37k Chrome users downloaded a fake Adblock Plus extension
1–10 of 42 posts
Re: 37k Chrome users downloaded a fake Adblock Plus extension
#2Extensions are the new "Let's play find the download button on a webpage" that's been around for years. [1]
So many users download replicas of uBlock and find it hard to install the original uBlock Origin extension. Countless times have I had to send them direct link to Chrome's extension site just to make sure they're installing the right one. This is the case especially as the genuine extension in this case has no direct author website and instead lists a repo on Github (average users feel this indicates a knockoff and look elsewhere).
[1] https://www.pcworld.com/article/2012958/how-to-avoid-fake-do...
Re: 37k Chrome users downloaded a fake Adblock Plus extension
#3Extensions are the new "Let's play find the download button on a webpage" that's been around for years. [1] So many users download replicas of uBlock and find it hard to install the original uBlock Origin extension. Countless times have I had to send them direct link to Chrome's extension site just to make sure they're installing the right one. This is the case especially as the genuine extension in this case has no…
This is especially a problem when you try looking for new extensions. It's not sufficient to just look at the reviews or popularity since often times the users themselves have no idea their browsing history is being captured and sold. Also it seems that Google is in no hurry to fix this issue as even having discovered and reported malicious extensions they remain up (see: https://news.ycombinator.com/item?id=14889619).
From the client side one mitigation might be to have all extensions denied network access by default and have the user manually whitelist those in a little-snitch like manner. There is an experimental flag for something similar to this called "User consent for extension scripts." From Google's side the best thing would be to run all extensions in a sandbox like they supposedly do for Android apps and monitor its activity to see if it does anything suspicious like record browsing history, redirect pages, or call out to sketchy URLs.
Re: 37k Chrome users downloaded a fake Adblock Plus extension
#4What are Google's rules about names? Only difference I can see here is the fake one is called "AdBlock" and the real one "Adblock".
Is changing the case of one letter enough to get an extension into the Chrome store? Or even worse are overlapping names allowed?
Re: 37k Chrome users downloaded a fake Adblock Plus extension
#5What are Google's rules about names? Only difference I can see here is the fake one is called "AdBlock" and the real one "Adblock". Is changing the case of one letter enough to get an extension into the Chrome store? Or even worse are overlapping names allowed?
It’s hard enough to tell someone which is best, telling them the particular capitalization is impossible without giving them a direct link.
In addition, preventing duplicate names is fairly hard if you support unicode. Characters like the zero width space, Mongolian vowel separator and many others make it algorithmically different but visually they are the same.
Re: 37k Chrome users downloaded a fake Adblock Plus extension
#6Extensions are the new "Let's play find the download button on a webpage" that's been around for years. [1] So many users download replicas of uBlock and find it hard to install the original uBlock Origin extension. Countless times have I had to send them direct link to Chrome's extension site just to make sure they're installing the right one. This is the case especially as the genuine extension in this case has no…
As an aside, anyone know why both of the major adblockers have an unrelated adblocker with the same name? (AdBlock/AdBlock Plus, uBlock/uBlock Origin.) Who thought this was a good idea?
Re: 37k Chrome users downloaded a fake Adblock Plus extension
#7Extensions are the new "Let's play find the download button on a webpage" that's been around for years. [1] So many users download replicas of uBlock and find it hard to install the original uBlock Origin extension. Countless times have I had to send them direct link to Chrome's extension site just to make sure they're installing the right one. This is the case especially as the genuine extension in this case has no…
As an aside, anyone know why both of the major adblockers have an unrelated adblocker with the same name? (AdBlock/AdBlock Plus, uBlock/uBlock Origin.) Who thought this was a good idea?
Adblock and Adblock Plus were different developers. (Now, I believe, they are both controlled by Eyeo.) The obvious name is shared, the "Plus" were added to indicate a fork of an earlier project. I believe this was far prior to the project getting monetized.
uBlock Origin was originally just uBlock, but a rough moderator took it over (or that's somewhat the story) so there's the Origin fork with the original Dev, the uBlock project does not appear to progress anymore.
Re: 37k Chrome users downloaded a fake Adblock Plus extension
#8Google in general is poor on security this should have been anticipated
Re: 37k Chrome users downloaded a fake Adblock Plus extension
#9What are Google's rules about names? Only difference I can see here is the fake one is called "AdBlock" and the real one "Adblock". Is changing the case of one letter enough to get an extension into the Chrome store? Or even worse are overlapping names allowed?
Google should make the extension name case insensitive like domain names. That should help a little bit.
Re: 37k Chrome users downloaded a fake Adblock Plus extension
#10What are Google's rules about names? Only difference I can see here is the fake one is called "AdBlock" and the real one "Adblock". Is changing the case of one letter enough to get an extension into the Chrome store? Or even worse are overlapping names allowed?
Google should make the extension name case insensitive like domain names. That should help a little bit.
Then people will use cyrillic letters, etc. That approach simply does not work.