Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Stylish” browser extension steals all your internet history

robertheaton.com

Post reply on HN
Print view View original

111–120 of 161 posts

Re: “Stylish” browser extension steals all your internet history

#111

Post by Blaaguuu »

logicallee wrote: post #29
mcjiggerlog wrote: post #18

This is a huge problem for the extension ecosystem in general. Who originally publishes an extension may not be the same entity that is pushing you updates in two years time, and there's no way as a user to know this. I publish a few extensions [1] [2] [3] and have been contacted multiple times by companies asking to buy them for several thousand dollars. They told me the going rate was 0.20 USD per user. You can ima…

I realize this is bad, but what happens to the user data exactly? I mean can someone here paint the bleakest, most dystopian possible use or future?

A lot of people focus on how this information is used by advertisers, which can be a problem, but in my opinion the bigger issue is how data brokers are starting to act like completely unregulated and sometimes highly inaccurate credit reports.

Re: “Stylish” browser extension steals all your internet history

#112

Post by DCoder »

TheCapeGreek wrote: post #16

As others have said, immediately switch to Stylus. While we're at it stop using Ghostery as well since they were bought by an ad company. Use Privacy Badger or a decent alternative (noscript + heavy/custom uBlock lists should work just fine)

Ghostery can replace scripts like Google Analytics with stubs that expose the same API but don't do anything. Last time I checked, NoScript/uMatrix can only outright block those scripts from loading, which breaks some poorly-coded sites.

Re: “Stylish” browser extension steals all your internet history

#113

Post by owlmirror »

oblio wrote: post #26
trio333 wrote: post #19

Always the same cycle. 1/ New great product is built. People love it. 2/ Once enough people use it, start monetizing in shady ways, annoying users just not too much or they leave. 3/ Very annoyed users switch to another product back to 1/

Small correction: 1/ New great _free_ product is built. People love it. Image and file hosting services and messengers are the best examples. I swear it's because the well has been poisoned and it's just impossible to monetize these services in a moral way.

This is absolutely not confined to free products. I did security audits for companies and part of that job was giving a go ahead before we allowed people to install software on their devices. Free software behaved much better than paid software by a wide margin.

Re: “Stylish” browser extension steals all your internet history

#114

Post by inetknght »

dredmorbius wrote: post #108
inetknght wrote: post #90

Earlier quoted context omitted.

If the site loads tons of crapware then the site is broken regardless of whether or not uMatrix blocked things.

If you've not been paying attention or specifically trying to counter that trend, you'd be amazed at how complex a typical site is. Even those which otherwise appear clean.

I appreciate the sentiment but indeed I know very well how complex a typical site is. Unfortunately I think a very large portion of most websites are far too complex for what they provide.

Re: “Stylish” browser extension steals all your internet history

#115

Post by dredmorbius »

inetknght wrote: post #114
dredmorbius wrote: post #108

Earlier quoted context omitted.

If you've not been paying attention or specifically trying to counter that trend, you'd be amazed at how complex a typical site is. Even those which otherwise appear clean.

I appreciate the sentiment but indeed I know very well how complex a typical site is. Unfortunately I think a very large portion of most websites are far too complex for what they provide.

Agreed on that last.

Re: “Stylish” browser extension steals all your internet history

#116

Post by zulln »

SippinLean wrote: post #103
_bxg1 wrote: post #101

This has been going on for years and Google has done nothing about it. These days I don't use any extensions where a major organization's reputation doesn't depend on them not becoming spyware. Truly a shame; I used to get a lot of benefit out of extensions, including a similar one named Stylebot, but now I don't trust anything other than Adblock Plus and the React Developer Tools to not covertly become malicious.

You probably shouldn't trust AB+ either (but switch to uBlock instead) https://en.wikipedia.org/wiki/Adblock_Plus#Controversy_over_...

For reasons I do not recall now, you should use uBlock Origin instead of uBlock as well. The former is often what people are referring to anyway, but worth mentioning.

Re: “Stylish” browser extension steals all your internet history

#117

Post by alexeiz »

IngvarLynn wrote: post #93

"OneTab" is another popular extension with the same issue. Switched to ff+"tabs aside" since then.

Really? This is getting out of hand. I found to be using at least several of the extensions mentioned here that I wasn't aware were stealing user data.

Re: “Stylish” browser extension steals all your internet history

#118

Post by Volt »

HelenePhisher wrote: post #39

Tampermonkey seems to be a good alternative as well and is available for all major browsers. Does anyone have information on if the Safari Stylish Addon does the same shady things? It's available in the official App Store and was approved by Apple it seems.

I was curious about this too. The source is on GitHub (https://github.com/350d/stylish), but who knows if Apple checks that they're the same when they're approving it.

Edit: I should note that it collects analytics, but it can be turned off in the preferences. I don't remember if it's on by default, but I suspect it is.

Re: “Stylish” browser extension steals all your internet history

#119

Post by rctgamer3 »

gruez wrote: post #88
zulln wrote: post #69

Earlier quoted context omitted.

Back in 2015 when Detectify (me being co-author) looked into this issue [1] many plugins do not actually have this code in the extensions, but rather a feature to download remote code and add it to the extension so to say. As long as that practice is allowed, source review would not help. [1] https://labs.detectify.com/2015/11/19/chrome-extensions-aka-...

AFAIK this isn't allowed in firefox extensions

It still isn't.

Re: “Stylish” browser extension steals all your internet history

#120

Post by inetknght »

bovine3dom wrote: post #95
inetknght wrote: post #89

Earlier quoted context omitted.

Firefox is in the right here. I absolutely do not ever want extensions to automatically get new permissions automatically just because I accepted an old version's lesser permissions. If you want more permissions, then ask for more permissions. And don't be surprised when people say NO. Not everyone wants to grant the permissions to your update even if the update fixes bugs in older versions. Not everyone will want yo…

> then ask for more permissions. I agree with you. As another reply to you states, however, Firefox doesn't currently let me ask. You have to kind of go hunting for it. > And if you're not adding a new feature, then why do you need more permissions? Firefox does not let me explain why the permissions are needed. It would be nice if we could have a little blurb where we can state our case next to each permission. Our…

Firefox and Chromium are both open source. If you don't like the way it works, then work with the teams to build a better experience.
Post reply on HN