capocani

They're transitioning to CSP: http://blog.chromium.org/2012/02/more-secure-extensions-by-d...

chrome://settings/syncSetup

Passwords are encrypted by default, the other option is to encrypt all synced data.

You should clear your friend's sync data from your dashboard BTW: https://www.google.com/dashboard/

Not a security flaw, you just synced his browser settings with your account. The proper way to log into another person's Chrome is by adding a new user in the "Personal Stuff" area first.

It's not as if the users set IE to read P3P headers so technically they didn't override any user settings.

P3P is lacking: http://bits.blogs.nytimes.com/2010/09/17/a-loophole-big-enou...

http://support.google.com/accounts/bin/answer.py?hl=en&a...

In some situations, the cookies we use to secure and authenticate your Google Account and store your preferences may be served from a different domain than the website you're visiting. This may happen, for example, if you visit websites with Google +1 buttons, or if you sign into a Google gadget on iGoogle.

Some browsers require third party cookies to use the P3P protocol to state their privacy practices. However, the P3P protocol was not designed with situations like these in mind. As a result, we've inserted a link into our cookies that directs users to a page where they can learn more about the privacy practices associated with these cookies.

Information that Google collects in association with these cookies is subject to our Privacy Policy.

Doesn't seem nefarious.

And thus forcing the rest of us to pay for the API.

Is it because the Maps API was free or am I not reading it correctly?