monopoly fiasco is held up as an example of bad prosecution, and we don't go after companies like that anymore.

mike_hearn3• 2 years ago

The name hangout_services suggests this is some old tech debty hack intended to make developing Google Hangouts easier by giving that team a direct stream of telemetry. For those who have forgotten, Hangouts was the first app that did video calling in the browser using what became WebRTC. If you look at what this module is doing it's exposing stuff like CPU/GPU/RAM usage/hardware details back to the app that it wouldn't normally have.

My guess is that Google will react to this Twitter thread by simply deleting it. Hangouts has been a dead product for a while; if their server side code still uses it they can surely remove it as presumably the Chrome team monitor WebRTC performance themselves in a multi-site way now, given the much wider usage.

lucacasonato4• 2 years ago

No, this is used by Google Meet right now. Open the "Troubleshooting" panel in meet.google.com in Chrome, and you'll see live system wide CPU usage reporting :)

mike_hearn3• 2 years ago

Right, Meet is derived from the Hangouts codebase, I still think they'll probably just delete it. Meet is a stable product, how valuable is this special privilege now?

cxr• 2 years ago

In principle, that's something that could be allowed without giving access "to" Google/the site owner—even allowing the site author to provide their own functions for formatting and drawing the values—and thus could be allowed for _any_ website. Designing and implementing it is a fun technical problem, so it's a wonder why it wasn't, considering the motivations of a typical programmer (and those at Google especially).

Cthulhu_• 2 years ago

Could it be that it tracks CPU / GPU usage etc to finetune what quality video streams to use? It's nonstandard but I can well imagine a native app would do this as well.

account425• 2 years ago

Apart from the privacy violation, isn't this a clear antitrust issue - Google is misusing their Browser dominance to give themselves and edge in the videoconferencing space.

kderbyma• 2 years ago

That was one reason I don't use Chrome. They clearly do special stuff on their sites. And spyware is guaranteed with chrome

dijit• 2 years ago

This kind of thing is common, there was a file called tweaks.cpp which had a list of domains that had slightly different behaviours.

That file was very telling to be honest and was well commenter. Firefox has a similar file.

cpeterso• 2 years ago

Firefox’s website “interventions” are documented on Firefox’s about:compat page. Each intervention has a link to more information about the website issue it’s fixing and a button to turn it off.

locallost• 2 years ago

Is this how they implement features like pinning a live game score in your phone from the browser? I always wondered how they do that.

Pesthuf• 2 years ago

Safari also has some Apple specific features, like being able to show a special dialog for logging into other websites with your Apple account that works differently from passkeys or password autofill, or the redirect based flow they make other browsers go through.

Always wondered how it's implemented in JS. WebAuthn with proprietary arguments...?

oissla• 2 years ago

bot detection?

sreejithr• 2 years ago

If you’re still using Chrome in 2024, you’re a fool.

theshrike79• 2 years ago

And this is why we should all boycott Chromium based browsers.

It's turning (and mostly has already turned) into the new Internet Explorer.

Use Safari or Firefox, or any other browser that's not based on Chromium.

Hizonner• 2 years ago

Google really needs to be broken up. Into 5 or 6 totally independent pieces.

throwaway4good2• 2 years ago

Isn't Google chrome open source?

It should be possible to point to the source code of whatever google.com extensions that may exist.

Or is this only available in the packaged distributions of Chrome?

throwaway4good2• 2 years ago

https://chromium.googlesource.com/chromium/src.git

poikroequ2• 2 years ago

I think there are a few bits and pieces which may not be open source, such as those for DRM.

cletus2• 2 years ago

I might be able to shed some light on this (disclaimer: Xoogler).

I worked for a time on Google's internal videoconferencing platform, called GVC. This was in 2010-2011 at a time when a lot of the company's VC equipment was proprietary, specifically Cisco Tandberg units. These were expensive and would be expensive to roll out to thousands of meeting rooms.

around this time a different team was developing Hangouts. It's been awhile so my memory may be off but I think it was called Google Meet at the time? or maybe that was later? It's hard to keep track. I think Hangouts was the name adopted when Google+ came along and rolled Hangouts into its product offering.

There were different configurations of GVC but the most common were these All-in-One ("AIO") monitor/computer combos. It was a full Intel PC. So the GVC platform was a custom Linux distro. The system was designed so GVCs could talk to Google services, which was nontrivial, and so software updates could be rolled out. It kept old distros too in case one didn't boot. These GVCs had to be named and a whole bunch of other issues.

Additionally they needed support for various hardware like a touch panel to dial. Larger units required larger PTZ camera support and support for various microphones.

Anyway, Hangouts became the stack GVC was built on. This ultimately replaced virtually all Tandbergs and saved a fortune. This system was certainly still in use by 2017. I can't speak for later.

Monitoring was a part of all this. So when I see there are *.google.com specific APIs, we need to be sure we're talking about this accurately. Like can Google query any Chrome instance in the world? Or is it only from/to google.com? I don't know the answer and the Tweet doesn't specify.

But given the name hangouts_services and the domain restriction I consider it highly likely this is purely to support monitoring embedded Chrome for GVC. I could be wrong.

deanCommie• 2 years ago

Fascinating!

