12 ms·

Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

160 points by uladzislau 13y ago

yaakov34 13y ago
Can we start a petition for Google to let us disable extensions on specific sites? After reading the last few stories about this, I am quite sure I don't want any extensions whatsoever running in the same tab as my Gmail account. I think there is some extension that does this for you (turns off other extensions per site), but then we get into a "who guards the guardians" situation. Not to mention we need better and finer grained permissions for extensions in general, now that we use so many web apps with crucial data.
- pasbesoin 13y ago
  Look into running separate sessions of your browser(s). Both Firefox and Google Chrome (or Chromium) allow you to do this, although the interfaces for doing so differ. A simple way to do this is to use different brands of browser, e.g. Gmail in Chrome and everything else in Firefox. But... if you really prefer one browser over another, for all use, then the separate profiles thing works. Note that in Chrome, this is now confused by the ability to change Google account log-ins. That is not a separate, browser-level profile with separate configuration. Instead, you are looking for the command line invocation argument --user-data-dir (in *NIX, at least; IIRC the flag name may differ slightly in the Windows version). For Firefox, there is the -p flag. IIRC, you have to combine it with another flag in order to ensure both that the profiles are running in separate invocations and that you can be prompted to choose what profile to use when you invoke Firefox. Of course, you can create menu items / icons for these invocations to make them "clicky" and avoid having to go to the command line and enter them each time, if you prefer. P.S. Yes, this will help you less if you insist upon clicking directly on/through links that are are e.g. mailed to you or, if you have Facebook in its own "box", posted on Facebook. From that perspective, having per site browser extension variability might still be useful. But then, you're still looking at also controlling referer passing, cookies and other local data, etc., etc.
  - yaakov34 13y ago
    I tried running a Chromium session with no extensions for the stuff I want to be more secure (email/banking/etc.), while using Chrome for everything else, and this does work in a way. But I find that I tend to forget to switch to the other browser sometimes. A solution which said "don't run extensions on mail.google.com and online.my_bank.com" would be a lot more convenient. The separate browser solution does protect from tracking, but with the security threats of today, like these malicious extensions with access to all your data, I've become desensitized to mere tracking.
    - pasbesoin 13y ago
      I changed the color scheme for one profile (although, that involved installing and trusting the color scheme; I got mine directly from Google's site as opposed to a third party site). An extra cue, when the border background, tabs, etc. look different in one versus the other. Still hardly foolproof...
  - riquito 13y ago
    To run a new, separated Firefox with a (possibly) different profile firefox -no-remote -ProfileManager It's always handy to have a "vanilla" profile, to compare how much the extensions tuned down the browser or try to understand if the error that you're seeing is caused by an extension. Having a "privacy" profile with some ad-hoc extensions helps too.
    - pasbesoin 13y ago
      Thanks. Sorry I mis-remembered the flag(s) from memory. And be sure you're using both, to make sure the separate profiles do not share the same process or something like that (again, from memory; Google can quickly turn up the details).
      - riquito 13y ago
        Your memory is right. Without -no-remote you would end up spawning another windows from the currently running firefox. Without -ProfileManager you can't choose a different profile. It's also a good idea to use different themes per profile (and I see you suggested it too).
- johnpmayer 13y ago
  > petition for Google Don't you mean a PR on the Chromium project?
- anonymfus 13y ago
  Opera 12 has ability to disable access of specific extensions to https sites and/or private tabs (by default access to https sites is enabled and to private tabs is disabled). May be there is a hope that they implement it in Blink based Opera, but now they only have ability to disable access of specific extensions to private windows and have no private tabs at all.
  - midas007 13y ago
    Opera 12 is ancient history. Opera 18 is now basically Chrome without the ability to set a custom search engine as default. Even with sqlite hacks, there's no way to set DDG as default on the stable release versions. (I use FF.)
    - ernesth 13y ago
      Opera 12 is the latest version on Linux.
- Houshalter 13y ago
  That's a good idea but only a crutch. I don't want extensions invading my privacy on any site. Finer grained permissions would be ideal.
  - riquito 13y ago
    Once an extension can modify the DOM (and most extensions need it) you loose any hope of permissions. From injecting javascript to sending data modifying an img[src], there's no way to protect your privacy. I don't think that permissions are a viable model here, it's more a problem of trust and auditing.
    - gcb0 13y ago
      extensions have the option of working only on a set of domain. So you could only install gmail extensions that work only on gmail.com and not on * as 99.999% of the extensions does. Most need to, like referrer blockers and user agent spoofers. But we only need those global extensions because google actively removes those functionalities from chromium, on a regular basis, after someone in the community adds it. over and over again.
