10 ms·

This is a huge problem for the extension ecosystem in general. Who originally publishes an extension may not be the same entity that is pushing you updates in t

This is a huge problem for the extension ecosystem in general. Who originally publishes an extension may not be the same entity that is pushing you updates in two years time, and there's no way as a user to know this. I publish a few extensions [1] [2] [3] and have been contacted multiple times by companies asking to buy them for several thousand dollars. They told me the going rate was 0.20 USD per user. You can imagine what kind of deals are being made when the extension has a million plus users. When pushed for exactly why they wanted to buy the extensions, which are in no way monetizable, they gave vague answers about "user insights". I can guarantee there will be many other major extensions that have sold out their users. [1] https://chrome.google.com/webstore/detail/old-reddit-redirect/dneaehbmnbhcippjikoajpoabadpodje https://chrome.google.com/webstore/detail/old-reddit-redirec... [2] https://chrome.google.com/webstore/detail/break-timer/hklkdbpicdmlpoiellngedpejjkmapei/reviews https://chrome.google.com/webstore/detail/break-timer/hklkdb... [3] https://chrome.google.com/webstore/detail/reddit-comment-collapser/njmimaecgocggclbecipdimilidimlpl https://chrome.google.com/webstore/detail/reddit-comment-col...

logicallee 8y ago
I realize this is bad, but what happens to the user data exactly? I mean can someone here paint the bleakest, most dystopian possible use or future?
- garganzol 8y ago
  Build a social/interaction graph and fill everything with Ads while selling the same information to intelligence agencies. No discretion. Only money. Nothing personal, it's just business. Sounds familiar? Facebook invented that already.
- peteretep 8y ago
  It gets sold to private investigators and insurers, and you shouldn't have ever Googled for "alzheimer disease symptoms" and you lose your child custody rights after a judge decides what you're looking at on YouPorn isn't sufficiently healthy.
- throwawaymath 8y ago
  The dystopian scenarios are fun to think about, but realistically speaking what happens is your data is used for market research. The vast majority of it is used to curate your advertising profile more effectively or to generate financial insights about companies based on consumer habits. In my experience anonymization is hit or miss, but ostensibly always in place.
- Blaaguuu 8y ago
  A lot of people focus on how this information is used by advertisers, which can be a problem, but in my opinion the bigger issue is how data brokers are starting to act like completely unregulated and sometimes highly inaccurate credit reports.
  - AznHisoka 8y ago
    do you mean the data is actually used to determine the credit of a business/individual?
fabricexpert 8y ago
I also have been contacted many times, and offered 1-3k for an extension I have with about 15k users. The extension has a backend API and web service which is required for the extension to work, not once has a buyer asked about acquiring that. They only want the extension and literally have no understanding of how it works or what it does. Their intent is obvious.
bovine3dom 8y ago
On the other side of the coin, Firefox makes it quite hard to push updates to users that require more permissions, requiring manual intervention to update. It signifies this with a small muted yellow exclamation mark on the hamburger menu, which is really hard to see. I've not received my own updates for weeks a few times because I haven't noticed the warning, and about a third of our users are on ancient versions presumably because of it [1]. I think the real solution to this problem is GDPR: massive fines if you abuse your users' trust (and get caught). I'm not keen on the literal dark pattern that Firefox uses to dissuade developers from requiring new permissions. [1] https://addons.mozilla.org/en-US/firefox/addon/tridactyl-vim/statistics/usage/versions/?last=365# https://addons.mozilla.org/en-US/firefox/addon/tridactyl-vim...
- worble 8y ago
  >On the other side of the coin, Firefox makes it quite hard to push updates to users that require more permissions, requiring manual intervention to update. It signifies this with a small muted yellow exclamation mark on the hamburger menu, which is really hard to see. I'm not sure how you can see this as anything but a good thing. If your extension wants more permissions than originally promised, then it absolutely should have to require user intervention to do. You can't just change the agreement like that. Maybe it could be better communicated, although I have to say I don't think I've ever not noticed that yellow icon, but this is far, far better than the alternative.
- fabricexpert 8y ago
  New permissions shouldn't be taken lightly. One day you'll install an extension that access only on a specific site, and the next day it's requesting access to all your bookmarks, location data, history etc. If you make it into a next next next dialogue box you're implementing an easily abused dark pattern. A better approach would be to allow extension upgrades, irrespective of permissions. If a user chooses to deny permissions the extension should still work on the latest version.
  - wruza 8y ago
    Why not just return empty datasets to extensions that ask for too much? Empty history, empty address book, white noise for camera and microphones, etc. Then it would be possible not only to ‘accept’ what it does or uninstall, but seamlessly deny what you don’t want.
deleted 8y ago
[deleted]
mastef 8y ago
It's actually how I became active in the webstore.. Tab Manager was sold to some other company and filled with malware afterwards. It took the webstore team over a year to take it down. Luckily enough the source code was still on github, and I managed to fork it and improve that version into "Tab Manager Plus" [1] Since then I've refurbished around 10 extensions and published a few of my own. It's fun, just annoying that malicious extensions aren't getting taken down fast enough, since I suppose not enough people report them. How to report malicious extensions is also sometimes unclear. Some people think they have to install them first, that's only true for ratings, not reports. For example to report the extension from this blog post you just have to submit this form [2] For other malicious extensions simply replace the extension id in that link. [1] Tab Manager Plus - https://chrome.google.com/webstore/detail/tab-manager-plus-for-chro/cnkdjjdmfiffagllbiiilooaoofcoeff https://chrome.google.com/webstore/detail/tab-manager-plus-f... [2] Report extension - https://chrome.google.com/webstore/report/fjnbnpbmkenffdnngjfgmeleoegfcffe https://chrome.google.com/webstore/report/fjnbnpbmkenffdnngj...
AznHisoka 8y ago
SimilarWeb and Jumpshot are the major clickstream companies that buy these extensions. One way to see whether an extension mines your browsing history is to use a tool like Fiddler to sniff out the outgoing requests. One sneaky way to get back at them is to send a bunch of fake “poison” requests with fake data back at these guys. It probably wont hurt them but if enough people do it, it might make their data worse and make their operation unprofitable.
invalidusernam3 8y ago
Those two reddit plugins are great, particularly the comment collapse one. I'm used to using the appolo reddit app now and I love its collapse feature (the native reddit one sucks). Installed and will be using both. Please don't steal my data!
phobosdeimos 8y ago
I disagree. Every time an add on is updated in FF I get directed to the patch notes. RTFM.
- sli 8y ago
  This is absolutely not universally true.
whrobbins 8y ago
This issue stands for apps as well. I once had someone try to buy [1] my popular Android app just to replace it with malware which would then be pushed to users through an innocuous update. What's so interesting to me is that there's no good way to prevent or even detect this. [1] https://willrobbins.org/a-clever-malware-tactic-and-why-theres-nothing-you-can-do-about-it/ https://willrobbins.org/a-clever-malware-tactic-and-why-ther...

