8 ms·
Popular Google Chrome extensions are constantly tracking you by default
- free2rhyme214 11y agoDoes Adblock plus do this? In Chrome's permissions they can read your browsing history.
- fnordian_slip 11y agoI don't know for sure, but there's been quite a bit of controversy about them in the last year, mainly because of their whitelisting (https://en.wikipedia.org/wiki/Adblock_Plus#Controversy_over_ad_filtering_and_ad_whitelisting https://en.wikipedia.org/wiki/Adblock_Plus#Controversy_over_...). I switched to ublock origin, works well for me, others recommend ublock (there's been quite a bit of drama between the original dev who's responsible for ublock origin, and the new dev who's responsible for ublock, I can't really recommend one over the other, if you're interested you might want to do some research there)
- karunadg 11y agoPest Control Services in India # http://topservice4u.in/pest-control-services.html http://topservice4u.in/pest-control-services.html Pest Control in Bangalore @ http://topservice4u.in/pest-control-services-bangalore/ http://topservice4u.in/pest-control-services-bangalore/ Pest Control in Mumbai @ http://topservice4u.in/pest-control-services-mumbai/ http://topservice4u.in/pest-control-services-mumbai/
- kzar 11y ago"I don't know for sure..." Please stop spreading FUD. Adblock Plus is not mentioned in the blog post, has a privacy policy and is open source. If you're worried about how it handles your data you can have a look at the code for yourself. https://adblockplus.org/en/privacy https://adblockplus.org/en/privacy https://github.com/adblockplus/adblockpluschrome https://github.com/adblockplus/adblockpluschrome
- theseatoms 11y agoDoes anyone know how big a deal this really is? So a handful of developers (and their employers) have my full browser history. What could possibly go wrong?
- scrollaway 11y agoIf someone else has it, everyone has it. You're never safe from a leak.
- danr4 11y agoThey store access tokens to your private accounts ie. Gmail. They/future hackers can use them to access your accounts.
- striking 11y agoThey can't steal cookies, because HttpOnly exists: http://blog.codinghorror.com/protecting-your-cookies-httponly/ http://blog.codinghorror.com/protecting-your-cookies-httponl... They can take your passwords, though. If you install an extension that "can access your data on all sites", I hope your trust is well-founded.
- borski 11y agoTo be clear, they can definitely steal cookies if the HTTPOnly flag isn't enabled. About 60% of the session cookies we see in our scans don't have it enabled. Scary.
- me_again 11y agoThe extension developers sell the right to embed arbitary tracking code in the extension. That code puts it on a site which arbitrary users can pay to get access to. Still not worried?
- melted 11y agoThis is basically why I only install a few extensions from trusted developers such as Google, EFF, and uBlock. Google tracks me anyway, EFF doesn't track me and it would destroy their reputation if they chose to start tracking, and uBlock Origin is the only popular remaining adblock extension which hasn't sold out (yet). Edit: uBlock Origin is the one that doesn't suck, uBlock is to be avoided.
- hartator 11y agouBlock origin, beware of uBlock.
- melted 11y agoYes, uBlock Origin, goes without saying.
- jokoon 11y agoI've read the difference, ublock doesn't seem very harmful, would I should I be wary ? Is it just because it's not free on ios or something ?
- tim333 11y agoIt's a question of the character of the people running the thing. The ublock guy seems a bit sketchier than the ublock origin guy.
- jkot 11y agoI would not trust adblock extensions. /etc/hosts works just fine.
- tim333 11y agoThe thing that worries me is extensions being able to grab my passwords. If my Lastpass extension can do it then presumably malicious extensions can too.
- xnx 11y agoAre there any adblocker-like/privacy-proxy tools to neuter extensions like this?
- kevindeasis 11y agoI would like to know about this as well, because I have never heard of such a product.
- deleted 11y ago[deleted]
- zetafunction 11y agoImagine a more powerful API existed that an extension could use to control other extensions. Now the badware extensions start using the more powerful API and you're back to square one...
- TeMPOraL 11y agoI'd like the ability to put an extension of my choice in a privileged mode so that it could escape such limitations. But sadly, given such feature, the usual response of asshole evil developers will be to ask users to give privileges to their extensions for "enhanced experience" or "to ensure that the extension works properly".
- plorg 11y agouBlock Origin can be used to block requests made by the browser and by extensions. The logger UI allows you to inspect these requests, and the 'behind-the-scenes' keyword can be used instead of a domain to construct blocking rules. See https://github.com/chrisaljoudi/uBlock/wiki/Behind-the-scene-network-requests https://github.com/chrisaljoudi/uBlock/wiki/Behind-the-scene..., which is applicable to both uBlock and uBlock Origin.
- gorhill 11y ago> uBlock Origin can be used to block requests made [...] by extensions This is no longer true for the Chromium version. There were changes in Chromium which now prevent extensions from being able to inspect/block network requests made by other extensions. See: https://github.com/gorhill/uMatrix/issues/338 https://github.com/gorhill/uMatrix/issues/338
- zobzu 11y agopopular android and ios app as well, i may add ;-)
- mark_l_watson 11y agoI went through my Chrome extensions today and removed all that were not from Google or EFF. A bit painful but I thought I should do it.
