So it boils down to trust anyway. No way a code signing certificate can impose that trust. At the end of the day, it all goes back to human stance towards other beings in this world and own dignity.
“Stylish” browser extension steals all your internet history
51–60 of 161 posts
Re: “Stylish” browser extension steals all your internet history
#52Earlier quoted context omitted.
Firefox lets you know when addon changes permission between versions. You are prompted to accept the new permissions before upgrading the addon. This has been helpful in weeding out addons that become too data hungry.
Sometimes extensions plan such things a long time ahead - for example this extension https://chrome.google.com/webstore/detail/bitcoin-litecoin-e... injects itself currently into all websites, and sends the url back to its own background page. So once they are ready to add malicious code in the future to pass that information somewhere else, no permission changes will be required. Before downloading any extensions, I…
Thank you for the information. Very helpful.
Re: “Stylish” browser extension steals all your internet history
#53Earlier quoted context omitted.
I can already see the followup HN news: "Google attacking developers on Chrome Web Store and breaking free web!"
Yeah one thing Google doesn't do is collect info about what you do on the internet and sell it to other people. https://myactivity.google.com/myactivity More seriously: if Stylish concerns you, Chrome should too.
Google indeed doesn't sell info to other people. (It does collect it though.)
Re: “Stylish” browser extension steals all your internet history
#54This is a huge problem for the extension ecosystem in general. Who originally publishes an extension may not be the same entity that is pushing you updates in two years time, and there's no way as a user to know this. I publish a few extensions [1] [2] [3] and have been contacted multiple times by companies asking to buy them for several thousand dollars. They told me the going rate was 0.20 USD per user. You can ima…
I realize this is bad, but what happens to the user data exactly? I mean can someone here paint the bleakest, most dystopian possible use or future?
Build a social/interaction graph and fill everything with Ads while selling the same information to intelligence agencies. No discretion. Only money. Nothing personal, it's just business. Sounds familiar? Facebook invented that already.
Re: “Stylish” browser extension steals all your internet history
#55Earlier quoted context omitted.
Yeah one thing Google doesn't do is collect info about what you do on the internet and sell it to other people. https://myactivity.google.com/myactivity More seriously: if Stylish concerns you, Chrome should too.
Google indeed doesn't sell info to other people. (It does collect it though.)
Good point, I should say sell /access to/ (via DoubleClick, AdWords and their other sources of revenue)
Re: “Stylish” browser extension steals all your internet history
#56I actually ran into this issue previously when for some reason I got a request on a `hidden` (very cryptic URL listed nowhere) diagnostic endpoint on one of our APIs.
I ended up identifying stylish as the culprit, at first I disabled the tracking option (which is opt out and probably violates GDPR), a few weeks later I installed stylus.
I also reported it around the same time and gave it a 1/5 star rating but google had no interest in the report it seems.
Re: “Stylish” browser extension steals all your internet history
#57It's not actually stealing if it's in the ToS, is it?
Yes, it is. For example, > TOS agreements require giving up first born—and users gladly consent https://arstechnica.com/tech-policy/2016/07/nobody-reads-tos...
As someone who used to read TOS and EULAs:
Somewhere around 10 years ago I switched strategy:
I don't read them at all. If anyone wants to sue my defense would be that nobody in their right mind (sorry younger me) would read that nonsense.
I assume the rules are basically "don't abuse our content or service",
... and I assume that they will sooner or later sell, abuse, leak, or hand over my data to law enforcement in any country including middle Eastern and African ones.
Re: “Stylish” browser extension steals all your internet history
#58Re: “Stylish” browser extension steals all your internet history
#59report stylish to Google https://chrome.google.com/webstore/report/fjnbnpbmkenffdnngj...
Re: “Stylish” browser extension steals all your internet history
#60This is a huge problem for the extension ecosystem in general. Who originally publishes an extension may not be the same entity that is pushing you updates in two years time, and there's no way as a user to know this. I publish a few extensions [1] [2] [3] and have been contacted multiple times by companies asking to buy them for several thousand dollars. They told me the going rate was 0.20 USD per user. You can ima…
On the other side of the coin, Firefox makes it quite hard to push updates to users that require more permissions, requiring manual intervention to update. It signifies this with a small muted yellow exclamation mark on the hamburger menu, which is really hard to see. I've not received my own updates for weeks a few times because I haven't noticed the warning, and about a third of our users are on ancient versions pr…
>On the other side of the coin, Firefox makes it quite hard to push updates to users that require more permissions, requiring manual intervention to update. It signifies this with a small muted yellow exclamation mark on the hamburger menu, which is really hard to see.
I'm not sure how you can see this as anything but a good thing. If your extension wants more permissions than originally promised, then it absolutely should have to require user intervention to do. You can't just change the agreement like that. Maybe it could be better communicated, although I have to say I don't think I've ever not noticed that yellow icon, but this is far, far better than the alternative.