18 ms·

Massive spying on users of Google's Chrome shows new security weakness

409 points by commoner 6y ago

DuckConference 6y ago
The other side of this is the many complaints in HN threads about restrictions on what extensions can do and which ones are allowed. I can't say whether chrome's extension library strikes the right balance, but I think it's a difficult tradeoff.
- simion314 6y ago
  A solution would be that browser maker always check what are the most popular extensions and implement those feature in browsers so you get security and performance. It is more work for the browser maker but you do it for the popular extension (if you care about your users and not about yourself - this applies to GNOME too)
  - GoblinSlayer 6y ago
    Remember pdfjs? Performance will be the same.
    - simion314 6y ago
      Pdf.js is great for majority of users IMO. A good example is readability, is part of many browsers now by default so you don't have to hunt for a good and trustworthy extension.
- realusername 6y ago
  The main issue people complain about is that it takes months for Google to review extensions and they shut down extensions randomly without giving reasons, not the amount of permissions.
- Mirioron 6y ago
  Instead of just outright limiting extensions you could give users the choice. Give us an option to make it impossible for extensions to send out data for example.
  - bgdam 6y ago
    Exactly. What Chrome and Firefox should do, is bundle their own analytics program into the extensions program, make these analytics available via AMO or Chrome Web Store (already has a very basic version), and remove the ability for extensions to perform outgoing network requests unless the user explicitly whitelists the extension. Even then, show big scary warnings about extensions given this permission being able to steal your bank passwords, just to keep the less tech-savvy informed.
    - Thorrez 6y ago
      One thing extensions commonly do is modify the page. If an extension can modify the page, it can insert an <img> which will cause a network request to happen. How do you plan to prevent this? Prevent extensions from modifying the page?
      - AznHisoka 6y ago
        Same suggestion applies. Show users the warning that extensions can modify your page and have users explicitly approve of it.
        pornel 6y ago
        And they already do that. The problem is, almost every extension has a legitimate need to read and/or modify the page, so people click through this permission warning like Vista's UAC.
  - hombre_fatal 6y ago
    I do notice that almost all of the extensions I use have no need to make http requests nor modify the dom (e.g. to add tracking <img> or css url()). I wonder what other methods there are to exfiltrate info beyond that.
azinman2 6y ago
I feel like Google Chrome should just have some icon or other visual indicator of when an extension has made a networking request. In addition, use the iOS model of permission and prompt the user when it wants to do something like access the network or read your browsing history. Perhaps if this happens on a frequent basis, give another indication that it's happening all the time with the ability to ignore such warnings. You need to repeatedly show such evidence to users for them to understand what's happening.
- s_gourichon 6y ago
  Most people would click on any warning without even reading, unfortunately.
  - azinman2 6y ago
    Which is why I say "You need to repeatedly show such evidence to users for them to understand what's happening." But showing the warning at least lets the more sophisticated people know what's up, and alerts them sooner that an extension that they previously trusted in one context now is doing something unexpected post-update.
jimbob45 6y ago
At this point, I treat Chrome like a Huawei phone: never secure and only to be used at work for those sweet sweet dev tools.
- tarkin2 6y ago
  I use Firefox’s tools. The console as a tiny editor is cool. I think Chrome has a better network timeline/waterfall and performance monitor thing. But I only use those occasionally.
  - chopin 6y ago
    I hate Chrome with a passion. But: Annoyingly, Firefox hides the the call stack for some error messages which is especially painful if these come from a framework. Chrome never fails me to show the entire call stack. As well inspection of request and response content is painful. Mouse scroll doesn't work and the horizontal bar shows only up when scrolling all the way down. Finally copying and pasting any header content is abysmal. I never get it to work. I use Firefox, even for development because I reject any support for Google but I wish there weren't these usability issues.
- pkulak 6y ago
  Firefox devs tools are great. I just use Chrome to play the occasional Stadia game.
- rado 6y ago
  Same here. Also never used any browser extension. Web devs need the pure browser experience.
  - _puk 6y ago
    The cumulative total hours wasted from all the Devs that accidentally left an ad blocker on whilst developing, then spent time debugging a misbehaving app has to be pretty high! I know I've been caught out on that one before..
- dewey 6y ago
deleted 6y ago
[deleted]
0xy 6y ago
I wonder if these extensions are so hard to spot because spying is a core feature of Google Chrome, and most top extensions do this. For example, the extraordinarily popular extension Honey phones home about your purchases, shopping habits and other data without adequately disclosing that fact. It's hard to see why Google would care when Chrome was always a trojan horse to co-opt web standards for their own purposes and to prevent measures taken against invasive tracking and data collection in the first place. Tracking is built directly into Chrome's source. Chrome will send "X-Client-Data" headers with a low-entropy identifier on every request to DoubleClick, an advertising agency owned by Google. DoubleClick's hostname is explicitly whitelisted in Chrome source code. Chrome was always meant for massive spying, and any "crackdowns" are only a reaction to media pressure.
- sandstrom 6y ago
  Here are more details about 'X-Client-Data'. I'm not saying it's necessarily a good practice (and maybe it's something they should stop doing), but I wouldn't call it "spying". It's analytics, used to test new Chrome features. https://9to5google.com/2020/02/06/google-chrome-x-client-data-tracking/ https://9to5google.com/2020/02/06/google-chrome-x-client-dat...
  - 0xy 6y ago
    Why is DoubleClick in the whitelist?
    - joshuamorton 6y ago
      Presumably, since, as the list you're referring to mentions, it's a Google owned property, and accessed by a lot of people, even those who don't usually access other google properties, which makes it really useful for analytics on a broader selection of sites/connections. Like, the function you're referring to, `IsGoogleAssociatedDomainUrl`, seems to only be used to log some information about https. Or at least that's all I found from searching for it. So it's even less innocuous, the use appears to be "we'd like to know if our sites are broken under HTTPS", vs. just HTTPS being broken in general. [I work at Google, but don't work anywhere near chrome, and I know basically nothing about it] Edit: You were referring to a different spot (experiments), where what I originally said applies. Having more analytics is really useful when trying to diagnose problems.
