More on DataSpii: How extensions hide their grabs and how they’re discovered
1–10 of 26 posts
Re: More on DataSpii: How extensions hide their grabs and how they’re discovered
#2This is why we need the changes that Chrome is making to their extension APIs [1][2]. We cannot trust extensions to have access to all URLs since it lets them collect all browsing history and content. Even if they're not doing it now, who's to say they won't sell their extension next year to the highest bidder who will. By forcing content blockers to use a new API that doesn't expose every visit to the extension itself a whole class of _potentially_ bad actors can't turn around and sell your data.
The average consumer that is installing these extensions are not aware of the risks they come with. An extension could easily be collecting usernames and passwords for banks, crypto wallets, etc. They have this ability because the extension requests access to all URLs and it's so common that no one questions it anymore. I'm glad to see Chrome taking steps to limit that access.
[1] https://blog.chromium.org/2018/10/trustworthy-chrome-extensi...
[2] https://blog.chromium.org/2019/06/web-request-and-declarativ...
Re: More on DataSpii: How extensions hide their grabs and how they’re discovered
#3This is why we need the changes that Chrome is making to their extension APIs [1][2]. We cannot trust extensions to have access to all URLs since it lets them collect all browsing history and content. Even if they're not doing it now, who's to say they won't sell their extension next year to the highest bidder who will. By forcing content blockers to use a new API that doesn't expose every visit to the extension itse…
1) With the Manifest V3 changes, will this apply to all already extensions installed before you install the latest version of Chrome? Or only extensions you install AFTER the update?
2) With the Manifest V3 changes, what is exactly stopping an extension from reading your browsing history, and the URLs you visit? I'm not sure I understand what they're changing.
Re: More on DataSpii: How extensions hide their grabs and how they’re discovered
#4This is why we need the changes that Chrome is making to their extension APIs [1][2]. We cannot trust extensions to have access to all URLs since it lets them collect all browsing history and content. Even if they're not doing it now, who's to say they won't sell their extension next year to the highest bidder who will. By forcing content blockers to use a new API that doesn't expose every visit to the extension itse…
No one is against the general Active-Tab permission changes that Chrome is proposing, but you're misunderstanding what Chrome's changes to the web request API actually accomplish.
They're not going to improve your privacy and they're not going to improve your security, because the observational capabilities are still going to be available.
And if the new active-tab permissions wouldn't be enough to protect users from the blocking capabilities of the web request API, they're not going to be enough to protect users from the observational capabilities either. Removing blocking abilities isn't really going to slow malicious extensions down.
As a quick side note, this is how roughly 80% of the big public conflicts with the Chrome/web branch of Google go nowadays.
- Google proposes a change that they claim will improve security or privacy.
- People point out that the change doesn't actually improve security or privacy.
- Google wonders out loud why people don't care about security and privacy.
In regards to the web request API, so many developers have explained the problems so many times, that a less charitable me could plausibly claim that the continued implication that extension developers just don't understand security is borderline misinformation.
Re: More on DataSpii: How extensions hide their grabs and how they’re discovered
#5This is why we need the changes that Chrome is making to their extension APIs [1][2]. We cannot trust extensions to have access to all URLs since it lets them collect all browsing history and content. Even if they're not doing it now, who's to say they won't sell their extension next year to the highest bidder who will. By forcing content blockers to use a new API that doesn't expose every visit to the extension itse…
No one is against the general Active-Tab permission changes that Chrome is proposing, but you're misunderstanding what Chrome's changes to the web request API actually accomplish. They're not going to improve your privacy and they're not going to improve your security, because the observational capabilities are still going to be available. And if the new active-tab permissions wouldn't be enough to protect users from…
Can any extension still be able to read my browsing history? IE. know what URLs I visit. What Google searches I perform? Even if it's technically harder to implement.
If so, then I totally agree: this change does absolutely nothing! But as expected from Google: this sort of thing has been going on for 5-10 years, and nothing has been done. They got my hopes up yet again.
Re: More on DataSpii: How extensions hide their grabs and how they’re discovered
#6hover zoom was known to be spyware long time ago.
https://old.reddit.com/r/chrome/comments/19nndn/hoverzoom_st...
