Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome extensions spying on users' browsing data

qcontinuum.substack.com

Post reply on HN
Print view View original

81–90 of 215 posts

Re: Chrome extensions spying on users' browsing data

#81

Post by m4rtink »

mixedbit wrote: post #23
singularfutur wrote: post #12

This is why I only run open source extensions that I can actually audit. uBlock Origin, SponsorBlock, the kind of tools where the code is available and the developer isn't anonymous. The Chrome Web Store is basically unregulated and Google doesn't care as long as they get their cut. Open source at least gives you a chance to see what you're installing before it starts exfiltrating your data to some server in a countr…

An extension from a trusted, non anonymous developer which is released as open source is a good signal that the extension can be trusted. But keep in mind that distribution channels for browser extensions, similarly to distribution channels for most other open source packages (pip, npm, rpm), do not provide any guarantee that the package you install and run is actually build verbatim from the code which is open sourc…

If the RPM/deb comes from a Linux distribution then there is a good chance there is a separate maintainer and the binary package is always built from the source code by the distro.

Also if the upstream developer goes malicious there is a good chance at least one of the distro maintainers will notice and both prevent the bad source code being built for the distro & notify others.

Re: Chrome extensions spying on users' browsing data

#84

Post by Valodim »

drdec wrote: post #75
mentalgear wrote: post #2

Browser extensions have much looser security than you would think: any extension, even if it just claims to change a style of a website, can see your input type=password fields - it's ludicrous that access to those does not need its own permission !

Even scripts within the page itself cannot read the value of password input fields. This is less of an issue than you are presenting it as.

...uhh, yes they can? Are you talking about input type=password fields, i.e. the ones 99% of passwords are entered in?

Re: Chrome extensions spying on users' browsing data

#85

Post by lapcat »

matheusmoreira wrote: post #4

And the ones that are not will probably get bought out at some point and become malware as well. The only extension I trust enough to install on any browser is uBlock Origin.

> The only extension I trust enough to install on any browser is uBlock Origin.

Note however that the origin of uBlock Origin is that the developer Raymond Hill transferred control of the original uBlock project to someone who turned out not to be trustworthy, and thus Hill had to fork it later.

Re: Chrome extensions spying on users' browsing data

#87

Post by rkagerer »

Here are 3 examples identified in their results.

Play Store pages for all 3 list strong assurances about how the developer declares no data is being sold to third parties, or collected unrelated to the item's core functionality.

Brave Web browser (runapps.org) https://chromewebstore.google.com/detail/mmfmakmndejojblgcee...

Handbrake Video Converter (runapps.org) https://chromewebstore.google.com/detail/gmdmkobghhnhmipbppl...

JustParty: Watch Netflix with Friends (JustParty.io) https://chromewebstore.google.com/detail/nhhchicejoohhbnhjpa...

My open question to Google is: What consequences will these developers face for lying to you and your users, and why should I have any faith at all in those declarations?

Re: Chrome extensions spying on users' browsing data

#88

Post by ptx »

Forgeties79 wrote: post #57
gilrain wrote: post #41

Earlier quoted context omitted.

[flagged]

How were they supposed to know that was going to happen? You think they walked up and said, “Hi. I’m here to buy your software and hurt people with it”?

If a stranger walks up to the chef in a restaurant and offers to pay them to put some mystery stuff in the food, or someone walks up in during a surgery and asks if they can make some incisions and inject some mystery stuff, would you (as a customer of the restaurant or hospital) expect this to be allowed?

Re: Chrome extensions spying on users' browsing data

#90

Post by baby »

I’ve always thought that it’s crazy how so many extensions can basically read the content of the webpages your browse. I’m wondering if the research should go further: find all extensions that have URLs backed in them or hashes (of domains?) then check what they do when you visit these URLs
Post reply on HN