algesten 6y ago
Given that they're the engine now, does anyone know if Microsoft Edge is better than Chrome for for privacy?
- Fiveplus 6y ago
  Given that we're on HN, I distinctly remember reading on a comment that the new Edge supposedly dials home to MS and is not really secure either.
  - fowl2 6y ago
    At least, if you're on Windows you pretty much already have to trust Microsoft, so you may as well not have to trust Google AS WELL.
  - GoblinSlayer 6y ago
    The concern is not that Chrome dials home to Google, but that any random dude scatters your data across entire internet.
    - Fiveplus 6y ago
      My comment is the answer to a specific comment asking about a tangential derivative based on the discussion (which is why it is not a new parent comment under the post itself). Thank you.
      - GoblinSlayer 6y ago
        Yeah, I mean a disconnected reply to a tangential question is misleading.
        deleted 6y ago
        [deleted]
- huhtenberg 6y ago
  They are both really bad for privacy. There's really no point in comparing them based on this criteria.
ThePhysicist 6y ago
There is a web intelligence company in Israel that is known to buy popular browser extensions like “Web of Trust” and use them to exfiltrate browsing data (with tons of sensitive and personal information). They have been called out for this several times already and some of their extensions got removed from the store, they invariably turn back up again after a few weeks though (good connections to Google/Mozilla I guess). Firefox isn’t better than Chrome in that regard btw as it also turns a blind eye on this kind of data collection. Extensions are ideal to exfiltrate data from browsers as they bypass all security measures and can literally see everything you do on every single page you visit. It still boggles my mind how you can call a browser secure and privacy-friendly (in the case of Firefox) and at the same time allow such blatant abuse for years and years. Me and other people have been pointing this out since at least 2016 and demanded better security controls for plugins / extensions but I’m getting really tired of it.
- matheusmoreira 6y ago
  The only trustworthy extensions are uBlock Origin and EFF's Privacy Badger. Everything else is best viewed as potential malware, no different than random downloadable executables. Honestly, uBlock Origin and Privacy Badger are so important at this point they should just become part of the browser itself. They're already in a league of their own.
  - esperent 6y ago
    I trust both of these extensions far more as extensions than I would if they were part of Chrome.
    - chii 6y ago
      and that is why they will eventually be removed one way or another imo.
      - vbezhenar 6y ago
        AFAIK Chrome will change ad blocking API and uBlock Origin won't follow it. So switch to Firefox.
TheChaplain 6y ago
I'd say most such issues with extensions could be solved if they were "read-only", i.e. were prevented from inserting data into documents, making or adding data into outbound requests.
- pkulak 6y ago
  It could block ads with monads!
- ketzu 6y ago
  Unfortunately that would also remove the reason that people are using the extension in the first place.
- _puk 6y ago
  Kind of, but you can still leak a lot of information in a simple read-only GET GET /realylongstringwithmeaningfulbits/{user identifier} This is basically what tracking pixels have been doing for years (1x1 transparent PNG).
  - TheChaplain 6y ago
    Sorry, I wasn't clear, I meant making _any_ outbound connections from the extension. If it can read or simply drop (such as for blockers) requests it should be fine, and make it harder to leak data.
FriendlyNormie 6y ago
Just 15 years ago, anything that has access to all data on all pages regardless of the stated reason would be classified as a UXSS hack and anyone creating such a thing would be locked up for decades. The fluoride is really doing its job.
Fiveplus 6y ago
What extensions do you primarily use on Chrome (if you do)? My list (on brave) includes: >uBlock Origin >Decentraleyes >Stylus
- deleted 6y ago
  [deleted]
- AlexanderDhoore 6y ago
  > I don't care about cookies
  - rsanek 6y ago
    No need for a separate extension, just go to ublock's filter lists and enable the cookies list under 'annoyances'
  - sopromo 6y ago
    You can hide all cookies popups with uBlock Origin and the annoyances filter.
- topspin 6y ago
  Stylus is the only one I had installed in Brave at the time you asked. I have several in Chrome but the thing is I no longer really use Chrome for general browsing. Chrome has been relegated to development activity; I isolate developer tools to that browser and leave them out of my day-to-day browser (Brave.) It's a nice arrangement really. Decentraleyes is interesting. Thanks for pointing that out.
  - Fiveplus 6y ago
    I see, I sometimes prefer using Brave when a website doesn't work okay on firefox. Or like you said, using developer tools of chrome are a good use case too. About decentraleyes, happy to help. It's a remarkable extension and I've been using it for about 2 years now. It's crazy how I still discover little tips and tricks that really help me while browsing forums to this date. Things that I would never otherwise encounter. I would have installed HTTPS everywhere but given that I rarely browse websites on brave, I reserved it for firefox.
fabian2k 6y ago
Potentially dumb question here, but would it be generally possible to create a permissions system for browser extensions that can distinguish between an extension that is actually sending information based on sensitive sources like page content and browser history and an extension that only sends harmless stuff over the network like e.g. asking for updated ad block lists? I'm imagining something like a sufficiently advanced type system that could tag data from sensitive sources, and force you to use a different API if you e.g. want to put that kind of tagged information in a network request. Though even if this would be available, I suspect there are many more indirect methods of exfiltrating information e.g. if you have the permission to change page content, which are probably very hard to impossible to distinguish effectively from benign stuff. Some of the most useful extensions need really scary permissions. I don't see any good way to robustly fix malicious extensions than to create a permissions system that would make the scary permissions unnecessary for most cases. The current system is broken enough that I try very hard to minimize which extensions I use. It's essentially just an ad blocker and a password safe in my main browser. And then a bunch of dev tools in a different browser I use for development, but not for browsing in general.
