Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome extensions spying on users' browsing data

qcontinuum.substack.com

Post reply on HN
Print view View original

161–170 of 215 posts

Re: Chrome extensions spying on users' browsing data

#161

Post by heavenlyfather »

@qcontinuum1 appreciate this kind of research. saw your other comments and you mentioned that the team's engineering resources are scarce + saw that at the bottom of the github repo that there are links to BTC address.

curious to know: 1- how large your team is? and how long this research took? it is very thorough and knowing such a detail might encourage others to participate in a joint effort in performing this kind of research 2- if this kind of research is your primary focus? 3- if there are other ways that financial support can be provided other than through xrp or btc?

i tried to look up your profiles but wasn't able to find where you were all from, so wishing you well wherever you are in the world. :)

Re: Chrome extensions spying on users' browsing data

#162

Post by Imustaskforhelp »

qcontinuum1 wrote: post #158
Imustaskforhelp wrote: post #142

Earlier quoted context omitted.

My point was to have a community effort around it as well if possible and people could say, upload suspicion and people could then confirm it? I am curious but wouldn't this effort be more better if more people outside who are interested in investing their own resources for the safety of a better internet could help you out in such endeavour? So essentially they can also help you out in such task essentially creating…

It is a noble idea to have a community driven effort in security research. We are sceptical that would work. The same way security researchers will read this thread in future bad actors (e.g. Similarweb) can read as well. Any tool that would be open sourced or community driven for extension scanning will be with enough time used by bad actors to evade the scans. That is also why we don't share the code for this resea…

Oh I understand. I don't have any expertise in such field but reading this, I can understand why open source approach might not work out which is a little sad being honest.

But I feel like then the (bottleneck?) [which I don't mean in a bad way] would be the team where the attackers might still be infinitely more which can exhaust your resources which you mention as such.

Also,Are there any other teams working in this? Thoughts on collaborating with anyone in the security field?

Maybe if a direct detailed discussion can't happen then just as how you released the list of these extensions, you can release extensions in future too as you detect them

Do you feel as if LLM generated vibe-coded (with some basic reading of code to just get idea and see if there's any bad issues) would be more safer than a random extension in firefox/chrome in general? Given one is a black box (closed source) generated by human and the other is an open code generated by a black box.

Re: Chrome extensions spying on users' browsing data

#163

Post by Forgeties79 »

ptx wrote: post #136
Forgeties79 wrote: post #118

Earlier quoted context omitted.

That isn’t remotely comparable. You’re asking someone to quietly alter someone else’s product, not selling the product to them. They didn’t pay him to change the extension, they bought it.

They bought the permission to make changes to customer machines that had been granted to the seller by the customer. If it's just a sale of the source code, there's no problem. But what is bought is usually the pre-existing update channel (the installed base), precisely to be able to alter the product for existing users without explicitly informing them or asking for consent.

I get what you’re trying to say but comparing selling your tool to pocketing money on the job to commit a crime is not the same thing.

Re: Chrome extensions spying on users' browsing data

#164

Post by lapcat »

mixmastamyk wrote: post #155
lapcat wrote: post #128

Earlier quoted context omitted.

> You don’t have to apply the same policies to everything you use. What's the reasoning behind it, though? You can arbitrarily apply different policies to different things, but there's no rhyme or reason to that. If the difference ultimately comes down to trusting certain developers to an extent that you don't need to audit their source, then I'm not sure why that couldn't also be true of certain extension developers…

Linux distros have a good reputation, browser extensions don’t. Might be simple as that.

It appears that you may have misunderstood the preceding discussion. Linux is open source and thus can be audited.

Re: Chrome extensions spying on users' browsing data

#165

Post by oj-hn-dot-com »

randunel wrote: post #19
singularfutur wrote: post #12

This is why I only run open source extensions that I can actually audit. uBlock Origin, SponsorBlock, the kind of tools where the code is available and the developer isn't anonymous. The Chrome Web Store is basically unregulated and Google doesn't care as long as they get their cut. Open source at least gives you a chance to see what you're installing before it starts exfiltrating your data to some server in a countr…

How do you check that the open sourced code is the same one that you are installing from the extension repository and actually running?

The open source one automatically publishes to the Chrome Store from GH actions so that there is no human involvement in the deployment process.

I'm currently in the process of setting that up for the one I'm building, because this transparency is very important to me) and it is a pain in the butt to do so. You have to go through a few verification processes at Google to get the keys approved.

Re: Chrome extensions spying on users' browsing data

#166

Post by chrisjj »

eli wrote: post #159
chrisjj wrote: post #55

Earlier quoted context omitted.

> And why didn't one of the wealthiest companies of the world capture this themselves? Assume they did. And the question becomes "Why didn't they come clean?" ... and much easier to answer.

Genuinely not sure what you're suggesting

I am suggesting Google did catch this.

Re: Chrome extensions spying on users' browsing data

#167

Post by leptons »

ravenstine wrote: post #148

This is why I disable automatic updates. Not just for browser extensions but everything. This whole "you gotta update immediately or you're gonna get hacked" thing is a charade. If anything, if you update you'll be hacked at this point.

Damned if you do, damned if you don't.

Re: Chrome extensions spying on users' browsing data

#169

Post by btown »

jakub_g wrote: post #36
mixedbit wrote: post #23

Earlier quoted context omitted.

An extension from a trusted, non anonymous developer which is released as open source is a good signal that the extension can be trusted. But keep in mind that distribution channels for browser extensions, similarly to distribution channels for most other open source packages (pip, npm, rpm), do not provide any guarantee that the package you install and run is actually build verbatim from the code which is open sourc…

Actually, npm supports "provenance" and as it eliminated long lived access tokens for publishing, it encourages people to use "trusted publishing" which over time should make majority of packages be auto-provenance-vefified. https://docs.npmjs.com/trusted-publishers#automatic-provenan...

Unless the Chrome web store integrates with this, it puts the onus on users to continuously scan extension updates for hash mismatches with the public extension builds, which isn’t standardized. And even then this would be after an update is unpacked, which may not run in time to prevent initial execution. Nor does it prevent a supply chain attack on the code running in the GitHub Action for the build, especially if dependencies aren’t pinned. There’s no free lunch here.

Re: Chrome extensions spying on users' browsing data

#170

Post by _slih »

RupertSalt wrote: post #40
deanc wrote: post #21

Over 15 years ago now, I had a popular chrome extension that did a very specific thing. I sold it for a few thousand bucks and moved on. It seemed a bit strange at the time, and I was very cautious in the sale, but sold it and moved on. It's abundantly obvious to me now that bad actors are purchasing legitimate chrome extensions to add this functionality and earn money off the user's data (or even worse). I have seen…

It is a classic supply-chain attack. The same modality is used by gamers to sell off their high-level characters, and social media accounts do "switcheroos" on posts, Pages, and Groups all the time. You know, a lot of consumer cybersecurity focuses on malware, browser security, LAN services, but I propose that the new frontier of breaches involves browser extensions, "cloud integrations", and "app access" granted fro…

Companies spend a fortune on endpoint security and then let employees install random Chrome extensions with full page access. I've seen AWS console sessions running in browsers with a dozen extensions nobody's ever audited. The extension store is basically a supply chain attack marketplace at this point
Post reply on HN