Remember when google removed extension APIs so that things like uBlock origin stopped working in Chrome, in the name of "security"?
Pepperidge farm remembers.
Chrome extensions spying on users' browsing data
151–160 of 215 posts
Re: Chrome extensions spying on users' browsing data
#152Made a quick tool so you can check if your extensions are on the list: https://extensioncheck.val.run 1. Go to chrome://extensions and toggle Developer mode on (so IDs are visible) 2. Select all text on the page with your mouse and copy 3. Paste it into the tool It parses the IDs and warns you if any are among the 287 spyware extensions.
Nothing happens when I click `Scan`.
Re: Chrome extensions spying on users' browsing data
#153Earlier quoted context omitted.
It’s one of the reasons I run Safari, which strictly limits what extensions can do for these reasons
No, Safari is really no different here from Chrome, and indeed there's broad compatibility between the extension API, such that in many cases you can use a Chrome extension unmodified in Safari.
Ah, thanks interesting. I remember the kerfuffle when Safari introduced its new model and I didn’t realise Chrome had followed suit
Re: Chrome extensions spying on users' browsing data
#154Made a quick tool so you can check if your extensions are on the list: https://extensioncheck.val.run 1. Go to chrome://extensions and toggle Developer mode on (so IDs are visible) 2. Select all text on the page with your mouse and copy 3. Paste it into the tool It parses the IDs and warns you if any are among the 287 spyware extensions.
Nothing happens when I click `Scan`.
Whoops, developer mode needs to be toggled on. Just updated the instructions
Re: Chrome extensions spying on users' browsing data
#155Earlier quoted context omitted.
Why do you think it’s not consistent? You don’t have to apply the same policies to everything you use.
> You don’t have to apply the same policies to everything you use. What's the reasoning behind it, though? You can arbitrarily apply different policies to different things, but there's no rhyme or reason to that. If the difference ultimately comes down to trusting certain developers to an extent that you don't need to audit their source, then I'm not sure why that couldn't also be true of certain extension developers…
Linux distros have a good reputation, browser extensions don’t. Might be simple as that.
Re: Chrome extensions spying on users' browsing data
#156Earlier quoted context omitted.
If you look at the request made, then it seems to check the category of the site, for whatever reason. I don't know that extensions, so I don't know if this is a legit use, sloppy use or harmful. I'm also not saying they found nothing at all. But looking through what they found, they seem to have not even thought much about whether those cases are legit and in the excepted and necessary realm of actions the add-on is…
This other research points to this type of pattern (sending all URLs to a server to allegedly provide functionality) being used under false pretenses: https://palant.info/2025/01/13/biscience-collecting-browsing... In particular, look for the diagram provided by a data vendor showing this in action. As with safebrowsing and adblocking extensions, there is no need to send data to servers. Many groups of smart people h…
> being used under false pretenses
Yes, obviously is that possible, but the least that one should do then is looking up what's really happening. These are browser addons, the source code is available. But instead they are looking from the outside and calling alarm on something they don't understand. That's just poor behaviour and harmful in today's climate.
Re: Chrome extensions spying on users' browsing data
#157Over 15 years ago now, I had a popular chrome extension that did a very specific thing. I sold it for a few thousand bucks and moved on. It seemed a bit strange at the time, and I was very cautious in the sale, but sold it and moved on. It's abundantly obvious to me now that bad actors are purchasing legitimate chrome extensions to add this functionality and earn money off the user's data (or even worse). I have seen…
While assuming absolutely zero bad will on your part, I would nevertheless find it fair if you were legally on the hook for whatever happened after the sale, unless you could prove that you provided reasonable means for the users of your extension to perform their due diligence on the new owner of the extension. This is of course easy to say in hindsight, and is absolutely a requirement that should be enforced by the…
How would that even work? What if the seemingly clean buyer sells it to someone else scammy?
Re: Chrome extensions spying on users' browsing data
#158Earlier quoted context omitted.
> So they already have a good bootstrapped amount & I feel as if qcontinuum is interested they can maybe implement the idea? We might to it once. That requires non-trivial engineering effort and resources and we are at the moment short on both of those.
My point was to have a community effort around it as well if possible and people could say, upload suspicion and people could then confirm it? I am curious but wouldn't this effort be more better if more people outside who are interested in investing their own resources for the safety of a better internet could help you out in such endeavour? So essentially they can also help you out in such task essentially creating…
It is a noble idea to have a community driven effort in security research. We are sceptical that would work. The same way security researchers will read this thread in future bad actors (e.g. Similarweb) can read as well.
Any tool that would be open sourced or community driven for extension scanning will be with enough time used by bad actors to evade the scans. That is also why we don't share the code for this research as it would only speed up this process.
Re: Chrome extensions spying on users' browsing data
#159And why didn't one of the wealthiest companies of the world capture this themselves? Considering the barriers they build to prevent adblockers, that doesn't shine a good light on them.
> And why didn't one of the wealthiest companies of the world capture this themselves? Assume they did. And the question becomes "Why didn't they come clean?" ... and much easier to answer.
Genuinely not sure what you're suggesting
Re: Chrome extensions spying on users' browsing data
#160You know, LLMs could do automated code reviews for each update to avoid things like this. It would be much better than unexamined updates.