Decoding network activity in Vivaldi

yngve

@Pathduck That extension ID isn't mentioned in the 2.8 source code, at least (another media related one that I do see in my installation, is mentioned). So I have no idea where that extension came from.

yngve

@Cqoicebordel AFAIK Form autofill would require enabling an API, and likely also Google Account integration, we have neither.

Cqoicebordel

@yngve: Then, why is it in Vivaldi settings ? (In privacy)
It looks like the feature is enabled, from the user POV.

Pathduck

@yngve said in Decoding network activity in Vivaldi:

@Pathduck That extension ID isn't mentioned in the 2.8 source code, at least (another media related one that I do see in my installation, is mentioned). So I have no idea where that extension came from.

Thanks for looking it up. It's probably something that snuck in a while back, even though I've never used Hangouts (but I've opened the page at times). The connections to accounts.google.com and mobile-gtalk.l.google.com are not there when using a clean profile.

It's referenced in the "Secure Preferences" file, and refers to an invalid location:

	"from_bookmark" : false,
	"from_webstore" : false,
	"install_time" : "13203613200388586",
		"name" : "Google Hangouts",
	"never_activated_since_loaded" : true,
	"path" : "D:\\bin\\Vivaldi\\Application\\2.6.1560.4\\resources\\hangout_services",
	"was_installed_by_default" : false,
	"was_installed_by_oem" : false

I suspect I'll need to do a profile reset to get rid of it, as it can't be "uninstalled". But I'm not paranoid about it, it's mostly driven by a healthy curiosity

yngve

@Cqoicebordel Hmmm, Have asked a couple of colleagues to do some testing. The setting was added to let users disable it easily, however given that the feature appears to need the Google Services API key, and we haven't enabled anything related to Google Sync (which does not work), the Account Login (which is not working either), or this feature (which likely require you to be logged into the Google Account via the Sync type login), I doubt it would work even if you are logged into a Google Account via their web page. It might be that this should be auto disabled.

agedcommotion

@axk: try vivaldi://settings/clearBrowserData "all time" it works
if you try cleaning from ctrl+shift+del doesnt work. today i learned

agedcommotion

@axk: try vivaldi://settings/clearBrowserData "all time" it works
if you try cleaning from ctrl+shift+del doesnt work. today i learned

Cqoicebordel

@yngve: Just to be clear, this feature doesn't fill the forms for you, but identify each input, to help you fill it (is it a name, an address, a phone number etc.)
So I don't think this feature needs you to be logged to a Google account.

For the rest, a definite answer would be good, as well as why this is on by default

reyn

hm, now i know that even push-notifications can be "dangerous" due to google, thanks.)

arod

Excellent article!

BoneTone

@reyn: "dangerous" in quotes is a good way to put it. What is the threat here? That done websites make use of GCM for their notifications, and Google will know that a notification was sent to some IP address? This isn't related to the Vivaldi browser, is a user-initiated behavior, so if anyone has that as a threat in their threat model, mitigation is simple -- don't sign up for notifications from websites that make use of GCM.

For me, this isn't an issue. I don't like notifications from websites in general, and never allow them. Even if I did, I'm almost always connected to a VPN, so my IP address isn't unique to me. The GCM servers aren't Google'd tracking servers. I suppose it's possible that they're used for tracking, but one could look into the ToS & privacy policy to confirm that. Point being, the risk is minimal with easy mitigation available. People who are highly concerned about exposing their IP address should be, and likely already are, using a VPN.

jasongo

I have a few questions:

When Vivaldi contacts Google servers, does Google log our IP address?
If we have a VPN via a browser extension, does Vivaldi route the transactions to the VPN when communicating with Google servers? Or does Vivaldi communicate "raw" with Google during loading of browser before the browser loads the browser extensions?
Is it possible for Vivaldi to create a proxy endpoints for those essential Google endpoints mentioned in this article so that Vivaldi browser does not directly communicate with Google's server?

Catweazle

Another question, what would happen to Vivaldi, when Google blocks its Chromium APIs (not only Sync) for other browsers than Chrome on March 15?

joeduffus

Excellent description and explanation!

Zalex108

Hi,
Would be useful to build an option to Export and Share the Settings we have enabled.

Would be manually done, so the user could decide whether do it or not.

This would go farther and be an Exporting/Importing file as well for other Profiles.

So this would help V to know what features the users use and to bckp some Setting