- lifty 6y ago
  I don’t see why it wouldn’t be possible to make a more granular extension permission system that also has stricter sandboxing. Safari is already going in that direction. The new extension system is more restricted, although I don’t know if there is any granularity to it.
  - moritonal 6y ago
    So WebExtensions support this, even dynamic permissions (like on Android). But I've found I've had to push developers to use it because it makes their life a bit harder and it's already a side-project.
    - kevingadd 6y ago
      The UX for the dynamic permissions and fine-grained permissions is, to be generous, not good. I never saw any expressed desire or commitment from the Chrome team to improve on this which is likely why so many extensions still just request blanket access instead.
bartkappenburg 6y ago
I would pay money for an extension that keeps track on datatraffic of other installed extension and creates firewall rules (or something equivalent) based on my permission/deny. (I know that this is the other way around, but apparantly chrome isn't fixing these data issues...)
- ricardo81 6y ago
  While I only have limited experience writing extensions, this seems doable. You can most definitely add a hook for every outgoing request, though I'm not sure if the browser lets you know the origin of the request, i.e. the browser window or an extension. If it could, at the most basic level it could write outgoing data to a log file.
  - tim1994 6y ago
    AFAIK this is not possible. I don't think you can block request made by other extensions. I assume the API you were referring to is https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/webRequest https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...
    - ricardo81 6y ago
      I wasn't sure if you could identify the origin of the request, I guess it makes sense that would not be possible or it could end up being cat and mouse between extensions. For me specifically I had done some work with Firefox extensions, pre-quantum.
tannhaeuser 6y ago
Is Chromium safe to use, or at least safe to use as packaged with Ubuntu's snaps? I know, I know, snaps are a difficult topic on their own, but my point is that, if Chrome's (and Edge's AFAIK) general hunger for data is a generally accepted fact at this point, then wouldn't employers/enterprises advising to use Chrome in their corporate networks not put themselves under risk of being sued for gross neglect in case customer data were leaking from Chrome sessions?
- querez 6y ago
  You can still install add-ons/extensions in Chromium, so it wouldn't help at all. Also, most malicious extensions try to siphon data from your web-session (e.g. your open gmail page), so sandoxing through snaps doesn't help, either. Chrome is still a fairly safe browser, and it is well within Google's interests to keep it that way. The big issue is users installing malicious extensions disguised as useful ones, and that's an issue independent of the used browser. You could argue that you are much safer with Firefox. Not because it's inherently safer, but simply because it's lower market penetration means that it is a less interesting target.
- grey_earthling 6y ago
  "It's Google. Everyone uses it. The defence rests." No-one gets fired for choosing IBM.
- zelphirkalt 6y ago
  Well,once at umiversity I saw Chrome installed on all machines, so I asked, why they installed spyware on _university_ machines. All I got was disbelieve and ridicule. These people are not even aware of what they are doing, nor informed enough to make such decisions.
  - tannhaeuser 6y ago
    I guess if it were a CompSci faculty, the therapy is making these actions of your uni public, then see their academic reputation asymptotically approaching zero :) Though it's not clear what Chrome sends home, and TFA is only about Chrome plugins, so lets not prematurely start a witch hunt.
jaredtn 6y ago
Which extensions were compromised? Not seeing a list anywhere.
- sergeykish 6y ago
  Mozilla maintains a list https://blocked.cdn.mozilla.net/ https://blocked.cdn.mozilla.net/ It would be nice to have it in Chrome https://bugs.chromium.org/p/chromium/issues/detail?id=1096436 https://bugs.chromium.org/p/chromium/issues/detail?id=109643... (star it please)
deleted 6y ago
[deleted]
dkthehuman 6y ago
I've been developing Chrome extensions full-time for about a year now [1], and it's honestly terrifying just how much access extensions have to sensitive user data. Best practices I've adopted for my own extension use: - Create a separate test Chrome profile to try out extensions - Delete extensions that ask for the overly broad "Read and change all your data on the websites you visit" permission unless (a) the extension is open-source (b) backed by a reputable company or (c) has a very good reason for requesting it, and I trust the makers One of the biggest issues with extensions today is the permissions model. On more established platforms like iOS and Android, all sensitive permissions have to be requested at runtime rather than at install-time, which forces developers to explain why they need the permissions they ask for. With browser extensions, there's no such requirement, which leads many developers to ask for all the permissions they can get because there's no downside to doing so. That's why over 80% of the top 1000 extensions ask for access to ALL domains [2], which means they have the power to steal any of your data (emails, passwords, etc.) on any site if they wanted or became compromised. I've written about this issue before [3] and the good news is that with Manifest V3, the Chrome team is planning to require that host permissions (which specifies the domains an extension can run on) be requested at runtime. I think the team should go even further and enforce the runtime restriction for all sensitive permissions, not just host permissions — if you agree, feel free to chime in on the post I made about it on the chromium-extensions mailing list [4]. The extension ecosystem is pretty broken right now security and privacy-wise, but with the upcoming changes, it's headed in a better direction. [1] https://news.ycombinator.com/item?id=22936742 https://news.ycombinator.com/item?id=22936742 [2] https://docs.google.com/document/d/1nPu6Wy4LWR66EFLeYInl3NzzhHzc-qnk4w4PX-0XMw8/edit#heading=h.oenw1ekaaubz https://docs.google.com/document/d/1nPu6Wy4LWR66EFLeYInl3Nzz... [3] https://www.notion.so/dkthehuman/Day-4-The-Dangers-of-Chrome-Extensions-af93b84006ed48c18b807f512b6c0a07 https://www.notion.so/dkthehuman/Day-4-The-Dangers-of-Chrome... [4] https://groups.google.com/a/chromium.org/d/msg/chromium-extensions/gJZFu8UsX4M/DigVX25cBQAJ https://groups.google.com/a/chromium.org/d/msg/chromium-exte...
GoblinSlayer 6y ago
People want to use IE6 and have security at the same time. History must repeat.
thePunisher 6y ago
The gist is that it's almost impossible to detect fraudulent extensions without extensive human review. Google should only allow extensions which it has signed off on.
ComodoHacker 6y ago
