There is a web intelligence company in Israel that is known to buy popular browser extensions like “Web of Trust” and use them to exfiltrate browsing data (with tons of sensitive and personal information). They have been called out for this several times already and some of their extensions got removed from the store, they invariably turn back up again after a few weeks though (good connections to Google/Mozilla I gu…
Why is this business model usually from Israel?
Because historically Israel heavy uses blackmail as a foreign policy tool.
There is a web intelligence company in Israel that is known to buy popular browser extensions like “Web of Trust” and use them to exfiltrate browsing data (with tons of sensitive and personal information). They have been called out for this several times already and some of their extensions got removed from the store, they invariably turn back up again after a few weeks though (good connections to Google/Mozilla I gu…
Why is this business model usually from Israel?
Probably more relaxed attitudes towards intelligence work, because of history.
There is a web intelligence company in Israel that is known to buy popular browser extensions like “Web of Trust” and use them to exfiltrate browsing data (with tons of sensitive and personal information). They have been called out for this several times already and some of their extensions got removed from the store, they invariably turn back up again after a few weeks though (good connections to Google/Mozilla I gu…
I'd say most such issues with extensions could be solved if they were "read-only", i.e. were prevented from inserting data into documents, making or adding data into outbound requests.
Kind of, but you can still leak a lot of information in a simple read-only GET
GET /realylongstringwithmeaningfulbits/{user identifier}
This is basically what tracking pixels have been doing for years (1x1 transparent PNG).
I wonder if these extensions are so hard to spot because spying is a core feature of Google Chrome, and most top extensions do this. For example, the extraordinarily popular extension Honey phones home about your purchases, shopping habits and other data without adequately disclosing that fact. It's hard to see why Google would care when Chrome was always a trojan horse to co-opt web standards for their own purposes…
Wow talk about revisionism! Chrome was meant as a hedge against IE and lesser so against Firefox. Microsoft owned the desktop with Windows and could easily shut Google out. See the reason surrounding the creation of the Google toolbar. Similarly Android is a hedge against IOS and mobile search.
Yes and no. If Google only wanted to hedge against IE they could have just contributed to Mozilla/Firefox. They clearly also wanted total control.
Wow talk about revisionism! Chrome was meant as a hedge against IE and lesser so against Firefox. Microsoft owned the desktop with Windows and could easily shut Google out. See the reason surrounding the creation of the Google toolbar. Similarly Android is a hedge against IOS and mobile search.
IE had bad standards support and bad defaults, while Chrome will actively track you on practically every site by sending an identifier to a whitelist including DoubleClick. Would you be defending it if it was called "DoubleClick Browser"? Google wants to secure the status quo with their own browser. What is the status quo? Massive spying, surveillance and tracking. This is why Safari and Firefox implemented strict me…
You claimed:
> Chrome was always a trojan horse to co-opt web standards for their own purposes
That wasn't the case. Google was concerned about Microsoft's ability to lock them out, and the lack of high quality browsers on non-Windows platforms.
The other side of this is the many complaints in HN threads about restrictions on what extensions can do and which ones are allowed. I can't say whether chrome's extension library strikes the right balance, but I think it's a difficult tradeoff.
Instead of just outright limiting extensions you could give users the choice. Give us an option to make it impossible for extensions to send out data for example.
Exactly. What Chrome and Firefox should do, is bundle their own analytics program into the extensions program, make these analytics available via AMO or Chrome Web Store (already has a very basic version), and remove the ability for extensions to perform outgoing network requests unless the user explicitly whitelists the extension. Even then, show big scary warnings about extensions given this permission being able to steal your bank passwords, just to keep the less tech-savvy informed.
At this point, I treat Chrome like a Huawei phone: never secure and only to be used at work for those sweet sweet dev tools.
Same here. Also never used any browser extension. Web devs need the pure browser experience.
The cumulative total hours wasted from all the Devs that accidentally left an ad blocker on whilst developing, then spent time debugging a misbehaving app has to be pretty high!
Is Chromium safe to use, or at least safe to use as packaged with Ubuntu's snaps? I know, I know, snaps are a difficult topic on their own, but my point is that, if Chrome's (and Edge's AFAIK) general hunger for data is a generally accepted fact at this point, then wouldn't employers/enterprises advising to use Chrome in their corporate networks not put themselves under risk of being sued for gross neglect in case cu…
You can still install add-ons/extensions in Chromium, so it wouldn't help at all. Also, most malicious extensions try to siphon data from your web-session (e.g. your open gmail page), so sandoxing through snaps doesn't help, either. Chrome is still a fairly safe browser, and it is well within Google's interests to keep it that way. The big issue is users installing malicious extensions disguised as useful ones, and that's an issue independent of the used browser. You could argue that you are much safer with Firefox. Not because it's inherently safer, but simply because it's lower market penetration means that it is a less interesting target.