this post was submitted on 23 Oct 2023
122 points (85.1% liked)

Technology

57432 readers
4768 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 1 year ago
MODERATORS
 

Google will soon start testing a new ‘IP protection’ feature for Chrome users, offering them greater control over their privacy. The tech giant the upcoming feature prevents websites from tracking users by hiding their IP address using proxy servers owned by Google.

To give you a quick recap, IP address is a unique numerical identifier that can be used to track a user’s geographical location and is used by advertisers to track a user’s browsing habits, see which websites they visit and provide personalized ads.

According to Google, the IP protection feature will be rolled out in multiple stages, with Phase 0 redirecting domains owned by Google (like Gmail) to a single proxy server. The company says the first phase will allow them to test its infrastructure and only a handful of users residing in the US will be enrolled.

Google also said that the upcoming IP protection feature will be available for users who have logged in to Chrome. To prevent misuse the tech giant will be implementing an authentication server that will set a quota for every user.

In the following phases, Google will start using a 2-hop proxy system, which essentially redirects a website’s request to a Google server that will again be redirected to an external CDN like Cloudflare.

While the IP protection feature might enhance user privacy, the tech giant has clarified that it is not a foolproof system. If a hacker is able to gain access to Google’s proxy server, they will be able to analyse all traffic passing through the network and even redirect users to malicious websites.

Since most of Google’s revenue comes from tracking users across the internet and offering them personalized ads, it will be interesting to see how the company strikes a balance between user privacy and revenue generation.

you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 6 points 10 months ago (2 children)

This would actually be good, because combined with encrypted client hello, a TLS connection to some website would only be identifiable by the IP and DNS queries. You don't have to use Google's DNS either.

So Google will basically see that you're connecting to a cloudflare hosted website or whatever the case is. Doesn't help much because they can't see encrypted data

[–] [email protected] 9 points 10 months ago (1 children)

Googles ships the browser wich ships with the root certificates which they can update remotly as the see fit im sure u can see the issue here.

[–] [email protected] 2 points 10 months ago* (last edited 10 months ago)

Doing that would cause all corporations and governments to switch to Edge immediately. Google actually built infra to make it impossible to get away with this kind of hijacking: look up Certificate Transparency.

[–] [email protected] 1 points 10 months ago (1 children)

Next step would be rewrapping the encrypted data (which several existing proxies already support) as a "security enhancement".

[–] darth_helmet 4 points 10 months ago (1 children)

They’d have to crack TLS or get you to trust their mitm cert, or fake what they present to the user..

I don’t see Google doing anything that foolish, it’s a security nightmare

[–] [email protected] 5 points 10 months ago (2 children)

They ship the browser, which on at least many OSes has the certificate store. And Android. They can ship whatever they want.

People fall for all kinds of shit for reasonableish-soubdubg security reasons. Lots of people would have said they didn't believe people would go for this either.

[–] darth_helmet 4 points 10 months ago (1 children)

Ok, but they still present the certificate to the user. They’d have to be very fucky with how they present that information if they were doing the validation at the proxy and then passing back that cert info.

And yeah, regular users might fall for that shit but Chrome would be banned across the corporate landscape the second it was found out.

[–] [email protected] 3 points 10 months ago* (last edited 10 months ago)

That optional feature might be banned, it likely would be easily disabled (I.e. not disablable) by corporate policy.

Having enough people to opt into it to be profitable would make it worth it. You may be underestimating the # of people who wouldn't care if it was packaged well.

[–] [email protected] 1 points 10 months ago (1 children)

They don't want every government to immediately ban the use of Chrome on government computers ....

[–] [email protected] 1 points 10 months ago* (last edited 10 months ago) (1 children)

Can you really not imagine a way that they'd ship a feature like that - maybe, disabled permanently with a corporate policy - where this wouldn't be a problem? Presumably they'd work with governments and corporations on something palatable, like they usually do.

I mean, this current feature isn't something that most governments really wouldn't want their users using either. Or the existing "secure DNS" feature, etc.

Edit: Or the root certificates they already add on top of what the OS provides and that the user can control.

[–] [email protected] 2 points 10 months ago* (last edited 10 months ago)

It's not a matter of imagination. There's specific infra preventing HTTPS MITM from being done secretly. Look up "Certificate Transparency". The CA certs shipped with browsers are a matter of public record, and any security whiz would love to catch this sort of bullshit.