Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Massive spying on users of Google's Chrome shows new security weakness

reuters.com

Post reply on HN
Print view View original

171–180 of 270 posts

Re: Massive spying on users of Google's Chrome shows new security weakness

#171

Post by mtrovo »

Melting_Harps wrote: post #165
matheusmoreira wrote: post #117

Earlier quoted context omitted.

The only trustworthy extensions are uBlock Origin and EFF's Privacy Badger. Everything else is best viewed as potential malware, no different than random downloadable executables. Honestly, uBlock Origin and Privacy Badger are so important at this point they should just become part of the browser itself. They're already in a league of their own.

> The only trustworthy extensions are uBlock Origin and EFF's Privacy Badger. Everything else is best viewed as potential malware, no different than random downloadable executables. What about Ghostery?

I think it's "safe". They are not going to put a malware on their extension as you installing the extension is how they make money. But as the company has a business model around collecting your browsing data and being a gatekeeper between you and advertiser it really depends what you're trying to protect against.

Re: Massive spying on users of Google's Chrome shows new security weakness

#172

Post by vbezhenar »

esperent wrote: post #161
vbezhenar wrote: post #142

Earlier quoted context omitted.

For me it's honest author. I don't trust code, I trust people.

I used to trust the authors of unlock, adblock, adblock origins. But they all sold out. Why do you think this time it's different?

I can't be sure about that, of course. It works for now and that's all that matters. Someone might fork it if that would happen.

Re: Massive spying on users of Google's Chrome shows new security weakness

#173

Post by inglor »

holoduke wrote: post #160
ThePhysicist wrote: post #7

There is a web intelligence company in Israel that is known to buy popular browser extensions like “Web of Trust” and use them to exfiltrate browsing data (with tons of sensitive and personal information). They have been called out for this several times already and some of their extensions got removed from the store, they invariably turn back up again after a few weeks though (good connections to Google/Mozilla I gu…

why would you want to have an extension able to do network calls anyway? my opinion extensions should not be allowed to do so.

Some reasons:

- Ad blocking - Reporting analytics to home base for product feedback - Mocking network requests to make certain pages load faster. - Performance analytics for the page's network (like the devtools).

Please remember that some extensions are not free, we companies like Microsoft paying a substantial amount of money for the extension we develop (Testim Editor) for example.

Re: Massive spying on users of Google's Chrome shows new security weakness

#174

Post by 0xy »

joshuamorton wrote: post #97
0xy wrote: post #76

Earlier quoted context omitted.

How do you know they're not using it for tracking, beyond an ambiguous PR statement that actually doesn't even say they aren't using it for tracking? What makes you sure of that? There are literally billions of dollars on the line. Does Safari or Firefox implement a similar tracking header? If it's so needed for experiments, why is Chrome literally the only browser sending this data to their advertising network (or a…

> Hence the ambiguous PR statement. There's nothing ambiguous about "is not used to identify or track individual users.". Any form of personalized ad tracking would require tracking individual users, by definition. So there's your answer. Your attempts to create weaseling where there isn't any, so that you can continue to exclaim about the potentials for tracking don't actually change the ambiguity of the statement.…

If Google can't keep things quiet, where can I find a rough list of factors DoubleClick uses in order to track users? Has any of those factors leaked in the past? Would anyone on the ad team at Google jeopardize their $350k per year to leak unethical behavior in that division?

There's plenty ambiguous about that statement. Firstly, it doesn't cover past or future. Room for weaseling there. Secondly, it specifically says "track individual users", rather than include devices or just say "tracking" generally. Could they be tracking multiple users with the data point of "rarely updates browser"? According to that statement, they didn't rule it out.

That statement explicitly does not say they are not using that information to track devices or Chrome installs.

In fact, it doesn't even say it isn't a factor in ad targeting algorithms.

Given it was written by Google's highly skilled PR team, and not a developer, I'm inclined to believe they wrote this ambiguously for a reason. Google does not have a good track record with the truth or community goodwill (they stabbed Firefox in the back).

It's an advertising company making billions of dollars specifically from the use of tracking data. You're asking me to trust that said advertising company isn't using a tracking ID for tracking purposes when said ID is sent directly to their advertising domains.

