Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome extensions spying on users' browsing data

qcontinuum.substack.com

Post reply on HN
Print view View original

91–100 of 215 posts

Re: Chrome extensions spying on users' browsing data

#91

Post by pocksuppet »

ptx wrote: post #88
Forgeties79 wrote: post #57

Earlier quoted context omitted.

How were they supposed to know that was going to happen? You think they walked up and said, “Hi. I’m here to buy your software and hurt people with it”?

If a stranger walks up to the chef in a restaurant and offers to pay them to put some mystery stuff in the food, or someone walks up in during a surgery and asks if they can make some incisions and inject some mystery stuff, would you (as a customer of the restaurant or hospital) expect this to be allowed?

If someone walks up to the owner in a restaurant and offers to pay them money to buy the restaurant, it's not considered suspicious.

Re: Chrome extensions spying on users' browsing data

#92

Post by coldtea »

Can extensions:

be scoped, meaning only allowed to read/access when you visit a particular domain whitelist (controlled by the user)?

be forced (by the extension API) to have a clear non-obfuscated feed of whatever they send that the user can log and/or tap onto and watch at any time?

If not, I wouldn't touch them with a 10000ft pole.

Re: Chrome extensions spying on users' browsing data

#93

Post by qcontinuum1 »

baby wrote: post #90

I’ve always thought that it’s crazy how so many extensions can basically read the content of the webpages your browse. I’m wondering if the research should go further: find all extensions that have URLs backed in them or hashes (of domains?) then check what they do when you visit these URLs

Without any doubt the research could continue on this. We had many opportunities to make the scan even wider and almost certainly we would uncover more extensions. The number of leaking extensions should not be taken as definite.

There are resource constrains. Those extensions try to actively detect if you are in developer mode. Took us a while to avoid such measures and we are certain we missed many extensions due to for example usage of Docker container. Ideally you want to use env as close to the real one as possible.

Without infrastructure this doesn't scale.

The same goes for the code analysis you have proposed. There are already tools that do that (see Secure Annex). Often the extensions download remote code that is responsible for data exfiltration or the code is obfuscated multiple times. Ideally you want to run the extension in browser and inspect its code during execution.

Re: Chrome extensions spying on users' browsing data

#94

Post by giarc »

My daughter, in grade school, uses a Chromebook at school and access Google Classroom through Chrome. The school has very few restrictions on extensions and when I log into her account, Chrome is littered with extensions. They all innocuous (ex. change cursor into cat, pets play around on your screen etc). However, without fail, each time I log in and go to the extension page, Chrome notifies me that one or more of the extensions was removed due to malicious activity or whatever.

Re: Chrome extensions spying on users' browsing data

#95

Post by matheusmoreira »

stevekemp wrote: post #80
matheusmoreira wrote: post #4

And the ones that are not will probably get bought out at some point and become malware as well. The only extension I trust enough to install on any browser is uBlock Origin.

That's the only extension I have installed too! I used to have tree-style tab, but now firefox has got native support for vertical tabs so I don't need to install anything extra. Installing new extensions is sometimes appealing, but the risk is just too high.

I often make the argument that uBlock Origin is so essential that it should be built into the browsers instead of being a separate extension. The restrictions imposed by manifest v3 are good, it's just that uBlock Origin is special enough that it should be able to bypass them.

Unfortunately, the huge conflicts of interest make this unrealistic. Can't trust developers funded by ad money to develop an ad blocker.

Re: Chrome extensions spying on users' browsing data

#96

Post by coldtea »

gilrain wrote: post #41
deanc wrote: post #21

Over 15 years ago now, I had a popular chrome extension that did a very specific thing. I sold it for a few thousand bucks and moved on. It seemed a bit strange at the time, and I was very cautious in the sale, but sold it and moved on. It's abundantly obvious to me now that bad actors are purchasing legitimate chrome extensions to add this functionality and earn money off the user's data (or even worse). I have seen…

[flagged]

He sold a piece of software he wrote. It's something totally legit that happens all the time.

And we don't know if the new owner changed anything or if anybody at all got hurt by that. We do know you rudely insulted the parent, however.

Re: Chrome extensions spying on users' browsing data

#99

Post by qcontinuum1 »

PurpleRamen wrote: post #13

I don't really understand the complaint here. It seems for most of those extensions have it in their literal purpose to send the active URL and get additional information back, for doing something locally with it. And why does this site has no scrollbar?? WTF, is Webdsign finally that broken?

We beg to differ. Consider for example "BlockSite Block Websites and Stay Focused" why would you need to send browsing data to remote server if your job is only to block selected domains?

Re: Chrome extensions spying on users' browsing data

#100

Post by coldtea »

Rebuff5007 wrote: post #58
singularfutur wrote: post #12

This is why I only run open source extensions that I can actually audit. uBlock Origin, SponsorBlock, the kind of tools where the code is available and the developer isn't anonymous. The Chrome Web Store is basically unregulated and Google doesn't care as long as they get their cut. Open source at least gives you a chance to see what you're installing before it starts exfiltrating your data to some server in a countr…

Do you also audit every part of every car you buy or medicine you take? Or do you rely on large well-established institutions to do that for you? "Dont trust google" imo is the wrong response here. We are at the mercy of our institutions, and if they are failing us we need mechanisms to keep them in check.

>Do you also audit every part of every car you buy or medicine you take? Or do you rely on large well-established institutions to do that for you?

Cars are under quite strict laws that software isn't. And there is only a small number of car vendors, while there are several orders of magnitude more extension vendors. Also a car vendor is a big company with many audits and controls, an extension "vendor" could just be some guy in his garage office, who just sold it to scammers, even for popular extensions.

And I still wouldn't trust a modern car using subscriptions and code updated.

Post reply on HN