I see this as an argument in favor of native apps. I mean really native, not Electron-esque ones. As you more and more turn the browser into an OS, you have to treat it like an OS. Don't allow unprivileged user to install unsigned kernel modules.
- kevingadd 6y ago
  It's really funny that on native there are all sorts of well-established models for communication between applications, sharing of files, etc. There are per-file and per-folder permissions systems, there's per-user permissions, and programs can be run with differing levels of access. If an app running in an App Store style sandbox (available on both OS X and Windows) wants to get its paws on my Outlook inbox files, it has some hard work ahead of it, and that's pretty nice. Even outside of a sandbox, the tools available to a regular (non-administrator) process are relatively restricted which helps limit the mischief they can easily get up to. And then on the web, you just load pages. Pages are pages, except ones that come over https get Special Privileges because the Chrome team decided that was the best way to decide whether user content could be trusted. And pages that load from the local filesystem are less trusted, because it's only safe if it's coming through a socket. Any content hosted on a given domain is just as trustworthy as other content on that domain, and most importantly - very importantly - if the end user installs an extension, it's very essential that the extension be able to easily exfiltrate every single byte of your gmail inbox. After all, pages are pages - why should gmail or my bank be special compared to any other website? Nobody put any real thought into how to structure the permissions model to combat real security threats. WebExtensions (the de-facto Worse is Better standard) basically dumps a bunch of different features into the 'do anything' permission bucket and leaves it up to the user to decide whether to trust an extension, despite the fact that an extension's ownership can change at any time. If an extension starts out without requesting any permissions, requesting a new permission (to do something useful) will silently disable your extension for all your customers - so naturally, what people do is request every single permission from the beginning, and users click Install anyway. It's positively grotesque that the warning for this is still "read and change all your data on the websites you visit", and that so many trivial things require it. Chrome still makes no effort to draw your attention to how very, very dangerous this permission is. Say what you will about the UAC trainwreck but at least the SmartScreen 'this software is suspect' popups are suitably scary Red or Yellow and large, legible text.
andirk 6y ago
I am curious as to how Brave browser works out of the box to thwart these types of malicious extensions. Brave neuters the common abuses of browser technology like tracking, but what about detecting third requests _even if you have agreed to them_?
noir_lord 6y ago
Other than a couple of minor developer related extensions the only extension I couldn't live without (in the sense it would make using the web significantly worse) is ublock origin - which is open source, vettable and you can install from the source if you really distrust the extension fronts.
endsofinvention 6y ago
The "mystery" company behind the extensions is Genimous, parent company of Polarity Technologies. Polarity owns the extension referenced in the Awake blog post: https://awakesecurity.com/blog/google-doppelganger-malicious-chrome-extension/ https://awakesecurity.com/blog/google-doppelganger-malicious...
afrcnc 6y ago
oh, the clickbait it's just shitty chrome extensions gobbling traffic history to resell to ad companies "massive spying" lol... making it sound like cyber-espionage
- dewey 6y ago
  You make it sounds like ad companies are more trustworthy than cyber espionage companies. Do you think the ad companies actually keep all that data? It's resold, hacked and shared.
phantom_oracle 6y ago
This will make the rounds because it has appeared on a large news agency and will be amplified louder than Joe Blog could do on his/her own, but this isn't a novel or shocking news. You don't need to look very far to see how shady the internet gets. Go to any mainstream news website that runs ads and you will see those scam 3rd-party ads(they used to promote bitcoin ads a few years ago until the mainstream outrage) you wouldn't click on in a million years. Now I'm not saying those ads are connected to broader malware, but if you start there you will uncover these shady operators(I discovered this when I did a little digging on a streaming website that provided content I could not obtain from the 32nd streaming service that I have to pay $10 a month to watch - and the amazing fact is that the same scammy ads you see on majornews.com is no different to the scammy ones you will see on torrentxyz.com).
amatecha 6y ago
Get something like Pi-Hole or the MVPS hosts file ( https://winhelp2002.mvps.org/hosts.htm https://winhelp2002.mvps.org/hosts.htm ) to block the majority of ads. Deal with the few ads that remain and enjoy blocking the vast majority trivially easily, without sharing all your browsing activity with an extension you can't easily audit the functionality of.
qmmmur 6y ago
Yet the majority of people here will read this and continue to use it because they are 'poweruser' web devs.
koalaman 6y ago
I guess Microsoft is timing some negative Chrome PR for their launch. I was gob smacked by the way they jammed Edge down my throat in the last Windows update. Nothing has changed at that company.
itsRetarded 6y ago
And you have a very vocal crowd that claims "noscript" and "password management" extensions are MORE secure. Probably some significant overlap with people that claim autism is an advantage.
itsRetarded 6y ago
That really tries to fit into the same model, and fails. Almost every browser extension operation is this scrub non-entity, some blowjob hack loser that's drinking from a fountain of fly-by-night accidental success, and 99% would sell you up the river if only they could.
sergeykish 6y ago
A chain is only as strong as its weakest link: * developer wants compensation * browser gallery has no resources * users has no time to audit Why as a user of Linux distribution I feel safer than installing extension? I asked maintainers, they have no answer, they don't perform audit. What if push to the gallery and update automatically is bad idea? I mean in Linux distribution maintainers pull updates, they test it and push to stable. Each distribution can block update, it makes sense for author and maintainers to easy update with reproducible builds, source version control. Distribution may audit application - it is much simpler than audit by each user. Distribution may patch application to its standards. In theory authors and maintainers can be bought, in practice it is much harder. And by itself this reduces pressure. So I believe gallery should be split to trusted and others. And browsers should allow alternative galleries. I have a few extensions I trust. What do you think?

