Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome extensions spying on users' browsing data

qcontinuum.substack.com

Post reply on HN
Print view View original

191–200 of 215 posts

Re: Chrome extensions spying on users' browsing data

#191

Post by cachius »

singularfutur wrote: post #12

This is why I only run open source extensions that I can actually audit. uBlock Origin, SponsorBlock, the kind of tools where the code is available and the developer isn't anonymous. The Chrome Web Store is basically unregulated and Google doesn't care as long as they get their cut. Open source at least gives you a chance to see what you're installing before it starts exfiltrating your data to some server in a countr…

This is why it's so sad that Tampermonkey isn't open source. https://github.com/Tampermonkey/tampermonkey/discussions/173...

Re: Chrome extensions spying on users' browsing data

#192

Post by revicon »

amalter wrote: post #186
revicon wrote: post #176

Earlier quoted context omitted.

Here's a one-shot script that does the compare for you, in case it's helpful... https://www.sfbaylabs.org/files2/2026-02-11/bad_browser_extension_check_osx.sh You can run it directly if you cut/paste this in your mac terminal... curl -fsSL https://www.sfbaylabs.org/files2/2026-02-11/bad_browser_extension_check_osx.sh | bash

Is there any irony in a thread on browser malware that includes a "please run this bash script blind"? Not that I don't trust you, but between now and when someone stumbles on this thread, your domain could expire and I could publish something crazy at that url.

This is why I put the raw url to the script first in my comment. Downloading the script file, doing a chmod +x and then a ./script.sh to execute it is daunting for some.

But I'll add a caveat to my original comment as well.

edit: Looks like I can't edit my original comment anymore.

Re: Chrome extensions spying on users' browsing data

#193

Post by useragent42 »

PurpleRamen wrote: post #156
useragent42 wrote: post #140

Earlier quoted context omitted.

This other research points to this type of pattern (sending all URLs to a server to allegedly provide functionality) being used under false pretenses: https://palant.info/2025/01/13/biscience-collecting-browsing... In particular, look for the diagram provided by a data vendor showing this in action. As with safebrowsing and adblocking extensions, there is no need to send data to servers. Many groups of smart people h…

> being used under false pretenses Yes, obviously is that possible, but the least that one should do then is looking up what's really happening. These are browser addons, the source code is available. But instead they are looking from the outside and calling alarm on something they don't understand. That's just poor behaviour and harmful in today's climate.

If you read their full paper, they do technical analysis confirming findings in many cases. Many other researchers have done the same in the recent past.

Full paper also says that the unique URLs were later requested by crawlers, which confirms server-side collection.

What happens server-side is also confirmed by the palant.info article that shows a graphic provided by a major data broker that shows exactly how they mis-use data collected by extensions under false pretenses.

It's far from speculation when there's both technical evidence collected by researchers and direct evidence provided by the bad actors themselves.

Re: Chrome extensions spying on users' browsing data

#194

Post by weird_tentacles »

gorhill wrote: post #173
lapcat wrote: post #85

Earlier quoted context omitted.

> The only extension I trust enough to install on any browser is uBlock Origin. Note however that the origin of uBlock Origin is that the developer Raymond Hill transferred control of the original uBlock project to someone who turned out not to be trustworthy, and thus Hill had to fork it later.

I never transferred the extension in the Chrome store. The Chrome store extension has always been the one from the repository I control, and I've had full control of it since when I created it back in June 2014.

Dude man, great respect for your work.

Re: Chrome extensions spying on users' browsing data

#195

Post by joquarky »

cachius wrote: post #191
singularfutur wrote: post #12

This is why I only run open source extensions that I can actually audit. uBlock Origin, SponsorBlock, the kind of tools where the code is available and the developer isn't anonymous. The Chrome Web Store is basically unregulated and Google doesn't care as long as they get their cut. Open source at least gives you a chance to see what you're installing before it starts exfiltrating your data to some server in a countr…

This is why it's so sad that Tampermonkey isn't open source. https://github.com/Tampermonkey/tampermonkey/discussions/173...

TM is capable of doing most of what other extensions do, so it's too bad it's not open source because the ecosystem is inherently transparent.

Re: Chrome extensions spying on users' browsing data

#197

Post by qcontinuum1 »

heavenlyfather wrote: post #161

@qcontinuum1 appreciate this kind of research. saw your other comments and you mentioned that the team's engineering resources are scarce + saw that at the bottom of the github repo that there are links to BTC address. curious to know: 1- how large your team is? and how long this research took? it is very thorough and knowing such a detail might encourage others to participate in a joint effort in performing this kin…

Thank you. We are very glad to see the discussion that the report has sparked and and also glad to see the feedback on it. It means a lot to us.

> 1- how large your team is? and how long this research took? it is very thorough and knowing such a detail might encourage others to participate in a joint effort in performing this kind of research

The group is not very large and it took a few months of non-continuous work.

> 2- if this kind of research is your primary focus?

At the moment it is not very clear if we will do followup on this topic or not as explained in different comment. At the moment yes, the group is new.

> 3- if there are other ways that financial support can be provided other than through xrp or btc?

No, at the moment. We would like to remain anonymous, at least for now.

Re: Chrome extensions spying on users' browsing data

#198

Post by dotancohen »

gnl wrote: post #72

Couple of quick thoughts on how to protect yourself from having a formerly trustworthy extension go rogue on you: - https://github.com/beaufortfrancois/extensions-update-notifi... And then you can do whatever you feel is an appropriate amount of research whenever a particularly privileged extension gets updated (check for transfer of ownership, etc.) - brave://flags/#brave-extension-network-blocking You can then crea…

  > Clone the GitHub repo, do a security audit with Claude Code, build from source, update manually
This is a great idea. Are there any deterministic tools to audit an extension codebase?

Re: Chrome extensions spying on users' browsing data

#199

Post by m4rtink »

pocksuppet wrote: post #138
m4rtink wrote: post #81

Earlier quoted context omitted.

If the RPM/deb comes from a Linux distribution then there is a good chance there is a separate maintainer and the binary package is always built from the source code by the distro. Also if the upstream developer goes malicious there is a good chance at least one of the distro maintainers will notice and both prevent the bad source code being built for the distro & notify others.

Browser extensions come from the Chrome/Firefox addon store, though and not through distros.

And maybe that's why we have the problem that is being discussed ? No third party that would audit and build extensions from source.

Re: Chrome extensions spying on users' browsing data

#200

Post by mixmastamyk »

lapcat wrote: post #164
mixmastamyk wrote: post #155

Earlier quoted context omitted.

Linux distros have a good reputation, browser extensions don’t. Might be simple as that.

It appears that you may have misunderstood the preceding discussion. Linux is open source and thus can be audited.

One might choose not to however, yet still audit their extensions.
Post reply on HN