3 ms·
Browsing history doesn't contain what's displayed on the page, and what you input into the input boxes, or POST requests. It's sorta like telephone metadata. O
by EGreg 2y ago
Browsing history doesn't contain what's displayed on the page, and what you input into the input boxes, or POST requests. It's sorta like telephone metadata.
On the other hand, I am always freaked out by Chrome extensions that "can read and change your data on all websites". Can't they have more granular permissions? You gotta have a lot of trust for those extensions LMAO. They can read your bank passwords, probably!! And if they are ever sold...
- herf 2y agoExactly - knowing the content of each webpage is pretty easy if you're "big brother" surveilling millions of people, even more so if you have a Chrome extension to help. It's "little brother" that benefits a lot here: bosses, spouses, parents, etc., who otherwise wouldn't click on 1000 links in your history.
- ls612 2y agoTo be fair for me the extensions that get that are uBO, Privacy Badger, and Tampermonkey. I trust gorhill and the EFF to not fuck me over on my data, and Tampermonkey kinda needs those sorts of permissions to work. My password manager has read access to every website but I'm already trusting it with all of my passwords so...
- EGreg 2y agoSeems like a very juicy target. These extensions should not store any data without a master password that you input every time. What if someone stole the signing key, and submitted an update to Chrome store, even for a little? Oh wait that is only for Chrome Apps. For extensions, they can literally update themselves anytime. Someone would just have to steal the certificate. If an extension that reads all data uses a CDN (like CloudFlare) that CDN can execute a MITM attack against it and download new code, that would he catastrophic even if it was caught 1 day later.
- ls612 2y ago>Oh wait that is only for Chrome Apps. For extensions, they can literally update themselves anytime. Someone would just have to steal the certificate. Mozilla reviews signed extension updates. Something tells me uBO is one of the most scrutinized given how very many users it has. >If an extension that reads all data uses a CDN (like CloudFlare) that CDN can execute a MITM attack against it and download new code, that would he catastrophic even if it was caught 1 day later. My threat model doesn't include state actors targeting me specifically. Not sure much of anything works against that threat model besides maybe iOS in Lockdown Mode as your only device.
- EGreg 2y agoExtensions can simply download and update their own code, eg by loading new stuff from localStorage. I have seen Metamask update itself randomly, and it has access to read every website
- ls612 2y agoCrypto wallets in web browser extensions seems like an absolutely terrible idea compared to any of my example.
- red_admiral 2y agoI have an extension like that called uBlock. If that ever gets compromised or sold, I will have much bigger problems ...
- immibis 2y agoYes, they can change it, that's what Manifest V2 deprecation is about. It will break a lot of ad blockers, because they rely on being able to read anything and change anything on all websites. Many people feel that Google is doing it to make more people watch more ads, not to improve security.