Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Massive spying on users of Google's Chrome shows new security weakness

reuters.com

Post reply on HN
Print view View original

151–160 of 270 posts

Re: Massive spying on users of Google's Chrome shows new security weakness

#151

Post by ThePhysicist »

coreai wrote: post #138
ThePhysicist wrote: post #7

There is a web intelligence company in Israel that is known to buy popular browser extensions like “Web of Trust” and use them to exfiltrate browsing data (with tons of sensitive and personal information). They have been called out for this several times already and some of their extensions got removed from the store, they invariably turn back up again after a few weeks though (good connections to Google/Mozilla I gu…

I feel like this argument is the same as ‘how third party apps are allowed in windows and macOS by Microsoft and Apple’ To me there has always been a trusted part of computing which is audited to some extent and marked as trusted. Browser extensions work the same way as software on an operating system. If they blocked all extensions outside trusted ones they would be criticised as well. However the auditing process i…

In 2016 we proved that the owner of "Web of Trust" was exfiltrating and illegally selling clickstream data to anyone who would pay. For Germany alone the data contained the browing information of more than three million people, often revealing highly intimate and sensitive details about their lives. Still, Chrome and Firefox reinstated the extension after less than four weeks, and to this day it keeps collecting clickstream data. It does so using dark patterns and I'm sure most of the users are not aware that a free extension they use to increase their safety while surfing the web surreptitiously sells their browsing data.

If the main selling point of your browser or OS is that you protect the privacy of your users you simply can't act like that, because most users are not aware of the data collection that is happening via these extensions.

With mobile apps we're in a similar situation, companies like X-Mode exfiltrate and sell location data via apps that claim to protect your privacy. Desktop software: Same story. Anti-virus software that is supposed to protect you actually exfiltrates personal data from your computer.

So yeah if you build an open platform there will be such abuse, but if you position yourself as a champion for privacy you simply can't allow that (or at least you should try to make it more difficult).

There are simple counter-measures that browser vendors could employ: Showing users how much data a given extension sends to a backend and ideally making that data transparent would be enough to stop most of these practices, because people would then realize that their free screenshot app somehow sends every single URL they open to a backend service. Right now this can happen entirely without the knowledge of the user. You can't control what you cannot see and understand.

Re: Massive spying on users of Google's Chrome shows new security weakness

#152

Post by bigiain »

mehrdadn wrote: post #64
0xy wrote: post #52

Earlier quoted context omitted.

Because the statement is deliberately ambiguous, and doesn't say they do not use it for tracking. "The X-Client-Data header is used to help Chrome test new features before rolling them out to all users. The information included in this header reflects the variations, or new feature trials, in which an installation of Chrome is currently enrolled. This information helps us measure server-side metrics for large groups…

I have no clue if they're lying or not, and I'm open to the possibility that they are, but you're not really making a good case for it here. It's pretty disingenuous to claim they track users and base it on lack of mathematically airtight evidence that they don't. That's not how accusations are supposed to work, right? I might as well claim you're a burglar because there's nothing to indicate you're not one. If you w…

> It's pretty disingenuous to claim they track users

Google lost the benefit of doubt years ago. This is Google 2020 - all they do is "track users":

https://www.reuters.com/article/us-alphabet-google-privacy-l...

https://www.compliancejunction.com/google-loses-appeal-of-e5...

> I might as well claim you're a burglar because there's nothing to indicate you're not one.

Google have been caught burgling houses repeatedly, and have been found in your house with burglary tools claiming "we're just doing, ummm, _browser experiments!!!_" You saying there's "no evidence of it actually happening " isn't useful.

Re: Massive spying on users of Google's Chrome shows new security weakness

#153

Post by numpad0 »

AareyBaba wrote: post #131
matheusmoreira wrote: post #117

Earlier quoted context omitted.

The only trustworthy extensions are uBlock Origin and EFF's Privacy Badger. Everything else is best viewed as potential malware, no different than random downloadable executables. Honestly, uBlock Origin and Privacy Badger are so important at this point they should just become part of the browser itself. They're already in a league of their own.

What makes uBlock Origin a trustworthy extension ? because it is open-source ?

I feel it dreadful to think uBlock Origin might not be trustworthy after all.

But I can’t find any other reason why I don’t think that that isn’t the case.