409 points by commoner 6y ago

The other side of this is the many complaints in HN threads about restrictions on what extensions can do and which ones are allowed. I can't say whether chrome's extension library strikes the right balance, but I think it's a difficult tradeoff.

simion314 6y ago
A solution would be that browser maker always check what are the most popular extensions and implement those feature in browsers so you get security and performance. It is more work for the browser maker but you do it for the popular extension (if you care about your users and not about yourself - this applies to GNOME too)
- GoblinSlayer 6y ago
  Remember pdfjs? Performance will be the same.
  - simion314 6y ago
    Pdf.js is great for majority of users IMO. A good example is readability, is part of many browsers now by default so you don't have to hunt for a good and trustworthy extension.
realusername 6y ago
The main issue people complain about is that it takes months for Google to review extensions and they shut down extensions randomly without giving reasons, not the amount of permissions.
Mirioron 6y ago
Instead of just outright limiting extensions you could give users the choice. Give us an option to make it impossible for extensions to send out data for example.
- bgdam 6y ago
  Exactly. What Chrome and Firefox should do, is bundle their own analytics program into the extensions program, make these analytics available via AMO or Chrome Web Store (already has a very basic version), and remove the ability for extensions to perform outgoing network requests unless the user explicitly whitelists the extension. Even then, show big scary warnings about extensions given this permission being able to steal your bank passwords, just to keep the less tech-savvy informed.
  - Thorrez 6y ago
    One thing extensions commonly do is modify the page. If an extension can modify the page, it can insert an <img> which will cause a network request to happen. How do you plan to prevent this? Prevent extensions from modifying the page?
    - AznHisoka 6y ago
      Same suggestion applies. Show users the warning that extensions can modify your page and have users explicitly approve of it.
      - pornel 6y ago
        And they already do that. The problem is, almost every extension has a legitimate need to read and/or modify the page, so people click through this permission warning like Vista's UAC.
- hombre_fatal 6y ago
  I do notice that almost all of the extensions I use have no need to make http requests nor modify the dom (e.g. to add tracking <img> or css url()). I wonder what other methods there are to exfiltrate info beyond that.

azinman2 6y ago

I feel like Google Chrome should just have some icon or other visual indicator of when an extension has made a networking request. In addition, use the iOS model of permission and prompt the user when it wants to do something like access the network or read your browsing history. Perhaps if this happens on a frequent basis, give another indication that it's happening all the time with the ability to ignore such warnings. You need to repeatedly show such evidence to users for them to understand what's happening.

s_gourichon 6y ago
Most people would click on any warning without even reading, unfortunately.
- azinman2 6y ago
  Which is why I say "You need to repeatedly show such evidence to users for them to understand what's happening." But showing the warning at least lets the more sophisticated people know what's up, and alerts them sooner that an extension that they previously trusted in one context now is doing something unexpected post-update.

jimbob45 6y ago

At this point, I treat Chrome like a Huawei phone: never secure and only to be used at work for those sweet sweet dev tools.

tarkin2 6y ago
I use Firefox’s tools. The console as a tiny editor is cool. I think Chrome has a better network timeline/waterfall and performance monitor thing. But I only use those occasionally.
- chopin 6y ago
  I hate Chrome with a passion. But: Annoyingly, Firefox hides the the call stack for some error messages which is especially painful if these come from a framework. Chrome never fails me to show the entire call stack. As well inspection of request and response content is painful. Mouse scroll doesn't work and the horizontal bar shows only up when scrolling all the way down. Finally copying and pasting any header content is abysmal. I never get it to work. I use Firefox, even for development because I reject any support for Google but I wish there weren't these usability issues.
pkulak 6y ago
Firefox devs tools are great. I just use Chrome to play the occasional Stadia game.
rado 6y ago
Same here. Also never used any browser extension. Web devs need the pure browser experience.
- _puk 6y ago
  The cumulative total hours wasted from all the Devs that accidentally left an ad blocker on whilst developing, then spent time debugging a misbehaving app has to be pretty high! I know I've been caught out on that one before..
dewey 6y ago

deleted 6y ago

[deleted]

0xy 6y ago

I wonder if these extensions are so hard to spot because spying is a core feature of Google Chrome, and most top extensions do this. For example, the extraordinarily popular extension Honey phones home about your purchases, shopping habits and other data without adequately disclosing that fact. It's hard to see why Google would care when Chrome was always a trojan horse to co-opt web standards for their own purposes and to prevent measures taken against invasive tracking and data collection in the first place. Tracking is built directly into Chrome's source. Chrome will send "X-Client-Data" headers with a low-entropy identifier on every request to DoubleClick, an advertising agency owned by Google. DoubleClick's hostname is explicitly whitelisted in Chrome source code. Chrome was always meant for massive spying, and any "crackdowns" are only a reaction to media pressure.

sandstrom 6y ago
Here are more details about 'X-Client-Data'. I'm not saying it's necessarily a good practice (and maybe it's something they should stop doing), but I wouldn't call it "spying". It's analytics, used to test new Chrome features. https://9to5google.com/2020/02/06/google-chrome-x-client-data-tracking/ https://9to5google.com/2020/02/06/google-chrome-x-client-dat...
- 0xy 6y ago
  Why is DoubleClick in the whitelist?
  - joshuamorton 6y ago
    Presumably, since, as the list you're referring to mentions, it's a Google owned property, and accessed by a lot of people, even those who don't usually access other google properties, which makes it really useful for analytics on a broader selection of sites/connections. Like, the function you're referring to, `IsGoogleAssociatedDomainUrl`, seems to only be used to log some information about https. Or at least that's all I found from searching for it. So it's even less innocuous, the use appears to be "we'd like to know if our sites are broken under HTTPS", vs. just HTTPS being broken in general. [I work at Google, but don't work anywhere near chrome, and I know basically nothing about it] Edit: You were referring to a different spot (experiments), where what I originally said applies. Having more analytics is really useful when trying to diagnose problems.

algesten 6y ago

Given that they're the engine now, does anyone know if Microsoft Edge is better than Chrome for for privacy?

