Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome extensions spying on users' browsing data

qcontinuum.substack.com

Post reply on HN
Print view View original

121–130 of 215 posts

Re: Chrome extensions spying on users' browsing data

#121

Post by ghtbircshotbe »

soared wrote: post #106
ghtbircshotbe wrote: post #101

Capital One just offered me $45 to install a Firefox extension. I declined, though I'm sort of tempted to get paid for getting spied on which I assume is happening anyway. And who knows, maybe I could get a couple more bucks later in the class action. https://addons.mozilla.org/en-US/firefox/addon/wikibuy-for-f...

Their offers are very hard to claim - only eligible to be used in their store, only given after making a purchase in their store, among other random strings. I tried to claim the same offer but could never actually get it.

That sounds right. I looked through the terms of the offer and it looked pretty onerous. I almost get the feeling they're trying to use my own hatred of the banks and desire to screw them out of $45 to trick me

Re: Chrome extensions spying on users' browsing data

#122

Post by PurpleRamen »

qcontinuum1 wrote: post #99
PurpleRamen wrote: post #13

I don't really understand the complaint here. It seems for most of those extensions have it in their literal purpose to send the active URL and get additional information back, for doing something locally with it. And why does this site has no scrollbar?? WTF, is Webdsign finally that broken?

We beg to differ. Consider for example "BlockSite Block Websites and Stay Focused" why would you need to send browsing data to remote server if your job is only to block selected domains?

If you look at the request made, then it seems to check the category of the site, for whatever reason. I don't know that extensions, so I don't know if this is a legit use, sloppy use or harmful. I'm also not saying they found nothing at all. But looking through what they found, they seem to have not even thought much about whether those cases are legit and in the excepted and necessary realm of actions the add-on is supposed to do, or if it's really harmful behaviour. I also don't see anything about how often the request was made. Was it on every url-change, or just once/occasionally?

This whole article is a bit too superficial for me.

Re: Chrome extensions spying on users' browsing data

#123

Post by molticrystal »

Using the below page you can check your extensions, select all your extensions on chrome://extensions/ (everything on the page, it will filter it out IDs) and it will check if any IDs match.

https://output.jsbin.com/gihukasezo/

or

https://jsfiddle.net/9kLsv3xm/latest/

or

https://pastebin.com/Sa8RmzcE

Re: Chrome extensions spying on users' browsing data

#124

Post by falcor84 »

abenga wrote: post #71
__alexs wrote: post #61

Earlier quoted context omitted.

My car can't login to my bank account.

Your car and fellow road users' cars generally have your life, your passengers' lives, and other road users' lives in its hands while in use.

Well, I see how, especially for people who are close to death and want to provide for their loved ones, the answer to "Your money or your life" might lean in the other direction.

Re: Chrome extensions spying on users' browsing data

#125

Post by fsflover »

anonymars wrote: post #77
endsandmeans wrote: post #25

Earlier quoted context omitted.

I agree but let me play the devil's advocate. I'll channel Stallman: Same argument can be applied to all closed source software. In the end its about who you trust and who needs to be verified and that is relative, subjective, and contextual... always. So unless you can read the source code and compile yourself on a system you built on an OS you also built from source on a machine built before server management backd…

Don't forget to channel Ken Thompson ("Reflections on Trusting Trust") -- you can read the source code, but where did you get the compiler?

This can be mitigated by Bootstrappable builds: https://news.ycombinator.com/item?id=41368835

Re: Chrome extensions spying on users' browsing data

#126

Post by PurpleRamen »

moebrowne wrote: post #34
PurpleRamen wrote: post #13

I don't really understand the complaint here. It seems for most of those extensions have it in their literal purpose to send the active URL and get additional information back, for doing something locally with it. And why does this site has no scrollbar?? WTF, is Webdsign finally that broken?

> And why does this site has no scrollbar Seems someone decided it was a good idea to make the scrollbar tiny and basically the same colour as the background: scrollbar-width: thin; scrollbar-color: rgb(219,219,219) rgb(255,255,255);

Oh, thanks! It's working when you just hit the right pixel somewhere around the left border.

Re: Chrome extensions spying on users' browsing data

#127

Post by notpushkin »

coldtea wrote: post #92

Can extensions: be scoped, meaning only allowed to read/access when you visit a particular domain whitelist (controlled by the user)? be forced (by the extension API) to have a clear non-obfuscated feed of whatever they send that the user can log and/or tap onto and watch at any time? If not, I wouldn't touch them with a 10000ft pole.

> be scoped

Yes. Not usually user-controllable though.

> be forced to have a clear non-obfuscated feed

Kinda. You can usually open a devtools instance that shows whatever the extension is doing. But you can’t enforce it to not obfuscate the network requests though (you’d have to make extensions non-Turing complete).

You could mitigate some of these issues by vetting the extensions harder before letting them into the stores. Mozilla requires all extensions to have a readable source code, for example.

Re: Chrome extensions spying on users' browsing data

#128

Post by lapcat »

notpushkin wrote: post #114
lapcat wrote: post #64

Earlier quoted context omitted.

I didn't claim that it's implausible. I asked a question. On the other hand, it's not that implausible either that someone might be running Google Chrome, Windows, Mac, etc. We know that many HN commenters do. Thus, while the OP may be 100% consistent, "I only run open source extensions that I can actually audit" would not be a consistent principle for those who also use closed source software.

Why do you think it’s not consistent? You don’t have to apply the same policies to everything you use.

> You don’t have to apply the same policies to everything you use.

What's the reasoning behind it, though?

You can arbitrarily apply different policies to different things, but there's no rhyme or reason to that.

If the difference ultimately comes down to trusting certain developers to an extent that you don't need to audit their source, then I'm not sure why that couldn't also be true of certain extension developers.

Re: Chrome extensions spying on users' browsing data

#129

Post by notpushkin »

mrweasel wrote: post #60
cebert wrote: post #5

Hopefully people will start learning that you want to install as few browser extensions as possible.

In principle I agree with you, there is just so much crap online that it's tempting to just add this one more extension to fix something. Looking at my own installed extensions, I have a password manager, Privacy Badger and Firefox Multi-Account Containers, which I suppose is the three I really need. Then I have one that puts the RSS icon back in the address bar, because Mozilla feels that RSS is less important than…

> one for removing sign in with Google

You could use an adblocker rule instead:

  ||accounts.google.com/gsi/client$script
(I’m not sure if it’s possible to do that with Privacy Badger though)

Re: Chrome extensions spying on users' browsing data

#130

Post by asimovDev »

dalmo3 wrote: post #56
RupertSalt wrote: post #40

Earlier quoted context omitted.

It is a classic supply-chain attack. The same modality is used by gamers to sell off their high-level characters, and social media accounts do "switcheroos" on posts, Pages, and Groups all the time. You know, a lot of consumer cybersecurity focuses on malware, browser security, LAN services, but I propose that the new frontier of breaches involves browser extensions, "cloud integrations", and "app access" granted fro…

Pardon the ignorance but what's being exploited by someone buying a video game character?

If you buy someone's old gaming account (Steam for example) with many years of activity, you can appear more legitimate when trading, therefore making it easier for people to trust you and fall victim to your scam(s)
Post reply on HN