- kevindeasis 11y agoI think Ublock Origin is definitely a google chrome extension that should be installed. I think it will absolutely benefit you.
- danieldk 11y agouMatrix is from the same developer and incredibly useful.
- kawera 11y agoFor those looking for a HoverZoom alternative, Imagus[1] works very well and does no tracking. (just a happy user) [1] https://chrome.google.com/webstore/detail/imagus/immpkjjlgappgfkkfieppnmlhakdmaab/related?hl=en https://chrome.google.com/webstore/detail/imagus/immpkjjlgap...
- mirimir 11y agoOK, so I'm glad that I never trusted Chrome. But now I'm wondering whether Firefox extensions are generally safe.
- zetafunction 11y agoFrom the article: Are Firefox extensions any better? To be honest, no.
- mirimir 11y agoOops, I missed that :(
- andybak 11y agoHuh? It's the basic concept of installing extensions from untrusted 3rd parties that's flawed. There's potentially a security framework that could mitigate this but it's not an easy problem given the incentives to work round it.
- sheensleeves 11y agoI would have thought that past 1,000,000 downloads you could trust the plugin but that is shown to be wrong. With Windows software I do a skim of the Wikipedia article for controversy as a sanity check but there aren't any for these extensions. Previously I would search the apps name + some obvious terms like malware but those results are too spammy to be helpful now. Extensions are very useful, so I'd hope there'd be some reaction from Google on this.
- xirdstl 11y agoOnce in awhile, I just yearn for the good ol' days of ActiveX.
- tajen 11y agoActiveX awesomely enabled a popular antivirus to execute from a webpage. Or at least that's what I understood at the time, but nevertheless that's the day I switched to Firefox.
- banku_brougham 11y agoI feel I should hand roll my own extensions from copies of favorites that I no longer trust (dead mouse, etc). Is there a good tutorial out there for this?
- peterhartree 11y ago1. You can download the source code of any extension on the Chrome Web Store using this extension: https://chrome.google.com/webstore/detail/chrome-extension-source-v/jifpbeccnghkjeaalbbjmodiffmgedin?hl=en https://chrome.google.com/webstore/detail/chrome-extension-s... 2. Review the source code. 3. Visit chrome://extensions and enable developer mode. 4. Click "Load unpacked extension" and point to the folder containing the extension source code you've reviewed. C.f. https://developer.chrome.com/extensions/getstarted#unpacked https://developer.chrome.com/extensions/getstarted#unpacked
- banku_brougham 11y agoAwesome, thanks!!
- mcnemesis 11y agoOne solution I see (though not optimal), is to install only those extensions you really can't do without, and then have them disabled by default. When you need to use its function though, enable it (only for that short session), and then disable it later. Otherwise, I have inspected many seemingly innocent extensions like JaSON and REST Console (both meant to run in own tabs, without need to read/modify data on sites I visit, but which nevertheless request for these permissions!). I quickly noted that many other extensions did request for these perms as well... So, for now, for the ones I can't uninstall, I'll just disable them, and only opt-in (maybe in incognito), when I need to use them.
- jokoon 11y agoThere have been many bad points for chrome this year, I'm glad I switched a long time ago to firefox.
- VMG 11y agoThe article has a section about Firefox plugins.
- myztic 11y agoWhen it comes to Google and Data Collection just always assume the worst. Not to bash on Google, I am no hater, but it's what they make money with. Browser for free? Google Mail with 15 GB of storage? We all know their business model. Either you pay with money or with information. I have been non-trusting of many Scripts for years now, call me paranoid, but if Facebook actually has the capability to just track you via Facebook Scripts that are executed on every site you have the option to Log in with Facebook or share via Facebook directly from the site, why would they not do it? Google also tries to keep you logged by all means possible. I block their Scripts, only temporarily allow if I need them, I don't keep cookies for longer than my current session except for Fastmail, I use VPN, have no DNS-Leak and WebRTC Detection turned off (last I checked you could not turn WebRTC Detection off in Chrome and the Extensions promising to do that were not working). And that's also why I use Mozilla Firefox. Not because it's the technically better browser, but I have trust in Mozilla and their API just allows capabilities Chrome isn't capable of (that's why there is no NoScript in Chrome and no, there is no NoScript-Alternative in Chrome with the same features and capabilities, look it up). Back when I used both Chrome and Firefox side by side, Firefox for example would turn off some Add-Ons/Extensions in Private Browsing Mode, while Chrome would not. I guess we all can grasp what most likely was the reason for it (Add-Ons/Extensions should not be able to obtain information from the user if in private browsing). I am not saying that everyone should do it this way, I even recognize I am not the normal user and this is not for everyone, but complaining about Google because of Data Collection is like complaining about Facebook and the information they have about people while using it heavily and putting sensitive information up on it willingly. Get over it ;)
- kevindeasis 11y agoWell, the topic of the article is not Google collecting data. It is about Chrome extensions. I can agree to some parts of what you said.
