31–40 of 124 posts
Since Chrome auto-updates extensions, users are likely not aware of this change. I've been using the extension for several months until I noticed the transparent redirection. In fact, the only reason I noticed the redirect is when it failed. I clicked on a Google search result and got stuck on a blank page like this: http://ecolink3.ecosia.org/?key=3cdcd4dc082e3c7b860abe4608b6925d&out=http%3A%2F%2Fwww.usatoday.com%2F…
How do you disable this?
Since Chrome auto-updates extensions, users are likely not aware of this change. I've been using the extension for several months until I noticed the transparent redirection. In fact, the only reason I noticed the redirect is when it failed. I clicked on a Google search result and got stuck on a blank page like this: http://ecolink3.ecosia.org/?key=3cdcd4dc082e3c7b860abe4608b6925d&out=http%3A%2F%2Fwww.usatoday.com%2F…
> Since Chrome auto-updates extensions How do you disable this?
Whoa, wait. One guy in this thread is claiming that Window Resizer was sending all your keystrokes back to a central server based on what he saw in Wireshark. Can anyone else verify this? I've had this extension installed for...a year, at least. Do I need to now go change every single password on every site because chances are it's been keylogged? This is insane.
The developer also seems to claim that the keylogger exists as well. If you want to take his word for it as well.
Since Chrome auto-updates extensions, users are likely not aware of this change. I've been using the extension for several months until I noticed the transparent redirection. In fact, the only reason I noticed the redirect is when it failed. I clicked on a Google search result and got stuck on a blank page like this: http://ecolink3.ecosia.org/?key=3cdcd4dc082e3c7b860abe4608b6925d&out=http%3A%2F%2Fwww.usatoday.com%2F…
> Since Chrome auto-updates extensions How do you disable this?
Which pops up a toast notification whenever an extension gets updated so you can investigate (Chrome doesn't force changelogs on updates either so you might have to dig deeper into the code).
If you don't mind having another extension which could be doing nefarious things.
Earlier quoted context omitted.
> Since Chrome auto-updates extensions How do you disable this?
Not sure if you can or not, but you can use this: https://chrome.google.com/webstore/detail/extensions-update-... Which pops up a toast notification whenever an extension gets updated so you can investigate (Chrome doesn't force changelogs on updates either so you might have to dig deeper into the code). If you don't mind having another extension which could be doing nefarious things.
[Rant: the whole concept of auto-update-by-default is stupid. /Rant]
Earlier quoted context omitted.
The developer also seems to claim that the keylogger exists as well. If you want to take his word for it as well.
I just can't even fathom. Like, every email I've typed. Every interaction with any site. Credit card numbers. How is this not entirely illegal? And it certainly shows an incredible flaw in Chrome extensions. This extension didn't do this when I installed it. A silent auto-update though basically turned it into the worst malware I've ever had installed on my computer. How can any Chrome extension ever be trusted? Furt…
Unfortunately this is simply a byproduct of the web's (and browsers') botched security model; there is no way to allow extensions to modify pages without them being able to read the pages, and if they can read the pages they naturally can catch events, including keystrokes.
This is why you should think - hard - whenever allowing any extension with that permission. It could autoupdate at any time to include malware.
There are a lot of bad extensions out there. I've encountered quite a few. It's a wide-open vector for exploitation and it happens all the time. Just last month I came across a game extension (super mario clone) that contained jQuery. Upon further inspection, it turned out it had been re-minified (making diffs difficult) and had a few lines deep inside that hijacked ads and replaced them with the author's ad network. Silent, effective, and this extension was on the 'top lists' for months. It might even still be there.
Be very aware of the permissions an extension asks for.
The extension hasn't existed on the chrome app store for months. Why is this news on HN now? It wasnt malware either, it was ecolinks garbage for google search results that you could opt-out of.
Does anyone know if the Chrome Remote Desktop extension would have been impacted by the keylogging?
Earlier quoted context omitted.
a hell of a lot of chrome extensions inject adverts and other tracking code into websites you visit, like Facebook and youtube. would you class those extensions as malware as well?
I would. Why wouldn't you?
Earlier quoted context omitted.
The developer also seems to claim that the keylogger exists as well. If you want to take his word for it as well.
What are Chrome extensions written in? I don't use Chrome but if it's JS then it wouldn't be difficult to verify these claims.
https://chrome.google.com/webstore/detail/read-later-fast/de...