Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Massive spying on users of Google's Chrome shows new security weakness

reuters.com

Post reply on HN
Print view View original

131–140 of 270 posts

Re: Massive spying on users of Google's Chrome shows new security weakness

#131

Post by AareyBaba »

matheusmoreira wrote: post #117
ThePhysicist wrote: post #7

There is a web intelligence company in Israel that is known to buy popular browser extensions like “Web of Trust” and use them to exfiltrate browsing data (with tons of sensitive and personal information). They have been called out for this several times already and some of their extensions got removed from the store, they invariably turn back up again after a few weeks though (good connections to Google/Mozilla I gu…

The only trustworthy extensions are uBlock Origin and EFF's Privacy Badger. Everything else is best viewed as potential malware, no different than random downloadable executables. Honestly, uBlock Origin and Privacy Badger are so important at this point they should just become part of the browser itself. They're already in a league of their own.

What makes uBlock Origin a trustworthy extension ? because it is open-source ?

Re: Massive spying on users of Google's Chrome shows new security weakness

#132

Post by Silhouette »

jopsen wrote: post #109
willvarfar wrote: post #89

Earlier quoted context omitted.

Could browser extensions be ran in a sandbox, with read_access to the page, but only able to read from whitelisted registered and fixed URLs for updating configuration etc? So your blocking extension can download lists of things to block, or other config, but it can't exfiltrate any information about the user's browsing habits. The only side channel I can then think of is using page rewriting or timing to communicate…

Next up is a firestorm over broken extensions, followed by baseless conspiracy theories on how this is all ploy for Mozilla to ban adblockers.. Web Extensions caused lots of outcry, when it was mostly about making extensions async and better sandboxed. EME caused similar outcry, when in fact it migrated us away from plugins riddled with security vulnerabilities (hint Flash). Today most DRM crap runs in a sandbox -- D…

The Web Extensions change in Firefox caused complaints mostly because it broke so much useful functionality, much of which has never been replaced. In quite a few cases that was because of the new security model, but also because the new API simply wasn't powerful enough to do the job properly either.

Re: Massive spying on users of Google's Chrome shows new security weakness

#133

Post by arminiusreturns »

matheusmoreira wrote: post #117
ThePhysicist wrote: post #7

There is a web intelligence company in Israel that is known to buy popular browser extensions like “Web of Trust” and use them to exfiltrate browsing data (with tons of sensitive and personal information). They have been called out for this several times already and some of their extensions got removed from the store, they invariably turn back up again after a few weeks though (good connections to Google/Mozilla I gu…

The only trustworthy extensions are uBlock Origin and EFF's Privacy Badger. Everything else is best viewed as potential malware, no different than random downloadable executables. Honestly, uBlock Origin and Privacy Badger are so important at this point they should just become part of the browser itself. They're already in a league of their own.

For those who like uBlock origin, you owe it to yourself to also checkout uMatrix. I use both.

Re: Massive spying on users of Google's Chrome shows new security weakness

#134

Post by [deleted] »

bgdam wrote: post #119
IncRnd wrote: post #104

Earlier quoted context omitted.

In the same way that DNS requests can exfiltrate data, requesting URLs can also exfiltrate data. This is trivial to perform.

This is an apples to oranges comparison. DNS requests exfiltrate data such as IP and the domain you want to visit. Currently extensions can literally upload all your passwords if they wish to. Restricting them to be able to only GET whitelisted URLs (no query params or paramterized URLs) would cut down on pretty much 99.999% of possible data theft scenarios.

[deleted]

Re: Massive spying on users of Google's Chrome shows new security weakness

#135

Post by ucosty »

bgdam wrote: post #119
IncRnd wrote: post #104

Earlier quoted context omitted.

In the same way that DNS requests can exfiltrate data, requesting URLs can also exfiltrate data. This is trivial to perform.