- myztic 11y agoYep, but since Google's whole business model revolves around monetizing user information, I am not surprised about this article. Google's Motto is "Data Collection for monetary purposes is not evil". Think about Android Application Permissions for example, I am not sure whether or not you now can revoke permissions one by one on your own (think I read something about this), but for how long was this not possible?
- hyperknot 11y agoDoes anyone have any knowledge about Wappalyzer? I cannot find it on this list, but it requests an inject.js on every webpage, even if the anonymous data sending is switched off in options. It's quite a popular and valuable extension for web developers, I hope someone can explain how it works.
- ycosynot 11y agoI read the file, it seems safe to me. It keeps track of javascript variables, and displays them in an element. There are many legit uses of injected scripts. I recommend the extension "Chrome extension source viewer", CRX viewer, to read the code without installing an extension. https://chrome.google.com/webstore/detail/chrome-extension-source-v/jifpbeccnghkjeaalbbjmodiffmgedin https://chrome.google.com/webstore/detail/chrome-extension-s...
- oelmekki 11y ago> more often than not, the extensions are also embedding third-party scripts which are gathering all your browser traffic. As someone who writes a lot of chrome extensions, I find that annoying, not to mention a bit insulting. Please provide the complete list of bad behaving extensions instead of implying we're mostly writing extensions to lure users into a trap. There are so many cool things you can do with chrome extensions, which are largely unexplored yet. Actually, it reminds me the state of javascript in the early 2000. It was not uncommon then too to say javascript developers were only in to write malwares and javascript should be avoided as much as possible. What would the web look like today if we listened to them? Now, the state of chrome permissions is indeed very bad. It is very restrictive by essence (you wouldn't have that many restrictions writing a desktop app, and you could do way more harm), but it makes everything looks suspicious. Do you need to access something to build a feature? Now user, when installing the extension, will catalog all the bad things you could do with this permission. Worst part is, the perimeter of permissions is often poorly delimited. Do you want user to be able to use an extension that enhance their experience on a website of their choice? You have to ask to be able to edit just any website. You often reach the "this extension can read all your browser history" state when you couldn't care less. I would gladly pay google to review my extension code and mark it as trusted. The confusion between good and bad developers must stop.
- karunadg 11y agoHair Transplant Clinic in India @ http://topservice4u.in/hair-transplant.html http://topservice4u.in/hair-transplant.html Bangalore Hair Transplant @ http://topservice4u.in/hair-transplant-surgeons-bangalore/ http://topservice4u.in/hair-transplant-surgeons-bangalore/
- karunadg 11y agoHair Transplant Clinic in India @ http://topservice4u.in/hair-transplant.html http://topservice4u.in/hair-transplant.html Bangalore Hair Transplant @ http://topservice4u.in/hair-transplant-surgeons-bangalore/ http://topservice4u.in/hair-transplant-surgeons-bangalore/
- shawn-furyan 11y agoThe problem with appending a list to this article is that this issue is presumed to be wide spread[1]. Creating a long list might give the illusion of exhaustiveness when the aim of the project isn't exhaustive identification of offenders, but to demonstrate the problem clearly with strong evidence. This at least empowers the Chrome developers to attack a defined problem, and it gives chrome users a tangible, clearly defined set of in-the-wild attacks to point to when complaining about Chrome's extension permission shortcomings. It also is an amount of work that is achievable by a small team, where an exhaustive outing would probably require the resources of a large organization. [1] Particularly since they seem to have found evidence that these tracking companies are actively reaching out to Chrome extension developers on the dl and offering them commissions.
- cdnsteve 11y agoSo this is essentially the same as man in the middle attacks but your basically saying here are all my keys. Scary. They better step up security on the extensions review process. I've already dumped chrome/Google because it tracks everything possible about you, especially when signed in.
- 4ad 11y agoWhat browser do you use?
- myztic 11y agoHave you tried using Chromium? (I still recommend Firefox though) Chrome is basically a stable release from Google of the Chromium Browser (which in itself is an Open Source Project), as such Chrome is more tightly integrated with Google Services, Chromium should be the better choice considering not wanting to be tracked. I think some systems (*BSD, GNU/Linux distributions) even only have Chromium available through their package systems, others possibly both.
- 4ad 11y agoChromium won't help you: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=786909 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=786909
- myztic 11y agoPhew... interesting, though it is marked as fixed?!
- cdnsteve 11y agoI'm using Ghostery browser on Android now. But I'm even paranoid of Android since you are always logged in. I was trying their ext with chrome to block trackers, some large business sites, I think business insider, have over 80 items blocked. This type of behavior is going to cause people to disable js entirely.
- borski 11y agoExtensions have a lot of power. We've written about a situation in the past where an extension actually XSS'd sites unintentionally, even if the site itself had XSS protections built-in: https://www.tinfoilsecurity.com/blog/building-a-browser-extension-be-careful-not-t-17787 https://www.tinfoilsecurity.com/blog/building-a-browser-exte...