So it's possible most of Google didn't even know this was possible until know.

Until know.

Now there's probably DOZENS of Product Managers approaching their product's tech lead going "OK, now...hear me out...."

kweingar• 2 years ago

There are zero product managers who read this Twitter thread about a random decade-old Chromium hack and will do anything about it.

hot_gril8• 2 years ago

I don't think it's this. Tried a Meet call in Firefox just now. If you click the troubleshooting button, there's a CPU chart greyed out that says "try Chrome to see your CPU usage." Sure enough, in Chrome you can view how much CPU Meet is using, or maybe it's systemwide idk, either way I don't think is available through regular APIs. Edit: Definitely systemwide as confirmed with some `yes` background tasks.

P.S. The naming confusion always comes up. GVC is such a nice clear name.

tedivm• 2 years ago

This seems pretty unequivocal then- they're clearly using this to provide additional functionality to their own applications (at least Meet) that other companies who don't control the browser can't match.

doe_eyes• 2 years ago

Like can Google query any Chrome instance in the world? Or is it only from/to google.com?

I'm sorry, I don't understand the distinction you're trying to make? Yes, it sounds like the API is exposed just to the content running on *.google.com, but that's still a lot like "Google can query any Chrome instance" (that visits their site, but that's ~100% given that even if you don't visit Google services, Chrome pulls in NTP content from Google by default).

I don't think this is being used maliciously, but it's still problematic if Google can troubleshoot problems this way, and their competitors in the same space can't. There's no API for Zoom, right?

warkdarrior• 2 years ago

That API is available to all extensions. So Zoom could create an extension that uses that API and get their users to install that extension and approve the permission for that API.

madeofpalk2• 2 years ago

I never worked at Google.... but this doesn't track for me.

You're saying the reason the 'retail' Google Chrome has this bundled plugin is so Google can get observability on CPU usage on internal appliances for an internal video conferencing platform?

cletus2• 2 years ago

I'm reading the tea leaves here. I have no direct knowledge of the situation. I'm retelling a story that seems (at least to me) to be consistent with what little information is here. There's plenty you can criticize Google on but I'm not sure this qualifies. Let's not attribute malice without cause. Or even negligence. It's fair to ask if this needs to be here still and what it's for. Let's just not fly off the handle prematurely.

As for "retail" Chrome having this plugin, it would make total sense. Chrome is a massive codebase. Maintaining a fork is a significant amount of effort. It would be far easier to add APIs to Chrome and whitelist them for only google.com extensions/JS.

stefan_2• 2 years ago

It's a nice story but it doesn't plausibly have any remote connection to this. I'm sure the people running the GCV platform with a custom Linux distro have some other way of reporting machine stats than literally "put our custom extension into every Chrome install ever".

You can try it for yourself, just

    chrome.runtime.sendMessage("nkeimhogjdpnpccoofpliimaahmaaome", {"method":"cpu.getInfo"}, (resp) => { console.log(resp); });

on any *.google.com page.

asr3• 2 years ago

So the concern is that Google is making Hangouts better in a way that is hard for competitors to replicate? (And by "hard," I mean, "competitors have to ask users to install something," not hard in any HN-relevant sense of the word.) This forum sure has a lot of wanna-be Handicapper Generals. https://en.wikipedia.org/wiki/Harrison_Bergeron

yjftsjthsd-h2• 2 years ago

If it's easy for users to just install the extension, then obviously there's no point in Google doing this in the first place. The fact that they bothered sounds like a pretty compelling argument for it being worth caring about.

asr3• 2 years ago

Worth caring about why?? Because you think Google shouldn’t be allowed to make things better for their users? Like I said, you are so concerned about fairness you’re missing the point.

daitangio• 2 years ago

I stopped using Chrome as my primary & only browser. Too much power in one hand?

benced2• 2 years ago

This API either shouldn’t exist or should be Google only. It would be an absolute disaster if everyone had access to it.

poikroequ2• 2 years ago

Is it not Google only?

benced2• 2 years ago

There's been proposals in the thread calling for it to be opened. I also saw one on Twitter calling for it to be opened under the DMA.

FateOfNations5• 2 years ago

It's an API that is available to extension developers. The wrinkle here is that Google bundles a hidden "Hangouts Services" extension in Chrome with permissions for *.google.com (the extension's ID is the "nkeimhogjdpnpccoofpliimaahmaaome" referenced in the examples).

mikeiz404• 2 years ago

Thread reader: https://twitter-thread.com/t/1810696257137959018

rldjbpin• 2 years ago

through this, at least it is now fairly well known that chrome is able to share detailed hardware details to a website.

now, is it bad that it is being done at all or that only google.com host requests can access it?

personally i see the value during debugging but having it forced enabled this way (also for only one company) is not great and should be remedied.

diego_sandoval• 2 years ago

Last time I used Google Chrome, if you logged into a Google account while using Chrome, it automatically logged you into that Google account in the browser itself.

Isn't that implemented in a similar way to this?

I agree with the concerns about unfair competition, and I think this auto-login "feature" could also qualify as an example.

Google Chrome has an API accesible only from *.google.com

Related Stories