Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Use "Amazon 1 Button" Chrome extension to sniff all HTTPS websites

blog.kotowicz.net

Post reply on HN
Print view View original

31–40 of 61 posts

Re: Use "Amazon 1 Button" Chrome extension to sniff all HTTPS websites

#31

Post by jonknee »

taway2012 wrote: post #2

This sort of abusive, insecure extension poisons the well for all extension developers. Now, I wish to submit a couple of feature requests to the Chrome team. 1) I wish there was a way by which an extension could declare its access patterns in much more fine-grained manner (kinda like CORS headers). Then I can prove to my users that my extension cannot do the sort of ugly crap that Amazon is doing. 2) Second is an AP…

Most extensions don't need much access, but this one does price comparisons as you browse. How else would it work unless it knows what you browse? Perhaps using activeTab could work, that might even be something I would use.

http://developer.chrome.com/extensions/activeTab.html

At least these extensions are .js files that you can read and that Chrome does tell you what it can access (and lets you see that after they are installed). A lot better than the situation for desktop software.

Re: Use "Amazon 1 Button" Chrome extension to sniff all HTTPS websites

#32

Post by kalleboo »

lazylland wrote: post #25

My paranoia in installing extensions is finally justified. If Amazon is pulling these kind of stunts, then imagine the kind of mischief the smaller apps are pulling off. This whole "scorched earth"-style permissions model that users can't make educated decisions about is what annoys me about current platforms like Chrome, Android and iOS. JavaME had an interesting model where the app asks permissions after it is inst…

> where the app asks permissions after it is installed (e.g. internet access, local file system access) for each thing it wants to do

iOS does the same for the permissions it supports (access to photo library, contacts, GPS/location, twitter accounts, etc etc), but a lot of things are always allowed (such as internet access). Facebook also lets you deny specific permissions to apps on their platform. I've always wondered why Android and browser extensions don't let you line-veto deny permissions.

Re: Use "Amazon 1 Button" Chrome extension to sniff all HTTPS websites

#33

Post by gohrt »

taopao wrote: post #11
makmanalp wrote: post #6

Cached: http://webcache.googleusercontent.com/search?q=cache:http://... The "news" part of this is that the extension allegedly reports all the URLs you've visited to amazon, including https ones, plus some reporting of site contents to alexa.

Amazon owns Alexa, just to make that clear.

Which sort of shows what a farce this hullaboo about information sharing is. "Megacorp promises not to share your information with other companies", but Megacorp owns dozens to hundreds of company-like projects anyway.

Re: Use "Amazon 1 Button" Chrome extension to sniff all HTTPS websites

#34

Post by gohrt »

shmageggy wrote: post #15
Afforess wrote: post #9

Earlier quoted context omitted.

Read the article. The configuration from amazon is only set up to gather https data on amazon sites. Because the configuration was sent over http, he used a man in the middle attack to change it to a wildcard, and gather all https data. Amazon wasn't being evil, just incompetent. Never attribute to malice what can adequately be explained by stupidity...

So logging every single URL you visit and every search you make on Google isn't evil? This is the kind of nasty extension that your browser warns you about when you open a private/incognito window. I realize you were just talking about the HTTPS aspect of it, but your parent asked about the generic "this". It's pretty clear they "might do this" so they can data-mine your browsing activity, which is now associated wit…

> every single URL you visit and every search you make on Google isn't evil

No, it's not evil, it's the the point of the extension -- to do product search.

If you don't like the product, you don't have to use it, but you can't say you want it, and then say it's evil for doing exactly what it says on the tin.

Re: Use "Amazon 1 Button" Chrome extension to sniff all HTTPS websites

#35

Post by borski »

Sadly, Amazon isn't alone in this. There is no secure CSP that Chrome implements for any of its extensions, and they don't require and sort of legitimate oversight, so I would venture to guess that there are at least a few dozen extensions that are just as bad.

We wrote about one, incidentally, a few months ago, that has hundreds of thousands of installs: https://www.tinfoilsecurity.com/blog/building-a-browser-exte...

Re: Use "Amazon 1 Button" Chrome extension to sniff all HTTPS websites

#36

Post by medde »

Afforess wrote: post #9
nkozyra wrote: post #3

Can anyone fathom a potentially benign reason Amazon might do this?

Read the article. The configuration from amazon is only set up to gather https data on amazon sites. Because the configuration was sent over http, he used a man in the middle attack to change it to a wildcard, and gather all https data. Amazon wasn't being evil, just incompetent. Never attribute to malice what can adequately be explained by stupidity...

that saying is only good if you are talking about an individual, not a company...

Re: Use "Amazon 1 Button" Chrome extension to sniff all HTTPS websites

#37

Post by jlgaddis »

gohrt wrote: post #33
taopao wrote: post #11

Earlier quoted context omitted.

Amazon owns Alexa, just to make that clear.

Which sort of shows what a farce this hullaboo about information sharing is. "Megacorp promises not to share your information with other companies", but Megacorp owns dozens to hundreds of company-like projects anyway.

Usually, they say they can/will share data with their "affiliates" -- you know, pretty much anybody they might enter into any type of agreement with.

Re: Use "Amazon 1 Button" Chrome extension to sniff all HTTPS websites

#38

Post by gcr »

Kerrick wrote: post #22

That's why in my Chrome extension that allows you to discover whether pages have been submitted on reddit as you browse [1], I was cautious with the fact that reddit is sent the URLs over HTTP. It has a Privacy section in the settings that lets you enable Wait For Click so URLs are only checked upon explicit request. It also lets you exclude domains or URL regular expressions from automatically checking the URL, forc…

Is there a way of testing for websites' existence on Reddit by a hash?

Re: Use "Amazon 1 Button" Chrome extension to sniff all HTTPS websites

#40

Post by byoogle »

astupidquestion wrote: post #30

Stupid questions: 1) Would a plugin such as Disconnect.me stop this from happening? (Yes, I am aware of the irony...) 2) What's the best way for a non-technical person to monitor traffic to ensure that plugins are not "phoning home"?

I'm one of the Disconnect devs and these definitely aren't stupid questions:

1. Unlike that other "privacy" cough extension, Disconnect doesn't send any data (user or otherwise) to Disconnect servers. In other words, Disconnect doesn't output user data that can be intercepted by a MITM attack. Disconnect does grab a config file on startup (https://disconnect.me/help#syncing), but unlike in the Amazon case, the file is both transferred over HTTPS and encrypted (with the Stanford Javascript Crypto Library). Also unlike in the Amazon case, the file has a limited functional scope (which third-party sites to block) so is less susceptible to being rewritten in an abusive way.

2. One of our other Chrome extensions, Collusion for Chrome, will actually show you requests that are coming from other extensions. The more technical approach, which isn't that hard and I'd like to see more people try, is to run a packet sniffer (recommended: http://www.wireshark.org/) or proxy server (recommended: http://www.charlesproxy.com/).

Post reply on HN