11 ms·

How about the related one that claims to be from Microsoft, but uses msftliveapps@gmail.com? https://chrome.google.com/webstore/detail/microsoft-autofill/fiedb

How about the related one that claims to be from Microsoft, but uses msftliveapps@gmail.com? https://chrome.google.com/webstore/detail/microsoft-autofill/fiedbfgcleddlbcmgdigjgdfcggjcion?hl=en-US https://chrome.google.com/webstore/detail/microsoft-autofill... I literally can’t tell real from fake on these shitty platforms. Edit: Or this using msandapp.chrome@gmail.com: https://chrome.google.com/webstore/detail/microsoft-news-new-tab/lklfbkdigihjaaeamncibechhgalldgl?hl=en-US https://chrome.google.com/webstore/detail/microsoft-news-new... The average person has no chance :-(

koheripbal 5y ago
How on Earth is "Offered by: Microsoft Corporation" not verified in literally any way whatsoever. That's so poorly vetted it's negligent. Maybe extensions and apps should be signed by domain ownership?
- yrro 5y ago
  In general this is a good idea. But in the case of Microsoft--good luck figuring out which of Microsoft's thousands of domains are legit! :)
  - koheripbal 5y ago
    It would seem to me that Microsoft would choose to link it to microsoft.com so that customers can easily recognize its authenticity.
    - yrro 5y ago
      They have already failed this test: they are already publishing extensions using msftliveapps@gmail.com and msandapp.bgcextn@gmail.com, doubtless many others!
      - evilsnoopi3 5y ago
        I believe Google requires you publish Chrome extensions with an @gmail address, in which case MS doesn’t really have a choice.
        yrro 5y ago
        Good grief--that is so evil (not to mention anticompetitive) that I didn't even consider it!
        deleted 5y ago
        [deleted]
        Godel_unicode 5y ago
        Not sure what would make using a Gmail account anticompetitive, but it's also not true. You need a chrome web store account (which they amusingly encourage you not to use your personal email for) which can use any email address.
        criddell 5y ago
        Any idea what problem Google is solving by requiring the use of gmail?
        nolok 5y ago
        Naivety on the internet, and people believing what they read on a web page without checking. Google doesn't require a gmail adresse to publish.
        criddell 5y ago
        Yeah, I didn't think it made sense.
        electroly 5y ago
        Absolutely untrue, as mentioned elsewhere in the thread. I have Chrome extensions published under a non-gmail email address.
    - dragonwriter 5y ago
      Microsoft might, I suppose, have a policy against microsoft.com accounts on other firms infrastructure, and therefore if it needs a Google account uses gmail or other non-microsoft.com domains.
  - formerly_proven 5y ago
    Reminds me of Paypal where I'm simply unable to tell whether some mails from them were phishing or not (regardless of time spent investigating these mails), and I believe that virtually no one would be able to tell.
    - ComputerGuru 5y ago
      They were even cognizant of the issue to the point where they set up a robo inbox you could forward any suspected phishing emails to and it would reply telling you if it was legit or not. It was something like phishing@paypal.com
    - rocqua 5y ago
      It still frustrates me that legitimate Paypal e-mails include really big "click here to login" buttons that link you to their website. Such links are considered a hallmark of phishing, and there are many attempts to prevent people from clicking on such links. Many services I use include text like 'we will never send you such a link you know how to get to our website'. The fact that paypal does not do this normalizes clicking on links in e-mails.
      - gowld 5y ago
        "use email for notifications, but don't trust email content" is not a solution for most users. If you can't trust email, why even have it? Install a secure app and leave email behind, or make email secure by having clients clearly display cryptographically secured provenance info, and flag unknown/untrusted senders.
        rocqua 5y ago
