Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome extensions spying on users' browsing data

qcontinuum.substack.com

Post reply on HN
Print view View original

71–80 of 215 posts

Re: Chrome extensions spying on users' browsing data

#71

Post by abenga »

__alexs wrote: post #61
Rebuff5007 wrote: post #58

Earlier quoted context omitted.

Do you also audit every part of every car you buy or medicine you take? Or do you rely on large well-established institutions to do that for you? "Dont trust google" imo is the wrong response here. We are at the mercy of our institutions, and if they are failing us we need mechanisms to keep them in check.

My car can't login to my bank account.

Your car and fellow road users' cars generally have your life, your passengers' lives, and other road users' lives in its hands while in use.

Re: Chrome extensions spying on users' browsing data

#72

Post by gnl »

Couple of quick thoughts on how to protect yourself from having a formerly trustworthy extension go rogue on you:

- https://github.com/beaufortfrancois/extensions-update-notifi...

And then you can do whatever you feel is an appropriate amount of research whenever a particularly privileged extension gets updated (check for transfer of ownership, etc.)

- brave://flags/#brave-extension-network-blocking

You can then create custom rules to filter extension traffic under brave://settings/shields/filters

e.g.:

  ! Obsidian Web
  *$domain=edoacekkjanmingkbkgjndndibhkegad
  @@||127.0.0.1^$domain=edoacekkjanmingkbkgjndndibhkegad
- Clone the GitHub repo, do a security audit with Claude Code, build from source, update manually

Re: Chrome extensions spying on users' browsing data

#73

Post by haritha-j »

__alexs wrote: post #61
Rebuff5007 wrote: post #58

Earlier quoted context omitted.

Do you also audit every part of every car you buy or medicine you take? Or do you rely on large well-established institutions to do that for you? "Dont trust google" imo is the wrong response here. We are at the mercy of our institutions, and if they are failing us we need mechanisms to keep them in check.

My car can't login to my bank account.

Give it a few years. After all how will Tesla get that $99 every month for your self driving susbscription?

Re: Chrome extensions spying on users' browsing data

#74

Post by lapcat »

Angostura wrote: post #59
singularfutur wrote: post #12

This is why I only run open source extensions that I can actually audit. uBlock Origin, SponsorBlock, the kind of tools where the code is available and the developer isn't anonymous. The Chrome Web Store is basically unregulated and Google doesn't care as long as they get their cut. Open source at least gives you a chance to see what you're installing before it starts exfiltrating your data to some server in a countr…

It’s one of the reasons I run Safari, which strictly limits what extensions can do for these reasons

No, Safari is really no different here from Chrome, and indeed there's broad compatibility between the extension API, such that in many cases you can use a Chrome extension unmodified in Safari.

Re: Chrome extensions spying on users' browsing data

#75

Post by drdec »

mentalgear wrote: post #2

Browser extensions have much looser security than you would think: any extension, even if it just claims to change a style of a website, can see your input type=password fields - it's ludicrous that access to those does not need its own permission !

Even scripts within the page itself cannot read the value of password input fields. This is less of an issue than you are presenting it as.

Re: Chrome extensions spying on users' browsing data

#77

Post by anonymars »

endsandmeans wrote: post #25
randunel wrote: post #19

Earlier quoted context omitted.

How do you check that the open sourced code is the same one that you are installing from the extension repository and actually running?

I agree but let me play the devil's advocate. I'll channel Stallman: Same argument can be applied to all closed source software. In the end its about who you trust and who needs to be verified and that is relative, subjective, and contextual... always. So unless you can read the source code and compile yourself on a system you built on an OS you also built from source on a machine built before server management backd…

Don't forget to channel Ken Thompson ("Reflections on Trusting Trust") -- you can read the source code, but where did you get the compiler?

Re: Chrome extensions spying on users' browsing data

#78

Post by drdec »

Pacers31Colts18 wrote: post #7

I think the industry needs to rethink extensions in general. VSCode and browser extensions seem to have very little thorough review or thought into them. A lot of enterprises aren't managing them properly.

Absolutely. I have not installed useful browser extensions because Mozilla isn't the maintainer. E.g. the Google container.

Re: Chrome extensions spying on users' browsing data

#79

Post by [deleted] »

dalmo3 wrote: post #56
RupertSalt wrote: post #40

Earlier quoted context omitted.

It is a classic supply-chain attack. The same modality is used by gamers to sell off their high-level characters, and social media accounts do "switcheroos" on posts, Pages, and Groups all the time. You know, a lot of consumer cybersecurity focuses on malware, browser security, LAN services, but I propose that the new frontier of breaches involves browser extensions, "cloud integrations", and "app access" granted fro…

Pardon the ignorance but what's being exploited by someone buying a video game character?

[deleted]

Re: Chrome extensions spying on users' browsing data

#80

Post by stevekemp »

matheusmoreira wrote: post #4

And the ones that are not will probably get bought out at some point and become malware as well. The only extension I trust enough to install on any browser is uBlock Origin.

That's the only extension I have installed too!

I used to have tree-style tab, but now firefox has got native support for vertical tabs so I don't need to install anything extra.

Installing new extensions is sometimes appealing, but the risk is just too high.

Post reply on HN