TECH DIGEST – Despite a poor reputation for privacy, Google’s Chrome browser continues to dominate. The web browser has around 65 per cent market share and two billion people are regularly using it. Its closest competitor, Apple’s Safari, lags far behind with under 20 per cent market share. That’s a lot of power, even before you consider Chrome’s data collection practices.

Is Google too big and powerful, and do you need to ditch Chrome for good? Privacy experts say yes. Chrome is tightly integrated with Google’s data gathering infrastructure, including services such as Google search and Gmail – and its market dominance gives it the power to help set new standards across the web. Chrome is one of Google’s most powerful data-gathering tools.

Google is currently under fire from privacy campaigners including rival browser makers and regulators for changes in Chrome that will spell the end of third-party cookies, the trackers that follow you as you browse. Although there are no solid plans for Europe yet, Google is planning to replace cookies with its own ‘privacy preserving’ tracking tech called FLoC, which critics say will give the firm even more power at the expense of its competitors due to the sheer scale of Chrome’s user base.

Chrome’s hefty data collection practices are another reason to ditch the browser. According to Apple’s iOS privacy labels, Google’s Chrome app can collect data including your location, search and browsing history, user identifiers and product interaction data for “personalisation” purposes.

Google says this gives you the ability to enable features such as the option to save your bookmarks and passwords to your Google Account. But unlike rivals Safari, Microsoft’s Edge and Firefox, Chrome links this data to devices and individuals.

Although Chrome legitimately needs to handle browsing data, it can siphon off a large amount of information about your activities and transmit it to Google, says Rowenna Fielding, founder and director of privacy consultancy Miss IG Geek. “If you’re using Chrome to browse the internet, even in private mode, Google is watching everything you do online, all the time. This allows Google to build up a detailed and sophisticated picture about your personality, interests, vulnerabilities and triggers.”

When you sync your Google accounts to Chrome, the data slurping doesn’t stop there. Information from other Google-owned products including its email service Gmail and Google search can be combined to form a scarily accurate picture. Chrome data can be added to your geolocation history from Google Maps, the metadata from your Gmail usage, your social graph – who you interact with, both on and offline – the apps you use on your Android phone, and the products you buy with Google Pay. “That creates a very clear picture of who you are and how you live your life,” Fielding says.

As well as gathering information about your online and offline purchases, data from Google Pay can be used “in the same way as data from other Google services,” says Fielding. “This is not just what you buy, but also your location, device contacts and information, and the links those details provide so you can be identified and profiled across multiple datasets.”

Google’s power goes even further than its own browser market share. Competitor browsers such as Microsoft’s Edge are based on the same engine, Chromium. “So under the hood they are still a form of Chrome”, says Sean Wright, an independent security researcher.

Google’s massive market share has allowed the internet giant to develop web standards such as AMP in Google mobile search, which publishers must use in order to appear at the top of search results. And more recently, Chrome’s FLoC effectively gives Google control over the ad tracking tech that will replace third-party cookies – although this is being developed in the open and with feedback from other developers.

Google’s power allows it to set the direction of the industry, says Wright. “Some of those changes are good, including the move to make HTTPS encryption a default, but others are more self-serving, such as the FLoC proposal.”

Google says its Ads products do not access synced Chrome browsing history, other than for preventing spam and fraud. The firm outlines that the iOS privacy labels represent the maximum categories of data that can be gathered, and what is actually collected depends on the features you use in the app, and how you configure your settings. It also claims its open-source FLoC API is privacy-focused and will not give Google Ads products special privileges or access.

Google says privacy and security “have always been core benefits of the Chrome browser”. A Google spokesperson highlighted the Safe Browsing features that protect against threats such as phishing and malware, as well as additional controls to help you manage your information in Chrome. In recent years the company has introduced more ways you can control your data. “Chrome offers helpful options to keep your data in sync across devices, and you control what activity gets saved to your Google Account if you choose to sign in,” the spokesperson says.

But that doesn’t change the level of data collection possible, or the fact that Google has so much sway, simply through its market dominance and joined up ad-driven ecosystem. “When you are a company that has the majority share of browsers and internet search, you suddenly have a huge amount of power,” says Matthew Gribben, a former GCHQ cybersecurity consultant. “When every web developer and SEO expert in the world needs to pander to these whims, the focus becomes on making sites work well for Google at the expense of everything else.”

And as long as people use Chrome and other services – many of which are, admittedly, more user friendly than those of rivals – then Google’s power shows no signs of diminishing. Chrome provides Google with “enormous amounts of behavioural and demographic data, control over people’s browsing experience, a platform for shaping the web to Google’s own advantage, and brand ‘capture’”, Fielding says. “When people’s favourite tools, games and sites only work with Chrome, they are reluctant to switch to an alternative.”