        There is no alternative to e-mail. Except perhaps for SMS. There is no other method for contacting people that is anywhere near as pervasive. It also has the advantage of being federated, not controlled by any specific entity. Besides that, compared to WhatsApp and signal, email is generally for longer and less urgent messages. Those fit notifications much better. In that context an email saying "hey this is whats up, login as you normally do if you want to verify or act accordingly". It's far from ideal. We will probably come to some form of solution at some point. But at this moment it is a clear no-brainer.
- donmcronald 5y ago
  It might be legit. The Microsoft rewards app uses msandapp.bgcextn@gmail.com. I’m guessing 1 million installs makes that legit. There’s no way even for technical people to make a proper assessment of the trustworthiness of the publisher. Google has ruined the internet because they want Google Search to be the only “trustworthy” source online. Too bad they suck at it and Google search is a steaming pile of shit now.
  - estaseuropano 5y ago
    1 million click farmers in china/India/Nigeria?
- scoopertrooper 5y ago
  That one is legit, I'm guessing Chrome requires users to use a gmail account in order to submit an extension to their store. https://blogs.windows.com/windowsexperience/2021/02/05/simplify-and-secure-your-life-with-microsofts-autofill-solution-for-passwords/ https://blogs.windows.com/windowsexperience/2021/02/05/simpl...
  - donmcronald 5y ago
    Talk about training users to fall for phishing schemes. Plus users have been so desensitized to entering 2FA codes they’ll type them in anywhere. I feel like web security is worse than it was 10 years ago.
    - thefounder 5y ago
      We need webauthn not just 2FA
      - throwawayboise 5y ago
        Love how the goalposts keep moving. First arcane password rules so it takes 5 minutes and half a dozen attempts to come up with a password that is accepted. Then force the user to change it often. Then add email verification. Then SMS/phone verification. Still not good enough, now we all need to have a hardware token to buy the counterfeit garbage for sale on Amazon. Fuck that. It's just not worth the trouble. Honestly the world was a lot easier (if a bit slower) when you dealt with businesses in person or via mail. Fraud and identity theft just doesn't scale in meatspace, so it was never a big problem.
        moshmosh 5y ago
        I maintain that most of what we get from the Web and computers, as individuals, is barely better than what we had before, and not enough so to justify its costs. Shopping very much included. For some context, I grew up very much "OMG wire my brain in, let's get this future shit going!" Years of watching that future develop, and some reflection, have almost entirely reversed that sentiment, for me. For example: are streaming services convenient? Yeah, of course. Am I actually happier with them than I was with the library, rentals, and the occasional purchased movie? Marginally, if at all. (but I have Internet service for the handful of things it actually is highly beneficial for, so, may as well use streaming, too) Is shopping online convenient? Yes. Am I happier than when I just had way less idea what was available to buy, and there was more friction to indulging every little purchase-whim? I really wonder. This one may not just be marginally better, but net-harmful.
- social_quotient 5y ago
  Considering APPLE goes so far to make you confirm DUNS numbers for a company acct. It seems like this would have been a good mitigating practice and already has precedence. While it’s a PITA it makes sense.
  - ocdtrekkie 5y ago
    The core issue is that Apple uses humans to evaluate these requests and provide a point of contact with businesses. Google believes any process requiring a human is broken.
eli 5y ago
I think those are legit. Guessing you need a gmail or gsuite address to publish?
- donmcronald 5y ago
  Too bad Microsoft can’t afford a Google Workspace account and has to rely on the free gmail accounts. Lmfao.
  - saalweachter 5y ago
    I wonder whether foo@x.microsoft.com would look more or less legitimate to the untrained eye.
  - mrweasel 5y ago
