Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Massive spying on users of Google's Chrome shows new security weakness

reuters.com

Post reply on HN
Print view View original

181–190 of 270 posts

Re: Massive spying on users of Google's Chrome shows new security weakness

#181

Post by fauigerzigerk »

ThePhysicist wrote: post #7

There is a web intelligence company in Israel that is known to buy popular browser extensions like “Web of Trust” and use them to exfiltrate browsing data (with tons of sensitive and personal information). They have been called out for this several times already and some of their extensions got removed from the store, they invariably turn back up again after a few weeks though (good connections to Google/Mozilla I gu…

>Extensions are ideal to exfiltrate data from browsers as they bypass all security measures and can literally see everything you do on every single page you visit.

That's not generally true. It depends on the permissions. If you grant an extension permission to access every page then yes it can do that. That's not bypassing all security measures.

Re: Massive spying on users of Google's Chrome shows new security weakness

#182

Post by katsura »

Melting_Harps wrote: post #165
matheusmoreira wrote: post #117

Earlier quoted context omitted.

The only trustworthy extensions are uBlock Origin and EFF's Privacy Badger. Everything else is best viewed as potential malware, no different than random downloadable executables. Honestly, uBlock Origin and Privacy Badger are so important at this point they should just become part of the browser itself. They're already in a league of their own.

> The only trustworthy extensions are uBlock Origin and EFF's Privacy Badger. Everything else is best viewed as potential malware, no different than random downloadable executables. What about Ghostery?

They weren't always cool: https://www.businessinsider.com/evidon-sells-ghostery-data-t...

As far as I know this changed later on, but still.

Re: Massive spying on users of Google's Chrome shows new security weakness

#183

Post by sergeykish »

ThePhysicist wrote: post #7

There is a web intelligence company in Israel that is known to buy popular browser extensions like “Web of Trust” and use them to exfiltrate browsing data (with tons of sensitive and personal information). They have been called out for this several times already and some of their extensions got removed from the store, they invariably turn back up again after a few weeks though (good connections to Google/Mozilla I gu…

These are strong words.

Mozilla is miles ahead of chrome with recommended extensions [1]:

> Recommended extensions undergo full code review by staff security experts to provide a strong additional security check.

It has a list of blocked addons [2]. And I believe that is Chrome who turned addons into Wild West, Mozilla had a long review process [3].

[1] https://blog.mozilla.org/firefox/firefox-recommended-extensi...

[2] https://blocked.cdn.mozilla.net/

[3] https://blog.mozilla.org/addons/2010/02/15/the-add-on-review...

Re: Massive spying on users of Google's Chrome shows new security weakness

#184

Post by imrelaxed »

AareyBaba wrote: post #139
omnifischer wrote: post #136

Earlier quoted context omitted.

the number of eyes looking at it all the time.

How many people are looking at the code ? The github commits show only one active contributor. I use uBlock Origin myself but I sometimes question the faith we place on open-source. We assume someone else is looking at the code.

It would be awesome if there was a volunteer financed code review group to review popular open source projects. I think I’m not the only one who would happily donate money to such a group for code reviews for various OSS projects. Initial code reviews would require a lot of effort, unless somehow automated, but after that it would be fairly easy to monitor and verify updates and changes to the code.

Re: Massive spying on users of Google's Chrome shows new security weakness

#186

Post by GoblinSlayer »

Fiveplus wrote: post #129
GoblinSlayer wrote: post #115

Earlier quoted context omitted.

The concern is not that Chrome dials home to Google, but that any random dude scatters your data across entire internet.

My comment is the answer to a specific comment asking about a tangential derivative based on the discussion (which is why it is not a new parent comment under the post itself). Thank you.

Yeah, I mean a disconnected reply to a tangential question is misleading.

Re: Massive spying on users of Google's Chrome shows new security weakness

#187

Post by sergeykish »

ThePhysicist wrote: post #151
coreai wrote: post #138

Earlier quoted context omitted.

I feel like this argument is the same as ‘how third party apps are allowed in windows and macOS by Microsoft and Apple’ To me there has always been a trusted part of computing which is audited to some extent and marked as trusted. Browser extensions work the same way as software on an operating system. If they blocked all extensions outside trusted ones they would be criticised as well. However the auditing process i…

In 2016 we proved that the owner of "Web of Trust" was exfiltrating and illegally selling clickstream data to anyone who would pay. For Germany alone the data contained the browing information of more than three million people, often revealing highly intimate and sensitive details about their lives. Still, Chrome and Firefox reinstated the extension after less than four weeks, and to this day it keeps collecting clic…

I am outsider interested in this topic, it would be great if you provided some links. I've found Web of Trust addon [1] and its Privacy Policy [2]:

> Automatically Collected Information

> Internet Protocol Address (trimmed to permanently remove specific location information other than country, city & postal code); device type; operating system and browser; Search engine results page (keyword, order/index of results, link of result, title, description, ads); web pages visited and time stamp of the visit; display ads; and WOT user ID.

That is awful [3] but that's what almost every web page wants to do. Privacy Respecting browser should not run javascript, ignore cookie, and block non 1st party resources. That's what my browser does. But this is not where consensus lies.

As I understand Mozilla allows to collect information if it is defined in Privacy Policy. It would be great to have badge "Collects Information".

[1] https://addons.mozilla.org/en-US/firefox/addon/wot-safe-brow...

[2] https://www.mywot.com/privacy

[3] https://www.pcmag.com/news/web-of-trust-browser-extension-ca...

Re: Massive spying on users of Google's Chrome shows new security weakness

#188

Post by bregma »

ThePhysicist wrote: post #7

There is a web intelligence company in Israel that is known to buy popular browser extensions like “Web of Trust” and use them to exfiltrate browsing data (with tons of sensitive and personal information). They have been called out for this several times already and some of their extensions got removed from the store, they invariably turn back up again after a few weeks though (good connections to Google/Mozilla I gu…

My nanny won't let me install extensions. She keeps me snug and secure in her warm and loving arms.

Re: Massive spying on users of Google's Chrome shows new security weakness

#189

Post by matheusmoreira »

AareyBaba wrote: post #131
matheusmoreira wrote: post #117

Earlier quoted context omitted.

The only trustworthy extensions are uBlock Origin and EFF's Privacy Badger. Everything else is best viewed as potential malware, no different than random downloadable executables. Honestly, uBlock Origin and Privacy Badger are so important at this point they should just become part of the browser itself. They're already in a league of their own.

What makes uBlock Origin a trustworthy extension ? because it is open-source ?

I monitor the issue tracker and explore the source code from time to time. The developer posts on HN and seems to be committed to the project and everything it stands for.

I'm not sure if builds are reproducible though. I don't think the author would allow the extensions to be hijacked by malicious actors but it'd still be nice to be able to verify a packaged extension was built from a given git commit.

Re: Massive spying on users of Google's Chrome shows new security weakness

#190

Post by jart »

ComodoHacker wrote: post #84

I see this as an argument in favor of native apps. I mean really native, not Electron-esque ones. As you more and more turn the browser into an OS, you have to treat it like an OS. Don't allow unprivileged user to install unsigned kernel modules.

Try this. https://raw.githubusercontent.com/jart/cosmopolitan/master/a...
Post reply on HN