21–30 of 105 posts
Does the Chrome store not require that the dev account associated with these extensions be on the official corporate domains? That would seem like an easy way to prevent spoofing of Fortune 100 companies.
As a maintainer of a relatively popular extension (hoverzoom+, ~360K users) I get business offers all the time [1]. A few of them are pretty good, actually. I'm not surprised that some developers eventually give up and take one of those offers. But I am surprised that there aren't more of these "under new management" extensions, or maybe we just don't know about them.
I'm surprised anyone ever installs browser extensions, given how many malicious extensions exist, and how intrusive they are whether malicious or not.
Five years ago I had a whole bunch of extensions, but that ended whenever it was that I first learned that there were bad actors buying legitimate extensions from their developers and filling them with malware. After that I dramatically reduced the number I had installed, down to basically a password manager and ublock origin. The brief install-time vetting I used to do would would do nothing to prevent an auto updat…
Example:
Beth Anderson Mon 10:58 AM To: Mostly Spam
Hello
I am Beth and I am offering monetization for browser extensions, with everything that is going on our team was extremely focused and productive in creating a way to earn revenue on extensions.
We offer to change default search to Bing or Yahoo on your extension which can earn up to $800 a month per 5000 users. This is a premium product by invitation only and can easily be added to your chrome extensions.
You are might curious to know if it is allowed? And I must say that this is completely allowed! Please reply to this email to discuss this further!
Looking forward hearing from you!
Beth Anderson
Business Development Manager
My team recently built a Chrome extension and expected to be grilled on permissions. We sailed through despite requesting access to all sorts of things. Their vetting seems strict from the outside, but does not seem like it after going through the process.
It seems but it doesn't seem? Sorry I can't figure out the typo
It is possible that we just did a really good job on the justifications, but I have never had a store submission come back with no required changes or clarifications outside of Google.
I'm surprised anyone ever installs browser extensions, given how many malicious extensions exist, and how intrusive they are whether malicious or not.
I emailed the dev (his email was on the about section of the extension). He told me that the code was no longer public because he was selling it to someone else that wanted to take it over. I had all kinds of red flags from this, so I uninstalled it right away.
> The extensions spoofed a range of consumer brands, including Adobe, Amazon, Facebook, HBO, Microsoft, Roku and Verizon Does the Chrome store not require that the dev account associated with these extensions be on the official corporate domains? That would seem like an easy way to prevent spoofing of Fortune 100 companies.
Simple domain validated publishing similar to Let's Encrypt would be way better for devs and users, but that would require Google and Apple to give up control and that doesn't happen in monopoly markets.
Edit: And Microsoft. Between them those 3 companies are the gatekeepers of almost all (signed) app distribution.
What?!? This work was done by an independent researcher. Why is google providing account recovery emails to the general public (and therefore attackers)?!?
Edit: fixed typo; replaced “recovery passwords” with “recovery emails”
> Additionally, Google’s account recovery tools indicate many different developer email addresses tied to extensions reviewed here share the same recovery email What?!? This work was done by an independent researcher. Why is google providing account recovery emails to the general public (and therefore attackers)?!? Edit: fixed typo; replaced “recovery passwords” with “recovery emails”
It doesn't refer to passwords but email addresses.
And Google doesn't have to provide them even the actual address for them to determine that they are identical, they just need to provide something that maps 1:1 with the email, without the mapping.
> Additionally, Google’s account recovery tools indicate many different developer email addresses tied to extensions reviewed here share the same recovery email What?!? This work was done by an independent researcher. Why is google providing account recovery emails to the general public (and therefore attackers)?!? Edit: fixed typo; replaced “recovery passwords” with “recovery emails”
> Why is google providing account recovery passwords to the general public It doesn't refer to passwords but email addresses. And Google doesn't have to provide them even the actual address for them to determine that they are identical, they just need to provide something that maps 1:1 with the email, without the mapping.
> Additionally, Google’s account recovery tools indicate many different developer email addresses tied to extensions reviewed here share the same recovery email What?!? This work was done by an independent researcher. Why is google providing account recovery emails to the general public (and therefore attackers)?!? Edit: fixed typo; replaced “recovery passwords” with “recovery emails”