Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Massive spying on users of Google's Chrome shows new security weakness

reuters.com

Post reply on HN
Print view View original

101–110 of 270 posts

Re: Massive spying on users of Google's Chrome shows new security weakness

#101

Post by joshuamorton »

bigiain wrote: post #63
mehrdadn wrote: post #35

Earlier quoted context omitted.

I see, thanks. I'm looking at that source and confused what it's actually doing though. What is the "tracking" aspect? I see ShouldAppendHeaders() returns true on doubleclick.net, but on the face of it, it seems to just be saying: "Should we send experimental headers to this URL? If it's doubleclick.net, then yes." But they claim [1] this X-Client-Data header is used for experimenting with Chrome, not for tracking. B…

Yeah, and that sounds totally plausible. That Google need to send "experimental headers" to a hardcoded domain for an advertising company they bought a decade or so back - because of course the results of web browser experiments should go to an advertising company (or these days th advertising division of a company) ad not, say, to google's own domain? /s Google are totally lying here.

You realize that the tracking headers are headers as part of the requests that you were already making to doubleclick. So, what's happening here is that if you make a request to doubleclick (say because you're viewing an ad), extra information is included that allows Google to understand which experiments were enabled on your browser.

If you never go to doubleclick yourself, chrome won't ever send data to it. It's not like a sneaky background thing. It's extra data attached to requests you were already making.

Re: Massive spying on users of Google's Chrome shows new security weakness

#102

Post by kevingadd »

moritonal wrote: post #88
lifty wrote: post #72

Earlier quoted context omitted.

I don’t see why it wouldn’t be possible to make a more granular extension permission system that also has stricter sandboxing. Safari is already going in that direction. The new extension system is more restricted, although I don’t know if there is any granularity to it.

So WebExtensions support this, even dynamic permissions (like on Android). But I've found I've had to push developers to use it because it makes their life a bit harder and it's already a side-project.

The UX for the dynamic permissions and fine-grained permissions is, to be generous, not good. I never saw any expressed desire or commitment from the Chrome team to improve on this which is likely why so many extensions still just request blanket access instead.

Re: Massive spying on users of Google's Chrome shows new security weakness

#103

Post by s_gourichon »

fabian2k wrote: post #17

Potentially dumb question here, but would it be generally possible to create a permissions system for browser extensions that can distinguish between an extension that is actually sending information based on sensitive sources like page content and browser history and an extension that only sends harmless stuff over the network like e.g. asking for updated ad block lists? I'm imagining something like a sufficiently a…

How would the browser detect an extension that gets access to information that should not get out, then mixes it into a unrecognisable (by the automatic analysis) wad of data that is sent to some server, and actually is decodable by some third party? This is bad. This is what Chrome apparently does with X-Client-Data. For reason that I would relate to Godel's theorem I think detection cannot be done automatically.

Therefore, any access to private information makes any extension tainted somehow.

What about an extension that does not explicitly ask for information? In this post-Meltdown world, private information can be inferred by any program running for a sufficient amount of time. So, any program or extension could be considered tainted.

Also, even a "neutral" feature, for example implementing a faster alternative to HTTP, could exfiltrate data in non-obvious ways, if only via playing with timing.

TL;DR open-source only, code reviewed software is the only hope in sight , but it is currently weak enough to allow channels mentioned in these threads.

Re: Massive spying on users of Google's Chrome shows new security weakness

#104

Post by IncRnd »

willvarfar wrote: post #89
ThePhysicist wrote: post #7

There is a web intelligence company in Israel that is known to buy popular browser extensions like “Web of Trust” and use them to exfiltrate browsing data (with tons of sensitive and personal information). They have been called out for this several times already and some of their extensions got removed from the store, they invariably turn back up again after a few weeks though (good connections to Google/Mozilla I gu…

Could browser extensions be ran in a sandbox, with read_access to the page, but only able to read from whitelisted registered and fixed URLs for updating configuration etc? So your blocking extension can download lists of things to block, or other config, but it can't exfiltrate any information about the user's browsing habits. The only side channel I can then think of is using page rewriting or timing to communicate…

In the same way that DNS requests can exfiltrate data, requesting URLs can also exfiltrate data. This is trivial to perform.

Re: Massive spying on users of Google's Chrome shows new security weakness

#105

Post by joshuamorton »

pdkl95 wrote: post #99
mehrdadn wrote: post #35

Earlier quoted context omitted.

I see, thanks. I'm looking at that source and confused what it's actually doing though. What is the "tracking" aspect? I see ShouldAppendHeaders() returns true on doubleclick.net, but on the face of it, it seems to just be saying: "Should we send experimental headers to this URL? If it's doubleclick.net, then yes." But they claim [1] this X-Client-Data header is used for experimenting with Chrome, not for tracking. B…

> What is the "tracking" aspect? See this post I made when X-Client-Header was introduced. > But they claim [1] this X-Client-Data header is used for experimenting with Chrome, not for tracking. They claim a lot of things. Sometimes they even modify their claims years after they first made them. Even if they were making 100% innocent claims now , they are not guaranteeing[2] they won't change how they use the data in…

> Google is saying they are tracking people with that header

No they don't. Nothing in your comment sounds anything like Google claiming to be tracking people. And as mentioned elsewhere in this thread, they explicitly claim to not be tracking individuals.

