Do you have Chrome Sync turned on for staff and/or students?

[pete]

As the title says really, just want some input.

 

Currently at SchoolA it's turned off in Google Workspace. In schools B, C & D it's in the default state. School E doesn't use Workspace.

 

I understand that it's useful for end-users across N+1 devices, but the failure modes that are most obvious are:

 

• End-user logs into work Google account on personal device, all saved passwords synced across increases the risk a household member accessing work data (on non-MFA-capable sites) or an unpatched browser leaking authentication data.
  
• End-user logs into work Google account on personal device, they or other household member does perfectly legal adult stuff in their own time that then (open tabs, bookmarks or history) gets synced back to work devices and causes HR issues.
  

 

edit: additional context. This is Chrome on Windows/Apple devices, not Chromebooks.

Edited October 31, 2023 by pete

[paulkerton]

As the title says really, just want some input.

 

Currently at SchoolA it's turned off in Google Workspace. In schools B, C & D it's in the default state. School E doesn't use Workspace.

 

I understand that it's useful for end-users across N+1 devices, but the failure modes that are most obvious are:

 

• End-user logs into work Google account on personal device, all saved passwords synced across increases the risk a household member accessing work data (on non-MFA-capable sites) or an unpatched browser leaking authentication data.
  
• End-user logs into work Google account on personal device, they or other household member does perfectly legal adult stuff in their own time that then (open tabs, bookmarks or history) gets synced back to work devices and causes HR issues.
  

 

It's on. As much as those things could be a problem there has to be a level of responsibility put on users.

If they go and sign into their browser with a work account and then look at unsavoury content then that is a them problem. You could always limit logins to managed devices only if it's that big an issue.

[DGardiner]

We have google browser istory disabled to try and avoid this

[jthompson]

Making use of managed devices and endpoint verification can help keep things clean and tidy on this front.

 

The usefulness of Chrome sync is fairly massive.

[mavhc]

Is it possible to only allow chrome sync on school managed devices? Similar to what you can do with OneDrive?

[jthompson]

Is it possible to only allow chrome sync on school managed devices? Similar to what you can do with OneDrive?

 

I must admin that I thought that it was, but it looks as though Chrome Sync isn't available to select for in Context-Aware Access (i.e. you can't actually say that Chrome Sync becomes unavailable if a device isn't company-owned and/or admin approved).

 

If you wanted to allow sync but prevent passwords from being included, the option for that is Admin > Devices > Chrome > Settings > User and browser settings > Other settings > Chrome Sync and roaming profiles (Chrome Browser – Cloud managed). Set it to Allow Chrome Sync but tick to exclude Passwords. There's an equivalent option alongside it for Chrome Sync (Chrome OS), too.

 

Drive for Desktop also has an option to limit it's use to company-owned devices.

Edited October 31, 2023 by jthompson

[mavhc]

Not providing a password manager just means every password is a) crap or b) the same

 

Another reason to give everyone a laptop and tell them only to use that for work

[DavR]

We have sync turned off. I'd rather have it turned on, or at least available to staff, but we're using the setting "Enable the creation of roaming copies for Google Chrome profile data", which saves bookmarks and other data to a user profile location. Using this setting prevents profile sync.

 

This is working at the moment, and I don't really want to upset it. It allows user Bookmarks to roam, and protects them from loss when PCs are rebuilt. Profile sync should do the same, but, it relies on users signing in.