Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Massive spying on users of Google's Chrome shows new security weakness

reuters.com

Post reply on HN
Print view View original

211–220 of 270 posts

Re: Massive spying on users of Google's Chrome shows new security weakness

#211

Post by Drawde »

arminiusreturns wrote: post #133
matheusmoreira wrote: post #117

Earlier quoted context omitted.

The only trustworthy extensions are uBlock Origin and EFF's Privacy Badger. Everything else is best viewed as potential malware, no different than random downloadable executables. Honestly, uBlock Origin and Privacy Badger are so important at this point they should just become part of the browser itself. They're already in a league of their own.

For those who like uBlock origin, you owe it to yourself to also checkout uMatrix. I use both.

Why not just use ublock origin in medium mode[0] (or hard mode[1] if you're so inclined)?

[0]https://github.com/gorhill/uBlock/wiki/Blocking-mode:-medium...

[1]https://github.com/gorhill/uBlock/wiki/Blocking-mode:-hard-m...

Re: Massive spying on users of Google's Chrome shows new security weakness

#212

Post by sergeykish »

ThePhysicist wrote: post #198
sergeykish wrote: post #187

Earlier quoted context omitted.

I am outsider interested in this topic, it would be great if you provided some links. I've found Web of Trust addon [1] and its Privacy Policy [2]: > Automatically Collected Information > Internet Protocol Address (trimmed to permanently remove specific location information other than country, city & postal code); device type; operating system and browser; Search engine results page (keyword, order/index of results,…

Here's a talk from 33C3: https://media.ccc.de/v/33c3-8034-build_your_own_nsa The data under "web pages visited and time stamp of the visit" is your clickstream data (you can check which data the extension sends using the network tab in the extension developer tools, though some extensions go to great lenghts to obfuscate it).

Danke schön. Schade, aber mein Deutsch ist nicht so gut.

Most of the users live in Privacy Nightmare and accept it. They also run closed source OS and applications. The truth is privacy has a cost - monetary (Apple ecosystem) or time/experience (Linux etc).

Apple can hire maintainers, Linux users can become maintainers. Those who live in free as beer land has free as beer support.

Re: Massive spying on users of Google's Chrome shows new security weakness

#213

Post by kekebo »

ThePhysicist wrote: post #197
sergeykish wrote: post #183

Earlier quoted context omitted.

These are strong words. Mozilla is miles ahead of chrome with recommended extensions [1]: > Recommended extensions undergo full code review by staff security experts to provide a strong additional security check. It has a list of blocked addons [2]. And I believe that is Chrome who turned addons into Wild West, Mozilla had a long review process [3]. [1] https://blog.mozilla.org/firefox/firefox-recommended-extensi...…

It's still so easy in Firefox to install add-ons that spy on your entire browser session and send tons of telemetry data to a backend (Ghostery is a popular example) while the user has no clue that any kind of data transfer even happens. Such behavior shouldn't be something that can be turned on with two clicks.

Ghostery is even a recommended Addon on AMO [1].

What would really be practical were some kind of extension analyzer/profiler that runs newly installed addons in a sandbox and displays attempted connections and payloads. Or a mode where connections need to be whitelisted, to limit the impact of silent addon takeovers.

Too many times I find myself having to download, unpack, and skim through an addon's source to make sure it's not doing anything malicious under the hood.

[1] https://addons.mozilla.org/en-US/firefox/addon/ghostery/

Re: Massive spying on users of Google's Chrome shows new security weakness

#214

Post by sergeykish »

criley2 wrote: post #201
sergeykish wrote: post #183

Earlier quoted context omitted.

These are strong words. Mozilla is miles ahead of chrome with recommended extensions [1]: > Recommended extensions undergo full code review by staff security experts to provide a strong additional security check. It has a list of blocked addons [2]. And I believe that is Chrome who turned addons into Wild West, Mozilla had a long review process [3]. [1] https://blog.mozilla.org/firefox/firefox-recommended-extensi...…

1. "Recommended" extensions are a subset of all extensions, so to narrow the comparison from "Extensions" to "A limited subset" feels dishonest. Not all Firefox extensions are Recommended. 2. Firefox took years and years to lock down extensions like Chrome, and people were legitimately upset that they turned extensions into basically privileged webpages in the name of security. They used to be more like software. It…

1. I just said it is good if at least subset can be trusted. It would be nice to have such feature in Chrome.

2. Sorry, could you please make your point clear (edit)? Firefox third party extensions used to access internal constructs. I think most of what is Firefox on top of Gecko is privileged extensions.

3. Yes, Firefox had addons with review process.

Re: Massive spying on users of Google's Chrome shows new security weakness

#215

Post by Klathmon »

raxxorrax wrote: post #206
imrelaxed wrote: post #184

Earlier quoted context omitted.

It would be awesome if there was a volunteer financed code review group to review popular open source projects. I think I’m not the only one who would happily donate money to such a group for code reviews for various OSS projects. Initial code reviews would require a lot of effort, unless somehow automated, but after that it would be fairly easy to monitor and verify updates and changes to the code.

Would be good training for apprentices too. Reading code is probably one of the best ways to learn. Granted, it could include a sophisticated and obfuscated backdoor, but I think it would still be caught.

I wouldn't be so sure that it's an inevitability that things would be caught.

The "underhanded C contest" [1] is a good example of this and something I like to point people to. From their about page:

>The Underhanded C Contest is an annual contest to write innocent-looking C code implementing malicious behavior. In this contest you must write C code that is as readable, clear, innocent and straightforward as possible, and yet it must fail to perform at its apparent function. To be more specific, it should perform some specific underhanded task that will not be detected by examining the source code.

