10 ms·

Emails a browser extension developer gets from scammers

198 points by ajayyy 6y ago

chovybizzass 6y ago
sounds like the ones i get when i register a domain.
eldog_ 6y ago
Have an extension on the chrome store too and receive these emails regularly. Promising cash to turn your extension into malware. Mine is a small, specific project that took a weekend or so of work, so I'm sure others in the same position would be tempted to take them up.
rsync 6y ago
I believe this ecosystem is simply an extension of the prior systray ecosystem wherein small, sometimes free windows applications would bundle a "helper" app that would basically spy on, and advertise to, the end user. This resulted, among other things, in an almost universal degradation of performance and usability of Windows XP/Vista for ... our parents and grandparents, basically.
- agwa 6y ago
  It's worse now because browser extensions auto-update which means that when a malicious actor buys an extension they gain access not only to future users but to all current users as well. Also, the Chrome Extension Store publicizes how many users each extension has, which allows malicious actors to operate extremely efficiently as they can easily find extensions to acquire and they know exactly what they're buying.
  - sashagim 6y ago
    And even worse, because they don’t only hurt performance and usability, but they also report private information. Even is the data is sent anymously, the url itself may contain private information. For instance, Google themselves still allow sharing documents via a “private” link which is then stored on some monitoring service. And some of those services allow anyone access and search these urls for some premium plan.
- danieldbird 6y ago
  "our parents and grandparents, basically." I now feel officially elderly, Cheers for that. Lol.
  - Aerroon 6y ago
    I think the implication here was that your parents and grandparents were less computer savvy at the time. This resulted in them installing all kinds of toolbars that destroyed performance.
- throwawayboise 6y ago
  Not just small free apps. Oracle would install the Ask toolbar when you installed their database server, unless you noticed and un-ticked that option in one of the installer dialogs. Oracle.
  - akiselev 6y ago
    IIRC for a while the official Java runtime installer also installed the Ask toolbar.
david422 6y ago
I have a small website that can get a surprising amount of traffic. Every other day I get an email from some "SEO expert" wanting to redesign my site or offer some partnership so I get more traffic. Which is slightly amusing because I must be getting enough traffic for them to want to find me.
- Debug_Overload 6y ago
  Almost every SEO "guru" and "expert" is a glorified snake oil salesman. I look at that whole industry the same way I look at the traditional woo-woo peddlers.
  - cutemonster 6y ago
    Makes me wonder what are the snake oily things they do?
    - mprev 6y ago
      Private blog networks, guest post spam, paid back links. Seems to be about 80% of the dodgy side of SEO.
      - wyclif 6y ago
        Bottom line is that they ruin the quality of search and create a tremendous amount of churn that requires search engines to constantly refine their algo.
        cutemonster 6y ago
        Is snake oil the right word -- if it actually works? (Well at least until the search engines get better at detecting gray? hat SEO) However, it's a tragedy of the commons failure? (Is there any short word for that)
- captn3m0 6y ago
  I linked the Instagram handle of a friend on one of my posts, and now I even get posts about promoting and marketing my Instagram handle with “real likes and comments”. Just one link.
kwerk 6y ago
Seems weird the first scammer asks the Dev to “unsubscribe” from their emails in the third message. Wouldn’t that hurt their deliverability?
- blackbear_ 6y ago
  It's a way to know that there's a real human behind the computer screen and that the address is not fake. Even a single bit of information can be valuable.
  - cutemonster 6y ago
    The scammers want to know if the developer's email works? If s/he doesn't click unsubscribe, maybe they've been talking with the wrong address, so they could continue with trying to find another address to the developer?
- drewmol 6y ago
  >Wouldn't that hurt their deliverability? If you're referring to deliverability of emails in the context of email spam filters then no. Having an unsubscribe option on repeated, unanswered solicitations would be helpful. The emails are not spam, and in the first email chain they are rather straightforward about their proposal and methods. I'm not sure what the scam actually is here.. people offering money for dev to scam users out of bandwidth? I do think it's noble of dev ignore the solicitation and provide exposure to this market however.
avipars 6y ago
Great extension, and as an app developer and very small influencer (several thousand followers), I still get spam and personalized phishing... 90% are just bots and automated attacks
- avipars 6y ago
  Scraping instagram, YT, and especially my Youtube account for information
throwaway13337 6y ago
Browser extensions are the most vulnerable every day apps people use. They're given so much power so quickly. Users agree to 'view and modify website data' not realizing that the app can now run arbitrary code on their gmail/banking/whatever accounts to report all information including passwords. For all the concern over application security, little is talked about here. Browser extensions are also super important. They stand as the only tool for users to take back control over their experience from companies that are in the interest of manipulating them for profit whenever they can. They are uniquely our agents here. Still, each extension is a potential huge vulnerability. It's tough to find a balance here.
