Welcome to DU! The truly grassroots left-of-center political community where regular people, not algorithms, drive the discussions and set the standards. Join the community: Create a free account Support DU (and get rid of ads!): Become a Star Member Latest Breaking News General Discussion The DU Lounge All Forums Issue Forums Culture Forums Alliance Forums Region Forums Support Forums Help & Search

Ms. Toad

(34,099 posts)
Wed Jan 15, 2014, 09:06 AM Jan 2014

Chrome and scary security "flaw"

I just encountered a very scary situation with Chrome - one which was intended to make life easier, but provided significant access to (fortunately) a friend who inherited a computer I once used.

If you've encountered this - I'd love advice to make sure I've fixed it.

Chrome allows the option to personalize the browser and sync everything you do over all your computers - and by default it is set to sync everything.

At some point I needed to port files from work to home, and Google Drive was the easiest way to do it. I cleaned everything off that computer that I could find when I resigned and moved to a new job. It was (theoretically) reformatted by the "IT" person at work -which really just meant a superficial removal of my work files.

I received a computer at my new job, where every single thing I do is connected to single login - including access to some very sensitive data. I was required to use Google drive to access a shared work file, so I logged in to my Google account.

I ran into the person who inherited my old computer at my old job, and he was laughing about the superficial cleaning job our "IT" person did - telling me that it was auto-filling both name and password for him. The scary thing was that the name and password did not exist the last time I touched that computer. He assumed I'd stored the name and password before I left, and had just forgotten to clean it. He tried to remove it, and it kept coming back - and but for a chance conversation about the technological illiteracy of a former co-worker I would not have known that access to my new work account was being shared with every computer where I'd ever used Chrome while signed in. Every time he wiped it out, it was resyncing and populating it again.

That's the warning part - if you ever use Chrome while signed in, the default is to sync accounts and passwords, among other things with any computer you've ever used with Chrome signed in. The second presumption Google made was also that if you are sharing a computer with anyone else, the passwords should work for everyone using the computer (signed in or not - my friend never signed in, but it was autofilling for him).

I've overridden the default sync at work, and will be much more careful going forward. But I had no clue this was happening until I did some research to find out how an account and password which I had never used at my former work place appeared on my old computer. That damage is already done - and fortunately a friend discovered it and a chance conversation gave me enough breadcrumbs to figure out what was going on.

So here's the question - does anyone know how to remove a computer I no longer have access to from the collection Google still thinks are mine and wants to sync to?

5 replies = new reply since forum marked as read
Highlight: NoneDon't highlight anything 5 newestHighlight 5 most recent replies
Chrome and scary security "flaw" (Original Post) Ms. Toad Jan 2014 OP
I think I found the solution - Ms. Toad Jan 2014 #1
When moving a computer to another user, the IT people should reformat the hard drive and rebuild the RC Jan 2014 #2
The IT person "thinks" she reformatted the hard drive. Ms. Toad Jan 2014 #4
There is a way to disconnect all devices PrestonLocke Jan 2014 #3
I'm hoping that did the trick. Ms. Toad Jan 2014 #5

Ms. Toad

(34,099 posts)
1. I think I found the solution -
Wed Jan 15, 2014, 09:33 AM
Jan 2014
https://support.google.com/chrome/answer/1181035?p=settings_encryption&rd=1

I've also asked the current owner of my former computer to remove me as a user, but I think removing synced data should give me a fresh start. And, now that I know what the default settings are I'll be much more careful.
 

RC

(25,592 posts)
2. When moving a computer to another user, the IT people should reformat the hard drive and rebuild the
Wed Jan 15, 2014, 10:19 AM
Jan 2014

computer. Who can know what information is stored where and when or if it might appear at a later date?
I'm assuming your computers are connected to a server? It could be the server is seeing this computer and still thinks it is your computer. Whatever, you need better IT. This should not be happening, Chrome or otherwise.

Ms. Toad

(34,099 posts)
4. The IT person "thinks" she reformatted the hard drive.
Reply to RC (Reply #2)
Thu Jan 16, 2014, 10:18 AM
Jan 2014

by deleting personal files.

