11 ms·

There is a web intelligence company in Israel that is known to buy popular browser extensions like “Web of Trust” and use them to exfiltrate browsing data (with

• matheusmoreira 6y ago
  The only trustworthy extensions are uBlock Origin and EFF's Privacy Badger. Everything else is best viewed as potential malware, no different than random downloadable executables. Honestly, uBlock Origin and Privacy Badger are so important at this point they should just become part of the browser itself. They're already in a league of their own.
  • esperent 6y ago
    I trust both of these extensions far more as extensions than I would if they were part of Chrome.
    • chii 6y ago
      and that is why they will eventually be removed one way or another imo.
      • vbezhenar 6y ago
        AFAIK Chrome will change ad blocking API and uBlock Origin won't follow it. So switch to Firefox.
        • matheusmoreira 6y ago
          These API changes are actually perfectly reasonable. The new API lets extensions tell the browser what to do to the page in a declarative manner. This eliminates the need to pass private user data to the extension code and reduces the potential for abuse. This is a massive improvement compared to just letting random extensions see everything on the page. uBlock Origin just happens to be so important and trusted by the community that it shouldn't be subjected to these restrictions. It's a special case.
  • AareyBaba 6y ago
    What makes uBlock Origin a trustworthy extension ? because it is open-source ?
    • omnifischer 6y ago
      the number of eyes looking at it all the time.
      • AareyBaba 6y ago
        How many people are looking at the code ? The github commits show only one active contributor. I use uBlock Origin myself but I sometimes question the faith we place on open-source. We assume someone else is looking at the code.
        • imrelaxed 6y ago
          It would be awesome if there was a volunteer financed code review group to review popular open source projects. I think I’m not the only one who would happily donate money to such a group for code reviews for various OSS projects. Initial code reviews would require a lot of effort, unless somehow automated, but after that it would be fairly easy to monitor and verify updates and changes to the code.
          • dhimes 6y ago
            I wonder if EFF or somebody could issue a "verified" badge that apps could apply for, with a small fee to finance the devs doing the audits?
            • voicedYoda 6y ago
              I love this idea and could get behind contributing.
            • pdkl95 6y ago
              A prerequisite of that type of badge that I really wish existed is a standardized, interoperable protocol for curation. Instead of trying to solve the problem of malicious software with a walled garden app store, anyone should be able to publish their own curated list of software (or any type of project?). The core component is a crypto-signed statement like: { "curator": { name="Alice", pubkey="...", url="..." }, "artifact": { type="software", name="Bob's App", version="1.2.3", published_file="bobapp-1.2.3.zip", published_file_sha256="...", published_file_url="..." }, "statements": [ { "type": "member_of_collection", "name": "Recommended Apps" }, { "type": "attestation", "name": "Passed Audit FOO", ...audit info... } ] } Publish lists of these (maybe RSS-ish style?), with sort of browsable/searchable/app-store-ish UI. A key feature is verification. A user should be able to easily inspect the known "curator statements" for an app for the curators the subscribe to, and be able to run a "git fsck"-style validation that proves "this app really is the version that: passed the EFF's 'No Tracking' audit, is on reviewer Carol's 'Recommended' list, was rated "Teen" by the ESRB, and is on my friend Dave's 'Cool stuff you should try' list. With such a system, anyone can perform an audit, and people can make their own decisions about what they want to trust.
  • arminiusreturns 6y ago
    For those who like uBlock origin, you owe it to yourself to also checkout uMatrix. I use both.
    • Drawde 6y ago
      Why not just use ublock origin in medium mode[0] (or hard mode[1] if you're so inclined)? [0]https://github.com/gorhill/uBlock/wiki/Blocking-mode:-medium-mode https://github.com/gorhill/uBlock/wiki/Blocking-mode:-medium... [1]https://github.com/gorhill/uBlock/wiki/Blocking-mode:-hard-mode https://github.com/gorhill/uBlock/wiki/Blocking-mode:-hard-m...
      • sergeykish 6y ago
        I find it easier to understand what application wants looking at numbers. And to toggle on 1st party cookies. My setup in between hard mode and nightmare: * * * block * * frame block * 1st-party css allow * 1st-party frame allow * 1st-party image allow
    • voicedYoda 6y ago
      I use both, and it's amazing what origin night let through that i can granularly stop with matrix.
  • Melting_Harps 6y ago
    > The only trustworthy extensions are uBlock Origin and EFF's Privacy Badger. Everything else is best viewed as potential malware, no different than random downloadable executables. What about Ghostery?
