Yes, you can steal Chrome's keys, but Google can easily update those in Chrome. Are you going to write an automated system to extract the keys from Chrome on every update? Doubtful.
This stops browsers like Opera and Brave from using the APIs.
In fact, can anyone name a browser except Chromium that uses Chrome's sync servers for syncing? Because I can't.
Also your point about backwards compatibility doesn't really make sense as Google has plenty of ways to detect browser version and capabilities of the sync engine (the sync engine sends that info to the sync server voluntarily right now).
Also Google can't just disable it's own API keys every time there is an update because this would shut down a large number of it's own users too. They would need to wait at least 1-3 months to avoid larger disruptions and this would give others more than enough time to fetch the latest keys (and if there is interest, there will always be someone who does that and posts them).
It can because the official Chrome auto-updates very reliably. They only have to support a few versions back. They could even force updates if they wanted.
None of that is true for Chromium. Do they really want to support the 10 year old Chromium from Debian stable?
(I mean, they're Google, they don't support anything that doesn't require payment from the user and barely that, but that's beside the point.)
That is not, in ANY way or by ANY stretch, their argument, although I'll agree it is clearly their intention. Their argument is very clearly based on a security perspective.
> Yes, you can steal Chrome's keys, but Google can easily update those in Chrome. Are you going to write an automated system to extract the keys from Chrome on every update? Doubtful.
Really? You think malware authors won't take such a simple step as that if it makes them money?! You're insane.
Besides which you don't (currently) have to do that because they've never changed!
> This stops browsers like Opera and Brave from using the APIs.
No, their terms of service do that. Otherwise, Opera and Brave could just go pull the keys out of the source and use them.
The unfortunate (for Google) reality is (as had already been pointed out to this fellow multiple times before he said that): whether they turn off these Linux distros' keys, people can still write third-party software to (ab)use these APIs, using Google's own keys. The CFAA is only going to keep legit uses from using Google's keys. This does not, in any way, fix the issue that Google is claiming it fixes.