Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Use "Amazon 1 Button" Chrome extension to sniff all HTTPS websites

blog.kotowicz.net

Post reply on HN
Print view View original

41–50 of 61 posts

Re: Use "Amazon 1 Button" Chrome extension to sniff all HTTPS websites

#41

Post by cortesoft »

gcr wrote: post #38
Kerrick wrote: post #22

That's why in my Chrome extension that allows you to discover whether pages have been submitted on reddit as you browse [1], I was cautious with the fact that reddit is sent the URLs over HTTP. It has a Privacy section in the settings that lets you enable Wait For Click so URLs are only checked upon explicit request. It also lets you exclude domains or URL regular expressions from automatically checking the URL, forc…

Is there a way of testing for websites' existence on Reddit by a hash?

Not sure if reddit supports it, but this is how we did our extension at an old startup I worked for.

We allowed users to share post-it note style comments on web sites with their friends; for example, I could leave you a little note on the hackernews front page, and the next time you go to the site you would see the not sitting on top of it.

In order to do this, we had to check every page you visited to see if there was a slide for you on it. We cared about privacy, so we took a hash of each URL and sent it instead of the URL itself. While we would know what site you are on if we happened to get a hit (i.e. you had a note on the page), we wouldn't know what site you were on if there was no note.

Of course, this was all based on the users trusting us to not change our code. There was nothing preventing us from changing how we sent the URLs. The level of access extensions get is SCARY. I don't think users realize what exactly they are allowing when they install them.

Re: Use "Amazon 1 Button" Chrome extension to sniff all HTTPS websites

#42

Post by sytelus »

taway2012 wrote: post #2

This sort of abusive, insecure extension poisons the well for all extension developers. Now, I wish to submit a couple of feature requests to the Chrome team. 1) I wish there was a way by which an extension could declare its access patterns in much more fine-grained manner (kinda like CORS headers). Then I can prove to my users that my extension cannot do the sort of ugly crap that Amazon is doing. 2) Second is an AP…

Chrome looks more and more insecure browser day by day. If the Chrome team gets their act together just not to show saved passwords in clear text I would say it would be big win for all its unsuspecting users.

Re: Use "Amazon 1 Button" Chrome extension to sniff all HTTPS websites

#43

Post by astupidquestion »

byoogle wrote: post #40
astupidquestion wrote: post #30

Stupid questions: 1) Would a plugin such as Disconnect.me stop this from happening? (Yes, I am aware of the irony...) 2) What's the best way for a non-technical person to monitor traffic to ensure that plugins are not "phoning home"?

I'm one of the Disconnect devs and these definitely aren't stupid questions: 1. Unlike that other "privacy" cough extension, Disconnect doesn't send any data (user or otherwise) to Disconnect servers. In other words, Disconnect doesn't output user data that can be intercepted by a MITM attack. Disconnect does grab a config file on startup ( https://disconnect.me/help#syncing ), but unlike in the Amazon case, the file…

Thank you. Can you recommend any tutorials for Charles Proxy or Wireshark? They are more technical than I understand.

Re: Use "Amazon 1 Button" Chrome extension to sniff all HTTPS websites

#44

Post by jrockway »

jlgaddis wrote: post #37
gohrt wrote: post #33

Earlier quoted context omitted.

Which sort of shows what a farce this hullaboo about information sharing is. "Megacorp promises not to share your information with other companies", but Megacorp owns dozens to hundreds of company-like projects anyway.

Usually, they say they can/will share data with their "affiliates" -- you know, pretty much anybody they might enter into any type of agreement with.

I think these agreements are in place so that if a malicious employee is hired and he accesses your data without authorization, they can fire the employee and be done. If their privacy policy said they wouldn't share the data, then they'd have to pay you damages. Since users aren't demanding actual privacy but do demand damages when they technically can, one would expect every company to write this sort of policy.

Re: Use "Amazon 1 Button" Chrome extension to sniff all HTTPS websites

#45

Post by byoogle »

astupidquestion wrote: post #43
byoogle wrote: post #40

Earlier quoted context omitted.

I'm one of the Disconnect devs and these definitely aren't stupid questions: 1. Unlike that other "privacy" cough extension, Disconnect doesn't send any data (user or otherwise) to Disconnect servers. In other words, Disconnect doesn't output user data that can be intercepted by a MITM attack. Disconnect does grab a config file on startup ( https://disconnect.me/help#syncing ), but unlike in the Amazon case, the file…

Thank you. Can you recommend any tutorials for Charles Proxy or Wireshark? They are more technical than I understand.