    They could, but what sort of service doesn't allow you to sign up with a random domain? It also wouldn't be better if they had: chrome@msftext.com, or are you suggesting just moving all microsoft.com emails to Google Workspace? Perhaps it's like YouTube? You cannot buy or use a Youtube Premium subscription with a Google Workspace account. I tried inviting a family member to my Youtube Premium subscription, using her Google Workspace email. It doesn't work, because Youtube doesn't see it as a Gmail account.
    - kadoban 5y ago
      @gapps.microsoft.com would be at least better than a random unverifiable @gmail.com address. Google Workspace (is that what we're calling it this week?) lets you use subdomains right?
      - m0dest 5y ago
        Let's be real: getting legal and infosec to sign off on that is never going to happen. "We just need to borrow a subdomain of Microsoft.com, give control to our biggest competitor, and sign a contract with them... to get a vanity email address in their store."
grigarav 5y ago
If you think that it's bad, have a look at https://chrome.google.com/webstore/detail/microsoft-defender-browse/bkbeeeffjjeopflfhgeknacdieedcoml https://chrome.google.com/webstore/detail/microsoft-defender.... Over 1 million people are using this crap...
- shp0ngle 5y ago
  Wait, that is not legit? How... how can you tell? edit: it's actually legit
  - kenniskrag 5y ago
    I would try to find a link on a official homepage (MS in this case) which links to this extension. Otherwise I wouldn't trust it. Links on this site to the extension: https://browserprotection.microsoft.com/learn.html https://browserprotection.microsoft.com/learn.html
typon 5y ago
This is why when setting up my relatives' computer I only install Adblock and then make this directory readonly: chmod 444 ~/Library/Application\ Support/Google/Chrome/Default/Extensions
- oauea 5y ago
  Sounds like a great way to get your browser to crash unexpectedly.
  - ocdtrekkie 5y ago
    Arguably that's better than the alternative, where they get scammed or hacked. I usually edit their desktop shortcut to disable extensions, personally, but I like the parent's solution better.
  - capableweb 5y ago
    Even better way to discover which browsers don't handle pretty normal situations (read-only) in a normal way. If Google Chrome is forcing people to allow installation of extensions, it's much better to move to a different browser, than to either live with crashes or live with poor security (in this, parental case).
    - typon 5y ago
      Yep. I was tired of coming home and seeing a million malware search engines and fake VPNs extensions installed. I'm always puzzled as how they manage to get in there. I'd rather crash the browser than allow this garbage which usually takes a full reinstall to get rid of.
      - e3bc54b2 5y ago
        Your comment made me chuckle. Back in 2008 Chrome was the breath of fresh air, with absolutely spartan look, total lack of extensions and amazing speed, while IE was the opposite. There was good reason for its initial popularity. And now, looks like Chrome lived long enough to see itself become a villain...
megous 5y ago
Extension offering replication of basic browser functionality sends some major red flags, especially around storing passwords.
nguyenkien 5y ago
Just like you, I assume that. I double check msftliveapps@gmail.com, and guess what, it's legit. Check this blog: https://blogs.windows.com/windowsexperience/2021/02/05/simplify-and-secure-your-life-with-microsofts-autofill-solution-for-passwords/ https://blogs.windows.com/windowsexperience/2021/02/05/simpl...
NazakiAid 5y ago
That top link screams scam. Replies from the "Product team at Microsoft Autofill" on a personal account, reviews about it taking up to 30% CPU all the time (possible crypto miner), and not using assets from the Microsoft brand.
k_sze 5y ago
Here is a crazy conspiracy theory: maybe they are both legit and MS used shady-looking e-mail addresses on purpose. Security-minded people will look at them and call them out, thus bringing to light how shitty the Chrome Extension store vetting process is, undermining Google Chrome's credibility in the process, so that users stay on MS Edge.

