4 ms·

Upon installing I get this creepy message: http://i.imgur.com/6MYin5b.png http://i.imgur.com/6MYin5b.png Are they really going to spy on my coinbase and stripe

Upon installing I get this creepy message: http://i.imgur.com/6MYin5b.png http://i.imgur.com/6MYin5b.png Are they really going to spy on my coinbase and stripe activities!?

taspeotis 13y ago
I wonder what sort of success you'd have by doing social engineering like this: Show HN: Something something Chrome extension Except it's actually malware.
middleclick 13y ago
I don't know about Ferro, but even vimium asks for this many permissions. I guess this due to the way it will handle shortcuts and bindings. I was hesitant to install vimium because of this but it is open source and the author seems to be someone famous so I can trust them. Related vimium ticket: https://github.com/philc/vimium/issues/366 https://github.com/philc/vimium/issues/366 TL;DR: not very unexpected perhaps?
- goldenkey 13y ago
  > to be someone famous so I can trust them Do you use the same logic for political leaders?
- lorendsr 13y ago
  Interestingly, Vimium's "Access your data on all websites" permissions can be less alarming than a similar notice only mentioning certain domains you care about, like stripe and coinbase.
lake99 13y ago
Disclaimer: I do not have much of an expertise in web technologies, and I do not have bitcoins. But when I look at http://www.getferro.com/#security http://www.getferro.com/#security, I see: Ferro does not transmit your personal information to nor store it on our servers. That includes, for instance, your browsing history, bookmarks, and saved sessions. The only personal information stored is your saved sessions, and that is either stored on your computer, or if you are signed into Chrome, on Chrome's sync servers, which are secured by Google. The only dynamic content that is displayed to you and did not originate from you is the list of recent donations on the options page, and that data is escaped. To those in the know, would they need access to your data to be able to send info from coinbase and stripe to you, or for donations?
cool-RR 13y ago
I decided to uninstall because of this. It's a dealbreaker.
lorendsr 13y ago
Ferro creator here. The answer is of course no, Ferro was not looking at your coinbase or stripe data. It was only loading the API scripts from those domains asynchronously in order to reduce the load time of the options page, and to do so it needed those domains in the permissions list. I just published v1.0.9, in which I have switched it back to the slow version and removed the coinbase/stripe permissions from the manifest. Once you receive the update (<1 hr), you can visit `chrome://extensions/` and click the Ferro "Permissions" link to confirm. For more information, see https://github.com/ferro/ferro/issues/9 https://github.com/ferro/ferro/issues/9

Upon installing I get this creepy message: http://i.imgur.com/6MYin5b.png http://i.imgur.com/6MYin5b.png Are they really going to spy on my coinbase and stripe activities!?

taspeotis 13y ago

I wonder what sort of success you'd have by doing social engineering like this: Show HN: Something something Chrome extension Except it's actually malware.

middleclick 13y ago

I don't know about Ferro, but even vimium asks for this many permissions. I guess this due to the way it will handle shortcuts and bindings. I was hesitant to install vimium because of this but it is open source and the author seems to be someone famous so I can trust them. Related vimium ticket: https://github.com/philc/vimium/issues/366 https://github.com/philc/vimium/issues/366 TL;DR: not very unexpected perhaps?

goldenkey 13y ago
> to be someone famous so I can trust them Do you use the same logic for political leaders?
lorendsr 13y ago
Interestingly, Vimium's "Access your data on all websites" permissions can be less alarming than a similar notice only mentioning certain domains you care about, like stripe and coinbase.

lake99 13y ago

Disclaimer: I do not have much of an expertise in web technologies, and I do not have bitcoins. But when I look at http://www.getferro.com/#security http://www.getferro.com/#security, I see: Ferro does not transmit your personal information to nor store it on our servers. That includes, for instance, your browsing history, bookmarks, and saved sessions. The only personal information stored is your saved sessions, and that is either stored on your computer, or if you are signed into Chrome, on Chrome's sync servers, which are secured by Google. The only dynamic content that is displayed to you and did not originate from you is the list of recent donations on the options page, and that data is escaped. To those in the know, would they need access to your data to be able to send info from coinbase and stripe to you, or for donations?

cool-RR 13y ago

I decided to uninstall because of this. It's a dealbreaker.

lorendsr 13y ago

Ferro creator here. The answer is of course no, Ferro was not looking at your coinbase or stripe data. It was only loading the API scripts from those domains asynchronously in order to reduce the load time of the options page, and to do so it needed those domains in the permissions list. I just published v1.0.9, in which I have switched it back to the slow version and removed the coinbase/stripe permissions from the manifest. Once you receive the update (<1 hr), you can visit `chrome://extensions/` and click the Ferro "Permissions" link to confirm. For more information, see https://github.com/ferro/ferro/issues/9 https://github.com/ferro/ferro/issues/9