    • mtrovo 6y ago
      I think it's "safe". They are not going to put a malware on their extension as you installing the extension is how they make money. But as the company has a business model around collecting your browsing data and being a gatekeeper between you and advertiser it really depends what you're trying to protect against.
    • katsura 6y ago
      They weren't always cool: https://www.businessinsider.com/evidon-sells-ghostery-data-to-advertisers-2013-6?IR=T https://www.businessinsider.com/evidon-sells-ghostery-data-t... As far as I know this changed later on, but still.
  • michaelbazos 6y ago
    There are often other extensions that we find too precious to delete them, however we need them only at specific occasions. For those, I came up with a “meta-extension” to easily disable or enable them: https://chrome.google.com/webstore/detail/extension-manager/nddeiknmamlpagmnabfdlljlikeoanch https://chrome.google.com/webstore/detail/extension-manager/...
    • sergeykish 6y ago
      This is great! But it is minified and there is no link to source. Why?
  • driverdan 6y ago
    Also HTTPS Everywhere and, in Firefox, NoScript.
    • livre 6y ago
      I stopped considering NoScript something I can trust when this happened[1]. Many years have passed, the Tor project trusts it but I'm still cautious. [1] http://www.schillmania.com/content/entries/2009/adblock-vs-noscript/ http://www.schillmania.com/content/entries/2009/adblock-vs-n...
• fulafel 6y ago
  Re security measures: these features have sadly been put under "enterprise" stuff but they are there: https://support.google.com/chrome/a/answer/9296680?hl=en https://support.google.com/chrome/a/answer/9296680?hl=en I wonder if there could be a community pseudo-enterprise that could eg have a reasonable whitelist of extensions... edit: whoops, that was a windows-only guide despite the title, here are linux / mac links: https://support.google.com/chrome/a/answer/7517525#permissions https://support.google.com/chrome/a/answer/7517525#permissio... https://support.google.com/chrome/a/answer/7517624?hl=en&ref_topic=9023246 https://support.google.com/chrome/a/answer/7517624?hl=en&ref...
  • silon42 6y ago
    IMO, at least for linux, popular (open source) extensions should be part of the distribution.
  • jedieaston 6y ago
    Chrome Enterprise is free (it’s just a zipped file with GPOs and the MSI installer for Chrome). These policies should apply on the Chrome you already have.
    • fulafel 6y ago
      Sure, but there's no reasonable UI, just meant to be configured by a company's IT grunts poking json config files or wielding regedit on windows.
• ponker 6y ago
  Why is this business model usually from Israel?
  • Gibbon1 6y ago
    Because historically Israel heavy uses blackmail as a foreign policy tool.
    • jereees 6y ago
      Argentinian here, can confirm. Just look up Nisman death AMIA bombing.
      • skissane 6y ago
        I know a little bit about that saga, but who are you accusing the Israeli government of blackmailing?
        • hnanon1 6y ago
          Anyone and everyone. One of the reasons they don't have a single true ally.
          • skissane 6y ago
            The person I was asking had brought up the death of Alberto Nisman and the investigation into the AMIA bombing in response to a statement that Israel "uses blackmail as a foreign policy tool". It seems to me like people make vague accusations against Israel without being specific about what exactly Israel allegedly did, and when challenged to be more specific they don’t respond. I have an open mind about whether any particular allegation against Israel (or any other country) is true, but if people won't make the allegation specific it is impossible to judge.
    • pokemongoaway 6y ago
      Yep... And still nearly everyone is self censoring and unable wonder why so many top human traffickers and pedophiles are Jewish...
• willvarfar 6y ago
  Could browser extensions be ran in a sandbox, with read_access to the page, but only able to read from whitelisted registered and fixed URLs for updating configuration etc? So your blocking extension can download lists of things to block, or other config, but it can't exfiltrate any information about the user's browsing habits. The only side channel I can then think of is using page rewriting or timing to communicate when the user browses to a page controlled by the extension owner. This would be something that there is at least a hope of spotting?
  • bzb3 6y ago
    Of course, that's how it works in Safari.
  • IncRnd 6y ago
    In the same way that DNS requests can exfiltrate data, requesting URLs can also exfiltrate data. This is trivial to perform.
    • bgdam 6y ago
      This is an apples to oranges comparison. DNS requests exfiltrate data such as IP and the domain you want to visit. Currently extensions can literally upload all your passwords if they wish to. Restricting them to be able to only GET whitelisted URLs (no query params or paramterized URLs) would cut down on pretty much 99.999% of possible data theft scenarios.
      • deleted 6y ago
        [deleted]
      • ucosty 6y ago
        You can exfiltrate data using regular DNS requests, by hiding the data in the host part of the query. The authoritative name server for the domain can then extract out and re-assemble the data. https://blogs.akamai.com/2017/09/introduction-to-dns-data-exfiltration.html https://blogs.akamai.com/2017/09/introduction-to-dns-data-ex...