- rakoo 6y ago
  Browser extensions have exactly as much power as the browser itself; that's why browser vendors controlling the distribution of extensions is not a bad idea in itself. Maybe there's a greater discussion to be had about the power that browsers themselves have over what has now become the life of their users.
  - evilpie 6y ago
    > Browser extensions have exactly as much power as the browser itself I would say this is false. Browsers can run arbitrary code on your machine. Extensions can't even access local files. If we are just talking about site information like cookies I would agree.
    - edoceo 6y ago
      Local File Browser extension for Chrome https://chrome.google.com/webstore/detail/local-explorer-file-manag/eokekhgpaakbkfkmjjcbffibkencdfkl?hl=en https://chrome.google.com/webstore/detail/local-explorer-fil...
      - evilpie 6y ago
        Okay, but that requires installing a native code module.
tomaszs 6y ago
How do he know these emails are from scammers? Some of these seem like legimate offers at the first glance. Please don't downvote if this is a stupid question for you. I'd really like to know how to recognize a scam email in these situations as a browser extension dev.
- mads 6y ago
  I believe the "scammer" parts comes from them wanting to leech data off the users of the given extensions. They are upfront about their intentions, I think, so scammer is maybe not the appropriate term. "Scummer" maybe.
  - tomaszs 6y ago
    It seems like it is a series of emails from one sender. The first email is about sharing users IPs. What can such scammer do with user IP?
    - drewmol 6y ago
      They want to leech bandwidth off the userbase which become 'bots', to resell as a distributed proxy/botnet service from my understanding at least.
  - Anthony-G 6y ago
    I agree with calling them “scummers” but “scammers” is also apt as they intend to scam the user of the extension - not necessarily the developer. Reading those emails brought to mind Bill Hicks' famous rant about “Satan's little helpers”: https://vimeo.com/36651896 https://vimeo.com/36651896
- ajayyy 6y ago
  I just added another email I got that I forgot about. In that one, they it looks like they steal the user's request headers. Their website also disappeared a month after their email.
dzhiurgis 6y ago
Wonder if these “partners” can be efficiently milked of their programmes - setup millions of browser instances in cloud...
dr_kiszonka 6y ago
That one email from Datos looking pretty professional. I don't know what their business is about, but they don't necessarily seem like scammers per se.
bransonf 6y ago
It’s pretty obvious what infatica is doing and while I agree it’s shady, I wouldn’t call it a scam. Peer-to-peer proxy doesn’t mean a botnet, at least not how I think most people think that to mean. Rather they are routing traffic through residential IPs for a number of customers. $25-45/1000 users sounds exactly within the margins of a VPN provider (they even mention hola.org in the 3rd email, which is $2.99/m per ‘premium’ user or free if you become a node in the network) and residential proxies are also commonly used for scraping and other IP-sensitive work, again within those margins. I didn’t find the code sample to be obfuscated, it was actually quite clear. It establishes a web socket with a server and simply passes requests through an endpoint, I.e. literally just a proxy. All that said, it’s definitely shady to put this in your extension without users knowing. But, if you need to monetize something free, and make at least a good effort to inform users or allow them to opt out, and we trust infatica doesn’t allow illegal use of its proxy network, then I don’t really see the problem. There’s a real need for residential IPs, no market to give each user $.025 and I can’t really fault someone for making a business out of this. Edit: I also find irony that the author labels datos.live a “scammer” when in fact they are a very legitimate business engaged in similar data collection to what Google already does. ...The same author who published an extension (in the Chrome Store) for YouTube
- walrus01 6y ago
  The further you dig into the "residential proxy" market, the more shady it gets. Google "residential proxies for sale" and follow the rabbit hole down...
  - bransonf 6y ago
    I certainly am not going to defend the whole market. I’m aware of many issues. But, there is a strict business need for these proxies. If you plan to fight giants, the first thing you need is their data. And you can’t get it without proxies. Sure, that’s another subject for debate; whether scraping/crawling is ethical itself.
    - walrus01 6y ago
butz 6y ago
Time to add user privacy and data usage dialogs to web extensions to inform users about "monetized" extensions, especially those trying to sneak in such SDKs later.
- ajayyy 6y ago
  Chrome webstore has actually started experimenting with an AppStore style privacy page (seems to be A/B test for now) https://media.discordapp.net/attachments/609441389423493128/801558220744163398/Screenshot_20210120-160531.jpg https://media.discordapp.net/attachments/609441389423493128/...
mackrevinack 6y ago
one of the things that is keeping me on firefox is how many open source extensions there are. i use maybe 16 and they are all open source, which doesn't mean they're free of malware, but it definitely reduces the likelihood
tgsovlerkhgsel 6y ago
The claim that X is allowed on the Chrome Web Store is extremely fishy given the "single purpose policy". You're not allowed to upload extensions that serve multiple purposes, e.g. "something useful the user wants" and "provide an exit point for a shady proxy network".
EGreg 6y ago
