61–70 of 146 posts
Quarantined - PUP.Optional.Hijacker. C:\USERS*\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\BCJINDCCCAAGFPAPJJMAFAPMMGKKHGOA
wondered what the extension was... JSON Formatter
WebExtension permissions are fucking broken if the set of permissions necessary to reformat and style JSON snippets is sufficient to inject network-capable Javascript code into any page. If basically any worthwhile extension can be silently updated to inject tags anywhere, then it's time to call this a failed experiment and move on. Bake UBlock and password-management APIs into the browser. Stop the madness.
To install a JSON formatter, you need to grant the following access: 1. Access to the page DOM to read the raw JSON content. 2. Permission to modify the DOM to display the formatted results. Unfortunately, these requirements necessitate broad host permissions, which allow an extension to inject ads or track user behaviors. There is no alternative way to define a strict security boundary that allows these specific per…
Noticed a suspicious element called give-freely-root-bcjindcccaagfpapjjmafapmmgkkhgoa in the chrome inspector today. Turns out about a month ago, the popular open source [JSON Formatter chrome extension]( https://chromewebstore.google.com/detail/json-formatter/bcji... ) went closed source and started injecting adware into checkout pages. Also seems to be doing some geolocation tracking. I didn't see this come up on h…
It's OK to inject ads, but not OK to remove them, under Google's current policies.
They have an API basically dedicated to this: https://developer.chrome.com/docs/extensions/reference/api/d...
I think you may have been confused about the Manifest V3 API changes, which were controversial because they didn't support every feature of the old API. The mainstream ad blockers all wrote new versions for Manifest V3.
Earlier quoted context omitted.
- click install - "It can: Read and change all your data on all websites" It's not alarming sounding enough for what that implies, but "it can trigger requests under its control" seems fairly obvious from that. The permission it uses to inject ads can be used to inject ads (or block them). Why a JSON formatter needs any permission at all is something anyone installing it should be asking themselves. --- This is not m…
"Read and change data on all websites" does not, to me, imply "make network requests on the user's behalf". Yes, I can put on my developer hat and surmise that, under the hood, the extension's injected payload can make network requests by adding elements to the DOM. No user will ever understand this, no matter how much you try to educate them through the permission prompt. This ends up being significantly worse than…
Yeah, I don't like this phrasing either, I think it downplays the risk to a dangerous degree (which is "it can see and do literally anything on any site you visit", which is GIGANTIC). It's one of the worst permissions to request, but it doesn't look like it.
But other permissions systems don't have per-site controls, or the ability to turn things off until activated, or isolate everything, or... the list is huge, others generally have permissions like "can access this folder [and others we haven't told you] [and folders you give it access to, which you can't revoke later https://news.ycombinator.com/item?id=47719602] [and only for applications which opt into this, normal ones can do anything anywhere any time]...." which is much worse.
Earlier quoted context omitted.
How did you "notice" a suspicious element in the inspector? Do you routinely look at the DOM?
I did webdev for a long time, so yeah. If you want the story, I was looking into guix on asahi and ended up on https://www.asahi-guix.org/ which didn’t load anything, so I checked the page source and noticed the element.
(I used to do a lot of web development and probably know dev tools better than most people here. However I almost never look at the DOM of a webpage I don't own)
> FWIW, and since a few of you probably use it… I own the JSON Formatter extension [0], which I created and open-sourced 12 years ago and have maintained [1] ever since, with 2 million users today. And I solemnly swear that I will never add any code that sends any data anywhere, nor let it fall into the hands of anyone else who would. I’ve been emailed several tempting cash offers from shady people who presumably want to steal everyone’s data or worse. I sometimes wish I had never put my name on it so I could just take the money without harming my reputation, but I did, so I’m stuck with being honourable. On the plus side I will always be able to say that I never sold out.
Earlier quoted context omitted.
Well no, actually. Both halves of that statement are false. Injecting ads will get you removed from the extension store if caught, while adblockers are advertised on the front page of the store.
Google's "Manifest 3" rules, vs. ad blocking, in Ars Technica.[1] Did the JSON formatter with ads get kicked out of the extension store yet? [1] https://arstechnica.com/gadgets/2024/08/chromes-manifest-v3-...
Earlier quoted context omitted.
Depends on how many JSON tokens you need to format. I recommend getting JSON ForMAX+ with 200k tokens and 100k sign in bonus.
I heard that JWTs are 5x the price of JSON tokens but only 3x if you have JSON ForULTRA+ (new) (for work or school).
HODL
WebExtension permissions are fucking broken if the set of permissions necessary to reformat and style JSON snippets is sufficient to inject network-capable Javascript code into any page. If basically any worthwhile extension can be silently updated to inject tags anywhere, then it's time to call this a failed experiment and move on. Bake UBlock and password-management APIs into the browser. Stop the madness.
Been researching extensions for a while now at the day job and I'm preparing some disclosures to the major browser vendors. The amount of absolute clusterfuckery in browser extensions is endless. One of the biggest issues is with how extensions define their permissions and capabilities in their manfiest.json files. I've reviewed thousands of these now, and probably only 5-10% of extensions actually get it right. Ther…
They tried to do this and people got very upset at them trying to kill adblockers.