Fiveplus 6y ago
Given that we're on HN, I distinctly remember reading on a comment that the new Edge supposedly dials home to MS and is not really secure either.
- fowl2 6y ago
  At least, if you're on Windows you pretty much already have to trust Microsoft, so you may as well not have to trust Google AS WELL.
- GoblinSlayer 6y ago
  The concern is not that Chrome dials home to Google, but that any random dude scatters your data across entire internet.
  - Fiveplus 6y ago
    My comment is the answer to a specific comment asking about a tangential derivative based on the discussion (which is why it is not a new parent comment under the post itself). Thank you.
    - GoblinSlayer 6y ago
      Yeah, I mean a disconnected reply to a tangential question is misleading.
      - deleted 6y ago
        [deleted]
huhtenberg 6y ago
They are both really bad for privacy. There's really no point in comparing them based on this criteria.

ThePhysicist 6y ago

There is a web intelligence company in Israel that is known to buy popular browser extensions like “Web of Trust” and use them to exfiltrate browsing data (with tons of sensitive and personal information). They have been called out for this several times already and some of their extensions got removed from the store, they invariably turn back up again after a few weeks though (good connections to Google/Mozilla I guess). Firefox isn’t better than Chrome in that regard btw as it also turns a blind eye on this kind of data collection. Extensions are ideal to exfiltrate data from browsers as they bypass all security measures and can literally see everything you do on every single page you visit. It still boggles my mind how you can call a browser secure and privacy-friendly (in the case of Firefox) and at the same time allow such blatant abuse for years and years. Me and other people have been pointing this out since at least 2016 and demanded better security controls for plugins / extensions but I’m getting really tired of it.

matheusmoreira 6y ago
The only trustworthy extensions are uBlock Origin and EFF's Privacy Badger. Everything else is best viewed as potential malware, no different than random downloadable executables. Honestly, uBlock Origin and Privacy Badger are so important at this point they should just become part of the browser itself. They're already in a league of their own.
- esperent 6y ago
  I trust both of these extensions far more as extensions than I would if they were part of Chrome.
  - chii 6y ago
    and that is why they will eventually be removed one way or another imo.
    - vbezhenar 6y ago
      AFAIK Chrome will change ad blocking API and uBlock Origin won't follow it. So switch to Firefox.

TheChaplain 6y ago

I'd say most such issues with extensions could be solved if they were "read-only", i.e. were prevented from inserting data into documents, making or adding data into outbound requests.

pkulak 6y ago
It could block ads with monads!
ketzu 6y ago
Unfortunately that would also remove the reason that people are using the extension in the first place.
_puk 6y ago
Kind of, but you can still leak a lot of information in a simple read-only GET GET /realylongstringwithmeaningfulbits/{user identifier} This is basically what tracking pixels have been doing for years (1x1 transparent PNG).
- TheChaplain 6y ago
  Sorry, I wasn't clear, I meant making _any_ outbound connections from the extension. If it can read or simply drop (such as for blockers) requests it should be fine, and make it harder to leak data.

FriendlyNormie 6y ago

Just 15 years ago, anything that has access to all data on all pages regardless of the stated reason would be classified as a UXSS hack and anyone creating such a thing would be locked up for decades. The fluoride is really doing its job.

Fiveplus 6y ago

What extensions do you primarily use on Chrome (if you do)? My list (on brave) includes: >uBlock Origin >Decentraleyes >Stylus

deleted 6y ago
[deleted]
AlexanderDhoore 6y ago
> I don't care about cookies
- rsanek 6y ago
  No need for a separate extension, just go to ublock's filter lists and enable the cookies list under 'annoyances'
- sopromo 6y ago
  You can hide all cookies popups with uBlock Origin and the annoyances filter.
topspin 6y ago
Stylus is the only one I had installed in Brave at the time you asked. I have several in Chrome but the thing is I no longer really use Chrome for general browsing. Chrome has been relegated to development activity; I isolate developer tools to that browser and leave them out of my day-to-day browser (Brave.) It's a nice arrangement really. Decentraleyes is interesting. Thanks for pointing that out.
- Fiveplus 6y ago
  I see, I sometimes prefer using Brave when a website doesn't work okay on firefox. Or like you said, using developer tools of chrome are a good use case too. About decentraleyes, happy to help. It's a remarkable extension and I've been using it for about 2 years now. It's crazy how I still discover little tips and tricks that really help me while browsing forums to this date. Things that I would never otherwise encounter. I would have installed HTTPS everywhere but given that I rarely browse websites on brave, I reserved it for firefox.

fabian2k 6y ago

Potentially dumb question here, but would it be generally possible to create a permissions system for browser extensions that can distinguish between an extension that is actually sending information based on sensitive sources like page content and browser history and an extension that only sends harmless stuff over the network like e.g. asking for updated ad block lists? I'm imagining something like a sufficiently advanced type system that could tag data from sensitive sources, and force you to use a different API if you e.g. want to put that kind of tagged information in a network request. Though even if this would be available, I suspect there are many more indirect methods of exfiltrating information e.g. if you have the permission to change page content, which are probably very hard to impossible to distinguish effectively from benign stuff. Some of the most useful extensions need really scary permissions. I don't see any good way to robustly fix malicious extensions than to create a permissions system that would make the scary permissions unnecessary for most cases. The current system is broken enough that I try very hard to minimize which extensions I use. It's essentially just an ad blocker and a password safe in my main browser. And then a bunch of dev tools in a different browser I use for development, but not for browsing in general.