First I want to remark how SERIOUS of a security hole browser extensions are, that can work on all websites without user interaction needed. They can READ ALL YOUR DATA including the passwords you type into gmail, and can do “forgot password” on any site and hijack your gmail in the background as you read it. And ONE PERSON is often all that’s required to push malware to everyone. This is what capitalism looks like, folks. Someone "built it" so they now privately "own it", no matter how big it gets. It's not put into the hands of an organization. The profit motive is quite strong, which is why someone can be "corrupted" by very tempting messages like this. If you had a lake or a forest privately owned by one or two people, and they had a lot of debts, they could easily sell it to polluters and loggers. Some people scoff and say "socialism has been tried, it never works." I admit that socialism simply trades one class of elites (the capitalists with a lot of shares) for another (the bureaucrats with a lot of political clout). BUT! I would like to say that socialism is not the only alternative. The other alternative is decentralized systems with no private ownership. I'm talking about science, open source software, and so on. There can be a Merkle tree of version updates (e.g. git version control) and each one can have various reputable organizations (like Zagat for software) building their reputation vetting it. Then, each community would run their own app store (think Wordpress plugins) which would work with these reputable organizations. There would be no heroes, no celebrities, no tweets at 3 am to 5 million people, no pulling from repos without peer review, no scientists instantly believed after publishing on arxiv.org . Congratulations for building a popular extension. You live in a world where you it's really bad to "criticize the profit", and where building it means you are responsible for it no matter how big it gets, but then we are all depending on your integrity and ability to rebuff life-changing amounts of money to not mine our data. We can pass laws to punish people after the fact, or we can gradually change our culture by rejecting "immediate gratification" of updates that are not vetted, just as corporations have done with bleeding edge vs stable Linux distros etc. Unfortunately, the Web has made it so that anything can be updated at any time, with no sysadmins or reviewers in the loop. It's a wonder more malware isn't silently everywhere already.
- rendall 6y ago
  >First I want to remark how SERIOUS of a security hole browser extensions are, that can work on all websites without user interaction needed. They can READ ALL YOUR DATA including the passwords you type into gmail, and can do “forgot password” on any site and hijack your gmail in the background as you read it. I'm not sure what you mean. There is a security check in place for Chrome extensions. Are you saying that it's inadequate or that it is security theater only? Because it sounds like you're implying that no security exists whatsoever.
rendall 6y ago
I don't get such emails. I'm feeling left out! But I do have a pretty strict and solid privacy policy, though, and it's open source: Privacy Policy The creator of "Twitter 'Likes' Hider" has zero interest in tracking you. Your privacy is sacrosanct. No data will be kept, tracked, transferred, sold, traded, nor even coveted in any respect, from now until the end of time.
robin21 6y ago
The biggest problem is that Chrome Extensions don’t have granular enough permissions. I’ve seen developers write explanations of needing access to “all your data” because of one small feature they need access to. They should also add some monitoring regarding domains extensions talk to. Or even make developers add a description of outgoing requests from extensions somehow.
- hydroxideOH- 6y ago
  You already have to do that. In the extension manifest you need to specify URLs you need to access. I'm pretty sure the process of approving an extension is entirely automated though, so there isn't any real accountability unless an extension is specifically investigated.
  - paulryanrogers 6y ago
    In practice many extensions need access to all URLs.
lrossi 6y ago
Some of these problems might disappear if Google would introduce a payment scheme for Chrome extension developers. Then authors might not be tempted to sell them to scammers.
Animats 6y ago
I just got one of those. Grr. From: victoria@monetization-providers.com Subject: Monetise Your Chrome Extension I came across your extension on the Google chrome store and wanted to reach out to you to offer a way to increase revenue earnings from your extension. We are providing our partners with Bing landers and feeds that pays really well on extensions for search. It can earn up to $800 a month per 5000 users, and it is a premium product by invitation only. If your extension does not have search this is not a problem with a simple update this can be added, furthermore it is completely acceptable by google chrome store. If this is something you would be interested in, I would be glad to schedule a call to discuss this with you! Also if you are looking to sell your extension we can discuss this opportunity as we buy extensions. Victoria Jude Business Development Manager The sending domain was registered yesterday.
- ralphzera 6y ago
  hahaha same bro
truumann 6y ago
Hello from ru extensions community! Nobody will read this, but all we need is just browser devs to finish this useless shit: https://i.ibb.co/C6nsNhX/2021-2-6-11-19-25.png https://i.ibb.co/C6nsNhX/2021-2-6-11-19-25.png Add a blacklist and the ability to manually edit lists. So that the extensions themselves are unloaded from memory or isolated on certain domains. You are and google assholes only think about further curtailing powers and opportunities for expansion and that's wrong.

