I will take the opportunity to share what I have observed a few weeks ago regarding another extension in the Chrome Store: Popup Blocker (800,000+ users)[1] als

I will take the opportunity to share what I have observed a few weeks ago regarding another extension in the Chrome Store: Popup Blocker (800,000+ users)[1] also leaks your browsing history. For every site you visit, there is a POST to https://api2.poperblocker.com/view/update which contains information about each visited page. Example of information sent in the POST (I randomly clicked on an entry in the front page of Hacker News): us=576 ver=1.0 sver=1 nid=chrome h=e[...]6 tid=1478271585985 u=https%3A%2F%2Fthehftguy.wordpress.com%2F2016%2F11%2F01%2Fdocker-in-production-an-history-of-failure%2F&p=https%3A%2F%2Fnews.ycombinator.com%2F rd=https%3A%2F%2Fnews.ycombinator.com%2F ch=2 The information above is double-encoded using atob before being sent in a POST. The `h` value stays the same i each POSTs. The privacy policy of the extension used to be complete nonsense, a copy-pasta of the text found on the front page of (probably unrelated) site `whatarecookies.com`. Looks like they changed it though[2], it is now a large image of pure-text HTML[3], which appears to be borrowed a lot from (coincidence!) WOT's own Privacy Policy's page.[4] I will assume using an image may be to purposefully make it more difficult to find out the copy-pasta. The review I had left a few weeks ago for the extension -- in which I informed of the above -- seems to be gone. [1] https://chrome.google.com/webstore/detail/poper-blocker/bkkbcggnhapdmkeljlodobbkopceiche/ https://chrome.google.com/webstore/detail/poper-blocker/bkkb... [2] http://www.poperblocker.com/privacy.html http://www.poperblocker.com/privacy.html [3] http://www.poperblocker.com/privacy.png http://www.poperblocker.com/privacy.png [4] https://www.mywot.com/en/privacy/privacy_policy https://www.mywot.com/en/privacy/privacy_policy