I've known we need better IT for a long time, but the former bosses were computer illiterate - so since the IT "guru" could do simple things, like search for software tools to open Word files which the owners had locked to prevent editing, they think she is a goddess. Those of us who know anything knew she was barely above their own literacy - that knowledge is the reason I discovered Chrome's "helpfulness" which - as far as I'm concerned - is downright dangerous because it is not disclosed in a way which makes it obvious. We had a get together of refugees from the company and a couple who were still there, and my friend who now has my computer commented on her incompetence because my account and password were still auto-populating, despite the fact that she thinks she reformatted the computer. When he mentioned an account I'd never used there, I went searching to try to figure out how that could have happened.

So I'm less concerned about the IT person there (since I'm no longer there) than I am about where else this might pop up for me and others. Chrome using a default of syncing everything (including passwords), in a manner which is computer dependent - not account dependent - is pretty scary considering how many computers change hands (deliberately or through theft).

I'm relatively computer saavy, and I was completely unaware this was happening. Now that I know it is happening, I now know how to prevent it. But it did not occur to me that once I signed into Chrome that it was syncing (and would continue to syncing forever) all saved passwords to all computers on which I had ever used signed into Chrome.

Just to be clear:

  • My friend never signed into my Chrome account on that computer (although it still existed when he inherited my computer), and after he discovered it was auto-populating online accounts he deleted the Chrome account in an attempt to get rid of of the e-mail account and password that would not die. He also deleted the most recently stored passwords to these online accounts. (According to Chrome that should fix the problem, but it continued to re-populate the fields).
  • I never used the online account which was auto-populating on that computer (It has existed, dormant, at the University I now work at), and the password did not exist until two days after I last touched the computer at my former work place, where it continued to auto-populate the account and password fields.
  • The only connection between the two was that I once signed onto Chrome on that computer. Fortunately, I rarely used Chrome until my new workplace - where it is the preferred browser. So I'm pretty sure this is the only rogue computer out there.


PrestonLocke

(217 posts)
3. There is a way to disconnect all devices
Wed Jan 15, 2014, 01:41 PM
Jan 2014

The option is somewhat hidden.

You need to head into your google account. Then it's Data Tools -> Chrome Sync -> Manage Chrome Sync -> Stop and Clear

Gotta echo what RC said, your IT is not doing their job.


Edit: Just checked and you can access the Chrome Sync dashboard from chrome by going to Settings and under Sign In it's the first link "Manage your synced data on Google Dashboard"

Ms. Toad

(34,099 posts)
5. I'm hoping that did the trick.
Thu Jan 16, 2014, 10:30 AM
Jan 2014

I discovered that option yesterday morning, just after I posted the first note (my second note links to those directions). I'll be testing it to make sure it did the trick, since Chrome also says that deleting the Chrome account on an individual device should disconnect the computer until it is signed in again. My friend did that long ago, and it did not disconnect the device.

IT is an idiot when it comes to computers. To be fair to her, my former bosses know nothing about computers - so when she could do very basic things, they made her the IT guru. When I was there, I did all my own IT work (to the extent I was permitted), since it was much more likely to be done correctly. There were four of us who were far more competent; two of us have now left. It was laughing at her being an idiot with one of the remaining ones which led to this discovery.

My bigger concern is making people aware that Chrome's syncing is computer dependent (rather than account dependent), and defaults to syncing everything (and making sure I've really disconnected any device which had been syncing without my knowledge). At least now there is a little box when you sign in to set your sync preferences. Even though that warning/option is extremely inadequate for the size of the potential breach, even that minimal notice was not there when I last signed into Chrome on that computer. And it has taken a lot of searching and puzzling various Chrome documents together for me to be sure that it was computer driven, rather than account driven, once it was initiated.

I'm just glad that Chrome was not my default browser. On computers I have complete control over, I do have quite a few saved passwords in a different browser. If that collection of saved passwords was auto-populating on any device I'd ever used but chosen not to save passwords because it is not completely under my control, I would be very concerned. Fortunately, Chrome was only syncing 2 - but the one of them has the keys to the kingdom of some sensitive data that I would never intentionally have stored on any computer that was not completely under my control, with machine password protection and an encrypted hard drive.

Latest Discussions»Help & Search»Computer Help and Support»Chrome and scary security...