If I could still edit it, I would correct my post to say that a user that has not activated remote desktop does have to enable it manually.

But there is still no way to control Chrome's surface area in the future, and features like this give me the heebie-jeebies. Two things:

1. Users that have already enable Chrome Remote Desktop don't need to authorize the set of computers that can access it remotely. You authorize one endpoint, but not the other. And since Chrome will occasionally install new extensions and apps in its regular updates, there's no notification for a lay user to know why they got "Chrome Remote Desktop". For that matter, anyone with access to a Google account can leverage one Chrome sync feature to gain access to others (mainly: from an extensions into completely owning their machine), allowing them to leverage Google account access into a much greater vulnerability on remote physical machines. Passwords, open tabs, history, form data, credit card information.

Let me walk you through this. Alice is using her computer at work. Eve has obtained Alice's credentials, and sets up a Chrome account on a machine and enables full sync, and installs the Chrome Remote Desktop extension on her computer.

Alice sees a new extension appear on her computer. Why is it there? Alice is never informed, and Google adds new apps and extensions with updates occasionally, so Alice proceeds to install Chrome Remote Desktop. Why not? Chrome seemed to think it was safe to put on her front page or in her app bar. Eve can pin it to her bookmark bar with a title like "Connect from home!", or even install multiple bookmarks to do this:

"Connect from home" "now today" "with Google Chrome" "Remote Desktop!"

Now it's just a matter of time. Eve could also use her access to the account to synchronize new extensions silently and in the background, allowing them to siphon off passwords and credit card numbers, even if Alice disallowed those items from synchronizing. Extensions are simply too powerful and the automatic update feature makes every extension from a third party developer a ticking time bomb.

2. You don't really offer a great way of blocking increases to the attack surface area of Chrome. You offer a way to totally turn off all Google Chrome automatic updates, but woe is the administrator that tries to use your policy tools to lock down Chrome. As Chrome is becoming an operating system unto itself, I find myself at a loss to understand why policies for this new operating system lag behind. Your suggestion doesn't prevent Chrome from automatically updating or synchronizing new extensions, and doesn't provide the average user with protection from a hijacked Chrome account. Disabling Chrome's automatic updates, if anything, makes them less secure.

No, what I want is the ability to lock Chrome's surface area to a particular version, not lock Chrome to the version itself. I want to see ways to limit my liability as an administrator to what I know and understand - and the Chrome team seems to think they know better than I do how to keep lay users safe. I disagree - given the fact that me, the security paranoid user, has already been bit by Chrome's security policies, I have no hope that they will avoid the same fate.