Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome extensions spying on users' browsing data

qcontinuum.substack.com

Post reply on HN
Print view View original

31–40 of 215 posts

Re: Chrome extensions spying on users' browsing data

#31

Post by mcjiggerlog »

xnorswap wrote: post #27
mcjiggerlog wrote: post #26

Earlier quoted context omitted.

I was just having a quick search and the only email I can find that offered a price range up front was for $0.1-0.4 per user, and that was from 2023. So I assume up to a dollar per user these days?

I imagine it must be very tempting to take that bag while old reddit is still usable. Thank you for not doing so.

No, fortunately in my case it's not tempting at all.

It's easy to see how many people in less advantaged positions would end up selling out, though.

Re: Chrome extensions spying on users' browsing data

#32

Post by insin »

randunel wrote: post #19
singularfutur wrote: post #12

This is why I only run open source extensions that I can actually audit. uBlock Origin, SponsorBlock, the kind of tools where the code is available and the developer isn't anonymous. The Chrome Web Store is basically unregulated and Google doesn't care as long as they get their cut. Open source at least gives you a chance to see what you're installing before it starts exfiltrating your data to some server in a countr…

How do you check that the open sourced code is the same one that you are installing from the extension repository and actually running?

CRX Viewer is handy for quickly checking what's been published:

https://robwu.nl/crxviewer/

Re: Chrome extensions spying on users' browsing data

#33

Post by lapcat »

> We built an automated scanning pipeline that runs Chrome inside a Docker container, routes all traffic through a man‑in‑the‑middle (MITM) proxy, and watches for outbound requests that correlate with the length of the URLs we feed it.

The biggest problem here is that "We" does not refer to Google itself, who are supposed to be policing their own Chrome Web Store. One of the most profitable corporations in world history is totally negligent.

Re: Chrome extensions spying on users' browsing data

#34

Post by moebrowne »

PurpleRamen wrote: post #13

I don't really understand the complaint here. It seems for most of those extensions have it in their literal purpose to send the active URL and get additional information back, for doing something locally with it. And why does this site has no scrollbar?? WTF, is Webdsign finally that broken?

> And why does this site has no scrollbar

Seems someone decided it was a good idea to make the scrollbar tiny and basically the same colour as the background:

    scrollbar-width: thin;
    scrollbar-color: rgb(219,219,219) rgb(255,255,255);

Re: Chrome extensions spying on users' browsing data

#36

Post by jakub_g »

mixedbit wrote: post #23
singularfutur wrote: post #12

This is why I only run open source extensions that I can actually audit. uBlock Origin, SponsorBlock, the kind of tools where the code is available and the developer isn't anonymous. The Chrome Web Store is basically unregulated and Google doesn't care as long as they get their cut. Open source at least gives you a chance to see what you're installing before it starts exfiltrating your data to some server in a countr…

An extension from a trusted, non anonymous developer which is released as open source is a good signal that the extension can be trusted. But keep in mind that distribution channels for browser extensions, similarly to distribution channels for most other open source packages (pip, npm, rpm), do not provide any guarantee that the package you install and run is actually build verbatim from the code which is open sourc…

Actually, npm supports "provenance" and as it eliminated long lived access tokens for publishing, it encourages people to use "trusted publishing" which over time should make majority of packages be auto-provenance-vefified.

https://docs.npmjs.com/trusted-publishers#automatic-provenan...

Re: Chrome extensions spying on users' browsing data

#37

Post by nanobuilds »

The browsing data itself is only half the problem. Even if you remove the spying extension, the profile it helped build persists and keeps shaping what you see as it gets sold and changes hands.

We focus a lot on blocking data collection and spyware.. but not enough about what happens after the data is already collected/stolen and baked into your algorithmic identity. So much of our data is already out there.

Re: Chrome extensions spying on users' browsing data

#39

Post by fusslo »

endsandmeans wrote: post #20

Most of them jump out as immediately dodgy -- except Stylsh. That is the only one I've ever used on the list but it's been several years.

"zoom", "LibreOffice Editor", "Enhanced Image Viewer", "Video Downloader PLUS"

I guess I shouldnt be surprised on how many use "LibreOffice" or other legit company names to lend legitimacy to themselves. I'm wondering if companies like Zoom don't audit the extension store for copyright claims

I for sure used to use Video Downloader PLUS when I still used chrome (and before youtube-dl)

Re: Chrome extensions spying on users' browsing data

#40

Post by RupertSalt »

deanc wrote: post #21

Over 15 years ago now, I had a popular chrome extension that did a very specific thing. I sold it for a few thousand bucks and moved on. It seemed a bit strange at the time, and I was very cautious in the sale, but sold it and moved on. It's abundantly obvious to me now that bad actors are purchasing legitimate chrome extensions to add this functionality and earn money off the user's data (or even worse). I have seen…

It is a classic supply-chain attack. The same modality is used by gamers to sell off their high-level characters, and social media accounts do "switcheroos" on posts, Pages, and Groups all the time.

You know, a lot of consumer cybersecurity focuses on malware, browser security, LAN services, but I propose that the new frontier of breaches involves browser extensions, "cloud integrations", and "app access" granted from accounts.

If I gave permission for Joe Random Developer's app to read, write, and delete everything in Gmail and Google Drive, that just set me up for ransomware or worse. Without a trace on any local OS. A virus scanner will never catch such attacks. The "Security Checkup" processes are slow and arduous. I often find myself laboriously revoking access and signing out obsolete sessions, one by one by one. There has got to be a better way.

Post reply on HN