koheripbal 5y ago

How on Earth is "Offered by: Microsoft Corporation" not verified in literally any way whatsoever. That's so poorly vetted it's negligent. Maybe extensions and apps should be signed by domain ownership?

yrro 5y ago
In general this is a good idea. But in the case of Microsoft--good luck figuring out which of Microsoft's thousands of domains are legit! :)
- koheripbal 5y ago
  It would seem to me that Microsoft would choose to link it to microsoft.com so that customers can easily recognize its authenticity.
  - yrro 5y ago
    They have already failed this test: they are already publishing extensions using msftliveapps@gmail.com and msandapp.bgcextn@gmail.com, doubtless many others!
    - evilsnoopi3 5y ago
      I believe Google requires you publish Chrome extensions with an @gmail address, in which case MS doesn’t really have a choice.
      - yrro 5y ago
        Good grief--that is so evil (not to mention anticompetitive) that I didn't even consider it!
        deleted 5y ago
        [deleted]
        Godel_unicode 5y ago
        Not sure what would make using a Gmail account anticompetitive, but it's also not true. You need a chrome web store account (which they amusingly encourage you not to use your personal email for) which can use any email address.
      - criddell 5y ago
        Any idea what problem Google is solving by requiring the use of gmail?
        nolok 5y ago
        Naivety on the internet, and people believing what they read on a web page without checking. Google doesn't require a gmail adresse to publish.
        criddell 5y ago
        Yeah, I didn't think it made sense.
      - electroly 5y ago
        Absolutely untrue, as mentioned elsewhere in the thread. I have Chrome extensions published under a non-gmail email address.
  - dragonwriter 5y ago
    Microsoft might, I suppose, have a policy against microsoft.com accounts on other firms infrastructure, and therefore if it needs a Google account uses gmail or other non-microsoft.com domains.
- formerly_proven 5y ago
  Reminds me of Paypal where I'm simply unable to tell whether some mails from them were phishing or not (regardless of time spent investigating these mails), and I believe that virtually no one would be able to tell.
  - ComputerGuru 5y ago
    They were even cognizant of the issue to the point where they set up a robo inbox you could forward any suspected phishing emails to and it would reply telling you if it was legit or not. It was something like phishing@paypal.com
  - rocqua 5y ago
    It still frustrates me that legitimate Paypal e-mails include really big "click here to login" buttons that link you to their website. Such links are considered a hallmark of phishing, and there are many attempts to prevent people from clicking on such links. Many services I use include text like 'we will never send you such a link you know how to get to our website'. The fact that paypal does not do this normalizes clicking on links in e-mails.
    - gowld 5y ago
      "use email for notifications, but don't trust email content" is not a solution for most users. If you can't trust email, why even have it? Install a secure app and leave email behind, or make email secure by having clients clearly display cryptographically secured provenance info, and flag unknown/untrusted senders.
      - rocqua 5y ago
        There is no alternative to e-mail. Except perhaps for SMS. There is no other method for contacting people that is anywhere near as pervasive. It also has the advantage of being federated, not controlled by any specific entity. Besides that, compared to WhatsApp and signal, email is generally for longer and less urgent messages. Those fit notifications much better. In that context an email saying "hey this is whats up, login as you normally do if you want to verify or act accordingly". It's far from ideal. We will probably come to some form of solution at some point. But at this moment it is a clear no-brainer.
donmcronald 5y ago
It might be legit. The Microsoft rewards app uses msandapp.bgcextn@gmail.com. I’m guessing 1 million installs makes that legit. There’s no way even for technical people to make a proper assessment of the trustworthiness of the publisher. Google has ruined the internet because they want Google Search to be the only “trustworthy” source online. Too bad they suck at it and Google search is a steaming pile of shit now.
- estaseuropano 5y ago
  1 million click farmers in china/India/Nigeria?
scoopertrooper 5y ago
That one is legit, I'm guessing Chrome requires users to use a gmail account in order to submit an extension to their store. https://blogs.windows.com/windowsexperience/2021/02/05/simplify-and-secure-your-life-with-microsofts-autofill-solution-for-passwords/ https://blogs.windows.com/windowsexperience/2021/02/05/simpl...
- donmcronald 5y ago
  Talk about training users to fall for phishing schemes. Plus users have been so desensitized to entering 2FA codes they’ll type them in anywhere. I feel like web security is worse than it was 10 years ago.
  - thefounder 5y ago
    We need webauthn not just 2FA
    - throwawayboise 5y ago
      Love how the goalposts keep moving. First arcane password rules so it takes 5 minutes and half a dozen attempts to come up with a password that is accepted. Then force the user to change it often. Then add email verification. Then SMS/phone verification. Still not good enough, now we all need to have a hardware token to buy the counterfeit garbage for sale on Amazon. Fuck that. It's just not worth the trouble. Honestly the world was a lot easier (if a bit slower) when you dealt with businesses in person or via mail. Fraud and identity theft just doesn't scale in meatspace, so it was never a big problem.
      - moshmosh 5y ago
        I maintain that most of what we get from the Web and computers, as individuals, is barely better than what we had before, and not enough so to justify its costs. Shopping very much included. For some context, I grew up very much "OMG wire my brain in, let's get this future shit going!" Years of watching that future develop, and some reflection, have almost entirely reversed that sentiment, for me. For example: are streaming services convenient? Yeah, of course. Am I actually happier with them than I was with the library, rentals, and the occasional purchased movie? Marginally, if at all. (but I have Internet service for the handful of things it actually is highly beneficial for, so, may as well use streaming, too) Is shopping online convenient? Yes. Am I happier than when I just had way less idea what was available to buy, and there was more friction to indulging every little purchase-whim? I really wonder. This one may not just be marginally better, but net-harmful.
social_quotient 5y ago
Considering APPLE goes so far to make you confirm DUNS numbers for a company acct. It seems like this would have been a good mitigating practice and already has precedence. While it’s a PITA it makes sense.
- ocdtrekkie 5y ago
  The core issue is that Apple uses humans to evaluate these requests and provide a point of contact with businesses. Google believes any process requiring a human is broken.

