Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Stylish” browser extension steals all your internet history

robertheaton.com

Post reply on HN
Print view View original

31–40 of 161 posts

Re: “Stylish” browser extension steals all your internet history

#31

Post by mirimir »

ssivark wrote: post #6

Most browser extensions seem to require access to one's browsing history and keystrokes, even for legitimate functioning. Is there any way to ensure that they do only what they claim to do, and don't abuse the permissions? (Apart from verifying the source code, because clearly, lines of junk code >> interested eyeballs). For example, would it be reasonable to enforce that an extension only acts locally, and cannot co…

Does NoScript detect connections by other add-ons to remote servers?

I do see in https://noscript.net/faq

> ... Firefox extensions are written in JavaScript too and NoScript doesn't block scripts living outside web pages (i.e. the browser components, included extensions) ...

Re: “Stylish” browser extension steals all your internet history

#32

Post by spookyuser »

kawera wrote: post #14
lifthrasiir wrote: post #2

tl;dr: Use Stylus [1]. Use Stylus. Use Stylus. I guess there should be an addon that notifies users for any ownership changes to browser addons they use. Or is there? [1] https://github.com/openstyles/stylus

This extension disables any updated extension that requires new permissions, among other niceties: https://chrome.google.com/webstore/detail/extensions-update-... (I'm only a user)

I thought chrome did this automatically now.

Re: “Stylish” browser extension steals all your internet history

#33

Post by fabricexpert »

mcjiggerlog wrote: post #18

This is a huge problem for the extension ecosystem in general. Who originally publishes an extension may not be the same entity that is pushing you updates in two years time, and there's no way as a user to know this. I publish a few extensions [1] [2] [3] and have been contacted multiple times by companies asking to buy them for several thousand dollars. They told me the going rate was 0.20 USD per user. You can ima…

I also have been contacted many times, and offered 1-3k for an extension I have with about 15k users.

The extension has a backend API and web service which is required for the extension to work, not once has a buyer asked about acquiring that. They only want the extension and literally have no understanding of how it works or what it does. Their intent is obvious.

Re: “Stylish” browser extension steals all your internet history

#36

Post by fabricexpert »

mcjiggerlog wrote: post #22
akerro wrote: post #21

Dont google and mozilla review source code of addons?

Mozilla yes - there's a delay when publishing whilst an actual human reviews the changes. For Google, updates are instantly published with, as far as I can tell, no kind of audit.

The Mozilla one is great, they insist on reproducible builds and do a thorough review. Although they can't catch everything, I would pick FF over Chrome all day for this reason alone.

Re: “Stylish” browser extension steals all your internet history

#38

Post by nailer »

izacus wrote: post #15
dannyw wrote: post #12

Google needs to take action here. From requiring re-confirming permissions every time a significant privacy policy change is made, or just by nuking SimilarWeb altogether from the web App Store.

I can already see the followup HN news: "Google attacking developers on Chrome Web Store and breaking free web!"

Yeah one thing Google doesn't do is collect info about what you do on the internet and sell it to other people.

https://myactivity.google.com/myactivity

More seriously: if Stylish concerns you, Chrome should too.

Re: “Stylish” browser extension steals all your internet history

#39

Post by HelenePhisher »

Tampermonkey seems to be a good alternative as well and is available for all major browsers.

Does anyone have information on if the Safari Stylish Addon does the same shady things? It's available in the official App Store and was approved by Apple it seems.

Re: “Stylish” browser extension steals all your internet history

#40

Post by mmsimanga »

lifthrasiir wrote: post #2

tl;dr: Use Stylus [1]. Use Stylus. Use Stylus. I guess there should be an addon that notifies users for any ownership changes to browser addons they use. Or is there? [1] https://github.com/openstyles/stylus

Firefox lets you know when addon changes permission between versions. You are prompted to accept the new permissions before upgrading the addon. This has been helpful in weeding out addons that become too data hungry.
Post reply on HN