Re: Massive spying on users of Google's Chrome shows new security weakness

#106

Post by kevingadd »

zelphirkalt wrote: post #75
fabian2k wrote: post #17

Potentially dumb question here, but would it be generally possible to create a permissions system for browser extensions that can distinguish between an extension that is actually sending information based on sensitive sources like page content and browser history and an extension that only sends harmless stuff over the network like e.g. asking for updated ad block lists? I'm imagining something like a sufficiently a…

Firefox already tells you what things an extension can do /what kind of permissions it has, when you are about to install one. You cannot install one and later turn off those permissions though. Would this fit what you describe?

The Chrome extension install flow is like this too. The problems are many but a few, briefly, are:

* "What the extension can do" is very poorly specified, using language that casual computer users won't understand

* The granularity of permissions is poor so in some cases one operation requires a seemingly unrelated permission. (Android historically has had this problem too)

* While Google have recently made some steps towards improving this specific issue, per-website permissions are something that WebExtensions barely handle. You can technically put a specific list of domain names in your permissions list, but if a site changes domains or adds a new subdomain your extension won't work until you push an update that requests the new permission... and that update will disable the extension for everyone on the planet until they dig around in the UI to find the permission request warning. The last time I checked Google's new solution for this was to allow the end user to narrow the 'access everything' permission to specific websites, which is... something, I guess.

Re: Massive spying on users of Google's Chrome shows new security weakness

#107

Post by raxxorrax »

azinman2 wrote: post #71
ponker wrote: post #36

Earlier quoted context omitted.

Why is this business model usually from Israel?

The business model of watching people's web browsing history and selling them adds? You mean like Jumpshot (through antivirus Avast -- Czech), Facebook/Twitter/Pinterest through their pixels (US), every ad tracking network (US/China/Europe generally), and Google through its search engine history & ad platform (US)? It feels very unfair to malign Israel here when the majority of surveillance on the web for money is ha…

Israel is used for ethically questionable stuff many "allies" don't want to do in their own countries. The NSA cannot contact random developers to spy on users, they would be caught yesterday. But it probably isn't antisemitism to state that you can sell any form of security product to more conservative Isrealis.

But yes, saying Isreal does undermine privacy to a disproportionate amount is probably false.

Not only sigint, weapons tests in general are also conveniently outsourced.

Re: Massive spying on users of Google's Chrome shows new security weakness

#108

Post by s_gourichon »

azinman2 wrote: post #77

I feel like Google Chrome should just have some icon or other visual indicator of when an extension has made a networking request. In addition, use the iOS model of permission and prompt the user when it wants to do something like access the network or read your browsing history. Perhaps if this happens on a frequent basis, give another indication that it's happening all the time with the ability to ignore such warni…

Most people would click on any warning without even reading, unfortunately.

Re: Massive spying on users of Google's Chrome shows new security weakness

#109

Post by jopsen »

willvarfar wrote: post #89
ThePhysicist wrote: post #7

There is a web intelligence company in Israel that is known to buy popular browser extensions like “Web of Trust” and use them to exfiltrate browsing data (with tons of sensitive and personal information). They have been called out for this several times already and some of their extensions got removed from the store, they invariably turn back up again after a few weeks though (good connections to Google/Mozilla I gu…

Could browser extensions be ran in a sandbox, with read_access to the page, but only able to read from whitelisted registered and fixed URLs for updating configuration etc? So your blocking extension can download lists of things to block, or other config, but it can't exfiltrate any information about the user's browsing habits. The only side channel I can then think of is using page rewriting or timing to communicate…

Next up is a firestorm over broken extensions, followed by baseless conspiracy theories on how this is all ploy for Mozilla to ban adblockers..

Web Extensions caused lots of outcry, when it was mostly about making extensions async and better sandboxed.

EME caused similar outcry, when in fact it migrated us away from plugins riddled with security vulnerabilities (hint Flash). Today most DRM crap runs in a sandbox -- DRM still sucks, but it doesn't compromise my browser :)

I'm suspect, extensions will be sandboxed further, but this will take time.

Re: Massive spying on users of Google's Chrome shows new security weakness

#110

Post by pokemongoaway »

Gibbon1 wrote: post #41
ponker wrote: post #36

Earlier quoted context omitted.

Why is this business model usually from Israel?

Because historically Israel heavy uses blackmail as a foreign policy tool.

Yep... And still nearly everyone is self censoring and unable wonder why so many top human traffickers and pedophiles are Jewish...
Post reply on HN