Google Switches On Browser Spy Cam in Chrome
Google’s frequent Chrome browser updates are rarely exciting, but one new feature built into the latest version ought to wake you up.
Chrome 21,Â released yesterdayÂ (July 31), fully implements WebRTC (for “real-time communication”), a new standard that letsÂ websitesÂ and Web applications use your computer’s camera and microphone â all the better to see and hear you with, of course.
Previously, websites and apps had to use browser plug-ins such asÂ Adobe Flash PlayerÂ or Microsoft Silverlight for audio and video interaction with the user.
WebRTC leverages the powers of HTML5, the next generation of code underlying the Web, to build multimedia features directly into the browser. Google’s Chrome blog already points to a couple of fun sites that let youÂ take your picture with the browserÂ orÂ play a virtual xylophone.
That all sounds great, but there doesn’t seem to be any way to disable WebRTC in Chrome 21.
An email seeking clarification from Google was not immediately returned.
Chrome requires websites and apps to ask theÂ user’s permissionÂ to access the camera and microphone. Yet any good hacker will tell you it’s just a matter of time before someone finds a way around that and uses WebRTC to have an unauthorized look at what people are doing in front of theirÂ computers.
To be fair, WebRTC may not be any less secure than what it’s replacing.
“The risk isn’t really larger than having Flash installed (of course, more and more people disable or do not install Flash),” Ullrich told SecurityNewsDaily via email. “Flash already had the ability to access the camera and microphone, and had some vulnerabilities that allowed websites to trick the user intoÂ enabling the camera/microphone via clickjacking.”
Besides Chrome, only the forward-looking Opera browser has implemented WebRTC. Mozilla Firefox and Microsoft Internet Explorer are working on including it in future versions.
Chrome users concerned about their privacy can’t simply refuse to update to Chrome 21, because Chrome automatically updates itself. (For the technically skilled, thereÂ areÂ waysÂ to turn automatic updating off.)