• discordance 6y ago
  Who? - please name names
  • bigiain 6y ago
    Cellebrite and NSO Group - for starters.
  • inglor 6y ago
    Cellebrite and NSO are unrelated and are offensive cyber companies. Companies like SimilarWeb and Alexa (not Israeli) do the thing OP describes.
• stilisstuk 6y ago
  I love that my it departement has turned off password saving, citing security concerns. But there is no problem in downloading any and all extensions.
• Larrikin 6y ago
  It's extremely annoying that Israel the country has found a way to exploit the shady shit they do as a country, like these disgusting security exploits they export all over the world , and the support the Jewish global community got from other countries after the genocide of world war two into turning any criticism of the country into anti-Semitism. As an American I feel Israel is only an ally like Saudi Arabia is an ally in that it's a country doing terrible shit I disagree with that dislikes other countries politicians I dislike hate.
  • allendoerfer 6y ago
    As a German I feel the US is only an ally like Saudi Arabia is an ally in that it's a country doing terrible shit I disagree with that dislikes other countries politicians I dislike hate. (I do not really think the US - or Isreal for that matter - is like Saudi Arabia AT ALL, Saudi Arabia is a horrific place and that comparison is pure madness by OP - but the "doing terrible shit" part is very true.)
• coreai 6y ago
  I feel like this argument is the same as ‘how third party apps are allowed in windows and macOS by Microsoft and Apple’ To me there has always been a trusted part of computing which is audited to some extent and marked as trusted. Browser extensions work the same way as software on an operating system. If they blocked all extensions outside trusted ones they would be criticised as well. However the auditing process is very controversial and could become like the Apple’s App Store where the apps/extensions maybe blocked for reasons other than just security to make it anti competitive which is certainly something possible with chrome
  • ThePhysicist 6y ago
    In 2016 we proved that the owner of "Web of Trust" was exfiltrating and illegally selling clickstream data to anyone who would pay. For Germany alone the data contained the browing information of more than three million people, often revealing highly intimate and sensitive details about their lives. Still, Chrome and Firefox reinstated the extension after less than four weeks, and to this day it keeps collecting clickstream data. It does so using dark patterns and I'm sure most of the users are not aware that a free extension they use to increase their safety while surfing the web surreptitiously sells their browsing data. If the main selling point of your browser or OS is that you protect the privacy of your users you simply can't act like that, because most users are not aware of the data collection that is happening via these extensions. With mobile apps we're in a similar situation, companies like X-Mode exfiltrate and sell location data via apps that claim to protect your privacy. Desktop software: Same story. Anti-virus software that is supposed to protect you actually exfiltrates personal data from your computer. So yeah if you build an open platform there will be such abuse, but if you position yourself as a champion for privacy you simply can't allow that (or at least you should try to make it more difficult). There are simple counter-measures that browser vendors could employ: Showing users how much data a given extension sends to a backend and ideally making that data transparent would be enough to stop most of these practices, because people would then realize that their free screenshot app somehow sends every single URL they open to a backend service. Right now this can happen entirely without the knowledge of the user. You can't control what you cannot see and understand.
    • 6y ago
• AznHisoka 6y ago
  Might as well call out this company. it is Similarweb.
  • sergeykish 6y ago
    These bought Stylish [1]. Privacy Policy is extremely unclear [2]: > We do not want ... does not mean we do not do > any data collected from you simply by your use of our product will never be used to figure out who you are or to send you targeted ads, and will not be shared with any other parties for those purposes. does not mean impossible, yes, that's was not on purpose (like facebook cambridge analytica) > Standard web server log information (i.e., page views)... > ... browser type, operating system, device model name, device screen size, time and date. We further collect IP Address (trimmed for anonymization). I can't process this. Compared with Stylus [3]: > Privacy Policy > Unlike other similar extensions, we don't find you to be all that interesting. Your questionable browsing history should remain between you and the NSA. Stylus collects nothing. Period. [1] https://robertheaton.com/2018/07/02/stylish-browser-extension-steals-your-internet-history/ https://robertheaton.com/2018/07/02/stylish-browser-extensio... [2] https://userstyles.org/login/policy https://userstyles.org/login/policy [3] https://chrome.google.com/webstore/detail/stylus/clngdbkpkpeebahjckkjfobafhncgmne?hl=en https://chrome.google.com/webstore/detail/stylus/clngdbkpkpe...
• porker 6y ago
  Is there a list of extensions that have been caught exfiltrating data? I look at the 20 I've got installed and wonder which are using the "Access to every website" permission for their own ends.
