Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using fake reviews to find dangerous extensions

krebsonsecurity.com

Post reply on HN
Print view View original

31–40 of 105 posts

Re: Using fake reviews to find dangerous extensions

#31

Post by skybrian »

hedora wrote: post #29
dragonwriter wrote: post #28

Earlier quoted context omitted.

> Why is google providing account recovery passwords to the general public It doesn't refer to passwords but email addresses. And Google doesn't have to provide them even the actual address for them to determine that they are identical, they just need to provide something that maps 1:1 with the email, without the mapping.

The actual email addresses are in screenshots in the article.

It looks like spreadsheet has the developer’s public email, not their recovery email.

Re: Using fake reviews to find dangerous extensions

#32

Post by facorreia »

I treat each and every Chrome extension as potentially malware, given that there are plenty of instances of legit extensions being sold and repurposed, and Chrome will silently install malware on my machine because of its auto-update-without-asking-or-verifying policy. I only trust a few, select extensions from large companies that hopefully won't sell them to a shady hacker.

Re: Using fake reviews to find dangerous extensions

#33

Post by matheusmoreira »

the_local_host wrote: post #4

I'm surprised anyone ever installs browser extensions, given how many malicious extensions exist, and how intrusive they are whether malicious or not.

Yeah. The only extensions people should install are uBlock Origin and EFF extensions like Privacy Badger. All others are potential malware.

I get downvoted a lot every time I post this here.

Re: Using fake reviews to find dangerous extensions

#35

Post by dataviz1000 »

facorreia wrote: post #32

I treat each and every Chrome extension as potentially malware, given that there are plenty of instances of legit extensions being sold and repurposed, and Chrome will silently install malware on my machine because of its auto-update-without-asking-or-verifying policy. I only trust a few, select extensions from large companies that hopefully won't sell them to a shady hacker.

I build my own personal Chrome extensions to be used only by myself and I treat them as potentially malware every single time I type `npm install`. If I built an extension to share, I would likely make it completely with vanilla JavaScript.

Re: Using fake reviews to find dangerous extensions

#36

Post by krebsonsecurity »

skybrian wrote: post #30
hedora wrote: post #27

> Additionally, Google’s account recovery tools indicate many different developer email addresses tied to extensions reviewed here share the same recovery email What?!? This work was done by an independent researcher. Why is google providing account recovery emails to the general public (and therefore attackers)?!? Edit: fixed typo; replaced “recovery passwords” with “recovery emails”

Often, account recovery reveals something about where the email will be sent but with some characters in the email redacted. Maybe that’s what’s happening here?

You are correct. Using the "forgot your password" function on Gmail often reveals snippets of the email account used for recovery and authentication of that account.

Re: Using fake reviews to find dangerous extensions

#37

Post by dragonwriter »

hedora wrote: post #29
dragonwriter wrote: post #28

Earlier quoted context omitted.

> Why is google providing account recovery passwords to the general public It doesn't refer to passwords but email addresses. And Google doesn't have to provide them even the actual address for them to determine that they are identical, they just need to provide something that maps 1:1 with the email, without the mapping.

The actual email addresses are in screenshots in the article.

Those are the developer emails, not the account recovery emails that it says are shared between different developer emails.

Developer emails for extensions are public normally, so those being revealed aren't an issue.

Re: Using fake reviews to find dangerous extensions

#38

Post by sneak »

Any of Google's thousands of staff could have done this trivial research, too, but apparently it's no one's job over there: just like detecting the hijacked verified Twitter accounts that reply to almost all Elon tweets with cryptocurrency scam links that any non-Twitter person can find in 100 seconds, or the antivax hashtag spammers on Instagram, etc.

These companies are very bad at being proactive in enforcing their published policies.

Re: Using fake reviews to find dangerous extensions

#39

Post by user-the-name »

voxl wrote: post #34
the_local_host wrote: post #4

I'm surprised anyone ever installs browser extensions, given how many malicious extensions exist, and how intrusive they are whether malicious or not.

How does your reasoning not apply to applications on any device?

Normal applications distributed through app stores tend to have access to a lot less personal data than browser extensions do.

Re: Using fake reviews to find dangerous extensions

#40

Post by user-the-name »

Jverse wrote: post #5
the_local_host wrote: post #4

I'm surprised anyone ever installs browser extensions, given how many malicious extensions exist, and how intrusive they are whether malicious or not.

Everyone's use case is different. There are definitely a lot of very useful extensions available.

Of course there are, but the point is, you can not really trust any of them. Today they will be very useful, tomorrow they may be malware, and there is no way for you to know or protect yourself.
Post reply on HN