logicallee 8y ago

I realize this is bad, but what happens to the user data exactly? I mean can someone here paint the bleakest, most dystopian possible use or future?

garganzol 8y ago
Build a social/interaction graph and fill everything with Ads while selling the same information to intelligence agencies. No discretion. Only money. Nothing personal, it's just business. Sounds familiar? Facebook invented that already.
peteretep 8y ago
It gets sold to private investigators and insurers, and you shouldn't have ever Googled for "alzheimer disease symptoms" and you lose your child custody rights after a judge decides what you're looking at on YouPorn isn't sufficiently healthy.
throwawaymath 8y ago
The dystopian scenarios are fun to think about, but realistically speaking what happens is your data is used for market research. The vast majority of it is used to curate your advertising profile more effectively or to generate financial insights about companies based on consumer habits. In my experience anonymization is hit or miss, but ostensibly always in place.
Blaaguuu 8y ago
A lot of people focus on how this information is used by advertisers, which can be a problem, but in my opinion the bigger issue is how data brokers are starting to act like completely unregulated and sometimes highly inaccurate credit reports.
- AznHisoka 8y ago
  do you mean the data is actually used to determine the credit of a business/individual?

fabricexpert 8y ago

I also have been contacted many times, and offered 1-3k for an extension I have with about 15k users. The extension has a backend API and web service which is required for the extension to work, not once has a buyer asked about acquiring that. They only want the extension and literally have no understanding of how it works or what it does. Their intent is obvious.