This is an apples to oranges comparison. DNS requests exfiltrate data such as IP and the domain you want to visit. Currently extensions can literally upload all your passwords if they wish to. Restricting them to be able to only GET whitelisted URLs (no query params or paramterized URLs) would cut down on pretty much 99.999% of possible data theft scenarios.

You can exfiltrate data using regular DNS requests, by hiding the data in the host part of the query. The authoritative name server for the domain can then extract out and re-assemble the data.

https://blogs.akamai.com/2017/09/introduction-to-dns-data-ex...

Re: Massive spying on users of Google's Chrome shows new security weakness

#136

Post by omnifischer »

AareyBaba wrote: post #131
matheusmoreira wrote: post #117

Earlier quoted context omitted.

The only trustworthy extensions are uBlock Origin and EFF's Privacy Badger. Everything else is best viewed as potential malware, no different than random downloadable executables. Honestly, uBlock Origin and Privacy Badger are so important at this point they should just become part of the browser itself. They're already in a league of their own.

What makes uBlock Origin a trustworthy extension ? because it is open-source ?

the number of eyes looking at it all the time.

Re: Massive spying on users of Google's Chrome shows new security weakness

#137

Post by bigiain »

joshuamorton wrote: post #130
bigiain wrote: post #128

Earlier quoted context omitted.

Do you really believe this is even vaguely close to true? To a first approximation, _nobody_ "goes to doubleclick themselves". At the same time, back in 2016 a study at Princeton found almost 50% of all sites on the web had Doubleclick on them (this is separate to the 70% of sites running Google Analytics - and I'd bet there's approximately zero sites that serve doubleclick ads/trackers but not google analytics ones,…

You've contradicted yourself in the first 3 lines. > At the same time, back in 2016 a study at Princeton found almost 50% of all sites on the web had Doubleclick tracking on the Means that many people are going to doubleclick, via it's ads existing on other sites. If the extent of your concern is that I said "going to" instead of "makes requests to", valid and I apologise for not being precise in my use of language.…

And how many times did your mom say she "went to" or "made requests to" doubleclick today?

We all know the answer. Zero. Whatever your sneaky-browser-behaviour-depending employer wants you to say in public, her answer will be zero. Same as 99.99% of the world.

Re: Massive spying on users of Google's Chrome shows new security weakness

#138

Post by coreai »

ThePhysicist wrote: post #7

There is a web intelligence company in Israel that is known to buy popular browser extensions like “Web of Trust” and use them to exfiltrate browsing data (with tons of sensitive and personal information). They have been called out for this several times already and some of their extensions got removed from the store, they invariably turn back up again after a few weeks though (good connections to Google/Mozilla I gu…

I feel like this argument is the same as ‘how third party apps are allowed in windows and macOS by Microsoft and Apple’

To me there has always been a trusted part of computing which is audited to some extent and marked as trusted. Browser extensions work the same way as software on an operating system. If they blocked all extensions outside trusted ones they would be criticised as well. However the auditing process is very controversial and could become like the Apple’s App Store where the apps/extensions maybe blocked for reasons other than just security to make it anti competitive which is certainly something possible with chrome

Re: Massive spying on users of Google's Chrome shows new security weakness

#139

Post by AareyBaba »

omnifischer wrote: post #136
AareyBaba wrote: post #131

Earlier quoted context omitted.

What makes uBlock Origin a trustworthy extension ? because it is open-source ?

the number of eyes looking at it all the time.

How many people are looking at the code ? The github commits show only one active contributor.

I use uBlock Origin myself but I sometimes question the faith we place on open-source. We assume someone else is looking at the code.

Re: Massive spying on users of Google's Chrome shows new security weakness

#140

Post by vbezhenar »

chii wrote: post #126
esperent wrote: post #120

Earlier quoted context omitted.

I trust both of these extensions far more as extensions than I would if they were part of Chrome.

and that is why they will eventually be removed one way or another imo.

AFAIK Chrome will change ad blocking API and uBlock Origin won't follow it. So switch to Firefox.
Post reply on HN