Google Chrome Saves Sensitive User Data In Plaintext

Google Chrome browser may be storing sensitive data in such a way that it would be relatively easy for a malicious third party to dig it up and steal your identity, among other things.

Security researchers at Identify Finder said they performed a series of deep scans on several employee computers using the latest version of Sensitive Data Manager (SDM). The scans revealed a bunch of Google Chrome SQLite and protocol buffers storing user information such as names, addresses, email addresses, phone numbers, bank account info, credit card details, and even social security numbers.

“We confirmed with each employee that sensitive data, such as social security and bank account numbers, were only entered on secure, reputable websites,” claims Identity Finder.

The data is not protected in the cache, which means that anyone with access to it can extract the information. This does not necessarily mean local access, as malicious software running on a user’s computer, and even social engineering, may yield the same results.

Handing over the computer to a computer repair shop, sending it in to the manufacturer, or selling it may provide third parties with access to sensitive information stored by the browser.

Google Chrome is the world’s third most popular web browser with a 16% market share; Firefox has a 19% share and Internet Explorer holds a 58% share, according to Net Applications.

This is the second finding of a profound Chrome shortcoming in three months. Last July, NSS Labs analyzed the privacy mechanisms built into Internet Explorer, Firefox, Chrome and Safari and found Chrome offering the poorest privacy protection.

A statement by Google on The Verge reads :

Google Chrome is the most secure browser and offers you control over how it uses and stores data. Chrome asks for permission before storing sensitive information like credit card details, and you don’t have to save anything if you don’t want to. Furthermore data stored locally by Chrome will be encrypted, if supported by the underlying operating system. For example, Chrome OS encrypts all data stored locally by default. We recommend people use the security measures built into their operating system of choice.

Read More

Chrome For Android Gets Application Shortcuts and Faster Search, 200-400 Milliseconds Faster

The new browser lets users add ios like web shortcuts to the home screen, will now open in a full-screen experience and appear as a separate app in the app switcher. With the Beta release of Chrome for android, it’s now easier to create shortcuts on the homescreen which open the website that you often go to.

When visiting a website you would like to save, user will have to simply select “Add to homescreen” from the toolbar menu. The new version 31 also brings the desktop client’s search focused tab. google has even provided search speed boost through server-side code. The new update, google have also made it work for web payments. On sites with request Autocomplete(), users will be able to either use their existing payment data stored with the browser or enter new details through a browser-provided interface. 

While, Google says that this feature will be rolling out to Beta users in android, Windows, and Chrome OS in the coming days. A Mac version will be included in a future release. Whereas, Google also shared that with all these new updates they promise much faster browsing experience on mobile phones. Google’s Developer Advocate, Ilya Grigorik said in a post:

Google mobile search is getting faster – to be exact, 200-400 milliseconds faster! We are gradually rolling out this improvement to all browsers that support the <a ping> attribute (currently, mobile Chrome and Safari).

What’s the benefit? Whenever the user clicks on a result, typically they are first sent to a Google URL redirector and then to the target site. With <a ping>, the click is tracked using an asynchronous call, meaning that the user sees one less redirect and a faster overall experience!

Read More