Google Browser Sync

Google recently launched Google Browser Sync and I keep getting ask if I have installed it and the answer is no. I totally understand the need, but I’m looking for a solution in which I can have just a bit more privacy and control over my data. It’s not like I’m a privacy fanatic, but I already give Google enough information. Just the other I was trying to figure out how to stay logged in to Gmail/Calendar but not to the Google homepage (e.g. disable search history). I did not spend much time on it, but I know there’s a Firefox extension that disable cookies on a per-tab basis. Anyways, I was going through their FAQ looking for the “encryption” question and I found several. Their FAQ is as follows:

Which browser settings does Google Browser Sync synchronize?

By default, Google Browser Sync continuously synchronizes your bookmarks, history, persistent cookies, tabs, windows, and saved passwords across computers…

For bookmarks, I use del.icio.us and Foxilicious. History, that they have. Persistent cookies, no way. Tabs, windows I use SessionSaver. Saved passwords, no.

Why do I need to provide a PIN?

The PIN you create during setup is used to encrypt information that’s synced between your computers, which may include sensitive information such as your passwords for websites. We use your PIN to unlock that information. Without your PIN, no one will be able to read the information that’s being transmitted between your computers via Google Browser Sync.

… and …

What’s the point of encrypting my information?

By encrypting your information, it will be transmitted to and stored on Google’s servers in a format that is nearly impossible to interpret without the PIN. That means that without the PIN, no one, not even Google, will be able to read your data.

At this moment, I thought I’ve found what I wanted: Encryption! Most likely it’s some fast block cipher encoding since I doubt they want to get in the business of key management. Although I’d really wish they offer hooks in Gmail to use GPG/PGP in Firefox through an Enigmail-like extension. Obviously, you can’t change your PIN as the FAQ says. If not, they would have to decrypt/re-encrypt everything again and remember no one, not even Google can read your data. What happens if I forget my PIN? Shouldn’t all my information be lost and I must start again? That’s encryption for you. But wait a minute, Google solved that part at least.

I forgot my PIN, what should I do?

You can recover your PIN quickly and easily. Just log on to a computer where you’ve installed Google Browser Sync, then follow these steps:

Your PIN is stored in the server in cleartext for all intended purposes and that’s why I don’t want to give my information. I understand Google wanting all of the data in the world to make it easier for us, but why do they need that data? I’m already sense fear when writing like this because I might get Access Denied if I try to use Google tomorrow when GoogleBot has indexed this post. There are no alternatives. Who knows the mind of Google? I hope I don’t sound hypocritical. By the way, I do store my information in Google Mail today, encrypted of course. I send myself messages encrypted using my GPG with a million-bits key I created for myself. I did this because I once lost my encrypted text file with all of my accounts/passwords. At least this way I have a bit more of a backup and only I have the key to decrypt it, although some day in the near future, everyone will have access to that super-important information of mine. I digress.

In the end, if 70% of the people will give their password for a chocolate bar, why not at least help them do it from multiple computers? Thanks Google Browser Sync.

About this entry

You’re currently reading “Google Browser Sync,” an entry on Elias Torres

Published:: 06.10.06 / 9am

Category:: Technology

About

I’m married and father of three.

I’m a Christian and worship at CBC.

I co-founded Performable.

I’m a java, python, javascript hacker.

Here’s my FOAF file (and URI).

I’m an amateur photographer.

I work on the Web.

I participate in Open Source software development (Roller, Abdera, RDFLib, WordPress).

You may contact me (email or jabber/gtalk) at .

BillyG 06.10.06 / 10am

I don’t keep bookmarks on my box, everything goes to my del.icio.us account. This of course gives me access at all times while online and negates the worry of me corrupting my FF profile (hasn’t happened in a long time but you never know). I figure there is a better chance of this happening than Y! going out of business lol.

I also use the InfoLister ext to save my FF extensions to my host (and provide a link to it on my sidebar for others to grok) so I really didn’t see the need for GBS in my case.

Anyway, I decided to give GBS a try after a day of two and immediately found that it made me relogin to delicious everytime I posted to it, totally unacceptable, as I’ve never had this problem before.

Needless, to say, I promptly deleted it and my deilicous is working as expected, just fine and G knows a tiny less amount about me lol.

Elias Torres 06.10.06 / 11am

BillyG, InfoLister looks like what I was looking because it writes it to a file. I now can write a cron job that encrypts it and scp to my hosting provider or S3.