Re: More on DataSpii: How extensions hide their grabs and how they’re discovered
#7Earlier quoted context omitted.
No one is against the general Active-Tab permission changes that Chrome is proposing, but you're misunderstanding what Chrome's changes to the web request API actually accomplish. They're not going to improve your privacy and they're not going to improve your security, because the observational capabilities are still going to be available. And if the new active-tab permissions wouldn't be enough to protect users from…
Can any extension still be able to read my browsing history? IE. know what URLs I visit. What Google searches I perform? Even if it's technically harder to implement. If so, then I totally agree: this change does absolutely nothing! But as expected from Google: this sort of thing has been going on for 5-10 years, and nothing has been done. They got my hopes up yet again.
Short answer yes.[0]
> In Manifest V3, this API will be discouraged (and likely limited) in its blocking form. The non-blocking implementation of the webRequest API, which allows extensions to observe network requests, but not modify, redirect, or block them (and thus doesn't prevent Chrome from continuing to process the request) will not be discouraged.
Longer answer, there are multiple good changes coming in V3 (in particular, the introduction of active-tab permissions, which would let you have an extension that can only run code when you explicitly click on it), but those changes aren't really part of the blocking/observation argument that's been happening.
I thought about doing a blog post going into more detail about this at one point, but I figured it was unlikely to make anything change, and that the controversy was old enough that anyone who wasn't already informed wouldn't care any more.
If I'm wrong, maybe I should take a week and write something more detailed.
[0]: https://docs.google.com/document/d/1nPu6Wy4LWR66EFLeYInl3Nzz...
Re: More on DataSpii: How extensions hide their grabs and how they’re discovered
#8This is why we need the changes that Chrome is making to their extension APIs [1][2]. We cannot trust extensions to have access to all URLs since it lets them collect all browsing history and content. Even if they're not doing it now, who's to say they won't sell their extension next year to the highest bidder who will. By forcing content blockers to use a new API that doesn't expose every visit to the extension itse…
1) With the Manifest V3 changes, will this apply to all already extensions installed before you install the latest version of Chrome? Or only extensions you install AFTER the update? 2) With the Manifest V3 changes, what is exactly stopping an extension from reading your browsing history, and the URLs you visit? I'm not sure I understand what they're changing.
1) I would think that there would be a period where its opt-in for a while before forcing the new API since its not backwards-compatible.
2) Nothing necessarily other than them rejecting extensions that access all URLs now if they don't need them.
Re: More on DataSpii: How extensions hide their grabs and how they’re discovered
#9hover zoom was known to be spyware long time ago. https://old.reddit.com/r/chrome/comments/19nndn/hoverzoom_st...
Known to whom?
This is very relevant as part of the broader conversation about defaults and the trade-offs to be made between flexibility for power users and relatively more safety for most users.
Re: More on DataSpii: How extensions hide their grabs and how they’re discovered
#10This is why we need the changes that Chrome is making to their extension APIs [1][2]. We cannot trust extensions to have access to all URLs since it lets them collect all browsing history and content. Even if they're not doing it now, who's to say they won't sell their extension next year to the highest bidder who will. By forcing content blockers to use a new API that doesn't expose every visit to the extension itse…
No one is against the general Active-Tab permission changes that Chrome is proposing, but you're misunderstanding what Chrome's changes to the web request API actually accomplish. They're not going to improve your privacy and they're not going to improve your security, because the observational capabilities are still going to be available. And if the new active-tab permissions wouldn't be enough to protect users from…
They stated in [1] that:
> In Manifest V3, we want activeTab-style host permissions to be the default, with a number of extra options. Instead of being granted access to all URLs on installation, extensions will be unable to request , and instead the user can choose to invoke the extension on certain websites, like they would with activeTab. Additional settings will be available to the user post-installation, to allow them to tweak behavior if they so desire.
To me that reads that extensions won't be allowed to request anymore which would definitely increase privacy since they won't be able to get script access on every website. Some observational capabilities will still be available but from what I'm reading not as many. I would've liked the web request API to be deprecated and discouraged or under heavy scrutiny, if used but there was too much push back.
[1] https://docs.google.com/document/d/1nPu6Wy4LWR66EFLeYInl3Nzz...