eli 5y ago

I think those are legit. Guessing you need a gmail or gsuite address to publish?

donmcronald 5y ago
Too bad Microsoft can’t afford a Google Workspace account and has to rely on the free gmail accounts. Lmfao.
- saalweachter 5y ago
  I wonder whether foo@x.microsoft.com would look more or less legitimate to the untrained eye.
- mrweasel 5y ago
  They could, but what sort of service doesn't allow you to sign up with a random domain? It also wouldn't be better if they had: chrome@msftext.com, or are you suggesting just moving all microsoft.com emails to Google Workspace? Perhaps it's like YouTube? You cannot buy or use a Youtube Premium subscription with a Google Workspace account. I tried inviting a family member to my Youtube Premium subscription, using her Google Workspace email. It doesn't work, because Youtube doesn't see it as a Gmail account.
  - kadoban 5y ago
    @gapps.microsoft.com would be at least better than a random unverifiable @gmail.com address. Google Workspace (is that what we're calling it this week?) lets you use subdomains right?
    - m0dest 5y ago
      Let's be real: getting legal and infosec to sign off on that is never going to happen. "We just need to borrow a subdomain of Microsoft.com, give control to our biggest competitor, and sign a contract with them... to get a vanity email address in their store."

grigarav 5y ago

If you think that it's bad, have a look at https://chrome.google.com/webstore/detail/microsoft-defender-browse/bkbeeeffjjeopflfhgeknacdieedcoml https://chrome.google.com/webstore/detail/microsoft-defender.... Over 1 million people are using this crap...

shp0ngle 5y ago
Wait, that is not legit? How... how can you tell? edit: it's actually legit
- kenniskrag 5y ago
  I would try to find a link on a official homepage (MS in this case) which links to this extension. Otherwise I wouldn't trust it. Links on this site to the extension: https://browserprotection.microsoft.com/learn.html https://browserprotection.microsoft.com/learn.html

typon 5y ago

This is why when setting up my relatives' computer I only install Adblock and then make this directory readonly: chmod 444 ~/Library/Application\ Support/Google/Chrome/Default/Extensions

oauea 5y ago
Sounds like a great way to get your browser to crash unexpectedly.
- ocdtrekkie 5y ago
  Arguably that's better than the alternative, where they get scammed or hacked. I usually edit their desktop shortcut to disable extensions, personally, but I like the parent's solution better.
- capableweb 5y ago
  Even better way to discover which browsers don't handle pretty normal situations (read-only) in a normal way. If Google Chrome is forcing people to allow installation of extensions, it's much better to move to a different browser, than to either live with crashes or live with poor security (in this, parental case).
  - typon 5y ago
    Yep. I was tired of coming home and seeing a million malware search engines and fake VPNs extensions installed. I'm always puzzled as how they manage to get in there. I'd rather crash the browser than allow this garbage which usually takes a full reinstall to get rid of.
    - e3bc54b2 5y ago
      Your comment made me chuckle. Back in 2008 Chrome was the breath of fresh air, with absolutely spartan look, total lack of extensions and amazing speed, while IE was the opposite. There was good reason for its initial popularity. And now, looks like Chrome lived long enough to see itself become a villain...

megous 5y ago

Extension offering replication of basic browser functionality sends some major red flags, especially around storing passwords.

nguyenkien 5y ago

Just like you, I assume that. I double check msftliveapps@gmail.com, and guess what, it's legit. Check this blog: https://blogs.windows.com/windowsexperience/2021/02/05/simplify-and-secure-your-life-with-microsofts-autofill-solution-for-passwords/ https://blogs.windows.com/windowsexperience/2021/02/05/simpl...

NazakiAid 5y ago

That top link screams scam. Replies from the "Product team at Microsoft Autofill" on a personal account, reviews about it taking up to 30% CPU all the time (possible crypto miner), and not using assets from the Microsoft brand.

k_sze 5y ago

Here is a crazy conspiracy theory: maybe they are both legit and MS used shady-looking e-mail addresses on purpose. Security-minded people will look at them and call them out, thus bringing to light how shitty the Chrome Extension store vetting process is, undermining Google Chrome's credibility in the process, so that users stay on MS Edge.