During an audit, Google found that some third-party products based on Chromium code used keys that allowed access to certain Google APIs and services meant for internal use, specifically google_default_client_id and google_default_client_secret. This allowed users to access their own Chrome Sync data (like bookmarks) not only in Chrome but also in third-party browsers based on Chromium code. Justifying its efforts to enhance security, Google is closing access to the aforementioned APIs for third-party software. This decision takes effect starting March 15 of this year.
As a result, many distributions are considering the possibility of completely abandoning Chromium in their offerings. Among them are: Arch Linux, Fedora, Debian, Slackware, OpenSUSE, and others.
Source:
Hi Chromium Developer,
We are writing to let you know that starting March 15, 2021, end users of Chromium and Chromium OS derivatives using google_default_client_id and google_default_client_secret in their build configuration will no longer be able to sign into their Google Accounts.
What do I need to know?
During a recent audit, we discovered that some 3rd-party Chromium-based browsers had keys that were allowed to access Google APIs and services that are reserved for Google use only. Chrome Sync is the most notable of these APIs. Specifically google_default_client_id and google_default_client_secret.
In practice, this means that a user would be able to access their personal Chrome Sync data (such as bookmarks) not just with Chrome, but also with a non-Google, Chromium-based browser. Please note that users would only be able to access their own Chrome Sync data, and only a small fraction of users of Chromium-based browsers were impacted. We have no reason to believe that user data is being abused or accessed by anyone other than the users themselves.
As part of Google’s efforts to improve user data security, we are removing access from Chromium and Chromium OS derivatives that used google_default_client_id and google_default_client_secret in their build configuration to Google-exclusive APIs starting on March 15, 2021. Guidance for vendors of Chromium derivative products is available on the Chromium wiki.
What does this mean for my users?
Users of products that are incorrectly using these APIs will notice that they won’t be able to log into their Google Accounts in those products anymore.
For users who accessed Google features (like Chrome Sync) through a 3rd-party Chromium-based browser, their data will continue to be available in their Google Account, and data that they have stored locally will continue to be available locally.
As always, users can view and manage their data through Google Chrome, Chrome OS, and/or on the My Google Activity page, and they can also download their data from the Google Takeout page, and/or delete it from this page.
What do I need to do?
To avoid disruption, follow the instructions for configuring and building Chromium derivatives in the Chromium Wiki (link provided above).
Possible ways to implement this are:
Removing google_default_client_id and google_default_client_secret from your build configuration.
Passing the —allow-browser-signin=false flag at startup.
Your projects that may be affected by this change are listed below:
Arch Linux Chromium (arch-linux-chromium)
If you have any questions or require assistance, please contact embedd…@chromium.org.
Sincerely,
The Google Chrome Team
Source: linux.org.ru
