Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome extensions spying on users' browsing data

qcontinuum.substack.com

Post reply on HN
Print view View original

131–140 of 215 posts

Re: Chrome extensions spying on users' browsing data

#131

Post by AJ007 »

nickjj wrote: post #28
randunel wrote: post #19

Earlier quoted context omitted.

How do you check that the open sourced code is the same one that you are installing from the extension repository and actually running?

> How do you check that the open sourced code is the same one that you are installing from the extension repository and actually running? Extensions are local files on disk. After installing it, you can audit it locally. I don't know about all operating systems but on Linux they are stored as .xpi files which are zip files. You can unzip it. On my machine they are installed to $HOME/.mozilla/firefox/52xz2p7e.default-…

Extensions are trivial unless they have to run external software or services. Download the extension, extract the source, audit it with a good thinking model and either strip out all third party URLs/addresses or have the agent clone the functionality you want.

Re: Chrome extensions spying on users' browsing data

#133

Post by Ntrails »

pocksuppet wrote: post #91
ptx wrote: post #88

Earlier quoted context omitted.

If a stranger walks up to the chef in a restaurant and offers to pay them to put some mystery stuff in the food, or someone walks up in during a surgery and asks if they can make some incisions and inject some mystery stuff, would you (as a customer of the restaurant or hospital) expect this to be allowed?

If someone walks up to the owner in a restaurant and offers to pay them money to buy the restaurant, it's not considered suspicious.

Assuming the someone is private equity buying out, I expect the quality to drop like a stone and the place to go to hell.

So. It's not suspicious. But you can rest assured as a customer it isn't good news

(that doesn't make it wrong to sell ofc)

Re: Chrome extensions spying on users' browsing data

#135

Post by ghostwords »

notpushkin wrote: post #129
mrweasel wrote: post #60

Earlier quoted context omitted.

In principle I agree with you, there is just so much crap online that it's tempting to just add this one more extension to fix something. Looking at my own installed extensions, I have a password manager, Privacy Badger and Firefox Multi-Account Containers, which I suppose is the three I really need. Then I have one that puts the RSS icon back in the address bar, because Mozilla feels that RSS is less important than…

> one for removing sign in with Google You could use an adblocker rule instead: ||accounts.google.com/gsi/client$script (I’m not sure if it’s possible to do that with Privacy Badger though)

Moving the toggle for "accounts.google.com" to full blocking in Privacy Badger ought to do it.

Heads up, full blocking of "accounts.google.com" will break some login pages entirely. But it is a good domain to fully block as long as you're comfortable using the "Disable for this site" button when something goes wrong.

Re: Chrome extensions spying on users' browsing data

#136

Post by ptx »

Forgeties79 wrote: post #118
ptx wrote: post #88

Earlier quoted context omitted.

If a stranger walks up to the chef in a restaurant and offers to pay them to put some mystery stuff in the food, or someone walks up in during a surgery and asks if they can make some incisions and inject some mystery stuff, would you (as a customer of the restaurant or hospital) expect this to be allowed?

That isn’t remotely comparable. You’re asking someone to quietly alter someone else’s product, not selling the product to them. They didn’t pay him to change the extension, they bought it.

They bought the permission to make changes to customer machines that had been granted to the seller by the customer. If it's just a sale of the source code, there's no problem. But what is bought is usually the pre-existing update channel (the installed base), precisely to be able to alter the product for existing users without explicitly informing them or asking for consent.

Re: Chrome extensions spying on users' browsing data

#137

Post by qcontinuum1 »

Imustaskforhelp wrote: post #115
georgehill wrote: post #70

At this point, someone should make a site to check whether installed extensions are malicious or not.

So this would require a list of decided malicious extensions or not and someone can go ahead and check through that. To find the list of decided malicious extensions, I can imagine that a github repository where people can create issues about the lack of safety (like imagine some github repo where this case could've also been uploaded) and people could discuss and then a .txt/json file could be there in the repo whic…

> So they already have a good bootstrapped amount & I feel as if qcontinuum is interested they can maybe implement the idea?

We might to it once. That requires non-trivial engineering effort and resources and we are at the moment short on both of those.

Re: Chrome extensions spying on users' browsing data

#138

Post by pocksuppet »

m4rtink wrote: post #81
mixedbit wrote: post #23

Earlier quoted context omitted.

An extension from a trusted, non anonymous developer which is released as open source is a good signal that the extension can be trusted. But keep in mind that distribution channels for browser extensions, similarly to distribution channels for most other open source packages (pip, npm, rpm), do not provide any guarantee that the package you install and run is actually build verbatim from the code which is open sourc…

If the RPM/deb comes from a Linux distribution then there is a good chance there is a separate maintainer and the binary package is always built from the source code by the distro. Also if the upstream developer goes malicious there is a good chance at least one of the distro maintainers will notice and both prevent the bad source code being built for the distro & notify others.

Browser extensions come from the Chrome/Firefox addon store, though and not through distros.

Re: Chrome extensions spying on users' browsing data

#139

Post by mrweasel »

ghostwords wrote: post #135
notpushkin wrote: post #129

Earlier quoted context omitted.

> one for removing sign in with Google You could use an adblocker rule instead: ||accounts.google.com/gsi/client$script (I’m not sure if it’s possible to do that with Privacy Badger though)

Moving the toggle for "accounts.google.com" to full blocking in Privacy Badger ought to do it. Heads up, full blocking of "accounts.google.com" will break some login pages entirely. But it is a good domain to fully block as long as you're comfortable using the "Disable for this site" button when something goes wrong.

Hey, that seems to work, very nice, that's one less extension.

Re: Chrome extensions spying on users' browsing data

#140

Post by useragent42 »

PurpleRamen wrote: post #122
qcontinuum1 wrote: post #99

Earlier quoted context omitted.

We beg to differ. Consider for example "BlockSite Block Websites and Stay Focused" why would you need to send browsing data to remote server if your job is only to block selected domains?

If you look at the request made, then it seems to check the category of the site, for whatever reason. I don't know that extensions, so I don't know if this is a legit use, sloppy use or harmful. I'm also not saying they found nothing at all. But looking through what they found, they seem to have not even thought much about whether those cases are legit and in the excepted and necessary realm of actions the add-on is…

This other research points to this type of pattern (sending all URLs to a server to allegedly provide functionality) being used under false pretenses: https://palant.info/2025/01/13/biscience-collecting-browsing...

In particular, look for the diagram provided by a data vendor showing this in action.

As with safebrowsing and adblocking extensions, there is no need to send data to servers.

Many groups of smart people have developed client-side and/or privacy-preserving implementations that have worked with high effectiveness for decades.

Unfortunately, many other groups have also financial incentives to not care about user privacy, so they go the route shown in the research.

Post reply on HN