Google IO At Google IO 2021 on Tuesday, the ad giant reiterated its web privacy commitments and talked up technologies aimed at narrowing the performance gap between web apps and their native counterparts.
Ben Galbraith, senior director of product at Google, likened the process isolation built into Chrome to the internet giant's approach to data protection in its Privacy Sandbox initiative.
"Chrome has innovated with the browser sandbox model from its earliest days, first by isolating each website into its own process, and more recently, expanding on that to isolate each cross-site iframe on a web page into its own process," said Galbraith.
"We're taking this same approach with user data and tracking, building a sort of Privacy Sandbox that seeks to keep all of your information safe and secure within your browser, resulting in a web where your identity and activity are private by default."
Announced two years ago as it became apparent that competitors, with the support of lawmakers, could win market share by promoting privacy, Google set about trying to rethink ad tech to make it less intrusive and more tolerable.
It began by changing the way cookies behaved in Chrome: instead of being visible across websites by default, cookies would only be visible to the website that set them – a noteworthy privacy improvement for those not already blocking third-party cookies by choosing more user-protective browsers or installing tracking defense extensions in Chrome.
"Before this change, it wasn't really clear whether a cookie was intended for first-party, or third-party use and browsers needed to observe how cookies were used in the wild to infer their purpose," explained Dion Almaer, director of engineering at Google.
"This also created a security problem because this wide default visibility of cookies exposed users to cross site request forgery attacks based on third parties absorbing the information in these cookies."
Developers, he said, are now required to opt-in to use third-party cookies across their websites – presumably using the
SameSite cookies – and "and in turn browsers can then disable such cookies in a very straightforward manner. This privacy preserving default behavior is now enforced in Chrome, Edge, and very soon Firefox."
Baking privacy in
This is one element among many Privacy Sandbox initiatives that are focused on developing privacy-preserving alternatives to cross-site tracking, slowly getting rid of third-party cookies, and ensuring that unscrupulous developers don't have the tools to re-implement tracking by other means.
Another example is the Attribution Reporting API, now available as an origin trial – a limited test available to a small set of Chrome users prior to public availability. It's intended to provide advertisers and publishers with a useful capability – the ability to understand how many people clicked on an ad and whether the ad led to a conversion event like a newsletter signup – without tracking people.
"Using this proposed API, no user identifying data is shared between the site," explained Galbriath. "Instead it's the browser that keeps track of the ad conversion. Later, the browser sends an encrypted report to the advertiser, for each of these conversion events, but it adds time delays and noise to these reports to further stifle attempts to identify users. This technique is broadly known as differential privacy."
Galbraith and Almaer also delved into ways in which Google has been working to expand the capabilities of the web platform through the addition of new APIs, an initiative referred to as Project Fugu.
Coming soon, there's an API called Declarative Link Capturing to let installed web apps launch when an appropriate link is clicked while also preventing multiple instances of the app from opening.
Another pending API is Multi-Screen Window Placement, "which allows web apps to discover all of the connected displays and control where the window is placed on those screens," explained Almaer. "This is actually a pretty handy feature these days for web-based presentation, and video conferencing apps."
The File System Access API will let web apps read and write to the user's local file system.
- Oracle vs Google: No, the Supreme Court did not say APIs aren't copyright – and that's a good thing
- We've got some really bad news about Apple's privacy measures, Google tells iOS app devs: It'll hurt your Google ad revenue
- If my calculations are correct, when Google Chrome hits version 88, you're gonna see some serious... security
- Google Chrome's crackdown on ad blockers and browser extensions, Manifest v3, is now available in beta
"We're also working on a new file handling API that would allow web applications to be registered as file type handlers, enabling users to open files directly in a web app from OS file browsers," said Almaer. "We hope to ship an experimental release of this API later this year."
The WebHID API arrived in Chrome 89, alongside the Web Serial API. The former provides support for connecting web apps to game controllers; the latter provides an interface for connecting serial devices, via system serial port or removable USB and Bluetooth devices that emulate a serial port.
Several other new web APIs – WebTransport, WebCodecs, Digital Goods, Idle Detection, and Storage Foundation – are currently being tested in origin trials. And dozens more are in earlier stages of development.
And the rest
Galbraith said as part of Google's effort to make security on the web more seamless, the company is working on cross-device one-time passwords. "One time passwords are these numeric codes that some sites can send you to login," he explained.
"And this feature enables you to receive one of these one-time passwords on your Android phone, and then have that automatically transferred to your Chrome browser running on some other device like a laptop."
"The web is evolving in fundamental ways so it doesn't become extinct," added Galbraith. "It's becoming private by default with new APIs that protect user privacy, and it also continues to gain powerful new capabilities that run what's possible on the platform, providing for better user experiences." ®