Chrome extensions spying on users' browsing data • Hacker News Board

Re: Chrome extensions spying on users' browsing data

#201

Post by no-name-here » Thu, Feb 12, 2026, 4:03 AM UTC

gnl wrote: post #72

Couple of quick thoughts on how to protect yourself from having a formerly trustworthy extension go rogue on you: - https://github.com/beaufortfrancois/extensions-update-notifi... And then you can do whatever you feel is an appropriate amount of research whenever a particularly privileged extension gets updated (check for transfer of ownership, etc.) - brave://flags/#brave-extension-network-blocking You can then crea…

> Clone the GitHub repo, … build from source, update manually

I’d be ok to do that once per extension, but then I’ve got multiple PCs (m), multiple browser profiles (p), OS-reimages (r), and each extension (e) locally installed doesn’t sync — manually re-installing local extensions m x p x r x e times is too much for me. :-( (And that’s even if I’m only running Chrome, as opposed to multiple browser or Chromium derivatives.)

Re: Chrome extensions spying on users' browsing data

#202

Post by dragonmost » Thu, Feb 12, 2026, 5:19 AM UTC

Chris2048 wrote: post #177

Rygian wrote: post #150

Earlier quoted context omitted.

While assuming absolutely zero bad will on your part, I would nevertheless find it fair if you were legally on the hook for whatever happened after the sale, unless you could prove that you provided reasonable means for the users of your extension to perform their due diligence on the new owner of the extension. This is of course easy to say in hindsight, and is absolutely a requirement that should be enforced by the…

No, how it should work is each extension is associated with a private key that is registered with a specific individual or legal entity and implies some kind of liability for anything signed with that key - and if/when the key changes (or the associated credentials), users will be explicitely alerted and need to re-authenticate the plugin. If the old owner gives their key to the new owner, then they should be on the…

How does this safe guards against having the extension under a company and selling that company off. Still the same entity, different owners, different "incentives".

Re: Chrome extensions spying on users' browsing data

#203

Post by Chris2048 » Thu, Feb 12, 2026, 6:50 AM UTC

dragonmost wrote: post #202

Chris2048 wrote: post #177

Earlier quoted context omitted.

No, how it should work is each extension is associated with a private key that is registered with a specific individual or legal entity and implies some kind of liability for anything signed with that key - and if/when the key changes (or the associated credentials), users will be explicitely alerted and need to re-authenticate the plugin. If the old owner gives their key to the new owner, then they should be on the…

How does this safe guards against having the extension under a company and selling that company off. Still the same entity, different owners, different "incentives".

Assuming the new owner is a director of the new company, they are now liable. Or possibly the previous owner, if they handed over the key as an asset.

Re: Chrome extensions spying on users' browsing data

#204

Post by deanc » Thu, Feb 12, 2026, 8:37 AM UTC

Rygian wrote: post #188

deanc wrote: post #174

Earlier quoted context omitted.

I wouldn't find that fair at all. Bad actors should be legally responsible for their bad action. If I sell you a taxi business, and then all of a sudden you decide to start robbing the customers - it's not my fault is it? And just to be clear, I had no idea if my extension was used for nefarious purposes, but in hindsight it probably was.

Customers were sold[1] a lifetime subscription to Honest Guy's taxis, and then Honest Guy does a secret deed to sell his taxi joint to Bad Guy[2] without telling any customer about it. Then customers start getting ripped of in all manner of ways, that some of them would have known to avoid if they knew their taxis were being run by Bad Guy. [1] Of course, the issue here is that no contracts were signed. [2] In the sp…

What is fair and what is legal are very different concepts. I agree in principle with what you're saying but there is no legal basis for it - as you recognise.

Re: Chrome extensions spying on users' browsing data

#205

Post by Cipater » Thu, Feb 12, 2026, 8:53 AM UTC

mcjiggerlog wrote: post #6

matheusmoreira wrote: post #4

And the ones that are not will probably get bought out at some point and become malware as well. The only extension I trust enough to install on any browser is uBlock Origin.

I have published an extension [1] that has 100k+ users and I've probably received hundreds of emails over the years asking me to sell out in one way or another. It's honestly relentless. For that reason I also only trust uBlock Origin, Bitwarden and my own extensions. I'd also note that all this spam is via the public email address you're forced to add to your extension listing by Google. I don't think I've ever had…

Thank you so much for making and maintaining this extension.

