Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome extensions spying on users' browsing data

qcontinuum.substack.com

Post reply on HN
Print view View original

141–150 of 215 posts

Re: Chrome extensions spying on users' browsing data

#141

Post by notenlish »

insin wrote: post #42
endsandmeans wrote: post #20

Most of them jump out as immediately dodgy -- except Stylsh. That is the only one I've ever used on the list but it's been several years.

HN story about what Stylish was up to 7 and a bit years ago: https://news.ycombinator.com/item?id=17447816 I'd assumed most people would have jumped ship to Stylus [1] after that, but most people probably never heard anything about what Stylish was/is doing. [1] https://chromewebstore.google.com/detail/stylus/clngdbkpkpee...

I like stylus, it doesn't have an intuitive ui though. Wish they'd improve it.

Re: Chrome extensions spying on users' browsing data

#142

Post by Imustaskforhelp »

qcontinuum1 wrote: post #137
Imustaskforhelp wrote: post #115

Earlier quoted context omitted.

So this would require a list of decided malicious extensions or not and someone can go ahead and check through that. To find the list of decided malicious extensions, I can imagine that a github repository where people can create issues about the lack of safety (like imagine some github repo where this case could've also been uploaded) and people could discuss and then a .txt/json file could be there in the repo whic…

> So they already have a good bootstrapped amount & I feel as if qcontinuum is interested they can maybe implement the idea? We might to it once. That requires non-trivial engineering effort and resources and we are at the moment short on both of those.

My point was to have a community effort around it as well if possible and people could say, upload suspicion and people could then confirm it?

I am curious but wouldn't this effort be more better if more people outside who are interested in investing their own resources for the safety of a better internet could help you out in such endeavour? So essentially they can also help you out in such task essentially creating an open source-ish committee/list which can decide it.

I do feel like if resources are something in short, then actually doing such would be even more beneficial, right? What are your thoughts on it?

(Tangent if you actually do this: This might become a cat and mouse game if the person with malicious extension say reads the github repo and if they see their extension in it before people can conclude its malicious, making the cat and mouse game but I am imagining a github action which can calculate the hash and download link and everything (essentially archiving) a state of extension and then people can get freed from the game and everything as well. So this might help a lot in future if you actually implement it)

Re: Chrome extensions spying on users' browsing data

#143

Post by sunaookami »

mcjiggerlog wrote: post #6
matheusmoreira wrote: post #4

And the ones that are not will probably get bought out at some point and become malware as well. The only extension I trust enough to install on any browser is uBlock Origin.

I have published an extension [1] that has 100k+ users and I've probably received hundreds of emails over the years asking me to sell out in one way or another. It's honestly relentless. For that reason I also only trust uBlock Origin, Bitwarden and my own extensions. I'd also note that all this spam is via the public email address you're forced to add to your extension listing by Google. I don't think I've ever had…

Can confirm this, also get a lot of sell-requests for my 10k+ user extension via the public mail that I have to add on the Chrome Web Store.

Re: Chrome extensions spying on users' browsing data

#144

Post by sjamaan »

coldtea wrote: post #100
Rebuff5007 wrote: post #58

Earlier quoted context omitted.

Do you also audit every part of every car you buy or medicine you take? Or do you rely on large well-established institutions to do that for you? "Dont trust google" imo is the wrong response here. We are at the mercy of our institutions, and if they are failing us we need mechanisms to keep them in check.

> Do you also audit every part of every car you buy or medicine you take? Or do you rely on large well-established institutions to do that for you? Cars are under quite strict laws that software isn't. And there is only a small number of car vendors, while there are several orders of magnitude more extension vendors. Also a car vendor is a big company with many audits and controls, an extension "vendor" could just be…

Also, car companies have a lot at stake and are a clear target. The scammer is hard to even identify, and has no reputation to worry about. Of course in case of a sold extension, the original author of the extension may have a reputation they care about, but only if they're still making other extensions.

Re: Chrome extensions spying on users' browsing data

#145

Post by smithza »

jakub_g wrote: post #36
mixedbit wrote: post #23

Earlier quoted context omitted.

An extension from a trusted, non anonymous developer which is released as open source is a good signal that the extension can be trusted. But keep in mind that distribution channels for browser extensions, similarly to distribution channels for most other open source packages (pip, npm, rpm), do not provide any guarantee that the package you install and run is actually build verbatim from the code which is open sourc…

Actually, npm supports "provenance" and as it eliminated long lived access tokens for publishing, it encourages people to use "trusted publishing" which over time should make majority of packages be auto-provenance-vefified. https://docs.npmjs.com/trusted-publishers#automatic-provenan...

key word "encourages"

when someone uses `npm install/add/whatever-verb` does it default to only using trusted publishing sources? and the dependency graph?

either 100% enforcement or it won't stick and these attack vulnerabilities are still there.

Re: Chrome extensions spying on users' browsing data

#146

Post by smithza »

singularfutur wrote: post #12

This is why I only run open source extensions that I can actually audit. uBlock Origin, SponsorBlock, the kind of tools where the code is available and the developer isn't anonymous. The Chrome Web Store is basically unregulated and Google doesn't care as long as they get their cut. Open source at least gives you a chance to see what you're installing before it starts exfiltrating your data to some server in a countr…

consider how the xz supply-chain attack occurred 2 years ago [0]. the malware isn't auditable with a `git clone` as easily as you might want.

[0] https://research.swtch.com/xz-timeline

Re: Chrome extensions spying on users' browsing data

#147

Post by extesy »

deanc wrote: post #21

Over 15 years ago now, I had a popular chrome extension that did a very specific thing. I sold it for a few thousand bucks and moved on. It seemed a bit strange at the time, and I was very cautious in the sale, but sold it and moved on. It's abundantly obvious to me now that bad actors are purchasing legitimate chrome extensions to add this functionality and earn money off the user's data (or even worse). I have seen…

For over 10 years that I maintain a reasonably popular cross-browser extension, I've been collecting various monetization offers. They simply don't stop coming: https://github.com/extesy/hoverzoom/discussions/670

Re: Chrome extensions spying on users' browsing data

#149

Post by welanes »

Made a quick tool so you can check if your extensions are on the list: https://extensioncheck.val.run

1. Go to chrome://extensions and toggle Developer mode on (so IDs are visible)

2. Select all text on the page with your mouse and copy

3. Paste it into the tool

It parses the IDs and warns you if any are among the 287 spyware extensions.

Re: Chrome extensions spying on users' browsing data

#150

Post by Rygian »

deanc wrote: post #21

Over 15 years ago now, I had a popular chrome extension that did a very specific thing. I sold it for a few thousand bucks and moved on. It seemed a bit strange at the time, and I was very cautious in the sale, but sold it and moved on. It's abundantly obvious to me now that bad actors are purchasing legitimate chrome extensions to add this functionality and earn money off the user's data (or even worse). I have seen…

While assuming absolutely zero bad will on your part, I would nevertheless find it fair if you were legally on the hook for whatever happened after the sale, unless you could prove that you provided reasonable means for the users of your extension to perform their due diligence on the new owner of the extension.

This is of course easy to say in hindsight, and is absolutely a requirement that should be enforced by the extension appstore, not by individual contributors such as yourself.

Post reply on HN