lifty 6y ago
I don’t see why it wouldn’t be possible to make a more granular extension permission system that also has stricter sandboxing. Safari is already going in that direction. The new extension system is more restricted, although I don’t know if there is any granularity to it.
- moritonal 6y ago
  So WebExtensions support this, even dynamic permissions (like on Android). But I've found I've had to push developers to use it because it makes their life a bit harder and it's already a side-project.
  - kevingadd 6y ago
    The UX for the dynamic permissions and fine-grained permissions is, to be generous, not good. I never saw any expressed desire or commitment from the Chrome team to improve on this which is likely why so many extensions still just request blanket access instead.

bartkappenburg 6y ago

I would pay money for an extension that keeps track on datatraffic of other installed extension and creates firewall rules (or something equivalent) based on my permission/deny. (I know that this is the other way around, but apparantly chrome isn't fixing these data issues...)

ricardo81 6y ago
While I only have limited experience writing extensions, this seems doable. You can most definitely add a hook for every outgoing request, though I'm not sure if the browser lets you know the origin of the request, i.e. the browser window or an extension. If it could, at the most basic level it could write outgoing data to a log file.
- tim1994 6y ago
  AFAIK this is not possible. I don't think you can block request made by other extensions. I assume the API you were referring to is https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/webRequest https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...
  - ricardo81 6y ago
    I wasn't sure if you could identify the origin of the request, I guess it makes sense that would not be possible or it could end up being cat and mouse between extensions. For me specifically I had done some work with Firefox extensions, pre-quantum.

tannhaeuser 6y ago

Is Chromium safe to use, or at least safe to use as packaged with Ubuntu's snaps? I know, I know, snaps are a difficult topic on their own, but my point is that, if Chrome's (and Edge's AFAIK) general hunger for data is a generally accepted fact at this point, then wouldn't employers/enterprises advising to use Chrome in their corporate networks not put themselves under risk of being sued for gross neglect in case customer data were leaking from Chrome sessions?

querez 6y ago
You can still install add-ons/extensions in Chromium, so it wouldn't help at all. Also, most malicious extensions try to siphon data from your web-session (e.g. your open gmail page), so sandoxing through snaps doesn't help, either. Chrome is still a fairly safe browser, and it is well within Google's interests to keep it that way. The big issue is users installing malicious extensions disguised as useful ones, and that's an issue independent of the used browser. You could argue that you are much safer with Firefox. Not because it's inherently safer, but simply because it's lower market penetration means that it is a less interesting target.
grey_earthling 6y ago
"It's Google. Everyone uses it. The defence rests." No-one gets fired for choosing IBM.
zelphirkalt 6y ago
Well,once at umiversity I saw Chrome installed on all machines, so I asked, why they installed spyware on _university_ machines. All I got was disbelieve and ridicule. These people are not even aware of what they are doing, nor informed enough to make such decisions.
- tannhaeuser 6y ago
  I guess if it were a CompSci faculty, the therapy is making these actions of your uni public, then see their academic reputation asymptotically approaching zero :) Though it's not clear what Chrome sends home, and TFA is only about Chrome plugins, so lets not prematurely start a witch hunt.

jaredtn 6y ago

Which extensions were compromised? Not seeing a list anywhere.

sergeykish 6y ago
Mozilla maintains a list https://blocked.cdn.mozilla.net/ https://blocked.cdn.mozilla.net/ It would be nice to have it in Chrome https://bugs.chromium.org/p/chromium/issues/detail?id=1096436 https://bugs.chromium.org/p/chromium/issues/detail?id=109643... (star it please)

deleted 6y ago

[deleted]

dkthehuman 6y ago

I've been developing Chrome extensions full-time for about a year now [1], and it's honestly terrifying just how much access extensions have to sensitive user data. Best practices I've adopted for my own extension use: - Create a separate test Chrome profile to try out extensions - Delete extensions that ask for the overly broad "Read and change all your data on the websites you visit" permission unless (a) the extension is open-source (b) backed by a reputable company or (c) has a very good reason for requesting it, and I trust the makers One of the biggest issues with extensions today is the permissions model. On more established platforms like iOS and Android, all sensitive permissions have to be requested at runtime rather than at install-time, which forces developers to explain why they need the permissions they ask for. With browser extensions, there's no such requirement, which leads many developers to ask for all the permissions they can get because there's no downside to doing so. That's why over 80% of the top 1000 extensions ask for access to ALL domains [2], which means they have the power to steal any of your data (emails, passwords, etc.) on any site if they wanted or became compromised. I've written about this issue before [3] and the good news is that with Manifest V3, the Chrome team is planning to require that host permissions (which specifies the domains an extension can run on) be requested at runtime. I think the team should go even further and enforce the runtime restriction for all sensitive permissions, not just host permissions — if you agree, feel free to chime in on the post I made about it on the chromium-extensions mailing list [4]. The extension ecosystem is pretty broken right now security and privacy-wise, but with the upcoming changes, it's headed in a better direction. [1] https://news.ycombinator.com/item?id=22936742 https://news.ycombinator.com/item?id=22936742 [2] https://docs.google.com/document/d/1nPu6Wy4LWR66EFLeYInl3NzzhHzc-qnk4w4PX-0XMw8/edit#heading=h.oenw1ekaaubz https://docs.google.com/document/d/1nPu6Wy4LWR66EFLeYInl3Nzz... [3] https://www.notion.so/dkthehuman/Day-4-The-Dangers-of-Chrome-Extensions-af93b84006ed48c18b807f512b6c0a07 https://www.notion.so/dkthehuman/Day-4-The-Dangers-of-Chrome... [4] https://groups.google.com/a/chromium.org/d/msg/chromium-extensions/gJZFu8UsX4M/DigVX25cBQAJ https://groups.google.com/a/chromium.org/d/msg/chromium-exte...

