“Stylish” browser extension steals all your internet history • Hacker News Board

Re: “Stylish” browser extension steals all your internet history

#61

Post by fabricexpert » Tue, Jul 03, 2018, 10:47 AM UTC

bovine3dom wrote: post #42

mcjiggerlog wrote: post #18

This is a huge problem for the extension ecosystem in general. Who originally publishes an extension may not be the same entity that is pushing you updates in two years time, and there's no way as a user to know this. I publish a few extensions [1] [2] [3] and have been contacted multiple times by companies asking to buy them for several thousand dollars. They told me the going rate was 0.20 USD per user. You can ima…

On the other side of the coin, Firefox makes it quite hard to push updates to users that require more permissions, requiring manual intervention to update. It signifies this with a small muted yellow exclamation mark on the hamburger menu, which is really hard to see. I've not received my own updates for weeks a few times because I haven't noticed the warning, and about a third of our users are on ancient versions pr…

New permissions shouldn't be taken lightly. One day you'll install an extension that access only on a specific site, and the next day it's requesting access to all your bookmarks, location data, history etc. If you make it into a next next next dialogue box you're implementing an easily abused dark pattern.

A better approach would be to allow extension upgrades, irrespective of permissions. If a user chooses to deny permissions the extension should still work on the latest version.

Re: “Stylish” browser extension steals all your internet history

#62

Post by spyder » Tue, Jul 03, 2018, 10:52 AM UTC

psergeant wrote: post #9

Offices in the UK. I would encourage anyone in the EU who used this to file a GDPR complaint.

From their Privacy Policy:

"Where provided under applicable law (such as within the European Union), you may have the right to ask us to delete Personal Information which you have provided to us [... ] contact our Data Protection Officer at: dpo@userstyles.org."

https://addons.mozilla.org/en-US/firefox/addon/stylish/priva...

Re: “Stylish” browser extension steals all your internet history

#63

Post by peteretep » Tue, Jul 03, 2018, 10:53 AM UTC

logicallee wrote: post #29

mcjiggerlog wrote: post #18

This is a huge problem for the extension ecosystem in general. Who originally publishes an extension may not be the same entity that is pushing you updates in two years time, and there's no way as a user to know this. I publish a few extensions [1] [2] [3] and have been contacted multiple times by companies asking to buy them for several thousand dollars. They told me the going rate was 0.20 USD per user. You can ima…

I realize this is bad, but what happens to the user data exactly? I mean can someone here paint the bleakest, most dystopian possible use or future?

It gets sold to private investigators and insurers, and you shouldn't have ever Googled for "alzheimer disease symptoms" and you lose your child custody rights after a judge decides what you're looking at on YouPorn isn't sufficiently healthy.

Re: “Stylish” browser extension steals all your internet history

#64

Post by peteretep » Tue, Jul 03, 2018, 10:54 AM UTC

spyder wrote: post #62

psergeant wrote: post #9

Offices in the UK. I would encourage anyone in the EU who used this to file a GDPR complaint.

From their Privacy Policy: "Where provided under applicable law (such as within the European Union), you may have the right to ask us to delete Personal Information which you have provided to us [... ] contact our Data Protection Officer at: dpo@userstyles.org." https://addons.mozilla.org/en-US/firefox/addon/stylish/priva...

That's nice for them. I also have the right to refer them to my local data commissioner though, about the absolutely lack of meaningful consent they gathered from me here. I hope their investors get taken to the cleaners by the resulting fines.

Re: “Stylish” browser extension steals all your internet history

#65

Post by Silhouette » Tue, Jul 03, 2018, 11:00 AM UTC

izacus wrote: post #53

nailer wrote: post #38

Earlier quoted context omitted.

Yeah one thing Google doesn't do is collect info about what you do on the internet and sell it to other people. https://myactivity.google.com/myactivity More seriously: if Stylish concerns you, Chrome should too.

Google indeed doesn't sell info to other people. (It does collect it though.)

Is there a definitive list anywhere of what Chrome collects and where it goes?

There have been rumours forever, but I'm interested in verifiable facts.

Re: “Stylish” browser extension steals all your internet history

#66

Post by AznHisoka » Tue, Jul 03, 2018, 11:06 AM UTC

mcjiggerlog wrote: post #18

This is a huge problem for the extension ecosystem in general. Who originally publishes an extension may not be the same entity that is pushing you updates in two years time, and there's no way as a user to know this. I publish a few extensions [1] [2] [3] and have been contacted multiple times by companies asking to buy them for several thousand dollars. They told me the going rate was 0.20 USD per user. You can ima…

SimilarWeb and Jumpshot are the major clickstream companies that buy these extensions. One way to see whether an extension mines your browsing history is to use a tool like Fiddler to sniff out the outgoing requests.

One sneaky way to get back at them is to send a bunch of fake “poison” requests with fake data back at these guys. It probably wont hurt them but if enough people do it, it might make their data worse and make their operation unprofitable.

Re: “Stylish” browser extension steals all your internet history

#67

Post by Silhouette » Tue, Jul 03, 2018, 11:07 AM UTC

TheCapeGreek wrote: post #16

As others have said, immediately switch to Stylus. While we're at it stop using Ghostery as well since they were bought by an ad company. Use Privacy Badger or a decent alternative (noscript + heavy/custom uBlock lists should work just fine)

While we're at it stop using Ghostery as well since they were bought by an ad company.

Ghostery invites you to submit various data to support it these days, but seems to be transparent about it and to work on an opt-in basis, so quite different to Stylish. Are you aware of other things that Ghostery is doing without the same transparency and consent?

Re: “Stylish” browser extension steals all your internet history

#68

Post by eurticket » Tue, Jul 03, 2018, 11:14 AM UTC

Is there a system in place to update everyone on new ownership changes and implementation of anti user-good practices like this?

Re: “Stylish” browser extension steals all your internet history

#69

Post by zulln » Tue, Jul 03, 2018, 11:20 AM UTC

akerro wrote: post #21

Dont google and mozilla review source code of addons?

Back in 2015 when Detectify (me being co-author) looked into this issue [1] many plugins do not actually have this code in the extensions, but rather a feature to download remote code and add it to the extension so to say. As long as that practice is allowed, source review would not help.

[1] https://labs.detectify.com/2015/11/19/chrome-extensions-aka-...

Re: “Stylish” browser extension steals all your internet history

#70

Post by invalidusernam3 » Tue, Jul 03, 2018, 11:21 AM UTC

mcjiggerlog wrote: post #18

This is a huge problem for the extension ecosystem in general. Who originally publishes an extension may not be the same entity that is pushing you updates in two years time, and there's no way as a user to know this. I publish a few extensions [1] [2] [3] and have been contacted multiple times by companies asking to buy them for several thousand dollars. They told me the going rate was 0.20 USD per user. You can ima…

Those two reddit plugins are great, particularly the comment collapse one. I'm used to using the appolo reddit app now and I love its collapse feature (the native reddit one sucks).

Installed and will be using both. Please don't steal my data!