Know that you are truly appreciated by many.

Re: Chrome extensions spying on users' browsing data

#206

Post by LtWorf » Thu, Feb 12, 2026, 8:57 AM UTC

elashri wrote: post #66

jakub_g wrote: post #36

Earlier quoted context omitted.

Actually, npm supports "provenance" and as it eliminated long lived access tokens for publishing, it encourages people to use "trusted publishing" which over time should make majority of packages be auto-provenance-vefified. https://docs.npmjs.com/trusted-publishers#automatic-provenan...

pypi also added this last year [1] and encouraging people to use trusted publishing as well. [1] https://docs.pypi.org/trusted-publishers/

If the build doesn't happen without network access, it doesn't really work.

Re: Chrome extensions spying on users' browsing data

#207

Post by LtWorf » Thu, Feb 12, 2026, 9:00 AM UTC

m4rtink wrote: post #199

pocksuppet wrote: post #138

Earlier quoted context omitted.

Browser extensions come from the Chrome/Firefox addon store, though and not through distros.

And maybe that's why we have the problem that is being discussed ? No third party that would audit and build extensions from source.

Everybody seems to hate distributions though.

Re: Chrome extensions spying on users' browsing data

#208

Post by __alexs » Thu, Feb 12, 2026, 9:02 AM UTC

abenga wrote: post #71

__alexs wrote: post #61

Earlier quoted context omitted.

My car can't login to my bank account.

Your car and fellow road users' cars generally have your life, your passengers' lives, and other road users' lives in its hands while in use.

My car probably could be hacked to murder me in secret but frankly I'm not worth expending that kind of access on.

The threat model is really very different.

Re: Chrome extensions spying on users' browsing data

#209

Post by gnl » Thu, Feb 12, 2026, 10:30 AM UTC

no-name-here wrote: post #201

gnl wrote: post #72

Couple of quick thoughts on how to protect yourself from having a formerly trustworthy extension go rogue on you: - https://github.com/beaufortfrancois/extensions-update-notifi... And then you can do whatever you feel is an appropriate amount of research whenever a particularly privileged extension gets updated (check for transfer of ownership, etc.) - brave://flags/#brave-extension-network-blocking You can then crea…

> Clone the GitHub repo, … build from source, update manually I’d be ok to do that once per extension, but then I’ve got multiple PCs (m), multiple browser profiles (p), OS-reimages (r), and each extension (e) locally installed doesn’t sync — manually re-installing local extensions m x p x r x e times is too much for me. :-( (And that’s even if I’m only running Chrome, as opposed to multiple browser or Chromium deriv…

Yeah that one's too much for me too, I used to do this years ago, but not anymore. Especially since I found out Brave supports network blocking for extensions, which is something you generally set up once and then forget about it. I'm just giving people tools and ideas I didn't see mentioned elsewhere in the comments, it's up to everyone to figure out their particular threat scenarios and tradeoffs individually.

This could probably be automated though if someone wanted to tackle it. git pull, agentic code review, auto-build from source, install.

Re: Chrome extensions spying on users' browsing data

#210

Post by gnl » Thu, Feb 12, 2026, 10:37 AM UTC

dotancohen wrote: post #198

gnl wrote: post #72

Couple of quick thoughts on how to protect yourself from having a formerly trustworthy extension go rogue on you: - https://github.com/beaufortfrancois/extensions-update-notifi... And then you can do whatever you feel is an appropriate amount of research whenever a particularly privileged extension gets updated (check for transfer of ownership, etc.) - brave://flags/#brave-extension-network-blocking You can then crea…

> Clone the GitHub repo, do a security audit with Claude Code, build from source, update manually This is a great idea. Are there any deterministic tools to audit an extension codebase?

I don't know, but if there were, I wouldn't expect them to do anywhere near as good a job or – perhaps somewhat counterintuitively – be anywhere near as reliable. Static rules only go so far when it comes to this stuff. And assuming that you're starting from a trustworthy base, and Claude Code (or similar) can focus its attention on recent changes to the repo in particular, I imagine sneaking actual malware in there would be pretty hard without throwing up a bunch of red flags.