GoblinSlayer 6y ago

People want to use IE6 and have security at the same time. History must repeat.

thePunisher 6y ago

The gist is that it's almost impossible to detect fraudulent extensions without extensive human review. Google should only allow extensions which it has signed off on.

ComodoHacker 6y ago

I see this as an argument in favor of native apps. I mean really native, not Electron-esque ones. As you more and more turn the browser into an OS, you have to treat it like an OS. Don't allow unprivileged user to install unsigned kernel modules.

kevingadd 6y ago
It's really funny that on native there are all sorts of well-established models for communication between applications, sharing of files, etc. There are per-file and per-folder permissions systems, there's per-user permissions, and programs can be run with differing levels of access. If an app running in an App Store style sandbox (available on both OS X and Windows) wants to get its paws on my Outlook inbox files, it has some hard work ahead of it, and that's pretty nice. Even outside of a sandbox, the tools available to a regular (non-administrator) process are relatively restricted which helps limit the mischief they can easily get up to. And then on the web, you just load pages. Pages are pages, except ones that come over https get Special Privileges because the Chrome team decided that was the best way to decide whether user content could be trusted. And pages that load from the local filesystem are less trusted, because it's only safe if it's coming through a socket. Any content hosted on a given domain is just as trustworthy as other content on that domain, and most importantly - very importantly - if the end user installs an extension, it's very essential that the extension be able to easily exfiltrate every single byte of your gmail inbox. After all, pages are pages - why should gmail or my bank be special compared to any other website? Nobody put any real thought into how to structure the permissions model to combat real security threats. WebExtensions (the de-facto Worse is Better standard) basically dumps a bunch of different features into the 'do anything' permission bucket and leaves it up to the user to decide whether to trust an extension, despite the fact that an extension's ownership can change at any time. If an extension starts out without requesting any permissions, requesting a new permission (to do something useful) will silently disable your extension for all your customers - so naturally, what people do is request every single permission from the beginning, and users click Install anyway. It's positively grotesque that the warning for this is still "read and change all your data on the websites you visit", and that so many trivial things require it. Chrome still makes no effort to draw your attention to how very, very dangerous this permission is. Say what you will about the UAC trainwreck but at least the SmartScreen 'this software is suspect' popups are suitably scary Red or Yellow and large, legible text.

andirk 6y ago

I am curious as to how Brave browser works out of the box to thwart these types of malicious extensions. Brave neuters the common abuses of browser technology like tracking, but what about detecting third requests _even if you have agreed to them_?

noir_lord 6y ago

Other than a couple of minor developer related extensions the only extension I couldn't live without (in the sense it would make using the web significantly worse) is ublock origin - which is open source, vettable and you can install from the source if you really distrust the extension fronts.

endsofinvention 6y ago

The "mystery" company behind the extensions is Genimous, parent company of Polarity Technologies. Polarity owns the extension referenced in the Awake blog post: https://awakesecurity.com/blog/google-doppelganger-malicious-chrome-extension/ https://awakesecurity.com/blog/google-doppelganger-malicious...

afrcnc 6y ago

oh, the clickbait it's just shitty chrome extensions gobbling traffic history to resell to ad companies "massive spying" lol... making it sound like cyber-espionage

dewey 6y ago
You make it sounds like ad companies are more trustworthy than cyber espionage companies. Do you think the ad companies actually keep all that data? It's resold, hacked and shared.

phantom_oracle 6y ago

This will make the rounds because it has appeared on a large news agency and will be amplified louder than Joe Blog could do on his/her own, but this isn't a novel or shocking news. You don't need to look very far to see how shady the internet gets. Go to any mainstream news website that runs ads and you will see those scam 3rd-party ads(they used to promote bitcoin ads a few years ago until the mainstream outrage) you wouldn't click on in a million years. Now I'm not saying those ads are connected to broader malware, but if you start there you will uncover these shady operators(I discovered this when I did a little digging on a streaming website that provided content I could not obtain from the 32nd streaming service that I have to pay $10 a month to watch - and the amazing fact is that the same scammy ads you see on majornews.com is no different to the scammy ones you will see on torrentxyz.com).

amatecha 6y ago

Get something like Pi-Hole or the MVPS hosts file ( https://winhelp2002.mvps.org/hosts.htm https://winhelp2002.mvps.org/hosts.htm ) to block the majority of ads. Deal with the few ads that remain and enjoy blocking the vast majority trivially easily, without sharing all your browsing activity with an extension you can't easily audit the functionality of.

qmmmur 6y ago

Yet the majority of people here will read this and continue to use it because they are 'poweruser' web devs.

koalaman 6y ago

I guess Microsoft is timing some negative Chrome PR for their launch. I was gob smacked by the way they jammed Edge down my throat in the last Windows update. Nothing has changed at that company.

itsRetarded 6y ago

And you have a very vocal crowd that claims "noscript" and "password management" extensions are MORE secure. Probably some significant overlap with people that claim autism is an advantage.

itsRetarded 6y ago

That really tries to fit into the same model, and fails. Almost every browser extension operation is this scrub non-entity, some blowjob hack loser that's drinking from a fountain of fly-by-night accidental success, and 99% would sell you up the river if only they could.

sergeykish 6y ago

A chain is only as strong as its weakest link: * developer wants compensation * browser gallery has no resources * users has no time to audit Why as a user of Linux distribution I feel safer than installing extension? I asked maintainers, they have no answer, they don't perform audit. What if push to the gallery and update automatically is bad idea? I mean in Linux distribution maintainers pull updates, they test it and push to stable. Each distribution can block update, it makes sense for author and maintainers to easy update with reproducible builds, source version control. Distribution may audit application - it is much simpler than audit by each user. Distribution may patch application to its standards. In theory authors and maintainers can be bought, in practice it is much harder. And by itself this reduces pressure. So I believe gallery should be split to trusted and others. And browsers should allow alternative galleries. I have a few extensions I trust. What do you think?