- oniTony 13y ago
  Chrome doesn't run extensions by default in incognito mode. > Because Google Chrome does not control how extensions handle your personal data, all extensions have been disabled for incognito windows. You can reenable them individually in the extensions manager. Keeping your gmail tab in an incognito window might be a good approach.
  - beefsack 13y ago
    While it's a decent workaround, I wouldn't call it ideal, namely because it requires a second window open when you might be starved for screen real estate and also because accidentally opening your mail once in a normal window could cause damage.
    - uptown 13y ago
      The Ghost Incognito extension allows you to force certain sites to always use Incognito mode. I realize using an extension to accomplish this objective is somewhat ironic, but seems like it'd work in this case if you can trust that one extension. https://chrome.google.com/webstore/detail/ghost-incognito/gedeaafllmnkkgbinfnleblcglamgebg?hl=en-US https://chrome.google.com/webstore/detail/ghost-incognito/ge...
  - mynameishere 13y ago
    Or just using thunderbird. I can't be the only one who doesn't like gmail's wonky interface.
    - eli 13y ago
      If I didn't use gmail through the web, I probably would use a different provider.
- deleted 13y ago
  [deleted]
- nikcub 13y ago
  I achieve this by having multiple users in Chrome. My main user is signed into my google account and has no extensions installed and all plugins disabled, I only access gmail and google services with it. My second user account is logged into basic services like HN, reddit, amazon and has only adblock and disconnect installed. A third user is not logged in anywhere and has adblock and a half-dozen other extensions installed including UA switcher. No plugins installed and cookies + cache cleared every day. 4th user has all the anonimity extensions installed and has privoxy + tor set as the proxy I use Facebook in a completely different browser again, YouTube and video watching in yet another and development in chromium. 7 or 8 different cookie stores, and a throwaway temp email account associated with the 3rd and 4th user for signing up to services. Start out by creating a separate user for browsing sites and eventually develop your own way to split up your web browsing profiles. This can get a bit messy when you try and access from tablet or mobikle , but I'd rather not have a single large profile and a huge exploit surface and sacrifice browsing history and remembering passwords.
  - broolstoryco 13y ago
    honestly this sounds like a pain in the ass
    - nikcub 13y ago
      Start off with two profiles and go from there. I use virtual desktops (spaces on OS X) to manage it. Space 2 is gmail, space 3 is logged in sites, space 4 is development, etc. Once you get used to it you instinctively switch without thinking about it I also created an app for OS X that creates temporary throwaway browser sessions for any supported browser you have installed: https://github.com/nikcub/tmpbrowser https://github.com/nikcub/tmpbrowser Makes it easier than using command line options and creating users
  - unbeli 13y ago
    What exactly are you trying to achieve with that, if I may ask?
    - 13y ago
hackinthebochs 13y ago
I was thinking about this just the other day. The movement towards auto-update-everything is a massive security breech. Browser extensions are a prime example. So much of what we do is centered around the browser, and yet we allow essentially random pieces of code complete access to all that activity. Even worse, this code is allowed to download and run new versions without any user interaction. Needless to say, the potential for harm here cannot be understated. Auto updating anything but the most critical and most trusted software is absolutely bone-headed and we're going to look back and wonder how we could be so stupid.
- username223 13y ago
  > Auto updating anything but the most critical and most trusted software is absolutely bone-headed Yep. It's kind of mind-blowing that Crome defaults to auto-updating extensions, then lets just anyone upload new versions of them. (Is it even possible to disable this idiocy?) I take some perverse joy in the fact that someone has "monetized" the auto-update treadmill. Maybe it will encourage people to think about the consequences of installing random code to your computer whenever someone else decides to do so.
- aboodman 13y ago
  If a piece of software can connect to the internet, it can implement its own autoupdate. For extensions it would be trivial. People even commonly did it with Greasemonkey scripts. The reason Chrome includes this functionality is because the hand-rolled solutions people come up with frequently have security problems. Also, auto update gives good developers a way to fix their own security bugs when they are discovered.
  - hackinthebochs 13y ago
    We should be asking ourselves why we allow extensions with so much power and no meaningful security model. Auto update is a misfeature if I've ever seen one (again for anything but the most critical pieces of software).
