20 December, 2018

Chrome: More From the "My Way or the Highway" Department

Google, in their infinite "wisdom," decided a few months ago that when you sign into Google, you also sign into Chrome.  I in particular do not really want my Google credentials being cached in a whole lot of software, and in particular, not within Chrome (or Chromium for that matter).  When Chrom(e|ium) exits, I don't want either to stay logged in.

A number of security- and privacy-focused folks pointed this out, the fact that they didn't take too kindly to logging into the Google services meant logging into their browser.  So Google said, OK, folks, don't worry, if you really, really want to separate these two functions out, all you have to is go into your flags and disable identity consistency.  That way, if you want to sign out of Gmail (or other services), you can, and still have your Chrome signed in and syncing settings, extensions, or whatever else you've configured to sync.  Or conversely, you can be signed out of Chrome, but still be able to log in and pick up your Gmail.

Now you know, this is the company which by default has a "remember me" style checkbox on their credentials dialog, which defaults to "on."  Similarly, if you've enabled RFC6238 TOTP multifactor authentication, there is a by-default-checked option so that you don't have to enter a TOTP for 30 days.  After all, they're trying to make using Google and its services as convenient and frictionless as possible...why authenticate when you can be remembered?  But of course, I can't tell you for sure, but the odds are pretty good the reason Google wants you to stay signed in is so that you can be tracked by them and other sites.  After all, that's extremely valuable data; they've made an entire very successful business of collecting, curating, and somewhat interpreting that data.

But here's the thing...in a subsequent Chrome release, that flag has no effect.  No, instead of being hidden away in some internal browser configuration page, it has "graduated" to the normal settings UI page, as "Allow Chrome sign-in".  Great,then!  Fixed, right?  Well...no, not really.

The "identity consistency flag" allowed nearly complete separation of in browser and Chrome "logged in status".  You didn't have to go into chrome://flags and toggle it on or off in order to log in or log out of Chrome; you could log into Gmail and not log into Chrome, or vice-versa.  If you did adjust that flag, you'd have to restart Chrome for it to take effect.  But no, this new toggle simply allows logging into Chrome, or disables the ability to log into Chrome and all its syncing goodness.  This is at first subtle, but really is profound in the implications of its implementation.  No longer can I just log into Chrome without logging into Gmail, if I log into one, I am logged into the other.  Sure, if I don't want to be logged into Chrome, I can go back into the settings ( == friction) and pull the slide switch the other way.  But then when I do want to log in, to get a sync going, I have to go into settings and slide the switch again.

And again...I understand the dual implication: they want me logged in/identified as much as humanly and inhumanly possible for their business, and basically their cover story is that they want it to be convenient and as frictionless as possible for the end user.  But to the security and privacy minded, conscientious end user, it is less convenient and more friction.

So...it's Sundar's way or the highway.  Sure...I suppose you could download the Chromium source, slice out these nasty bits, and build it yourself, but who wants that badly to take on that maintenance responsibility?

Idunno...I'm actually tempted to do this, because I'm sick and tired of all the goddamn stoopid animations...like you can't even open the main menu without a stoopid bloom of the 3 dots, and you can't visit a subsection without the page being slid all around, either horizontally or vertically.  This is DESPITE many requests to remove UI animations, usually from folks accessing computers with Chrome on them remotely (and the slow update times that entails sometimes).


English is a difficult enough language to interpret correctly when its rules are followed, let alone when the speaker or writer chooses not to follow those rules.

"Jeopardy!" replies and randomcaps really suck!