I've been informed that Chrom Extension advertising malware is a highly efficient and key source of money laundering. The market size of this is only limited by Google Chrome users. This is just the tip of that iceberg.
Adware vendors buy Chrome Extensions to send ad- and malware-filled updates
21–30 of 111 posts
Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates
#22I was contacted and offered some payments to start including some sort of ads in my Chrome extension. As I understood it, it would inject ads and/or replace links on web pages with affiliate links.
I declined their offer.
Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates
#23Earlier quoted context omitted.
Obligatory response that not everyone has time or training to examine code for problems. Google is a trusted source.
>Google is a trusted source Hardly, if this kind of thing is allowed in their marketplace.
You're missing the point. Google and Apple are trusted sources in the real world. In the real world, people say things like "I have an Android" and advertisements say "Get a free Android with contract" If the distinction there is lost, I don't think you can expect the general consumer to know that Google isn't a "trusted source" by the definition of FSF advocates, right? Nor, I would contest, that they need to.
>Hardly, if this kind of thing is allowed in their marketplace.
They'll move on this just like they started actively patrolling the Play Store for malware. Because they are a trusted source, even if they aren't an FSF definition of trusted source.
Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates
#24Why use any extensions ever?
Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates
#25Earlier quoted context omitted.
Look into running separate sessions of your browser(s). Both Firefox and Google Chrome (or Chromium) allow you to do this, although the interfaces for doing so differ. A simple way to do this is to use different brands of browser, e.g. Gmail in Chrome and everything else in Firefox. But... if you really prefer one browser over another, for all use, then the separate profiles thing works. Note that in Chrome, this is…
To run a new, separated Firefox with a (possibly) different profile firefox -no-remote -ProfileManager It's always handy to have a "vanilla" profile, to compare how much the extensions tuned down the browser or try to understand if the error that you're seeing is caused by an extension. Having a "privacy" profile with some ad-hoc extensions helps too.
Thanks. Sorry I mis-remembered the flag(s) from memory. And be sure you're using both, to make sure the separate profiles do not share the same process or something like that (again, from memory; Google can quickly turn up the details).
Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates
#26Earlier quoted context omitted.
Look into running separate sessions of your browser(s). Both Firefox and Google Chrome (or Chromium) allow you to do this, although the interfaces for doing so differ. A simple way to do this is to use different brands of browser, e.g. Gmail in Chrome and everything else in Firefox. But... if you really prefer one browser over another, for all use, then the separate profiles thing works. Note that in Chrome, this is…
I tried running a Chromium session with no extensions for the stuff I want to be more secure (email/banking/etc.), while using Chrome for everything else, and this does work in a way. But I find that I tend to forget to switch to the other browser sometimes. A solution which said "don't run extensions on mail.google.com and online.my_bank.com" would be a lot more convenient. The separate browser solution does protect…
I changed the color scheme for one profile (although, that involved installing and trusting the color scheme; I got mine directly from Google's site as opposed to a third party site).
An extra cue, when the border background, tabs, etc. look different in one versus the other. Still hardly foolproof...
Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates
#27While on the subject of Chrome Extensions,could someone explain why? the React: Dev tools extension has Incognito mode.
Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates
#28Can we start a petition for Google to let us disable extensions on specific sites? After reading the last few stories about this, I am quite sure I don't want any extensions whatsoever running in the same tab as my Gmail account. I think there is some extension that does this for you (turns off other extensions per site), but then we get into a "who guards the guardians" situation. Not to mention we need better and f…
That's a good idea but only a crutch. I don't want extensions invading my privacy on any site. Finer grained permissions would be ideal.
Once an extension can modify the DOM (and most extensions need it) you loose any hope of permissions. From injecting javascript to sending data modifying an img[src], there's no way to protect your privacy. I don't think that permissions are a viable model here, it's more a problem of trust and auditing.
Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates
#29Earlier quoted context omitted.
To run a new, separated Firefox with a (possibly) different profile firefox -no-remote -ProfileManager It's always handy to have a "vanilla" profile, to compare how much the extensions tuned down the browser or try to understand if the error that you're seeing is caused by an extension. Having a "privacy" profile with some ad-hoc extensions helps too.
Thanks. Sorry I mis-remembered the flag(s) from memory. And be sure you're using both, to make sure the separate profiles do not share the same process or something like that (again, from memory; Google can quickly turn up the details).
Your memory is right. Without -no-remote you would end up spawning another windows from the currently running firefox. Without -ProfileManager you can't choose a different profile.
It's also a good idea to use different themes per profile (and I see you suggested it too).
Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates
#30Earlier quoted context omitted.
That's a good idea but only a crutch. I don't want extensions invading my privacy on any site. Finer grained permissions would be ideal.
Once an extension can modify the DOM (and most extensions need it) you loose any hope of permissions. From injecting javascript to sending data modifying an img[src], there's no way to protect your privacy. I don't think that permissions are a viable model here, it's more a problem of trust and auditing.
extensions have the option of working only on a set of domain. So you could only install gmail extensions that work only on gmail.com and not on * as 99.999% of the extensions does. Most need to, like referrer blockers and user agent spoofers. But we only need those global extensions because google actively removes those functionalities from chromium, on a regular basis, after someone in the community adds it. over and over again.