198 points by ajayyy 6y ago

sounds like the ones i get when i register a domain.

Have an extension on the chrome store too and receive these emails regularly. Promising cash to turn your extension into malware. Mine is a small, specific project that took a weekend or so of work, so I'm sure others in the same position would be tempted to take them up.

rsync 6y ago

I believe this ecosystem is simply an extension of the prior systray ecosystem wherein small, sometimes free windows applications would bundle a "helper" app that would basically spy on, and advertise to, the end user. This resulted, among other things, in an almost universal degradation of performance and usability of Windows XP/Vista for ... our parents and grandparents, basically.

agwa 6y ago
It's worse now because browser extensions auto-update which means that when a malicious actor buys an extension they gain access not only to future users but to all current users as well. Also, the Chrome Extension Store publicizes how many users each extension has, which allows malicious actors to operate extremely efficiently as they can easily find extensions to acquire and they know exactly what they're buying.
- sashagim 6y ago
  And even worse, because they don’t only hurt performance and usability, but they also report private information. Even is the data is sent anymously, the url itself may contain private information. For instance, Google themselves still allow sharing documents via a “private” link which is then stored on some monitoring service. And some of those services allow anyone access and search these urls for some premium plan.
danieldbird 6y ago
"our parents and grandparents, basically." I now feel officially elderly, Cheers for that. Lol.
- Aerroon 6y ago
  I think the implication here was that your parents and grandparents were less computer savvy at the time. This resulted in them installing all kinds of toolbars that destroyed performance.
throwawayboise 6y ago
Not just small free apps. Oracle would install the Ask toolbar when you installed their database server, unless you noticed and un-ticked that option in one of the installer dialogs. Oracle.
- akiselev 6y ago
  IIRC for a while the official Java runtime installer also installed the Ask toolbar.

david422 6y ago

I have a small website that can get a surprising amount of traffic. Every other day I get an email from some "SEO expert" wanting to redesign my site or offer some partnership so I get more traffic. Which is slightly amusing because I must be getting enough traffic for them to want to find me.