bovine3dom 8y ago

On the other side of the coin, Firefox makes it quite hard to push updates to users that require more permissions, requiring manual intervention to update. It signifies this with a small muted yellow exclamation mark on the hamburger menu, which is really hard to see. I've not received my own updates for weeks a few times because I haven't noticed the warning, and about a third of our users are on ancient versions presumably because of it [1]. I think the real solution to this problem is GDPR: massive fines if you abuse your users' trust (and get caught). I'm not keen on the literal dark pattern that Firefox uses to dissuade developers from requiring new permissions. [1] https://addons.mozilla.org/en-US/firefox/addon/tridactyl-vim/statistics/usage/versions/?last=365# https://addons.mozilla.org/en-US/firefox/addon/tridactyl-vim...

worble 8y ago
>On the other side of the coin, Firefox makes it quite hard to push updates to users that require more permissions, requiring manual intervention to update. It signifies this with a small muted yellow exclamation mark on the hamburger menu, which is really hard to see. I'm not sure how you can see this as anything but a good thing. If your extension wants more permissions than originally promised, then it absolutely should have to require user intervention to do. You can't just change the agreement like that. Maybe it could be better communicated, although I have to say I don't think I've ever not noticed that yellow icon, but this is far, far better than the alternative.
fabricexpert 8y ago
New permissions shouldn't be taken lightly. One day you'll install an extension that access only on a specific site, and the next day it's requesting access to all your bookmarks, location data, history etc. If you make it into a next next next dialogue box you're implementing an easily abused dark pattern. A better approach would be to allow extension upgrades, irrespective of permissions. If a user chooses to deny permissions the extension should still work on the latest version.
- wruza 8y ago
  Why not just return empty datasets to extensions that ask for too much? Empty history, empty address book, white noise for camera and microphones, etc. Then it would be possible not only to ‘accept’ what it does or uninstall, but seamlessly deny what you don’t want.

deleted 8y ago

[deleted]

mastef 8y ago

It's actually how I became active in the webstore.. Tab Manager was sold to some other company and filled with malware afterwards. It took the webstore team over a year to take it down. Luckily enough the source code was still on github, and I managed to fork it and improve that version into "Tab Manager Plus" [1] Since then I've refurbished around 10 extensions and published a few of my own. It's fun, just annoying that malicious extensions aren't getting taken down fast enough, since I suppose not enough people report them. How to report malicious extensions is also sometimes unclear. Some people think they have to install them first, that's only true for ratings, not reports. For example to report the extension from this blog post you just have to submit this form [2] For other malicious extensions simply replace the extension id in that link. [1] Tab Manager Plus - https://chrome.google.com/webstore/detail/tab-manager-plus-for-chro/cnkdjjdmfiffagllbiiilooaoofcoeff https://chrome.google.com/webstore/detail/tab-manager-plus-f... [2] Report extension - https://chrome.google.com/webstore/report/fjnbnpbmkenffdnngjfgmeleoegfcffe https://chrome.google.com/webstore/report/fjnbnpbmkenffdnngj...

AznHisoka 8y ago

SimilarWeb and Jumpshot are the major clickstream companies that buy these extensions. One way to see whether an extension mines your browsing history is to use a tool like Fiddler to sniff out the outgoing requests. One sneaky way to get back at them is to send a bunch of fake “poison” requests with fake data back at these guys. It probably wont hurt them but if enough people do it, it might make their data worse and make their operation unprofitable.

invalidusernam3 8y ago

Those two reddit plugins are great, particularly the comment collapse one. I'm used to using the appolo reddit app now and I love its collapse feature (the native reddit one sucks). Installed and will be using both. Please don't steal my data!

phobosdeimos 8y ago

I disagree. Every time an add on is updated in FF I get directed to the patch notes. RTFM.

sli 8y ago
This is absolutely not universally true.

whrobbins 8y ago

This issue stands for apps as well. I once had someone try to buy [1] my popular Android app just to replace it with malware which would then be pushed to users through an innocuous update. What's so interesting to me is that there's no good way to prevent or even detect this. [1] https://willrobbins.org/a-clever-malware-tactic-and-why-theres-nothing-you-can-do-about-it/ https://willrobbins.org/a-clever-malware-tactic-and-why-ther...