Re: Massive spying on users of Google's Chrome shows new security weakness

#175

Post by peteretep »

azinman2 wrote: post #71
ponker wrote: post #36

Earlier quoted context omitted.

Why is this business model usually from Israel?

The business model of watching people's web browsing history and selling them adds? You mean like Jumpshot (through antivirus Avast -- Czech), Facebook/Twitter/Pinterest through their pixels (US), every ad tracking network (US/China/Europe generally), and Google through its search engine history & ad platform (US)? It feels very unfair to malign Israel here when the majority of surveillance on the web for money is ha…

I don't have the data, but I definitely think of Israel as being a country where many of these questionable data privacy things originate. Add PIPL to the list, who are a data aggregator and who claim to be in Idaho, where all their management is actually in Israel.

Re: Massive spying on users of Google's Chrome shows new security weakness

#176

Post by commoner »

joshuamorton wrote: post #96
bigiain wrote: post #73

Earlier quoted context omitted.

You do know the history of the name doubleclick, right? Now want to explain why a browser experiment or analytics domain whitelist includes an advertising surveillance domain? (The answer, so far as I can work out, is that Google thinks "The stupid cattle won't even notice mostly, and the ones that do - we'll just get our stooges on social media to claim they're being paranoid, and that everybody should just keep fat…

> we'll just get our stooges on social media to claim they're being paranoid Accusing people of being shills is a violation of the HN guidelines, please don't. > You do know the history of the name doubleclick, right? I honestly have no clue what you're implying here. > Now want to explain why a browser experiment or analytics domain whitelist includes an advertising surveillance domain? So that it can pass analytics…

You're a Google employee, and you're vociferously defending Google's use of a tracking header in Chrome. Others deserve to know your conflict of interest so that they can read your arguments in the right context.

Re: Massive spying on users of Google's Chrome shows new security weakness

#177

Post by willvarfar »

IncRnd wrote: post #104
willvarfar wrote: post #89

Earlier quoted context omitted.

Could browser extensions be ran in a sandbox, with read_access to the page, but only able to read from whitelisted registered and fixed URLs for updating configuration etc? So your blocking extension can download lists of things to block, or other config, but it can't exfiltrate any information about the user's browsing habits. The only side channel I can then think of is using page rewriting or timing to communicate…

In the same way that DNS requests can exfiltrate data, requesting URLs can also exfiltrate data. This is trivial to perform.

Why I specified "fixed URLs", to close that loophole

Re: Massive spying on users of Google's Chrome shows new security weakness

#179

Post by edjroot »

ThePhysicist wrote: post #151
coreai wrote: post #138

Earlier quoted context omitted.

I feel like this argument is the same as ‘how third party apps are allowed in windows and macOS by Microsoft and Apple’ To me there has always been a trusted part of computing which is audited to some extent and marked as trusted. Browser extensions work the same way as software on an operating system. If they blocked all extensions outside trusted ones they would be criticised as well. However the auditing process i…

In 2016 we proved that the owner of "Web of Trust" was exfiltrating and illegally selling clickstream data to anyone who would pay. For Germany alone the data contained the browing information of more than three million people, often revealing highly intimate and sensitive details about their lives. Still, Chrome and Firefox reinstated the extension after less than four weeks, and to this day it keeps collecting clic…

> Showing users how much data a given extension sends to a backend and ideally making that data transparent would be enough to stop most of these practices

Exactly! I find it abhorrent that not even Firefox has something straightforward like that as a “first-class” feature. Most of the extensions I use shouldn't need to communicate with any server at all to begin with, so having to just trust the author's words or manually audit the code on every update (or stop them altogether) and maybe fork the project (if that's even possible)... Doesn't make sense.

The one thing I'm aware of that these extensions could do to sidestep such a mechanism is to inject scripts on pages that then exfiltrate your data, but injection could also be blocked, and as a last resort I trust uMatrix would have me covered ;)

Re: Massive spying on users of Google's Chrome shows new security weakness

#180

Post by amatecha »

Get something like Pi-Hole or the MVPS hosts file ( https://winhelp2002.mvps.org/hosts.htm ) to block the majority of ads. Deal with the few ads that remain and enjoy blocking the vast majority trivially easily, without sharing all your browsing activity with an extension you can't easily audit the functionality of.
Post reply on HN