Debug_Overload 6y ago
Almost every SEO "guru" and "expert" is a glorified snake oil salesman. I look at that whole industry the same way I look at the traditional woo-woo peddlers.
- cutemonster 6y ago
  Makes me wonder what are the snake oily things they do?
  - mprev 6y ago
    Private blog networks, guest post spam, paid back links. Seems to be about 80% of the dodgy side of SEO.
    - wyclif 6y ago
      Bottom line is that they ruin the quality of search and create a tremendous amount of churn that requires search engines to constantly refine their algo.
      - cutemonster 6y ago
        Is snake oil the right word -- if it actually works? (Well at least until the search engines get better at detecting gray? hat SEO) However, it's a tragedy of the commons failure? (Is there any short word for that)
captn3m0 6y ago
I linked the Instagram handle of a friend on one of my posts, and now I even get posts about promoting and marketing my Instagram handle with “real likes and comments”. Just one link.

kwerk 6y ago

Seems weird the first scammer asks the Dev to “unsubscribe” from their emails in the third message. Wouldn’t that hurt their deliverability?

blackbear_ 6y ago
It's a way to know that there's a real human behind the computer screen and that the address is not fake. Even a single bit of information can be valuable.
- cutemonster 6y ago
  The scammers want to know if the developer's email works? If s/he doesn't click unsubscribe, maybe they've been talking with the wrong address, so they could continue with trying to find another address to the developer?
drewmol 6y ago
>Wouldn't that hurt their deliverability? If you're referring to deliverability of emails in the context of email spam filters then no. Having an unsubscribe option on repeated, unanswered solicitations would be helpful. The emails are not spam, and in the first email chain they are rather straightforward about their proposal and methods. I'm not sure what the scam actually is here.. people offering money for dev to scam users out of bandwidth? I do think it's noble of dev ignore the solicitation and provide exposure to this market however.

avipars 6y ago

Great extension, and as an app developer and very small influencer (several thousand followers), I still get spam and personalized phishing... 90% are just bots and automated attacks

avipars 6y ago
Scraping instagram, YT, and especially my Youtube account for information

throwaway13337 6y ago

Browser extensions are the most vulnerable every day apps people use. They're given so much power so quickly. Users agree to 'view and modify website data' not realizing that the app can now run arbitrary code on their gmail/banking/whatever accounts to report all information including passwords. For all the concern over application security, little is talked about here. Browser extensions are also super important. They stand as the only tool for users to take back control over their experience from companies that are in the interest of manipulating them for profit whenever they can. They are uniquely our agents here. Still, each extension is a potential huge vulnerability. It's tough to find a balance here.

rakoo 6y ago
Browser extensions have exactly as much power as the browser itself; that's why browser vendors controlling the distribution of extensions is not a bad idea in itself. Maybe there's a greater discussion to be had about the power that browsers themselves have over what has now become the life of their users.
- evilpie 6y ago
  > Browser extensions have exactly as much power as the browser itself I would say this is false. Browsers can run arbitrary code on your machine. Extensions can't even access local files. If we are just talking about site information like cookies I would agree.
  - edoceo 6y ago
    Local File Browser extension for Chrome https://chrome.google.com/webstore/detail/local-explorer-file-manag/eokekhgpaakbkfkmjjcbffibkencdfkl?hl=en https://chrome.google.com/webstore/detail/local-explorer-fil...
    - evilpie 6y ago
      Okay, but that requires installing a native code module.

tomaszs 6y ago

How do he know these emails are from scammers? Some of these seem like legimate offers at the first glance. Please don't downvote if this is a stupid question for you. I'd really like to know how to recognize a scam email in these situations as a browser extension dev.