Of course, the average Joe can’t do this and will end up with GBS.

[...] — Elias Torres. I don’t have much faith in the accuracy of that chocolate bar password survey, but still … [...]

David Masover 07.22.06 / 7pm

Could you please confirm whether this works the way you think it does? Here’s how I think it works: Your PIN is kept in cleartext on the _local_ machine, and never sent to Google. Every now and then, it makes you re-enter it anyway, but if that hasn’t happened, there should still be a copy on a machine where you’ve already installed and been using Browser Sync — thus, you can view it. You could probably theoretically change your PIN — decrypt your data, change your PIN, re-encrypt your data, and re-upload it.

Elias Torres 07.23.06 / 7am

David,

I think you could be correct and I could confirm my suspicions by contradiction of yours. I guess I will have to install Browser sync. Anyhow, if you are right then we have our PIN in cleartext in our local machine and that’s not that safe. Imagine the next worm or a rogue extension uploading everyone’s PIN number to a central location. Also, what kind of encryption algorithm could they be using from Javascript since they are doing this locally. I guess we’ll have to find out. In Windows you could encrypt the PIN with your logon information but you need a DLL call for that and most likely the Firefox extension is for all platforms, so I doubt they are using that.

Dhval 07.12.07 / 9am

Today 8:27am (EDT) I lost my pin, did a google search with “google browser sync lost pin” and this page was the first page to show up. This is rather an anomaly because I always thought google gives priority to pages on google.com. I Always wonder that the user specific search information is good enough to do a lot of things and how may google use it.

David you are right the PIN is indeed on local machine. So google can claim that they don’t have access to your browser data and saved password. This is confirmed from this faq, http://www.google.com/tools/firefox/browsersync/faq.html#q19.
But ever wonder how secure can a 4-DIGIT password be. So it boils down that goggle owns every GBS user, not only there browsing history but all “sensitive” information.

Definitely it doesn’t scare me as my “sensitive” information isn’t worth much accept for nasty ad’s. But I can say that this isn’t fair enough.

Phillip 08.31.07 / 8am

Dhval

Don’t know where a “four digit PIN” concept comes from. While my Google PIN (for Browser Sync) is over eight digits long, includes numbers, letters, and sybols. I’d wager it is fairly secure.

The PIN can be shown in clear text on the LOCAL machine when modifying settings, but I do not believe it is stored on the LOCAL machine that way (unconfirmed.) It is stored no where other than each local machine that has Google Sync

Elias Torres
You can, of course, disable the sync of any portion of that data, on a category by category basis. You can also choose to encrypt any category. Only passwords have no option to pass unencrypted. If security is your issue, choose which information you want to sync, choose to encrypt it all, and have fun.

As far as overall security, If you are using windows (and most other OSs) general access to your local machine is insecure enough. Having, or not having google sync makes little difference.

Using firefox to encrypt my passwords locally, sync-ing only my passwords and bookmarks to google and encrypting all sync categories makes my life very convenient, and reasonably secure. I use 6 different computers (four regularly), and trying to keep up with where that damn link is that I added a couple weeks ago would otherwise be very unpleasant.

It is useful to remember that security is never perfect. The real goal of computer security is to make the obtainment of the information not be (or to appear not to be) worth the amount of resources and effort required to obtain it.

Bank vaults work on this principle. Front door locks work on this principle. Security systems. All security, physical and otherwise is based upon this principle.

ANYTHING can be broken into with enough time and resources. “Secure” things just are not worth the requisite amount of time and/or resources.

David 10.12.07 / 12am

I redownloaded my OS and don’t know what my pin number is so I can’t open the browser sync. How can I get my pin number?
Thanks,
David

Elias Torres

Google Browser Sync

Which browser settings does Google Browser Sync synchronize?

Why do I need to provide a PIN?

What’s the point of encrypting my information?

I forgot my PIN, what should I do?

About this entry

Comments are closed

Recently

Categories

Monthly Archives

About

Pages

Elias Torres

Google Browser Sync

Which browser settings does Google Browser Sync synchronize?

Why do I need to provide a PIN?

What’s the point of encrypting my information?

I forgot my PIN, what should I do?

About this entry

Comments are closed

Links

Blogroll

Recently

Categories

Monthly Archives

About

Pages