Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome extensions spying on users' browsing data

qcontinuum.substack.com

Post reply on HN
Print view View original

211–215 of 215 posts

Re: Chrome extensions spying on users' browsing data

#211

Post by tremon »

Rygian wrote: post #188
deanc wrote: post #174

Earlier quoted context omitted.

I wouldn't find that fair at all. Bad actors should be legally responsible for their bad action. If I sell you a taxi business, and then all of a sudden you decide to start robbing the customers - it's not my fault is it? And just to be clear, I had no idea if my extension was used for nefarious purposes, but in hindsight it probably was.

Customers were sold[1] a lifetime subscription to Honest Guy's taxis, and then Honest Guy does a secret deed to sell his taxi joint to Bad Guy[2] without telling any customer about it. Then customers start getting ripped of in all manner of ways, that some of them would have known to avoid if they knew their taxis were being run by Bad Guy. [1] Of course, the issue here is that no contracts were signed. [2] In the sp…

Replace Honest Guy with local hospital or care home and bad guy with vulture capital, and you will find that this happens all too often; any time there's an established and captive audience, you will find vultures circling all around it.

At least there's invididual states actually responding to this malpractice: https://pestakeholder.org/reports/2025-state-healthcare-poli...

Re: Chrome extensions spying on users' browsing data

#213

Post by mickelsen »

I still use the Little Rat extension, it shows a little notification when an extension does a network request, and lets you see quickly what type and where. It can also block requests (doesn't seem to work all the time in Brave now, even with the flag on), activate and deactivate extensions:

https://github.com/dnakov/little-rat

There's also this site that I've used from time to time to audit extensions quickly:

https://chrome-stats.com/

Re: Chrome extensions spying on users' browsing data

#214

Post by notpushkin »

lapcat wrote: post #164
mixmastamyk wrote: post #155

Earlier quoted context omitted.

Linux distros have a good reputation, browser extensions don’t. Might be simple as that.

It appears that you may have misunderstood the preceding discussion. Linux is open source and thus can be audited.

One benefit that FOSS provides is that there’s more eyeballs on the source code, so yeah, it’s a very strong trust signal. But sometimes priorities are a bit different, and ultimately you need to trust something.

IMO it still makes sense to personally vet browser extensions and trust the OS/browser:

1. It’s hard to create a new operating system or browser, so we don’t see many new ones. (Not taking into account Firefox forks / Chromium reskins here.) For browser extensions, the entry barrier is much lower, and the chance that one of them will be malicious is higher.

2. It’s also much harder to audit all of Linux, or Firefox/Chromium, especially if you’re not too familiar with the domain. For browser extensions on the other hand, it’s usually possible to go through them in one night.

Re: Chrome extensions spying on users' browsing data

#215

Post by legitimate_key »

The concerning pattern is that the data-collecting ones actively hide what they're doing — the Similarweb-linked extensions apparently obfuscate with Base64 or AES-256 before sending.

Worth distinguishing from extensions that are genuinely client-side. A basic test: check the extension's manifest for network permissions (host_permissions). If it only requests the active tab and has no background network access, it physically cannot phone home. The inspection is 30 seconds in chrome://extensions.

The more insidious problem is that users can't easily distinguish between "this extension processes data locally" and "this extension processes data locally and also sends it somewhere." Same UI, very different behavior.

Post reply on HN