6 ms·

Extensions that do this terrify me. Imagine a popular Chrome extension, say, Fireshot, with 2 million active installs, selling out. The next update of the app g

Extensions that do this terrify me. Imagine a popular Chrome extension, say, Fireshot, with 2 million active installs, selling out. The next update of the app gets shipped with a screen scraper that looks at coinbase.com. Some time after you've last visited your dashboard, it opens a connection on some entirely unrelated site and posts to the 'send' page to send all of your BTC to a third party address. Or if you have 2FA enabled for sends, just intercept the send POST with an address of your choice, but display the user's originally input address on the confirmation screen. To make it even more confusing, keep a list of transactions:intended accounts so any time the user looks on _any_ bitcoin site it shows the transaction was going to the right account.

galfarragem 9y ago
I always use incognito mode (disable all extensions) when visiting relevant sites. I wonder if it's enough.
deleted 9y ago
[deleted]
edjroot 9y ago
You can set a flag on Chrome (chrome://flags/#extension-active-script-permission) to block the extension by default and only activate it when you click the pageAction/browserAction or if you whitelist it (for that website only or for all websites). Also, two extensions come in handy: "Chrome extension source viewer" [1] and "Extensions Update Notifier" [2] (self-descriptive titles). The second one can automatically disable extensions when they're updated. They're honestly a little annoying if you have more than a handful of extensions since they lack some essential features (e.g. viewing a code diff from the previous version), but at least they're open source! :) [1]: https://chrome.google.com/webstore/detail/chrome-extension-source-v/jifpbeccnghkjeaalbbjmodiffmgedin https://chrome.google.com/webstore/detail/chrome-extension-s... [2]: https://chrome.google.com/webstore/detail/extensions-update-notifie/nlldbplhbaopldicmcoogopmkonpebjm https://chrome.google.com/webstore/detail/extensions-update-...
pjc50 9y ago
The bitcoin people will tell you that if you're using the same computer to browse the web as to hold a bitcoin wallet, you're doing it wrong. (there are other conclusions one could reach from this, such as the disadvantages of being your own uninsured bank)
- dominotw 9y ago
  Isn't that how silk road guy got caught by the feds.
  - sincerely 9y ago
    i thought he signed up for a forum with an email tied to his real life identity but used his previously anon handle
    - r3bl 9y ago
      It was a StackOverflow question he posted while creating Silk Road, in which he used his real name (before switching to the "frosty" alias in under a minute). And his SSH key had both the username and hostname set to that alias ("frosty@frosty"), which is how they connected him to Silk Road. Specifically, it was this question: https://stackoverflow.com/questions/15445285/how-can-i-connect-to-a-tor-hidden-service-using-curl-in-php https://stackoverflow.com/questions/15445285/how-can-i-conne...
Haydos585x2 9y ago
We should try and be more sinister. Imagine a company purchases or influences a plugin so much that when a news article is read about E Corp dumping toxic waste into drinking water the content is changed to play down the numbers and sentiment.
- katastic 9y ago
  You mean like the MSM did with the Iraq war? Or the Vitamin Industry employed Mel Gibson himself to stop regulation of vitamins? Pretty sure all of that stuff is basically happening. We're just realizing a recent "tech" version of it. But the core corruption has always been there.

galfarragem 9y ago

I always use incognito mode (disable all extensions) when visiting relevant sites. I wonder if it's enough.

deleted 9y ago

[deleted]

edjroot 9y ago

You can set a flag on Chrome (chrome://flags/#extension-active-script-permission) to block the extension by default and only activate it when you click the pageAction/browserAction or if you whitelist it (for that website only or for all websites). Also, two extensions come in handy: "Chrome extension source viewer" [1] and "Extensions Update Notifier" [2] (self-descriptive titles). The second one can automatically disable extensions when they're updated. They're honestly a little annoying if you have more than a handful of extensions since they lack some essential features (e.g. viewing a code diff from the previous version), but at least they're open source! :) [1]: https://chrome.google.com/webstore/detail/chrome-extension-source-v/jifpbeccnghkjeaalbbjmodiffmgedin https://chrome.google.com/webstore/detail/chrome-extension-s... [2]: https://chrome.google.com/webstore/detail/extensions-update-notifie/nlldbplhbaopldicmcoogopmkonpebjm https://chrome.google.com/webstore/detail/extensions-update-...

pjc50 9y ago

The bitcoin people will tell you that if you're using the same computer to browse the web as to hold a bitcoin wallet, you're doing it wrong. (there are other conclusions one could reach from this, such as the disadvantages of being your own uninsured bank)

dominotw 9y ago
Isn't that how silk road guy got caught by the feds.
- sincerely 9y ago
  i thought he signed up for a forum with an email tied to his real life identity but used his previously anon handle
  - r3bl 9y ago
    It was a StackOverflow question he posted while creating Silk Road, in which he used his real name (before switching to the "frosty" alias in under a minute). And his SSH key had both the username and hostname set to that alias ("frosty@frosty"), which is how they connected him to Silk Road. Specifically, it was this question: https://stackoverflow.com/questions/15445285/how-can-i-connect-to-a-tor-hidden-service-using-curl-in-php https://stackoverflow.com/questions/15445285/how-can-i-conne...

Haydos585x2 9y ago

We should try and be more sinister. Imagine a company purchases or influences a plugin so much that when a news article is read about E Corp dumping toxic waste into drinking water the content is changed to play down the numbers and sentiment.

katastic 9y ago
You mean like the MSM did with the Iraq war? Or the Vitamin Industry employed Mel Gibson himself to stop regulation of vitamins? Pretty sure all of that stuff is basically happening. We're just realizing a recent "tech" version of it. But the core corruption has always been there.