mads 6y ago
I believe the "scammer" parts comes from them wanting to leech data off the users of the given extensions. They are upfront about their intentions, I think, so scammer is maybe not the appropriate term. "Scummer" maybe.
- tomaszs 6y ago
  It seems like it is a series of emails from one sender. The first email is about sharing users IPs. What can such scammer do with user IP?
  - drewmol 6y ago
    They want to leech bandwidth off the userbase which become 'bots', to resell as a distributed proxy/botnet service from my understanding at least.
- Anthony-G 6y ago
  I agree with calling them “scummers” but “scammers” is also apt as they intend to scam the user of the extension - not necessarily the developer. Reading those emails brought to mind Bill Hicks' famous rant about “Satan's little helpers”: https://vimeo.com/36651896 https://vimeo.com/36651896
ajayyy 6y ago
I just added another email I got that I forgot about. In that one, they it looks like they steal the user's request headers. Their website also disappeared a month after their email.

dzhiurgis 6y ago

Wonder if these “partners” can be efficiently milked of their programmes - setup millions of browser instances in cloud...

dr_kiszonka 6y ago

That one email from Datos looking pretty professional. I don't know what their business is about, but they don't necessarily seem like scammers per se.

bransonf 6y ago

It’s pretty obvious what infatica is doing and while I agree it’s shady, I wouldn’t call it a scam. Peer-to-peer proxy doesn’t mean a botnet, at least not how I think most people think that to mean. Rather they are routing traffic through residential IPs for a number of customers. $25-45/1000 users sounds exactly within the margins of a VPN provider (they even mention hola.org in the 3rd email, which is $2.99/m per ‘premium’ user or free if you become a node in the network) and residential proxies are also commonly used for scraping and other IP-sensitive work, again within those margins. I didn’t find the code sample to be obfuscated, it was actually quite clear. It establishes a web socket with a server and simply passes requests through an endpoint, I.e. literally just a proxy. All that said, it’s definitely shady to put this in your extension without users knowing. But, if you need to monetize something free, and make at least a good effort to inform users or allow them to opt out, and we trust infatica doesn’t allow illegal use of its proxy network, then I don’t really see the problem. There’s a real need for residential IPs, no market to give each user $.025 and I can’t really fault someone for making a business out of this. Edit: I also find irony that the author labels datos.live a “scammer” when in fact they are a very legitimate business engaged in similar data collection to what Google already does. ...The same author who published an extension (in the Chrome Store) for YouTube

walrus01 6y ago
The further you dig into the "residential proxy" market, the more shady it gets. Google "residential proxies for sale" and follow the rabbit hole down...
- bransonf 6y ago
  I certainly am not going to defend the whole market. I’m aware of many issues. But, there is a strict business need for these proxies. If you plan to fight giants, the first thing you need is their data. And you can’t get it without proxies. Sure, that’s another subject for debate; whether scraping/crawling is ethical itself.
  - walrus01 6y ago

butz 6y ago

Time to add user privacy and data usage dialogs to web extensions to inform users about "monetized" extensions, especially those trying to sneak in such SDKs later.

ajayyy 6y ago
Chrome webstore has actually started experimenting with an AppStore style privacy page (seems to be A/B test for now) https://media.discordapp.net/attachments/609441389423493128/801558220744163398/Screenshot_20210120-160531.jpg https://media.discordapp.net/attachments/609441389423493128/...

mackrevinack 6y ago

one of the things that is keeping me on firefox is how many open source extensions there are. i use maybe 16 and they are all open source, which doesn't mean they're free of malware, but it definitely reduces the likelihood

tgsovlerkhgsel 6y ago

The claim that X is allowed on the Chrome Web Store is extremely fishy given the "single purpose policy". You're not allowed to upload extensions that serve multiple purposes, e.g. "something useful the user wants" and "provide an exit point for a shady proxy network".

