Thread · 4 tweets · 26 Jan 2021

I don't see how that would be impossible, it could be happening right now! Chrome has way too strong ties to Google identity. Just looking at their SSO sideways logs you into Chrome. It's dark patterns all the way down.

Then when you're logged, it will prompt you to sync at every occasion. Breath on an extension or some preference and you'll get prompted. The prompt doesn't tell you much. It has a big okay button and it's not very obvious how to dismiss it. Again, dark patterns.

If you don't then go set up a passphrase for your sync, your data — including history — is synced to Google in cleartext. For some strange reason there is no constant badgering prompt to get you to set up a passphrase. I'm willing to bet the overwhelming majority sync in clear.

Now, is this malicious? Maybe, maybe not. They have a good security team, but they never treat Google as part of the threat model. Either way — they already have the data and can use it easily.