141–150 of 270 posts
There is a web intelligence company in Israel that is known to buy popular browser extensions like “Web of Trust” and use them to exfiltrate browsing data (with tons of sensitive and personal information). They have been called out for this several times already and some of their extensions got removed from the store, they invariably turn back up again after a few weeks though (good connections to Google/Mozilla I gu…
Who? - please name names
Earlier quoted context omitted.
The only trustworthy extensions are uBlock Origin and EFF's Privacy Badger. Everything else is best viewed as potential malware, no different than random downloadable executables. Honestly, uBlock Origin and Privacy Badger are so important at this point they should just become part of the browser itself. They're already in a league of their own.
What makes uBlock Origin a trustworthy extension ? because it is open-source ?
There is a web intelligence company in Israel that is known to buy popular browser extensions like “Web of Trust” and use them to exfiltrate browsing data (with tons of sensitive and personal information). They have been called out for this several times already and some of their extensions got removed from the store, they invariably turn back up again after a few weeks though (good connections to Google/Mozilla I gu…
There is a web intelligence company in Israel that is known to buy popular browser extensions like “Web of Trust” and use them to exfiltrate browsing data (with tons of sensitive and personal information). They have been called out for this several times already and some of their extensions got removed from the store, they invariably turn back up again after a few weeks though (good connections to Google/Mozilla I gu…
Could browser extensions be ran in a sandbox, with read_access to the page, but only able to read from whitelisted registered and fixed URLs for updating configuration etc? So your blocking extension can download lists of things to block, or other config, but it can't exfiltrate any information about the user's browsing habits. The only side channel I can then think of is using page rewriting or timing to communicate…
Earlier quoted context omitted.
In the same way that DNS requests can exfiltrate data, requesting URLs can also exfiltrate data. This is trivial to perform.
This is an apples to oranges comparison. DNS requests exfiltrate data such as IP and the domain you want to visit. Currently extensions can literally upload all your passwords if they wish to. Restricting them to be able to only GET whitelisted URLs (no query params or paramterized URLs) would cut down on pretty much 99.999% of possible data theft scenarios.
Earlier quoted context omitted.
Exactly. What Chrome and Firefox should do, is bundle their own analytics program into the extensions program, make these analytics available via AMO or Chrome Web Store (already has a very basic version), and remove the ability for extensions to perform outgoing network requests unless the user explicitly whitelists the extension. Even then, show big scary warnings about extensions given this permission being able t…
One thing extensions commonly do is modify the page. If an extension can modify the page, it can insert an which will cause a network request to happen. How do you plan to prevent this? Prevent extensions from modifying the page?
What extensions do you primarily use on Chrome (if you do)? My list (on brave) includes: >uBlock Origin >Decentraleyes >Stylus
> uMatrix
> PopupWindow https://github.com/ettoolong/PopupWindow (Firefox and Chrome)
> HideScrollbars https://github.com/sergeykish/hide-scrollbars (Chrome for now)
Last two is the possible vector, requires review.
I believe in security through simplicity (suckless style). So I've created one myself.
Any additional feature requires code - like toggle on/off https://github.com/quinton-ashley/firefox-hide-scrollbars.
There is a web intelligence company in Israel that is known to buy popular browser extensions like “Web of Trust” and use them to exfiltrate browsing data (with tons of sensitive and personal information). They have been called out for this several times already and some of their extensions got removed from the store, they invariably turn back up again after a few weeks though (good connections to Google/Mozilla I gu…
[flagged]
(I do not really think the US - or Isreal for that matter - is like Saudi Arabia AT ALL, Saudi Arabia is a horrific place and that comparison is pure madness by OP - but the "doing terrible shit" part is very true.)
Earlier quoted context omitted.
Could browser extensions be ran in a sandbox, with read_access to the page, but only able to read from whitelisted registered and fixed URLs for updating configuration etc? So your blocking extension can download lists of things to block, or other config, but it can't exfiltrate any information about the user's browsing habits. The only side channel I can then think of is using page rewriting or timing to communicate…
Or just don't let it send data. Most plugins have no need to do that.
Elements filtered by uBlock origin are typically not even loaded over the net. That means that an outside observer can see what uBlock origin does.
However, you could envision a variant of uBlock origin that still loads everything, and only does cosmetic blocking.
But eg an extensions that is supposed to protect your privacy will have to have an influence on your browser's network output.