I don't know of any, but I imagine there are a bunch on YouTube and so forth. I will say that of the two, Charles is the easier to use and I don't think too hard to figure out without any docs.

Re: Use "Amazon 1 Button" Chrome extension to sniff all HTTPS websites

#47

Post by drivingmenuts »

jrockway wrote: post #44
jlgaddis wrote: post #37

Earlier quoted context omitted.

Usually, they say they can/will share data with their "affiliates" -- you know, pretty much anybody they might enter into any type of agreement with.

I think these agreements are in place so that if a malicious employee is hired and he accesses your data without authorization, they can fire the employee and be done. If their privacy policy said they wouldn't share the data, then they'd have to pay you damages. Since users aren't demanding actual privacy but do demand damages when they technically can, one would expect every company to write this sort of policy.

The affiliate agreements allow them to further monetize the data by selling access to third parties without fear of getting sued.

Someone who's hired isn't an affiliate, he's an employee.

Generally, the usage of the term "affiliate" (ie., sales affiliate) is a corporatism designed to make a wage slave job sound better than it is.

Re: Use "Amazon 1 Button" Chrome extension to sniff all HTTPS websites

#48

Post by gcr »

cortesoft wrote: post #41
gcr wrote: post #38

Earlier quoted context omitted.

Is there a way of testing for websites' existence on Reddit by a hash?

Not sure if reddit supports it, but this is how we did our extension at an old startup I worked for. We allowed users to share post-it note style comments on web sites with their friends; for example, I could leave you a little note on the hackernews front page, and the next time you go to the site you would see the not sitting on top of it. In order to do this, we had to check every page you visited to see if there…

Hey, that's awesome! Your design reminds me of "hoodwink'd", which was "underground" in the sense that you had to edit your DNS settings for "hoodwink'd" to work. http://ecmanaut.blogspot.com/2006/01/hoodwinkd.html

Your site URL hashing system is also pretty close how Goggles works, only instead of notes, you get to draw MS paint-like scribbles. http://goggles.sneakygcr.net

Each website is uniquely keyed by a hash of the URL, so Goggles doesn't know the website's URL even if there is a hit. (It does send the page title to the server though because popular sites go on a leaderboard; i'm not so sure about that decision though since it can leak some privacy...)

Browsers are doing a much better job at protecting/restricting bookmarklets than extensions and I wish more of these kinds of notetaking apps/tricks use bookmarklets instead. For example, I just now discovered that Chrome will prevent Goggles from working on certain HTTPS sites like hacker news because it loads javascript from an http:// URL, which is a great design decision from the Chrome team.

Re: Use "Amazon 1 Button" Chrome extension to sniff all HTTPS websites

#49

Post by JosephHatfield »

jlgaddis wrote: post #37
gohrt wrote: post #33

Earlier quoted context omitted.

Which sort of shows what a farce this hullaboo about information sharing is. "Megacorp promises not to share your information with other companies", but Megacorp owns dozens to hundreds of company-like projects anyway.

Usually, they say they can/will share data with their "affiliates" -- you know, pretty much anybody they might enter into any type of agreement with.

I believe that in the US (as opposed to the EEA) companies are allowed to share most non-sensitive data with affiliates and partners as long as they tell you that and provide an "Opt-Out" clause in their privacy statement. The default there is that data is shared unless you demand otherwise. If companies want to share sensitive data (medical info and the like) they also have to mention in this in their privacy statement but the clause there must be "Opt-In" instead with the default being that data is not shared.

Re: Use "Amazon 1 Button" Chrome extension to sniff all HTTPS websites

#50

Post by quotemstr »

byoogle wrote: post #40
astupidquestion wrote: post #30

Stupid questions: 1) Would a plugin such as Disconnect.me stop this from happening? (Yes, I am aware of the irony...) 2) What's the best way for a non-technical person to monitor traffic to ensure that plugins are not "phoning home"?

I'm one of the Disconnect devs and these definitely aren't stupid questions: 1. Unlike that other "privacy" cough extension, Disconnect doesn't send any data (user or otherwise) to Disconnect servers. In other words, Disconnect doesn't output user data that can be intercepted by a MITM attack. Disconnect does grab a config file on startup ( https://disconnect.me/help#syncing ), but unlike in the Amazon case, the file…

> encrypted (with the Stanford Javascript Crypto Library)

TLS already encrypts. What threat model prompted your decision to use JavaScript cryptography?

Post reply on HN