If you go look around the hall of fame on that site, or just take a look at the contest winners, it's absolutely insane how subtle some of those exploits are. And shockingly (to me anyway) many of the exploits don't require C or use some quirk of C, they would work in many different languages, the first contest winner is a perfect example of that [2].

I can honestly say that for some of them, even if you told me there was an exploit in the code, I wouldn't be able to find them on my own.

And the scariest part is that almost all of the submissions to that contest have plausible deniability. They look like innocent bugs, typos, or small logic mistakes. Some even layer multiple small subtle changes which each on their own are completely fine but when all run together reveal big exploits.

[1] http://underhanded-c.org/

[2] http://underhanded-c.org/_page_id_14.html

Re: Massive spying on users of Google's Chrome shows new security weakness

#216

Post by fulafel »

jedieaston wrote: post #194
fulafel wrote: post #34

Earlier quoted context omitted.

Re security measures: these features have sadly been put under "enterprise" stuff but they are there: https://support.google.com/chrome/a/answer/9296680?hl=en I wonder if there could be a community pseudo-enterprise that could eg have a reasonable whitelist of extensions... edit: whoops, that was a windows-only guide despite the title, here are linux / mac links: https://support.google.com/chrome/a/answer/7517525#per…

Chrome Enterprise is free (it’s just a zipped file with GPOs and the MSI installer for Chrome). These policies should apply on the Chrome you already have.

Sure, but there's no reasonable UI, just meant to be configured by a company's IT grunts poking json config files or wielding regedit on windows.

Re: Massive spying on users of Google's Chrome shows new security weakness

#217

Post by jcranmer »

aembleton wrote: post #154
fabian2k wrote: post #17

Potentially dumb question here, but would it be generally possible to create a permissions system for browser extensions that can distinguish between an extension that is actually sending information based on sensitive sources like page content and browser history and an extension that only sends harmless stuff over the network like e.g. asking for updated ad block lists? I'm imagining something like a sufficiently a…

> asking for updated ad block lists You could only allow GET requests and require the user to whitelist this the first time the extension does it. Subsequent calls to the same blocklist would go through without a user prompt, but if it suddenly started trying to send your email address or some other param, it would stand out.

A trivial way way to get around that:

Make calls to two seemingly benign requests early on. Now you can send whatever data you want to without triggering another prompt by successively requesting the first resource to indicate a '0' and the second resource to indicate a '1'.

Re: Massive spying on users of Google's Chrome shows new security weakness

#218

Post by sergeykish »

ThePhysicist wrote: post #197
sergeykish wrote: post #183

Earlier quoted context omitted.

These are strong words. Mozilla is miles ahead of chrome with recommended extensions [1]: > Recommended extensions undergo full code review by staff security experts to provide a strong additional security check. It has a list of blocked addons [2]. And I believe that is Chrome who turned addons into Wild West, Mozilla had a long review process [3]. [1] https://blog.mozilla.org/firefox/firefox-recommended-extensi...…

It's still so easy in Firefox to install add-ons that spy on your entire browser session and send tons of telemetry data to a backend (Ghostery is a popular example) while the user has no clue that any kind of data transfer even happens. Such behavior shouldn't be something that can be turned on with two clicks.

Privacy Policy [1]:

> Human Web

> ... turned on by default

> Data Collection: In order for Human Web to function we automatically collect non-private URLs, search queries along with search engine results pages, suspicious URLs that could potentially be phishing websites, information related to safe and unsafe trackers, and information related to the prevalence and performance of Trackers.

So opt out data collection, I thought better of Recommend Extensions. They really should use leverage to make safe defaults and forbid dark patters.

[1] https://addons.mozilla.org/en-US/firefox/addon/ghostery/priv...

Re: Massive spying on users of Google's Chrome shows new security weakness

#219

Post by michaelbazos »

matheusmoreira wrote: post #117
ThePhysicist wrote: post #7

There is a web intelligence company in Israel that is known to buy popular browser extensions like “Web of Trust” and use them to exfiltrate browsing data (with tons of sensitive and personal information). They have been called out for this several times already and some of their extensions got removed from the store, they invariably turn back up again after a few weeks though (good connections to Google/Mozilla I gu…

The only trustworthy extensions are uBlock Origin and EFF's Privacy Badger. Everything else is best viewed as potential malware, no different than random downloadable executables. Honestly, uBlock Origin and Privacy Badger are so important at this point they should just become part of the browser itself. They're already in a league of their own.

There are often other extensions that we find too precious to delete them, however we need them only at specific occasions. For those, I came up with a “meta-extension” to easily disable or enable them:

https://chrome.google.com/webstore/detail/extension-manager/...

Re: Massive spying on users of Google's Chrome shows new security weakness

#220

Post by voicedYoda »

dhimes wrote: post #205
imrelaxed wrote: post #184

Earlier quoted context omitted.

It would be awesome if there was a volunteer financed code review group to review popular open source projects. I think I’m not the only one who would happily donate money to such a group for code reviews for various OSS projects. Initial code reviews would require a lot of effort, unless somehow automated, but after that it would be fairly easy to monitor and verify updates and changes to the code.

I wonder if EFF or somebody could issue a "verified" badge that apps could apply for, with a small fee to finance the devs doing the audits?

I love this idea and could get behind contributing.
Post reply on HN