Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The "Window Resizer" extension for Chrome now contains malware (2013)

productforums.google.com

Post reply on HN
Print view View original

91–100 of 124 posts

Re: The "Window Resizer" extension for Chrome now contains malware (2013)

#91

Post by dminor »

timmclean wrote: post #89
silverlight wrote: post #23

Whoa, wait. One guy in this thread is claiming that Window Resizer was sending all your keystrokes back to a central server based on what he saw in Wireshark. Can anyone else verify this? I've had this extension installed for...a year, at least. Do I need to now go change every single password on every site because chances are it's been keylogged? This is insane.

This comment from Paul Irish suggests that there was no keylogger: https://news.ycombinator.com/item?id=7048862

He's talking about a different extension.

Re: The "Window Resizer" extension for Chrome now contains malware (2013)

#93

Post by timmclean »

dminor wrote: post #91
timmclean wrote: post #89

Earlier quoted context omitted.

This comment from Paul Irish suggests that there was no keylogger: https://news.ycombinator.com/item?id=7048862

He's talking about a different extension.

Whoops, you're right.

Do we have any confirmation other than from jollymonsa on the Chrome Forums that there was in fact a keylogger?

Re: The "Window Resizer" extension for Chrome now contains malware (2013)

#94

Post by GrinningFool »

chrislomax wrote: post #81

I noticed this about a month back. I was browsing the web one Saturday morning and spotted an "Eco link" next to the search results. Most of them were big sites, like Amazon and eBay etc. I immediately emailed one of our SEO guys with a snippet of the page and said, "we need to know how to do this in Google, it must be a new feature". I stupidly assumed it was a new feature Google had rolled out. When he replied that…

I would argue that if you installed any extension that requested full access to your data without understanding the implications, you're not as careful a browser as you believe you are.

This isn't to say what the developer did is in any way ok ( I don't think it is), nor is it my intent to insult you. Rather - it's to highlight a deeper problem with this kind of click-through security model that chrome web store, play store, et al are fostering.

If somebody who has a reasonable understanding of computers and works with them for a living still clicks though this kind of agreement, what hope has the other 99% of the connected-device-using population?

Re: The "Window Resizer" extension for Chrome now contains malware (2013)

#95

Post by chrislomax »

GrinningFool wrote: post #94
chrislomax wrote: post #81

I noticed this about a month back. I was browsing the web one Saturday morning and spotted an "Eco link" next to the search results. Most of them were big sites, like Amazon and eBay etc. I immediately emailed one of our SEO guys with a snippet of the page and said, "we need to know how to do this in Google, it must be a new feature". I stupidly assumed it was a new feature Google had rolled out. When he replied that…

I would argue that if you installed any extension that requested full access to your data without understanding the implications, you're not as careful a browser as you believe you are. This isn't to say what the developer did is in any way ok ( I don't think it is), nor is it my intent to insult you. Rather - it's to highlight a deeper problem with this kind of click-through security model that chrome web store, pla…

I guess you're right in a respect. I think I trusted this to be right though, I never imagined that you could change something so dramatically to the point where it isn't even the same product any more.

With Chrome having such a good level of sandbox and Google being proud of that I didn't think it would be so easy for someone to release an extension that basically acted as malware.

I do in general have really good browsing habits, I just need to re-evaluate who I trust.

Re: The "Window Resizer" extension for Chrome now contains malware (2013)

#96

Post by oneeyedpigeon »

AJ007 wrote: post #90
sergiotapia wrote: post #88

Google really REALLY needs to up their game. https://news.ycombinator.com/item?id=7046240 I don't feel safe using their services anymore.

Theory: Google decided to have relaxed rules to play catch up with Apple's App Store. After hearing from other Android devs and what they were getting away with I decided to stick to Apple for a while.

This is a Chrome extension, not an App.

Re: The "Window Resizer" extension for Chrome now contains malware (2013)

#97

Post by bronsoja »

darklrd wrote: post #18
Svip wrote: post #9

Earlier quoted context omitted.

He asks specifically if he has broken some rules in Google Chrome's terms of service, where another user replies with quotations from the ToS. He barks at that saying his extension is allowed to do what he does, because his extension does reveal exactly what it does, if you read its permissions carefully. Although, I cannot confirm whether that is true, but that's what he is saying. I have no idea what he is up to; b…

They seem to have an automated review process unless the extension is flagged for manual review. Source - https://developers.google.com/chrome/web-store/faq#faq-gen-0... .

Yeah, seems like they should maybe institute some type of manual review for any type of "global" permissions. It would impede the well-behaving apps that legitimately need global permissions, but it might be worth it.

Re: The "Window Resizer" extension for Chrome now contains malware (2013)

#98

Post by tomswartz07 »

oneeyedpigeon wrote: post #96
AJ007 wrote: post #90

Earlier quoted context omitted.

Theory: Google decided to have relaxed rules to play catch up with Apple's App Store. After hearing from other Android devs and what they were getting away with I decided to stick to Apple for a while.

This is a Chrome extension, not an App.

To be more specific, not an Android app. Chrome has web apps, but that's not the case here.

Re: The "Window Resizer" extension for Chrome now contains malware (2013)

#99

Post by hughtopping »

timmclean wrote: post #52

I'm most concerned about the keylogging claims. Does anyone have a copy of the CRX so that we can determine if keystrokes were in fact being transmitted?

It looks like the developer still has a copy hosted on his own site:

http://ionut-botizan.net/window-resizer/

Re: The "Window Resizer" extension for Chrome now contains malware (2013)

#100

Post by chrisbalt »

8ig8 wrote: post #10

Reddit discussion from last month: http://www.reddit.com/r/YouShouldKnow/comments/1snyyl/ysk_th... Also, alternative as discussed on SO: http://stackoverflow.com/questions/20775775/alternative-to-c... See it in action: http://chrisbalt.com/blog/2013/12/20/link-hijacking-through-... Edit: Related: http://superuser.com/questions/694825/why-my-google-search-r... http://windowresizer.userecho.com/topic/353032-did-you-pul…

One thing I wish I had called out more clearly in my post ("See it in action") was the fact that the "feature" would re-enable itself after every update of the extension, which seemed to be quite frequently.

It's a shame; it really was a feature-packed, helpful extension.

Post reply on HN