3 ms·
Having spent some time looking at the code of popular Chrome extensions recently I was left really shaken about whats happening under the hood. Google's positi
by kettl2 10y ago
Having spent some time looking at the code of popular Chrome extensions recently I was left really shaken about whats happening under the hood.
Google's position seems to be, if a website can track you and monitor your behavior when you are on the page, then an extension should be able to do so too. But the extensions have a whole lot more capability. They can look at my history, bookmarks, all the fucking tabs I have open and whats happening in each one and send nice reports of to god knows who.
If I download a simple task list extension and every word typed, mouse move, click etc is being sent to Google Analytics I would like to know that! Cause my expectation is its a simple list being stored locally on my device not being shared with anyone. Same goes for history stats extensions. Or reddit\youtube filtering extensions. Every single extension I looked at was hooked up to some analytics framework/cloud backup/sync service or the other. If some third party dev sitting in his mom's basement is collecting all this data. I want to know!
The best was the history stats extension I had installed. Very useful/pretty reports/code on Github/nice backstory about a benevolent developer building something cool for the world in his free time etc. When I dig around the story changes to the dev disappearing after selling it off to shady characters, who then proceed to do things like randomly redirect pages to ad sites.
At install time there is no reason Google can't say this extension uses Google Analytics to track where you are clicking etc and what data and how much data is being sent off everyday to god knows who.
- robryk 10y ago> At install time there is no reason Google can't say this extension uses Google Analytics to track where you are clicking etc and what data and how much data is being sent off everyday to god knows who. Let's say Google started to do this in a way that causes people not to want to use such extensions. Why do you think extension authors would stop using analytics as opposed to use some other analytics provider (that is on average more fishy security-wise)? Disclaimer: I work at Google, but not on anything Chrome-related.
- kettl3 10y agoThe extension framework already requires the developer to get permission for which URL's the extension is sending http requests to, in the manifest. All I want is, to see that list of who is being sent data, before I install anything. Especially in those extensions where no one would assume data is being sent at all - like in this example - When I look at the "details" in Chrome it says no special permissions requested. When I look at the code its busy talking to Google Analytics and Firebase. https://chrome.google.com/webstore/detail/super-simple-tasks/bngpflcpbefndiblbdjokgpmbldcoplk https://chrome.google.com/webstore/detail/super-simple-tasks...
- hvis 10y agoThen the extension would have to similarly say, on install, that it sends analytics to <fishy provider>. Which would make the user want to use them even less.
- geofft 10y agoThere are self-hosted analytics solutions, and worst case, you can always reverse-proxy to Google Analytics. So the extension will say "MyExtension needs to comunicate with MyExtension.com" and nobody will know why. (Unless you have a manual review process, of course.)
- dhruvkar 10y agoWe need a transparency extension, one that provides a report each day detailing what, of yours, was sent to who by what extension. *edit: spelling mistakes