Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome extensions spying on users' browsing data

qcontinuum.substack.com

Post reply on HN
Print view View original

61–70 of 215 posts

Re: Chrome extensions spying on users' browsing data

#61

Post by __alexs »

Rebuff5007 wrote: post #58
singularfutur wrote: post #12

This is why I only run open source extensions that I can actually audit. uBlock Origin, SponsorBlock, the kind of tools where the code is available and the developer isn't anonymous. The Chrome Web Store is basically unregulated and Google doesn't care as long as they get their cut. Open source at least gives you a chance to see what you're installing before it starts exfiltrating your data to some server in a countr…

Do you also audit every part of every car you buy or medicine you take? Or do you rely on large well-established institutions to do that for you? "Dont trust google" imo is the wrong response here. We are at the mercy of our institutions, and if they are failing us we need mechanisms to keep them in check.

My car can't login to my bank account.

Re: Chrome extensions spying on users' browsing data

#62

Post by cess11 »

l72 wrote: post #30

The fact that most of these are capturing query parameters: "u": "https://www.google.com/search?q=target", indicates that are capturing tons of authentication tokens. So this goes way beyond just spying on your browser history.

If a service is sending auth tokens as URL parameters, stop using it. Those are always public.

Re: Chrome extensions spying on users' browsing data

#63

Post by elashri »

dalmo3 wrote: post #56
RupertSalt wrote: post #40

Earlier quoted context omitted.

It is a classic supply-chain attack. The same modality is used by gamers to sell off their high-level characters, and social media accounts do "switcheroos" on posts, Pages, and Groups all the time. You know, a lot of consumer cybersecurity focuses on malware, browser security, LAN services, but I propose that the new frontier of breaches involves browser extensions, "cloud integrations", and "app access" granted fro…

Pardon the ignorance but what's being exploited by someone buying a video game character?

I think he was just saying that it is similar business to that. Just drawing comparison that there are a market like selling video games accounts. Also usually people who cheats in games will buy high level accounts because they will be banned much faster if they start playing with new accounts for cheats. This happens in some of the games I play all the time.

Re: Chrome extensions spying on users' browsing data

#64

Post by lapcat »

nemomarx wrote: post #51
lapcat wrote: post #44

Earlier quoted context omitted.

> This is why I only run open source extensions that I can actually audit. How far does your principle extend? To your web browser too? Google Chrome itself is partly but not entirely open source. Your operating system? Only Linux? Mac and Windows include closed source.

On HN of all places it's not that implausible that someone might be running Linux and Chromium or Firefox, surely?

I didn't claim that it's implausible. I asked a question.

On the other hand, it's not that implausible either that someone might be running Google Chrome, Windows, Mac, etc. We know that many HN commenters do. Thus, while the OP may be 100% consistent, "I only run open source extensions that I can actually audit" would not be a consistent principle for those who also use closed source software.

Re: Chrome extensions spying on users' browsing data

#65

Post by lapcat »

bell-cot wrote: post #48
lapcat wrote: post #33

> We built an automated scanning pipeline that runs Chrome inside a Docker container, routes all traffic through a man‑in‑the‑middle (MITM) proxy, and watches for outbound requests that correlate with the length of the URLs we feed it. The biggest problem here is that "We" does not refer to Google itself, who are supposed to be policing their own Chrome Web Store. One of the most profitable corporations in world hist…

GOOG didn't get to be one of the most profitable corporations in the world by spending big on cost centers.

It can't cost that much if some random blogger can do it.

Re: Chrome extensions spying on users' browsing data

#66

Post by elashri »

jakub_g wrote: post #36
mixedbit wrote: post #23

Earlier quoted context omitted.

An extension from a trusted, non anonymous developer which is released as open source is a good signal that the extension can be trusted. But keep in mind that distribution channels for browser extensions, similarly to distribution channels for most other open source packages (pip, npm, rpm), do not provide any guarantee that the package you install and run is actually build verbatim from the code which is open sourc…

Actually, npm supports "provenance" and as it eliminated long lived access tokens for publishing, it encourages people to use "trusted publishing" which over time should make majority of packages be auto-provenance-vefified. https://docs.npmjs.com/trusted-publishers#automatic-provenan...

pypi also added this last year [1] and encouraging people to use trusted publishing as well.

[1] https://docs.pypi.org/trusted-publishers/

Re: Chrome extensions spying on users' browsing data

#67

Post by benregenspan »

gilrain wrote: post #41
deanc wrote: post #21

Over 15 years ago now, I had a popular chrome extension that did a very specific thing. I sold it for a few thousand bucks and moved on. It seemed a bit strange at the time, and I was very cautious in the sale, but sold it and moved on. It's abundantly obvious to me now that bad actors are purchasing legitimate chrome extensions to add this functionality and earn money off the user's data (or even worse). I have seen…

[flagged]

This is what I'd say about someone who sold their extension today, but I don't think this business model was nearly as well-known 15 years ago.

Re: Chrome extensions spying on users' browsing data

#68

Post by [deleted] »

__alexs wrote: post #61
Rebuff5007 wrote: post #58

Earlier quoted context omitted.

Do you also audit every part of every car you buy or medicine you take? Or do you rely on large well-established institutions to do that for you? "Dont trust google" imo is the wrong response here. We are at the mercy of our institutions, and if they are failing us we need mechanisms to keep them in check.

My car can't login to my bank account.

[deleted]
Post reply on HN