No post body was provided.
Massive spying on users of Google's Chrome shows new security weakness
11–20 of 270 posts
Re: Massive spying on users of Google's Chrome shows new security weakness
#12Given that they're the engine now, does anyone know if Microsoft Edge is better than Chrome for for privacy?
Given that we're on HN, I distinctly remember reading on a comment that the new Edge supposedly dials home to MS and is not really secure either.
Re: Massive spying on users of Google's Chrome shows new security weakness
#13I'd say most such issues with extensions could be solved if they were "read-only", i.e. were prevented from inserting data into documents, making or adding data into outbound requests.
It could block ads with monads!
Re: Massive spying on users of Google's Chrome shows new security weakness
#14The other side of this is the many complaints in HN threads about restrictions on what extensions can do and which ones are allowed. I can't say whether chrome's extension library strikes the right balance, but I think it's a difficult tradeoff.
The main issue people complain about is that it takes months for Google to review extensions and they shut down extensions randomly without giving reasons, not the amount of permissions.
Re: Massive spying on users of Google's Chrome shows new security weakness
#15At this point, I treat Chrome like a Huawei phone: never secure and only to be used at work for those sweet sweet dev tools.
Firefox devs tools are great. I just use Chrome to play the occasional Stadia game.
Re: Massive spying on users of Google's Chrome shows new security weakness
#16What extensions do you primarily use on Chrome (if you do)?
My list (on brave) includes:
>uBlock Origin
>Decentraleyes
>Stylus
Re: Massive spying on users of Google's Chrome shows new security weakness
#17Potentially dumb question here, but would it be generally possible to create a permissions system for browser extensions that can distinguish between an extension that is actually sending information based on sensitive sources like page content and browser history and an extension that only sends harmless stuff over the network like e.g. asking for updated ad block lists?
I'm imagining something like a sufficiently advanced type system that could tag data from sensitive sources, and force you to use a different API if you e.g. want to put that kind of tagged information in a network request. Though even if this would be available, I suspect there are many more indirect methods of exfiltrating information e.g. if you have the permission to change page content, which are probably very hard to impossible to distinguish effectively from benign stuff.
Some of the most useful extensions need really scary permissions. I don't see any good way to robustly fix malicious extensions than to create a permissions system that would make the scary permissions unnecessary for most cases.
The current system is broken enough that I try very hard to minimize which extensions I use. It's essentially just an ad blocker and a password safe in my main browser. And then a bunch of dev tools in a different browser I use for development, but not for browsing in general.
Re: Massive spying on users of Google's Chrome shows new security weakness
#18I wonder if these extensions are so hard to spot because spying is a core feature of Google Chrome, and most top extensions do this. For example, the extraordinarily popular extension Honey phones home about your purchases, shopping habits and other data without adequately disclosing that fact. It's hard to see why Google would care when Chrome was always a trojan horse to co-opt web standards for their own purposes…
Here are more details about 'X-Client-Data'. I'm not saying it's necessarily a good practice (and maybe it's something they should stop doing), but I wouldn't call it "spying". It's analytics, used to test new Chrome features.
https://9to5google.com/2020/02/06/google-chrome-x-client-dat...
Re: Massive spying on users of Google's Chrome shows new security weakness
#19I wonder if these extensions are so hard to spot because spying is a core feature of Google Chrome, and most top extensions do this. For example, the extraordinarily popular extension Honey phones home about your purchases, shopping habits and other data without adequately disclosing that fact. It's hard to see why Google would care when Chrome was always a trojan horse to co-opt web standards for their own purposes…
Wow talk about revisionism!
Chrome was meant as a hedge against IE and lesser so against Firefox. Microsoft owned the desktop with Windows and could easily shut Google out. See the reason surrounding the creation of the Google toolbar.
Similarly Android is a hedge against IOS and mobile search.
Re: Massive spying on users of Google's Chrome shows new security weakness
#20At this point, I treat Chrome like a Huawei phone: never secure and only to be used at work for those sweet sweet dev tools.
I use Firefox’s tools. The console as a tiny editor is cool. I think Chrome has a better network timeline/waterfall and performance monitor thing. But I only use those occasionally.
I hate Chrome with a passion. But: Annoyingly, Firefox hides the the call stack for some error messages which is especially painful if these come from a framework. Chrome never fails me to show the entire call stack.
As well inspection of request and response content is painful. Mouse scroll doesn't work and the horizontal bar shows only up when scrolling all the way down.
Finally copying and pasting any header content is abysmal. I never get it to work.
I use Firefox, even for development because I reject any support for Google but I wish there weren't these usability issues.