Removing Google's "Autoupdate" (Keystone) Software

Nov 7, 2019 · 2 min read

If you have software like Little Snitch, it will alert you to software that tries to contact servers on the internet without your specific permission. In particular, I want to single out Google.

If you have installed Chrome or any Google software, Google drops another piece of software called Keystone that will run quietly several times a day to contact Google’s servers. Ostensibly, Google would say it’s to check for software updates, a necessary evil to combat hackers, but:

What other data from your computer is uploaded each time this check happens? Your location? Unique identifier?
Why do you need to check for software updates multiple times a day?

In any case, why not give me, the user, the choice of whether to check for updates automatically or manually. I despise this behaviour. I think it invades my privacy.

Worse, Google hides the software so that it’s difficult for noobs to find and quash. In fact, they recently changed how you disable the software so that the old method (which a Google search would show you) does not work. This smells rotten to me.

So here’s how to rid of it on macOS.

First, find the offending software:

$ find -E ~/Library/ -name *GoogleSoftwareUpdate* -print 2>/dev/null
$                   // and/or
$ find -E /Library/ -name *GoogleSoftwareUpdate* -print 2>dev/null

This software is sometimes installed in ~/Library/ and sometimes in /Library/.

Mine was located in my ~/Library/ directory. To remove you need to run ksinstall and tell it to uninstall the autoupdate software. That autoupdate software, as I mentioned, is called Keystone (hence “ks” in the name of the executable). Even the name “keystone” tells me that this software likely functions more than just to check whether new software is available.

So:

$ /Users/hal9000/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/Resources/ksinstall --nuke

Yeah, it’s buried deep. Now, that --nuke flag is new. Previous versions would use --uninstall. I suspect Google changed it to frustrate any previously written scripts to root it out and remove it from your life.