111–120 of 215 posts
So it's completely impossible that such malicious extensions still exist.
(may contain sarcasm)
The fact that most of these are capturing query parameters: "u": "https://www.google.com/search?q=target", indicates that are capturing tons of authentication tokens. So this goes way beyond just spying on your browser history.
If a service is sending auth tokens as URL parameters, stop using it. Those are always public.
My daughter, in grade school, uses a Chromebook at school and access Google Classroom through Chrome. The school has very few restrictions on extensions and when I log into her account, Chrome is littered with extensions. They all innocuous (ex. change cursor into cat, pets play around on your screen etc). However, without fail, each time I log in and go to the extension page, Chrome notifies me that one or more of t…
I'd either go ahead and talk to her and remove extensions altogether and ask her to have a stock/only open source extensions (yes opensource also has supply issues but its infinitely more managable than this) or the second option being to maybe create them yourself . I don't know about how chrome works (I use firefox) but one thing that you can do is if the thing is simple for your daughter, then just vibe code it and use tampermonkey (heck even open source it) and then audit the code written by it yourself if you want better security concerns.
Nowadays I really just end up creating my own extensions with tampermonkey before using any proprietory extension. With tampermonkey, the cycle actually feels really simple (click edit paste etc.) and even a single glance at code can show any security errors for basic stuff and its one of the few use cases of (AI?) in my opinion.
Earlier quoted context omitted.
On HN of all places it's not that implausible that someone might be running Linux and Chromium or Firefox, surely?
I didn't claim that it's implausible. I asked a question. On the other hand, it's not that implausible either that someone might be running Google Chrome, Windows, Mac, etc. We know that many HN commenters do. Thus, while the OP may be 100% consistent, "I only run open source extensions that I can actually audit" would not be a consistent principle for those who also use closed source software.
At this point, someone should make a site to check whether installed extensions are malicious or not.
To find the list of decided malicious extensions, I can imagine that a github repository where people can create issues about the lack of safety (like imagine some github repo where this case could've also been uploaded) and people could discuss and then a .txt/json file could be there in the repo which gets updated every time an extension is confirmed to be malicious.
Thoughts?
Edit: (To take initiative?) I have created a git repo with this https://github.com/SerJaimeLannister/unsafe-extensions-list but I would need some bootstrap list of malicious extensions. So I know nothing about this field and the only extension I can add is this one maybe but maybe someone can fork this idea (who is more knowledgable within the extension community space) or perhaps they can add entries into it.
Edit 2: Looks like qcontinuum actually have a github repo and I hadn't read the article while I had written the comment but its not 1 extension but rather 287 extensions and they have mentioned all in their git repo
https://github.com/qcontinuum1/spying-extensions
So they already have a good bootstrapped amount & I feel as if qcontinuum is interested they can maybe implement the idea?
Earlier quoted context omitted.
How do you check that the open sourced code is the same one that you are installing from the extension repository and actually running?
This kind of nihilistic comment doesn’t do anything for me. There’s always a possibility of problems along the chain. You are reducing your risk not eliminating it.
Got to say, mischaracterising a neutral question as a nihilistic comment doesn't do anything for me.
Earlier quoted context omitted.
How were they supposed to know that was going to happen? You think they walked up and said, “Hi. I’m here to buy your software and hurt people with it”?
If a stranger walks up to the chef in a restaurant and offers to pay them to put some mystery stuff in the food, or someone walks up in during a surgery and asks if they can make some incisions and inject some mystery stuff, would you (as a customer of the restaurant or hospital) expect this to be allowed?
This is why I only run open source extensions that I can actually audit. uBlock Origin, SponsorBlock, the kind of tools where the code is available and the developer isn't anonymous. The Chrome Web Store is basically unregulated and Google doesn't care as long as they get their cut. Open source at least gives you a chance to see what you're installing before it starts exfiltrating your data to some server in a countr…
[0] https://chromewebstore.google.com/detail/aws-colorful-navbar...