In theory, competition and data protection laws should provide the tools to keep Google from getting out of control, says Fielding. But in practice, “that doesn’t seem to be working for various reasons including disparities of wealth and power between Google and national regulators”. Fielding adds that Google is also useful to many governments and economies and it is tricky to enforce national laws against a global corporation.

There are steps you can take to lock down your account, such as preventing your browsing data being collected by not syncing Chrome, and turning off third-party cookie tracking. But note that the more features you use in Chrome, the more data Google needs to ensure they can function properly. And as Google’s power and dominance continues to surge, the other option is to ditch Chrome altogether.

If you do decide to ditch Chrome, there are plenty of other feature-rich privacy browser options to consider, including Firefox, Brave and DuckDuckGo, which don’t involve giving Google any of your data.

Source:Wired

The post It’s Time To Ditch Chrome appeared first on Tech Digest News.

TECH DIGEST – SCAMMERS JUST FOUND a new phishing lure to play with Google Drive. A flaw in the Drive is being exploited to send out seemingly legitimate emails and push notifications from Google that, if opened, could land people on malicious websites. The scam itself is nothing new—messages asking you to click on dodgy links are as old as the internet itself—but could catch a lot of people off guard.

The smartest part of the scam is that the emails and notifications it generates come directly from Google. On mobile, the scam uses the collaboration feature in Google Drive to generate a push notification inviting people to collaborate on a document. If tapped, the notification takes you directly to a document that contains a very large, tempting link. An email notification created by the scam, which also comes from Google, also contains a potentially malicious link. Unlike regular spam, which Gmail does a pretty good job of filtering out, this message not only makes it into your inbox, it gets an added layer of legitimacy by coming from Google itself.

The success of email spam filters has left scammers looking for new ways to get people to click on malicious links. And Google Drive is pretty accommodating. By default, Drive wants you to know when someone has mentioned you on a document. In a work setting, this could be a colleague asking you to check over a slide in a presentation or a brief for a new project. For scammers, it’s a clever way of putting a malicious link right in front of a potential victim.

The scammers are working their way through a huge list of Gmail accounts, with scores of people reporting similar versions of the attack in recent weeks. One of the scam notifications received by WIRED linked to a Google Slides document that had been created by a Gmail account with a Russian name. The document’s edit history showed it had been copied from another document and was constantly being edited, suggesting that scammers were duplicating the scam and adding more people to try and lure in new victims. WIRED contacted the Gmail address linked to the scam document but received no reply. The scam document has since been deleted for violating Google’s terms of service.

People targeted by the scam receive Google Drive notifications and emails in Russian or broken English asking them to collaborate on documents with nonsense names. These documents always contain a link to a scam website. One of the websites used for the scam, which was only registered on October 26, bombards people with notifications and requests to click on links to deals and prize draws. Other versions of the scam try to lure people to click on links to check their bank account or to receive a payment.

It might not be elegant but the scam is effective in getting malicious links into people’s inboxes and mobile devices. “Link delivery is always a challenge,” says Jake—@JCyberSec_ on Twitter—an independent cybersecurity researcher who has been tracking phishing campaigns for five years and who was also targeted by the Drive scam. “Emails are closely monitored and scanned by systems meaning a huge number of spam emails are detected before delivery,” he says – but Google Drive offers no such protection. “Threat actors are always attempting to find new delivery methods,” Jake says. And on mobile the phishing method could be particularly effective. “Mobile targeted phishing is on the rise as there are less security controls,” he adds.

A Google spokesperson says the company has measures in place to detect new spam attacks and stop them, but that no security measures are 100 percent effective. The spokesperson adds that Google is working on new measures to make it harder for Google Drive spam to evade its systems. Anyone targeted by the scam can report it to Google via the company’s support page.

“It’s difficult for Google to do anything if the notification is coming from a legitimate account, which is, of course, easy to create,” says David Emm, principal security researcher at cybersecurity firm Kaspersky. He adds that, as with all phishing scams, the important is to think before you click. “Avoid clicking on unsolicited links of any kind when sent from unknown sources. If you weren’t expecting to receive it and don’t know the sender, don’t respond.”

The novel approach to tricking people into clicking on malicious links is similar to a scam that planted phishing links into Google Calendar. In that instance, phishers realized they could take advantage of a default setting in Google Calendar that let them plant their own events laced with dodgy links. As with the Google Drive scam, emails and notifications generated by the Calendar scam also came from Google.

Posts on Google community forums and social media suggest that the Drive scam has gone into overdrive in recent weeks, with some people complaining of receiving multiple notifications to collaborate on dodgy documents. Many of the documents reported to Google appear to have been deleted for violating its terms of service.

The post Beware Of New Google Drive Scam Landing In Inboxes appeared first on Tech Digest News.