Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome extensions spying on users' browsing data

qcontinuum.substack.com

Post reply on HN
Print view View original

51–60 of 215 posts

Re: Chrome extensions spying on users' browsing data

#51

Post by nemomarx »

lapcat wrote: post #44
singularfutur wrote: post #12

This is why I only run open source extensions that I can actually audit. uBlock Origin, SponsorBlock, the kind of tools where the code is available and the developer isn't anonymous. The Chrome Web Store is basically unregulated and Google doesn't care as long as they get their cut. Open source at least gives you a chance to see what you're installing before it starts exfiltrating your data to some server in a countr…

> This is why I only run open source extensions that I can actually audit. How far does your principle extend? To your web browser too? Google Chrome itself is partly but not entirely open source. Your operating system? Only Linux? Mac and Windows include closed source.

On HN of all places it's not that implausible that someone might be running Linux and Chromium or Firefox, surely?

Re: Chrome extensions spying on users' browsing data

#52

Post by bennydog224 »

singularfutur wrote: post #12

This is why I only run open source extensions that I can actually audit. uBlock Origin, SponsorBlock, the kind of tools where the code is available and the developer isn't anonymous. The Chrome Web Store is basically unregulated and Google doesn't care as long as they get their cut. Open source at least gives you a chance to see what you're installing before it starts exfiltrating your data to some server in a countr…

This is the safest way. You also want to disable auto update to version lock, which means using Firefox or Safari or loading unpacked if you use Chrome.

Re: Chrome extensions spying on users' browsing data

#54

Post by NamlchakKhandro »

lapcat wrote: post #44
singularfutur wrote: post #12

This is why I only run open source extensions that I can actually audit. uBlock Origin, SponsorBlock, the kind of tools where the code is available and the developer isn't anonymous. The Chrome Web Store is basically unregulated and Google doesn't care as long as they get their cut. Open source at least gives you a chance to see what you're installing before it starts exfiltrating your data to some server in a countr…

> This is why I only run open source extensions that I can actually audit. How far does your principle extend? To your web browser too? Google Chrome itself is partly but not entirely open source. Your operating system? Only Linux? Mac and Windows include closed source.

If they live in California, they're most assuredly borrowing prestige through licenced usage of apple hardware.

Because let's get real, no one ever gets a job in tech if they're not an iPhone user right?

Re: Chrome extensions spying on users' browsing data

#55

Post by chrisjj »

GuestFAUniverse wrote: post #35

And why didn't one of the wealthiest companies of the world capture this themselves? Considering the barriers they build to prevent adblockers, that doesn't shine a good light on them.

> And why didn't one of the wealthiest companies of the world capture this themselves?

Assume they did.

And the question becomes "Why didn't they come clean?" ... and much easier to answer.

Re: Chrome extensions spying on users' browsing data

#56

Post by dalmo3 »

RupertSalt wrote: post #40
deanc wrote: post #21

Over 15 years ago now, I had a popular chrome extension that did a very specific thing. I sold it for a few thousand bucks and moved on. It seemed a bit strange at the time, and I was very cautious in the sale, but sold it and moved on. It's abundantly obvious to me now that bad actors are purchasing legitimate chrome extensions to add this functionality and earn money off the user's data (or even worse). I have seen…

It is a classic supply-chain attack. The same modality is used by gamers to sell off their high-level characters, and social media accounts do "switcheroos" on posts, Pages, and Groups all the time. You know, a lot of consumer cybersecurity focuses on malware, browser security, LAN services, but I propose that the new frontier of breaches involves browser extensions, "cloud integrations", and "app access" granted fro…

Pardon the ignorance but what's being exploited by someone buying a video game character?

Re: Chrome extensions spying on users' browsing data

#57

Post by Forgeties79 »

gilrain wrote: post #41
deanc wrote: post #21

Over 15 years ago now, I had a popular chrome extension that did a very specific thing. I sold it for a few thousand bucks and moved on. It seemed a bit strange at the time, and I was very cautious in the sale, but sold it and moved on. It's abundantly obvious to me now that bad actors are purchasing legitimate chrome extensions to add this functionality and earn money off the user's data (or even worse). I have seen…

[flagged]

How were they supposed to know that was going to happen? You think they walked up and said, “Hi. I’m here to buy your software and hurt people with it”?

Re: Chrome extensions spying on users' browsing data

#58

Post by Rebuff5007 »

singularfutur wrote: post #12

This is why I only run open source extensions that I can actually audit. uBlock Origin, SponsorBlock, the kind of tools where the code is available and the developer isn't anonymous. The Chrome Web Store is basically unregulated and Google doesn't care as long as they get their cut. Open source at least gives you a chance to see what you're installing before it starts exfiltrating your data to some server in a countr…

Do you also audit every part of every car you buy or medicine you take? Or do you rely on large well-established institutions to do that for you?

"Dont trust google" imo is the wrong response here. We are at the mercy of our institutions, and if they are failing us we need mechanisms to keep them in check.

Re: Chrome extensions spying on users' browsing data

#59

Post by Angostura »

singularfutur wrote: post #12

This is why I only run open source extensions that I can actually audit. uBlock Origin, SponsorBlock, the kind of tools where the code is available and the developer isn't anonymous. The Chrome Web Store is basically unregulated and Google doesn't care as long as they get their cut. Open source at least gives you a chance to see what you're installing before it starts exfiltrating your data to some server in a countr…

It’s one of the reasons I run Safari, which strictly limits what extensions can do for these reasons

Re: Chrome extensions spying on users' browsing data

#60

Post by mrweasel »

cebert wrote: post #5

Hopefully people will start learning that you want to install as few browser extensions as possible.

In principle I agree with you, there is just so much crap online that it's tempting to just add this one more extension to fix something.

Looking at my own installed extensions, I have a password manager, Privacy Badger and Firefox Multi-Account Containers, which I suppose is the three I really need. Then I have one that puts the RSS icon back in the address bar, because Mozilla feels that RSS is less important than having the address bar show me special dates, and two that removes very specific things: One for cookie popups and one for removing sign in with Google.

The only one of these I feel should actually be a plugin is my password manager. Privacy management (including cookies), RSS and containers could just be baked into Firefox. All of those seems more relevant to me than AI.

Maybe adding a GreaseMonkey lite could fix the rest of my problem, using code I write and control.

Post reply on HN