EGreg 6y ago

First I want to remark how SERIOUS of a security hole browser extensions are, that can work on all websites without user interaction needed. They can READ ALL YOUR DATA including the passwords you type into gmail, and can do “forgot password” on any site and hijack your gmail in the background as you read it. And ONE PERSON is often all that’s required to push malware to everyone. This is what capitalism looks like, folks. Someone "built it" so they now privately "own it", no matter how big it gets. It's not put into the hands of an organization. The profit motive is quite strong, which is why someone can be "corrupted" by very tempting messages like this. If you had a lake or a forest privately owned by one or two people, and they had a lot of debts, they could easily sell it to polluters and loggers. Some people scoff and say "socialism has been tried, it never works." I admit that socialism simply trades one class of elites (the capitalists with a lot of shares) for another (the bureaucrats with a lot of political clout). BUT! I would like to say that socialism is not the only alternative. The other alternative is decentralized systems with no private ownership. I'm talking about science, open source software, and so on. There can be a Merkle tree of version updates (e.g. git version control) and each one can have various reputable organizations (like Zagat for software) building their reputation vetting it. Then, each community would run their own app store (think Wordpress plugins) which would work with these reputable organizations. There would be no heroes, no celebrities, no tweets at 3 am to 5 million people, no pulling from repos without peer review, no scientists instantly believed after publishing on arxiv.org . Congratulations for building a popular extension. You live in a world where you it's really bad to "criticize the profit", and where building it means you are responsible for it no matter how big it gets, but then we are all depending on your integrity and ability to rebuff life-changing amounts of money to not mine our data. We can pass laws to punish people after the fact, or we can gradually change our culture by rejecting "immediate gratification" of updates that are not vetted, just as corporations have done with bleeding edge vs stable Linux distros etc. Unfortunately, the Web has made it so that anything can be updated at any time, with no sysadmins or reviewers in the loop. It's a wonder more malware isn't silently everywhere already.

rendall 6y ago
>First I want to remark how SERIOUS of a security hole browser extensions are, that can work on all websites without user interaction needed. They can READ ALL YOUR DATA including the passwords you type into gmail, and can do “forgot password” on any site and hijack your gmail in the background as you read it. I'm not sure what you mean. There is a security check in place for Chrome extensions. Are you saying that it's inadequate or that it is security theater only? Because it sounds like you're implying that no security exists whatsoever.

rendall 6y ago

I don't get such emails. I'm feeling left out! But I do have a pretty strict and solid privacy policy, though, and it's open source: Privacy Policy The creator of "Twitter 'Likes' Hider" has zero interest in tracking you. Your privacy is sacrosanct. No data will be kept, tracked, transferred, sold, traded, nor even coveted in any respect, from now until the end of time.

robin21 6y ago

The biggest problem is that Chrome Extensions don’t have granular enough permissions. I’ve seen developers write explanations of needing access to “all your data” because of one small feature they need access to. They should also add some monitoring regarding domains extensions talk to. Or even make developers add a description of outgoing requests from extensions somehow.

hydroxideOH- 6y ago
You already have to do that. In the extension manifest you need to specify URLs you need to access. I'm pretty sure the process of approving an extension is entirely automated though, so there isn't any real accountability unless an extension is specifically investigated.
- paulryanrogers 6y ago
  In practice many extensions need access to all URLs.

lrossi 6y ago

Some of these problems might disappear if Google would introduce a payment scheme for Chrome extension developers. Then authors might not be tempted to sell them to scammers.

Animats 6y ago

I just got one of those. Grr. From: victoria@monetization-providers.com Subject: Monetise Your Chrome Extension I came across your extension on the Google chrome store and wanted to reach out to you to offer a way to increase revenue earnings from your extension. We are providing our partners with Bing landers and feeds that pays really well on extensions for search. It can earn up to $800 a month per 5000 users, and it is a premium product by invitation only. If your extension does not have search this is not a problem with a simple update this can be added, furthermore it is completely acceptable by google chrome store. If this is something you would be interested in, I would be glad to schedule a call to discuss this with you! Also if you are looking to sell your extension we can discuss this opportunity as we buy extensions. Victoria Jude Business Development Manager The sending domain was registered yesterday.

ralphzera 6y ago
hahaha same bro

truumann 6y ago

Hello from ru extensions community! Nobody will read this, but all we need is just browser devs to finish this useless shit: https://i.ibb.co/C6nsNhX/2021-2-6-11-19-25.png https://i.ibb.co/C6nsNhX/2021-2-6-11-19-25.png Add a blacklist and the ability to manually edit lists. So that the extensions themselves are unloaded from memory or isolated on certain domains. You are and google assholes only think about further curtailing powers and opportunities for expansion and that's wrong.