181–190 of 374 posts
If you put something out on the web that gets somewhat popular, you are going to get all sorts of scummy people contacting you. The first one that happened to me: I have a domain name and someone emailed me to let me know, as a courtesy, that someone was buying similar Chinese domain names and did I want to get them first. I thought that was nice that they were notifying me ... oh wait, they're just trying to get me…
If you do anything with web3 crypto or even money, always use different browser profiles. The profiles that you use for Metamask, don't install any extensions into those beyond MM.
What's wrong with selling data if it's truly anonymized?
This one is interesting because it seems harmless, if not even helpful (Monitoring DNS errors). What am I missing here? "I’m sure you get business proposals all the time, so I’ll get straight to the point. I hope what I’m proposing is a little different and might actually interest you. I like Hover Zoom+ as a great alternative to it’s bigger brother Hover Zoom that lost its glamour over the last couple of months. We'…
FWIW, and since a few of you probably use it… I own the JSON Formatter extension [0], which I created and open-sourced 12 years ago and have maintained [1] ever since, with 2 million users today. And I solemnly swear that I will never add any code that sends any data anywhere, nor let it fall into the hands of anyone else who would. I’ve been emailed several tempting cash offers from shady people who presumably want…
Earlier quoted context omitted.
except it's always listening for you to say "siri" or "google assisstent". Some androids also show what music is playing nearby. You can thankfully opt-out but the ability to is still there.
They do that with local processing. For the music thing it calculates a hash locally and send it to their servers.
Earlier quoted context omitted.
The issue with that is that "Gets to read and/or write the DOM" happens to be the only permissions a nefarious extension needs while also being those that a vast number of useful extensions require.
That's why it'd be nice to have a general "access the internet" permission, since DOM reads are usually harmless if they can't get any data back.
Some of the difficulty around securing extensions boils down to the fact that Javascript permissions could be better. Websites do a decent job of sandboxing the website, but sandboxing within websites (without relying on iframes) is much more difficult.
Per-site permissions and click-to-activate are also really useful features here. It's easy to forget how recent they are. But it would be good to go further if possible and having barriers in front of exfiltration would be a big part of that -- there are many browser permissions that would become less dangerous if you could know for sure that the data they generate can't get off your device. I just think it would be really difficult to try and build browser permissions around that in a user-legible way.
I have an extension I wrote that is literally for a single regional website to do some extra blocking to get around a paywall. There are under 10 installs total. For some reason, the most recent monetization email I got thought it was 10,000. > I'm reaching out to discuss a unique monetization opportunity for your extension, , through our exclusive Premium Bing Hosted Product. > I'm thrilled to let you know that this…
Maybe mark as spam and move on.
Earlier quoted context omitted.
Might at least make these attacks harder if users could disable extension updates, or had to opt into them. Most of these extensions are simple and don't really need to be updated, yet the update mechanism is silent full auto bada bing bada boom no rollbacks. I can't think of any updates more aggressive, not even Steam.
Yet another opportunity to recommend Firefox to readers. I'm not sure I advise doing it, but you can go to about:addons and hit the gear icon and you can uncheck "Update Addons Automatically". Even better, click on an extension and under the "details" tab there's an option per-addon to set whether you want automatic updates or not, so you can disable updates just for the one addon you don't trust (or enable updates j…