  • inglor 6y ago
    As a maintainer of an extension with said permission I think it's important to acknowledge some extensions do need said permission. For example at the extension I help maintain (Testim Editor) we literally do test automation which requires elevated permissions.
  • sergeykish 6y ago
    Caught extensions would be automatically disabled, right? Check Privacy Policy, if none exists it is either clear or non conformant. Extensions which states they collect data are not removed - for example Stylish, Web of Trust.
• zelly 6y ago
  I hope we don't get even more locked down permissions for Web Extensions. I would prefer that the Chrome Web Store manually vets every extension and update. Maybe start charging big $$$ like Apple does. Most extensions will disappear from the stores, but they won't disappear from all existence (as changing the permissions model would effectively do). Power users who could vet the extension themselves can install extensions manually (maybe even behind a command line switch to futher filter out computer illiterates). That's a good compromise.
  • raxxorrax 6y ago
    I hope we don't get access controlled software from large developers. Mobile OS sway me pretty quickly to say 'no' to that. Maybe supply users with curated software, but I think the store model failed spectacularly. They contain more crap than a malicious website could ever hope to supply.
• holoduke 6y ago
  why would you want to have an extension able to do network calls anyway? my opinion extensions should not be allowed to do so.
  • inglor 6y ago
    Some reasons: - Ad blocking - Reporting analytics to home base for product feedback - Mocking network requests to make certain pages load faster. - Performance analytics for the page's network (like the devtools). Please remember that some extensions are not free, we companies like Microsoft paying a substantial amount of money for the extension we develop (Testim Editor) for example.
• inglor 6y ago
  For what it's worth both Google and Mozilla are paying customers of competitive intelligence from said companies. It's super easy to blame some semi-known Israeli company where in fact it's a way for companies like Google to bypass their own security policy and restrictions. - Google does not collect all website data - Google creates an extension model that allows a third-party to collect all analytics data - Google buys said analytics data and has access to it. It's done in a somewhat semi-regulated way, but the whole thing is a regulation bypass companies like Google do that will (hopefully) eventually be plugged. This is similar to the toolbar and installer industry of 5-10 years ago.
• fauigerzigerk 6y ago
  >Extensions are ideal to exfiltrate data from browsers as they bypass all security measures and can literally see everything you do on every single page you visit. That's not generally true. It depends on the permissions. If you grant an extension permission to access every page then yes it can do that. That's not bypassing all security measures.
• sergeykish 6y ago
  These are strong words. Mozilla is miles ahead of chrome with recommended extensions [1]: > Recommended extensions undergo full code review by staff security experts to provide a strong additional security check. It has a list of blocked addons [2]. And I believe that is Chrome who turned addons into Wild West, Mozilla had a long review process [3]. [1] https://blog.mozilla.org/firefox/firefox-recommended-extensions/ https://blog.mozilla.org/firefox/firefox-recommended-extensi... [2] https://blocked.cdn.mozilla.net/ https://blocked.cdn.mozilla.net/ [3] https://blog.mozilla.org/addons/2010/02/15/the-add-on-review-process-and-you/ https://blog.mozilla.org/addons/2010/02/15/the-add-on-review...
  • ThePhysicist 6y ago
    It's still so easy in Firefox to install add-ons that spy on your entire browser session and send tons of telemetry data to a backend (Ghostery is a popular example) while the user has no clue that any kind of data transfer even happens. Such behavior shouldn't be something that can be turned on with two clicks.
    • kekebo 6y ago
      Ghostery is even a recommended Addon on AMO [1]. What would really be practical were some kind of extension analyzer/profiler that runs newly installed addons in a sandbox and displays attempted connections and payloads. Or a mode where connections need to be whitelisted, to limit the impact of silent addon takeovers. Too many times I find myself having to download, unpack, and skim through an addon's source to make sure it's not doing anything malicious under the hood. [1] https://addons.mozilla.org/en-US/firefox/addon/ghostery/ https://addons.mozilla.org/en-US/firefox/addon/ghostery/
      • sergeykish 6y ago
        They state it in plain site. Sadly it is not advertised clearly. Yes, that would be good. I would love to hear that someone I trust checked latest version. If enough people joined we can make distribution. And, hey! It is MPL-2 [1], bad defaults can be patched. [1] https://github.com/ghostery/ghostery-extension https://github.com/ghostery/ghostery-extension
• bregma 6y ago
  My nanny won't let me install extensions. She keeps me snug and secure in her warm and loving arms.
• hnanon1 6y ago
  Thank you for taking the time to point this out to people who may not have known about these disgusting practices.