Agentless Backup is Not a Myth

A bug in the latest version of the Google Chrome browser could leak the identity of users trying to surf anonymously, developers warn.

The flaw means that domain-name queries are made by a user's local network even when Chrome is configured to used a third-party proxy. Users typically use proxies to conceal their local IP address in an attempt to browse anonymously. When the feature is set up, domain-name queries are supposed to be funneled through the proxy, rather than being made by a user's local network.

Short for the onion router, Tor is a free service that routes internet connections through an unpredictable series of IP addresses to prevent the true source of a user's connection from being detected. It is used by configuring a browser or other internet-facing application to use an IP address that belongs to the Tor project. Those using Chrome 3.0.195.33, the most recent version of the Google browser, receive no such protection.

There seems to be some confusion about what's causing the bug. According to the Full-Disclosure advisory, a feature known as DNS pre-fetching, which is enabled by default, is responsible for the loss of anonymity. But some developers participating in this discussion in a forum for Google's open-source Chromium browser say the vulnerability exists even when pre-fetching is disabled.

It's unclear when the hole might be patched.

"We're looking into fixing this issue," a Google spokesman said, "but it only potentially impacts a very small number of people who make use of anonymity services like Tor."

Those looking for more dependable anonymous browsing are better off using Firefox in concert with the Torbutton. ®

Steps to Take Before Choosing a Business Continuity Partner