On January 15, 2021, the Google Chrome team sent an email to Linux distribution developers: starting March 15, 2021, Chromium derivatives will no longer be able to use Google APIs such as Google Sync. For the sake of user account security, Google is cutting off third-party access to its APIs.
It’s easy to understand why: Google worries that someone malicious could use google_default_client_id and google_default_client_secret to impersonate the official client and call Google APIs. So Google is removing those keys on March 15, 2021, and is now telling the development community to update and drop those features.
The trigger was a recent audit that found certain Chromium-based third-party browsers carrying keys that grant access to Google APIs and to services reserved for Google alone — most notably the Chrome Sync API, which syncs accounts.
What This Affects
Going forward, no browser other than Google’s own Chrome will be able to use Google APIs. That means no access to users’ bookmarks, no signing into Google accounts to sync account data, and no retrieval of saved passwords.
Developers in the Linux community say that without Google Sync their derivatives have little reason to exist, and no reason to keep maintaining the Chromium package, so they’re considering removing it. Chrome’s engineering director Jochen Eisinger replied that the decision won’t change. Both Slackware Linux and Arch Linux say they’re considering removing Chromium from their repositories.
Here’s my translation of the email:
Hello Chromium developers:
This is to notify you that starting March 15, 2021, end users of Chromium and Chromium OS derivatives that use
google_default_client_idandgoogle_default_client_secretin their build configuration will no longer be able to log in to their Google accounts.What do I need to know?
In a recent audit, we found that some Chromium-based third-party browsers have keys that grant access to Google APIs and services reserved for Google’s exclusive use. Chrome Sync is the best known of these APIs.
In practice this means users could access their personal Chrome Sync data (such as bookmarks) not only with the Chrome browser but also with non-Google Chromium-based browsers. Note that users could only access their own Chrome Sync data, and only a small fraction of Chromium-based browser users were affected. We have no reason to believe user data was misused or accessed by anyone other than the users themselves.
As part of Google’s effort to improve user data security, we are removing the
google_default_client_idandgoogle_default_client_secretused by Chromium and Chromium OS derivatives to access Google-exclusive APIs in their build configuration, starting March 15, 2021. The Chromium Wiki provides guidance for vendors of Chromium derivative products.What does this mean for my users?
Users of products that use these APIs incorrectly will notice that they can no longer sign in to their Google accounts with those products.
For users who accessed Google functionality (such as Chrome Sync) through third-party Chromium-based browsers, their data will remain available in their Google account, and locally stored data will remain available locally.
As always, users can view and manage their data through Google Chrome, Chrome OS and/or the “My Google Activity” page, download data from the Google export page, and/or delete data from that page.
What do I need to do?
To avoid disruption, follow the instructions in the Chromium Wiki (link above) on configuring and building Chromium derivatives.
Possible ways to accomplish this:
Remove
google_default_client_idandgoogle_default_client_secretfrom your build configuration.Pass the
--allow-browser-signin=falseflag at startup.Projects likely affected by this change are listed below:
Arch Linux Chromium (arch-linux-chromium)
If you have any questions or need help, contact embedd … @ chromium.org.
Sincerely,
The Google Chrome Team