Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Massive spying on users of Google's Chrome shows new security weakness

reuters.com

Post reply on HN
Print view View original

201–210 of 270 posts

Re: Massive spying on users of Google's Chrome shows new security weakness

#201

Post by criley2 »

sergeykish wrote: post #183
ThePhysicist wrote: post #7

There is a web intelligence company in Israel that is known to buy popular browser extensions like “Web of Trust” and use them to exfiltrate browsing data (with tons of sensitive and personal information). They have been called out for this several times already and some of their extensions got removed from the store, they invariably turn back up again after a few weeks though (good connections to Google/Mozilla I gu…

These are strong words. Mozilla is miles ahead of chrome with recommended extensions [1]: > Recommended extensions undergo full code review by staff security experts to provide a strong additional security check. It has a list of blocked addons [2]. And I believe that is Chrome who turned addons into Wild West, Mozilla had a long review process [3]. [1] https://blog.mozilla.org/firefox/firefox-recommended-extensi...…

1. "Recommended" extensions are a subset of all extensions, so to narrow the comparison from "Extensions" to "A limited subset" feels dishonest. Not all Firefox extensions are Recommended.

2. Firefox took years and years to lock down extensions like Chrome, and people were legitimately upset that they turned extensions into basically privileged webpages in the name of security. They used to be more like software. It wasn't until what 2017 or 2018 that Firefox truly took security seriously and stopped letting extensions run application code.

3. Chrome didn't turn extensions into the 'wild west'! For the record, Firefox 3.0 had "Add-ons" in 2008 a few months before Google released Chrome 1.0!

Re: Massive spying on users of Google's Chrome shows new security weakness

#203

Post by raxxorrax »

AareyBaba wrote: post #131
matheusmoreira wrote: post #117

Earlier quoted context omitted.

The only trustworthy extensions are uBlock Origin and EFF's Privacy Badger. Everything else is best viewed as potential malware, no different than random downloadable executables. Honestly, uBlock Origin and Privacy Badger are so important at this point they should just become part of the browser itself. They're already in a league of their own.

What makes uBlock Origin a trustworthy extension ? because it is open-source ?

There could always be more trust. But if you compare it to browsers from ad companies...

Re: Massive spying on users of Google's Chrome shows new security weakness

#204

Post by gorhill »

willvarfar wrote: post #89
ThePhysicist wrote: post #7

There is a web intelligence company in Israel that is known to buy popular browser extensions like “Web of Trust” and use them to exfiltrate browsing data (with tons of sensitive and personal information). They have been called out for this several times already and some of their extensions got removed from the store, they invariably turn back up again after a few weeks though (good connections to Google/Mozilla I gu…

Could browser extensions be ran in a sandbox, with read_access to the page, but only able to read from whitelisted registered and fixed URLs for updating configuration etc? So your blocking extension can download lists of things to block, or other config, but it can't exfiltrate any information about the user's browsing habits. The only side channel I can then think of is using page rewriting or timing to communicate…

It's a similar idea I shared with Moz people last year when asked about how privacy concerns raised in manifest v3 could be addressed, I quote myself:

===

> The host permission in current extension framework does not distinguish between accessing all the data and connecting to any remote server.

>

> The key issue I see is that it also allows uBO to connect to any remote server. I think it would help a lot to have a _separate_ permission for remote server access, since this is the key privacy issue here: user data leaving the browser to be collected by a remote server.

>

> So what about a new permission specifically dedicated to specify where an extension is allowed to connect? Without this permission, an extension wouldn't be allowed to connect to a remote server, i.e. unable to leak user data.

===

As a mental framework, I consider the ability to see the URL of all requests or all the DOM to be a read operation, while extensions making requests to remote server (directly or indirectly) is a write operation (to the wide internet). The latter is where the real privacy concerns are, and this is what should be tackled in some manner. I don't see manifest v3 addressing this[1].

* * *

[1] https://www.eff.org/deeplinks/2019/07/googles-plans-chrome-e...

Re: Massive spying on users of Google's Chrome shows new security weakness

#205

Post by dhimes »

imrelaxed wrote: post #184
AareyBaba wrote: post #139

Earlier quoted context omitted.

How many people are looking at the code ? The github commits show only one active contributor. I use uBlock Origin myself but I sometimes question the faith we place on open-source. We assume someone else is looking at the code.

It would be awesome if there was a volunteer financed code review group to review popular open source projects. I think I’m not the only one who would happily donate money to such a group for code reviews for various OSS projects. Initial code reviews would require a lot of effort, unless somehow automated, but after that it would be fairly easy to monitor and verify updates and changes to the code.

I wonder if EFF or somebody could issue a "verified" badge that apps could apply for, with a small fee to finance the devs doing the audits?

Re: Massive spying on users of Google's Chrome shows new security weakness

#206

Post by raxxorrax »

imrelaxed wrote: post #184
AareyBaba wrote: post #139

Earlier quoted context omitted.

How many people are looking at the code ? The github commits show only one active contributor. I use uBlock Origin myself but I sometimes question the faith we place on open-source. We assume someone else is looking at the code.

It would be awesome if there was a volunteer financed code review group to review popular open source projects. I think I’m not the only one who would happily donate money to such a group for code reviews for various OSS projects. Initial code reviews would require a lot of effort, unless somehow automated, but after that it would be fairly easy to monitor and verify updates and changes to the code.

Would be good training for apprentices too. Reading code is probably one of the best ways to learn. Granted, it could include a sophisticated and obfuscated backdoor, but I think it would still be caught.

Re: Massive spying on users of Google's Chrome shows new security weakness

#208

Post by itsRetarded »

That really tries to fit into the same model, and fails.

Almost every browser extension operation is this scrub non-entity, some blowjob hack loser that's drinking from a fountain of fly-by-night accidental success, and 99% would sell you up the river if only they could.

Re: Massive spying on users of Google's Chrome shows new security weakness

#209

Post by matheusmoreira »

vbezhenar wrote: post #140
chii wrote: post #126

Earlier quoted context omitted.

and that is why they will eventually be removed one way or another imo.

AFAIK Chrome will change ad blocking API and uBlock Origin won't follow it. So switch to Firefox.

These API changes are actually perfectly reasonable. The new API lets extensions tell the browser what to do to the page in a declarative manner. This eliminates the need to pass private user data to the extension code and reduces the potential for abuse. This is a massive improvement compared to just letting random extensions see everything on the page.

uBlock Origin just happens to be so important and trusted by the community that it shouldn't be subjected to these restrictions. It's a special case.

Re: Massive spying on users of Google's Chrome shows new security weakness

#210

Post by raxxorrax »

zelly wrote: post #159
ThePhysicist wrote: post #7

There is a web intelligence company in Israel that is known to buy popular browser extensions like “Web of Trust” and use them to exfiltrate browsing data (with tons of sensitive and personal information). They have been called out for this several times already and some of their extensions got removed from the store, they invariably turn back up again after a few weeks though (good connections to Google/Mozilla I gu…

I hope we don't get even more locked down permissions for Web Extensions. I would prefer that the Chrome Web Store manually vets every extension and update. Maybe start charging big $$$ like Apple does. Most extensions will disappear from the stores, but they won't disappear from all existence (as changing the permissions model would effectively do). Power users who could vet the extension themselves can install exte…

I hope we don't get access controlled software from large developers. Mobile OS sway me pretty quickly to say 'no' to that. Maybe supply users with curated software, but I think the store model failed spectacularly. They contain more crap than a malicious website could ever hope to supply.
Post reply on HN