Re: Massive spying on users of Google's Chrome shows new security weakness

#154

Post by aembleton »

fabian2k wrote: post #17

Potentially dumb question here, but would it be generally possible to create a permissions system for browser extensions that can distinguish between an extension that is actually sending information based on sensitive sources like page content and browser history and an extension that only sends harmless stuff over the network like e.g. asking for updated ad block lists? I'm imagining something like a sufficiently a…

> asking for updated ad block lists

You could only allow GET requests and require the user to whitelist this the first time the extension does it.

Subsequent calls to the same blocklist would go through without a user prompt, but if it suddenly started trying to send your email address or some other param, it would stand out.

Re: Massive spying on users of Google's Chrome shows new security weakness

#156

Post by phantom_oracle »

This will make the rounds because it has appeared on a large news agency and will be amplified louder than Joe Blog could do on his/her own, but this isn't a novel or shocking news.

You don't need to look very far to see how shady the internet gets. Go to any mainstream news website that runs ads and you will see those scam 3rd-party ads(they used to promote bitcoin ads a few years ago until the mainstream outrage) you wouldn't click on in a million years.

Now I'm not saying those ads are connected to broader malware, but if you start there you will uncover these shady operators(I discovered this when I did a little digging on a streaming website that provided content I could not obtain from the 32nd streaming service that I have to pay $10 a month to watch - and the amazing fact is that the same scammy ads you see on majornews.com is no different to the scammy ones you will see on torrentxyz.com).

Re: Massive spying on users of Google's Chrome shows new security weakness

#157

Post by aembleton »

Asuchug4 wrote: post #93
fabian2k wrote: post #17

Potentially dumb question here, but would it be generally possible to create a permissions system for browser extensions that can distinguish between an extension that is actually sending information based on sensitive sources like page content and browser history and an extension that only sends harmless stuff over the network like e.g. asking for updated ad block lists? I'm imagining something like a sufficiently a…

It is almost a 'stopping problem'. You can send any data by sending GET with data encoded in url path, without any query string. How is any sandbox supposed to detect if you are sending data or really just getting information (like updating adblock list).

The url path shouldn't change on each call, so ask the user to whitelist each request the first time that they are made. Subsequent GET requests to the same endpoint and same params can go through without a prompt.

Re: Massive spying on users of Google's Chrome shows new security weakness

#158

Post by porker »

ThePhysicist wrote: post #7

There is a web intelligence company in Israel that is known to buy popular browser extensions like “Web of Trust” and use them to exfiltrate browsing data (with tons of sensitive and personal information). They have been called out for this several times already and some of their extensions got removed from the store, they invariably turn back up again after a few weeks though (good connections to Google/Mozilla I gu…

Is there a list of extensions that have been caught exfiltrating data?

I look at the 20 I've got installed and wonder which are using the "Access to every website" permission for their own ends.

Re: Massive spying on users of Google's Chrome shows new security weakness

#159

Post by zelly »

ThePhysicist wrote: post #7

There is a web intelligence company in Israel that is known to buy popular browser extensions like “Web of Trust” and use them to exfiltrate browsing data (with tons of sensitive and personal information). They have been called out for this several times already and some of their extensions got removed from the store, they invariably turn back up again after a few weeks though (good connections to Google/Mozilla I gu…

I hope we don't get even more locked down permissions for Web Extensions. I would prefer that the Chrome Web Store manually vets every extension and update. Maybe start charging big $$$ like Apple does. Most extensions will disappear from the stores, but they won't disappear from all existence (as changing the permissions model would effectively do). Power users who could vet the extension themselves can install extensions manually (maybe even behind a command line switch to futher filter out computer illiterates). That's a good compromise.

Re: Massive spying on users of Google's Chrome shows new security weakness

#160

Post by holoduke »

ThePhysicist wrote: post #7

There is a web intelligence company in Israel that is known to buy popular browser extensions like “Web of Trust” and use them to exfiltrate browsing data (with tons of sensitive and personal information). They have been called out for this several times already and some of their extensions got removed from the store, they invariably turn back up again after a few weeks though (good connections to Google/Mozilla I gu…

why would you want to have an extension able to do network calls anyway? my opinion extensions should not be allowed to do so.
Post reply on HN