Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Stylish” browser extension steals all your internet history

robertheaton.com

Post reply on HN
Print view View original

71–80 of 161 posts

Re: “Stylish” browser extension steals all your internet history

#71

Post by bausshf »

spyder wrote: post #62
psergeant wrote: post #9

Offices in the UK. I would encourage anyone in the EU who used this to file a GDPR complaint.

From their Privacy Policy: "Where provided under applicable law (such as within the European Union), you may have the right to ask us to delete Personal Information which you have provided to us [... ] contact our Data Protection Officer at: dpo@userstyles.org." https://addons.mozilla.org/en-US/firefox/addon/stylish/priva...

That still isn't GDPR compliant, because it's forced consent, which is no consent.

Re: “Stylish” browser extension steals all your internet history

#72

Post by applecrazy »

bovine3dom wrote: post #42
mcjiggerlog wrote: post #18

This is a huge problem for the extension ecosystem in general. Who originally publishes an extension may not be the same entity that is pushing you updates in two years time, and there's no way as a user to know this. I publish a few extensions [1] [2] [3] and have been contacted multiple times by companies asking to buy them for several thousand dollars. They told me the going rate was 0.20 USD per user. You can ima…

On the other side of the coin, Firefox makes it quite hard to push updates to users that require more permissions, requiring manual intervention to update. It signifies this with a small muted yellow exclamation mark on the hamburger menu, which is really hard to see. I've not received my own updates for weeks a few times because I haven't noticed the warning, and about a third of our users are on ancient versions pr…

Actually, Chrome does this too:

> Chrome prompts the user if adding the permissions results in different warning messages than the user has already seen and accepted.[1]

[1]: https://developer.chrome.com/extensions/permissions

Re: “Stylish” browser extension steals all your internet history

#73

Post by liamfd »

Chilinot wrote: post #17
TheCapeGreek wrote: post #16

As others have said, immediately switch to Stylus. While we're at it stop using Ghostery as well since they were bought by an ad company. Use Privacy Badger or a decent alternative (noscript + heavy/custom uBlock lists should work just fine)

If you dont want the heavy handed solution that NoScript provides, i would suggest "uBlock Matrix".

How does that compare to uBlock Origin?

Re: “Stylish” browser extension steals all your internet history

#74

Post by novaRom »

spyder wrote: post #62
psergeant wrote: post #9

Offices in the UK. I would encourage anyone in the EU who used this to file a GDPR complaint.

From their Privacy Policy: "Where provided under applicable law (such as within the European Union), you may have the right to ask us to delete Personal Information which you have provided to us [... ] contact our Data Protection Officer at: dpo@userstyles.org." https://addons.mozilla.org/en-US/firefox/addon/stylish/priva...

Data collection by default. They don't even ask to "opt in". Hopefully they will pay enough in EU to learn.

Re: “Stylish” browser extension steals all your internet history

#75

Post by tim1994 »

mcjiggerlog wrote: post #22
akerro wrote: post #21

Dont google and mozilla review source code of addons?

Mozilla yes - there's a delay when publishing whilst an actual human reviews the changes. For Google, updates are instantly published with, as far as I can tell, no kind of audit.

Are you sure about that? AFAIK there is just an automatic validation system. I am an extension author myself and this is from a recent update approval email:

"This version has been screened and approved for the public. Keep in mind that other reviewers may look into this version in the future and determine that it requires changes or should be taken down. In that case, you will be notified again with details and next steps."

Perhaps this also depends on the number of users...

Re: “Stylish” browser extension steals all your internet history

#77

Post by Zren »

I've gotten annoyed enough to just copy the source from most of my extensions (located at `~/.config/google-chrome/Default/Extensions/`), remove the update stuff from the `metadata.json` and load them as developer extensions so they never update.

It's easy enough to update them + audit the code when something breaks. The hardest part is downloading the new code (.crx) without installing it, I had to write javascript I paste into the console. StackOverflow can unzip a crx by striping the first 306 bytes.

I forked Stylish v1.5.2 a year ago before I heared of Stylus, but I've no need to to switch since the original extension was pretty good. https://github.com/Zren/chrome-extension-stylish#fork

Re: “Stylish” browser extension steals all your internet history

#79

Post by phobosdeimos »

mcjiggerlog wrote: post #18

This is a huge problem for the extension ecosystem in general. Who originally publishes an extension may not be the same entity that is pushing you updates in two years time, and there's no way as a user to know this. I publish a few extensions [1] [2] [3] and have been contacted multiple times by companies asking to buy them for several thousand dollars. They told me the going rate was 0.20 USD per user. You can ima…

I disagree. Every time an add on is updated in FF I get directed to the patch notes. RTFM.
Post reply on HN