Adware vendors buy Chrome Extensions to send ad- and malware-filled updates
1–10 of 111 posts
Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates
#2Can we start a petition for Google to let us disable extensions on specific sites? After reading the last few stories about this, I am quite sure I don't want any extensions whatsoever running in the same tab as my Gmail account. I think there is some extension that does this for you (turns off other extensions per site), but then we get into a "who guards the guardians" situation.
Not to mention we need better and finer grained permissions for extensions in general, now that we use so many web apps with crucial data.
Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates
#3I was thinking about this just the other day. The movement towards auto-update-everything is a massive security breech. Browser extensions are a prime example. So much of what we do is centered around the browser, and yet we allow essentially random pieces of code complete access to all that activity. Even worse, this code is allowed to download and run new versions without any user interaction. Needless to say, the potential for harm here cannot be understated.
Auto updating anything but the most critical and most trusted software is absolutely bone-headed and we're going to look back and wonder how we could be so stupid.
Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates
#4Can we start a petition for Google to let us disable extensions on specific sites? After reading the last few stories about this, I am quite sure I don't want any extensions whatsoever running in the same tab as my Gmail account. I think there is some extension that does this for you (turns off other extensions per site), but then we get into a "who guards the guardians" situation. Not to mention we need better and f…
Look into running separate sessions of your browser(s). Both Firefox and Google Chrome (or Chromium) allow you to do this, although the interfaces for doing so differ.
A simple way to do this is to use different brands of browser, e.g. Gmail in Chrome and everything else in Firefox. But... if you really prefer one browser over another, for all use, then the separate profiles thing works.
Note that in Chrome, this is now confused by the ability to change Google account log-ins. That is not a separate, browser-level profile with separate configuration.
Instead, you are looking for the command line invocation argument --user-data-dir (in *NIX, at least; IIRC the flag name may differ slightly in the Windows version).
For Firefox, there is the -p flag. IIRC, you have to combine it with another flag in order to ensure both that the profiles are running in separate invocations and that you can be prompted to choose what profile to use when you invoke Firefox.
Of course, you can create menu items / icons for these invocations to make them "clicky" and avoid having to go to the command line and enter them each time, if you prefer.
P.S. Yes, this will help you less if you insist upon clicking directly on/through links that are are e.g. mailed to you or, if you have Facebook in its own "box", posted on Facebook.
From that perspective, having per site browser extension variability might still be useful. But then, you're still looking at also controlling referer passing, cookies and other local data, etc., etc.
Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates
#5This is a disturbing situation, but it's hard to say what the best way of dealing with it is. The first thing most people reach for first is that extensions shouldn't auto-update. Personally, I disagree - I love silent auto-updates in general. It's a huge drag on the computing experience to have dozens of different widgets all requiring manual updates, all with different mechanisms and all on their own schedules. If I had to pick the one most annoying thing about running Windows, that would be it. The biggest appeal to me of Chromebooks is silent auto-update of everything. Don't bug me about updates, just make everything always run the latest, most feature-filled and bug-fixed versions.
I'd lean towards using a finer-grained permission model for extensions, and javascript in general. As far as I know, most extensions now can only request permissions to run arbitrary JS on every page you visit, and send arbitrary AJAX to any URL. Perhaps we could do a better job of locking that down. Have no such thing as a permission to AJAX any URL, but instead make AJAXing any particular TLD a new permission. Maybe we can also only allow access to DOM elements originating from particular domains. Then you could keep auto-update, but require a new user authorization for any new URL/domain access that an extension needs. It'd probably get pretty complex, but I think we could put together something reasonable. But then the other problem is the pile of plugins out there already with those arbitrary permissions. Maybe you could let them stay, but not allow any updates without switching to the new permission model?
Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates
#6Obligatory note: Another example of why we should only run Free Software and only from trusted sources. Users of Trisquel or gNewSense never have problems like this.
Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates
#7Can we start a petition for Google to let us disable extensions on specific sites? After reading the last few stories about this, I am quite sure I don't want any extensions whatsoever running in the same tab as my Gmail account. I think there is some extension that does this for you (turns off other extensions per site), but then we get into a "who guards the guardians" situation. Not to mention we need better and f…
Look into running separate sessions of your browser(s). Both Firefox and Google Chrome (or Chromium) allow you to do this, although the interfaces for doing so differ. A simple way to do this is to use different brands of browser, e.g. Gmail in Chrome and everything else in Firefox. But... if you really prefer one browser over another, for all use, then the separate profiles thing works. Note that in Chrome, this is…
I tried running a Chromium session with no extensions for the stuff I want to be more secure (email/banking/etc.), while using Chrome for everything else, and this does work in a way. But I find that I tend to forget to switch to the other browser sometimes. A solution which said "don't run extensions on mail.google.com and online.my_bank.com" would be a lot more convenient.
The separate browser solution does protect from tracking, but with the security threats of today, like these malicious extensions with access to all your data, I've become desensitized to mere tracking.
Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates
#8Can we start a petition for Google to let us disable extensions on specific sites? After reading the last few stories about this, I am quite sure I don't want any extensions whatsoever running in the same tab as my Gmail account. I think there is some extension that does this for you (turns off other extensions per site), but then we get into a "who guards the guardians" situation. Not to mention we need better and f…
> petition for Google
Don't you mean a PR on the Chromium project?
Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates
#9[deleted]
Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates
#10Obligatory note: Another example of why we should only run Free Software and only from trusted sources. Users of Trisquel or gNewSense never have problems like this.
Obligatory response that not everyone has time or training to examine code for problems. Google is a trusted source.