Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Massive spying on users of Google's Chrome shows new security weakness

reuters.com

Post reply on HN
Print view View original

231–240 of 270 posts

Re: Massive spying on users of Google's Chrome shows new security weakness

#231

Post by Crespyl »

matheusmoreira wrote: post #189
AareyBaba wrote: post #131

Earlier quoted context omitted.

What makes uBlock Origin a trustworthy extension ? because it is open-source ?

I monitor the issue tracker and explore the source code from time to time. The developer posts on HN and seems to be committed to the project and everything it stands for. I'm not sure if builds are reproducible though. I don't think the author would allow the extensions to be hijacked by malicious actors but it'd still be nice to be able to verify a packaged extension was built from a given git commit.

Reproducible builds for extensions is a good idea that I hadn't considered before.

Most browser extensions these days are just some JS zipped up with some metadata and maybe a few assets, right?

There might be trouble with minified JS, but I'd assume most optimizers/minifiers are either deterministic or could be configured that way.

Re: Massive spying on users of Google's Chrome shows new security weakness

#232

Post by sergeykish »

Drawde wrote: post #211
arminiusreturns wrote: post #133

Earlier quoted context omitted.

For those who like uBlock origin, you owe it to yourself to also checkout uMatrix. I use both.

Why not just use ublock origin in medium mode[0] (or hard mode[1] if you're so inclined)? [0] https://github.com/gorhill/uBlock/wiki/Blocking-mode:-medium... [1] https://github.com/gorhill/uBlock/wiki/Blocking-mode:-hard-m...

I find it easier to understand what application wants looking at numbers. And to toggle on 1st party cookies. My setup in between hard mode and nightmare:

    * * * block
    * * frame block
    * 1st-party css allow
    * 1st-party frame allow
    * 1st-party image allow

Re: Massive spying on users of Google's Chrome shows new security weakness

#233

Post by hnanon1 »

ThePhysicist wrote: post #7

There is a web intelligence company in Israel that is known to buy popular browser extensions like “Web of Trust” and use them to exfiltrate browsing data (with tons of sensitive and personal information). They have been called out for this several times already and some of their extensions got removed from the store, they invariably turn back up again after a few weeks though (good connections to Google/Mozilla I gu…

Thank you for taking the time to point this out to people who may not have known about these disgusting practices.

Re: Massive spying on users of Google's Chrome shows new security weakness

#234

Post by josefx »

dontblink wrote: post #19
0xy wrote: post #5

I wonder if these extensions are so hard to spot because spying is a core feature of Google Chrome, and most top extensions do this. For example, the extraordinarily popular extension Honey phones home about your purchases, shopping habits and other data without adequately disclosing that fact. It's hard to see why Google would care when Chrome was always a trojan horse to co-opt web standards for their own purposes…

Wow talk about revisionism! Chrome was meant as a hedge against IE and lesser so against Firefox. Microsoft owned the desktop with Windows and could easily shut Google out. See the reason surrounding the creation of the Google toolbar. Similarly Android is a hedge against IOS and mobile search.

> ! Chrome was meant as a hedge against IE and lesser so against Firefox.

IE was steadily loosing ground to Firefox years before Chrome came around. You want to claim that Google feared the half starved stepchild that was IE more than the add blocking enabled Firefox that was eating up market share left and right?

> Microsoft owned the desktop with Windows and could easily shut Google out.

How would building your own browser help with that? If Microsoft managed to build its walled garden (which it tried) it could have just shut Chrome out.

Chrome is already entering its planed end game: Adblock APIs are crippled and third party cookies get the boot while all Google properties get an additional x-client-data identifier to uniquely identify its user.

Re: Massive spying on users of Google's Chrome shows new security weakness

#235

Post by sergeykish »

ComodoHacker wrote: post #84

I see this as an argument in favor of native apps. I mean really native, not Electron-esque ones. As you more and more turn the browser into an OS, you have to treat it like an OS. Don't allow unprivileged user to install unsigned kernel modules.

Like virus ridden Windows applications or malware Android applications? Now as then it is community problem - someone has to review application. Unless obfuscated it is much simpler than native, otherwise mark it unsafe.

Re: Massive spying on users of Google's Chrome shows new security weakness

#236

Post by joshuamorton »

commoner wrote: post #176
joshuamorton wrote: post #96

Earlier quoted context omitted.

> we'll just get our stooges on social media to claim they're being paranoid Accusing people of being shills is a violation of the HN guidelines, please don't. > You do know the history of the name doubleclick, right? I honestly have no clue what you're implying here. > Now want to explain why a browser experiment or analytics domain whitelist includes an advertising surveillance domain? So that it can pass analytics…

You're a Google employee, and you're vociferously defending Google's use of a tracking header in Chrome. Others deserve to know your conflict of interest so that they can read your arguments in the right context.

I disclosed that in the comment this user was commenting in response to, before they commented. In other words, they accused me of shilling in reply to a comment where I openly and willingly clarified my relationship with Google.

It is possible to ask someone to, or disclose for someone, a conflict of interest, without breaking the HN guidelines. The comment did neither.

Re: Massive spying on users of Google's Chrome shows new security weakness

#237

Post by yjftsjthsd-h »

willvarfar wrote: post #177
IncRnd wrote: post #104

Earlier quoted context omitted.

In the same way that DNS requests can exfiltrate data, requesting URLs can also exfiltrate data. This is trivial to perform.

Why I specified "fixed URLs", to close that loophole

My fixed URLs are example.com/0 and example.com/1; I'm going to load them a lot, sometimes in different sequences.

Re: Massive spying on users of Google's Chrome shows new security weakness

#238

Post by joshuamorton »

pdkl95 wrote: post #200
joshuamorton wrote: post #105

Earlier quoted context omitted.

> Google is saying they are tracking people with that header No they don't. Nothing in your comment sounds anything like Google claiming to be tracking people. And as mentioned elsewhere in this thread, they explicitly claim to not be tracking individuals.

The only source I can find for that "explicit claim" seems to be from an emailed statement to (several?) journalists where they state: >> "The information included in this header reflects the variations, or new feature trials, in which an installation of Chrome is currently enrolled. [...] it is not used to identify or track individual users." I believe this statement is true . They are not using the X-Client-Data HT…

Using x and y to track individuals is still using x to track individuals.

> when the stated purpose of header is to create a new tracking identifier that accomplishes the same thing as a personally identifying identifier when you combine it with the other data that Google already tracks

This is not stated anywhere except by you. The stated purpose of the identifier is to track analytics around chrome experiments, and only that.

The tuple (IPv4 Address, User-Agent) is already unique for almost all, so why go to all the effort?

Re: Massive spying on users of Google's Chrome shows new security weakness

#240

Post by sergeykish »

A chain is only as strong as its weakest link:

* developer wants compensation

* browser gallery has no resources

* users has no time to audit

Why as a user of Linux distribution I feel safer than installing extension? I asked maintainers, they have no answer, they don't perform audit. What if push to the gallery and update automatically is bad idea?

I mean in Linux distribution maintainers pull updates, they test it and push to stable. Each distribution can block update, it makes sense for author and maintainers to easy update with reproducible builds, source version control. Distribution may audit application - it is much simpler than audit by each user. Distribution may patch application to its standards.

In theory authors and maintainers can be bought, in practice it is much harder. And by itself this reduces pressure.

So I believe gallery should be split to trusted and others. And browsers should allow alternative galleries. I have a few extensions I trust.

What do you think?

Post reply on HN