    - 13y ago
ufmace 13y ago
This is a disturbing situation, but it's hard to say what the best way of dealing with it is. The first thing most people reach for first is that extensions shouldn't auto-update. Personally, I disagree - I love silent auto-updates in general. It's a huge drag on the computing experience to have dozens of different widgets all requiring manual updates, all with different mechanisms and all on their own schedules. If I had to pick the one most annoying thing about running Windows, that would be it. The biggest appeal to me of Chromebooks is silent auto-update of everything. Don't bug me about updates, just make everything always run the latest, most feature-filled and bug-fixed versions. I'd lean towards using a finer-grained permission model for extensions, and javascript in general. As far as I know, most extensions now can only request permissions to run arbitrary JS on every page you visit, and send arbitrary AJAX to any URL. Perhaps we could do a better job of locking that down. Have no such thing as a permission to AJAX any URL, but instead make AJAXing any particular TLD a new permission. Maybe we can also only allow access to DOM elements originating from particular domains. Then you could keep auto-update, but require a new user authorization for any new URL/domain access that an extension needs. It'd probably get pretty complex, but I think we could put together something reasonable. But then the other problem is the pile of plugins out there already with those arbitrary permissions. Maybe you could let them stay, but not allow any updates without switching to the new permission model?
- kzahel 13y ago
  The problem is with users. They ignore the scary "access to all websites" dialogs and install extensions. Sites like pinterest have extensions that request these permissions, when they don't even need them. There's a way to have the extension only have access to the site you're on when you CLICK somewhere in your toolbar. There are fine grained permissions and optional permissions to specific hosts and ports and URL patterns. It's all very well thought out. The problem is with users. For example, I have an extension that enables autocomplete on all web pages: https://chrome.google.com/webstore/detail/autocomplete-on/gdhbgagnmhdafendedikgjimegoipbnk https://chrome.google.com/webstore/detail/autocomplete-on/gd..., and it has access to all data on all websites. People install it every day, I don't know why. I would never install or trust anybody else with such an extension. I have to manually clone any extension I like and upload it to the chrome web store; that way I know it's not going to auto update and do nefarious things.
quadrangle 13y ago
Obligatory note: Another example of why we should only run Free Software and only from trusted sources. Users of Trisquel or gNewSense never have problems like this.
- 27182818284 13y ago
  Obligatory response that not everyone has time or training to examine code for problems. Google is a trusted source.
  - dublinben 13y ago
    >Google is a trusted source Hardly, if this kind of thing is allowed in their marketplace.
    - 27182818284 13y ago
      You're missing the point. Google and Apple are trusted sources in the real world. In the real world, people say things like "I have an Android" and advertisements say "Get a free Android with contract" If the distinction there is lost, I don't think you can expect the general consumer to know that Google isn't a "trusted source" by the definition of FSF advocates, right? Nor, I would contest, that they need to. >Hardly, if this kind of thing is allowed in their marketplace. They'll move on this just like they started actively patrolling the Play Store for malware. Because they are a trusted source, even if they aren't an FSF definition of trusted source.
  - dredmorbius 13y ago
    Obligatory response that you're not relying solely on your own ability to examine code for problems, but the entire universe of those able to do so. With proprietary code, you're restricted to audits done by those whom the code author has allowed to do so (or who have surreptitiously obtained the source ... and having done so, put themselves at legal risk by disclosing their findings).
- nl 13y ago
  All Chrome Extensions are completely opensource (lowercase - in the sense you can unzip them and inspect the source). The evidence seems to be that this does actually work - people do look, and find out suspicious looking issues. However, that is insufficient to protect users of extensions that were previously trustworthy and then become malicious.
deleted 13y ago
[deleted]
jaredsohn 13y ago
I would like it if the browser's DOM view would highlight changes made by an extension (at least directly; if the user injects JavaScript, it might be easier to just show that JavaScript rather than the changes that that code made to the DOM.) Also, it should log it (although this may create security concerns) so that one could occasionally look over what their extensions are doing. Similarly, there should be a log for AJAX requests made by the extension directly.
deleted 13y ago
[deleted]
riquito 13y ago
It's not just a DOM change problem. What if an extension change owner and start sending pairs (domain/user's credentials) to someone else? What if one buy an extension to get bank sites accesses?
- MasterScrat 13y ago
  What's surprising is that extensions are by default not "Allowed in incognito", however they are allowed when using HTTPS and there is no option to disable them there.
  - shadowfox 13y ago
    Opera seems to allow this (and it seems to give a bit more fine grained control over when/where extensions are allowed).
  - blibble 13y ago
    if adblock didn't work on https that'd be one way to see it massively deployed ;)
  - MichaelGG 13y ago
    HTTPS shouldn't be thought as just for secure sites, but just as the default. 4chan and this site run on HTTPS yet I wouldn't want to disable extensions for them because of that.
jaredsohn 13y ago
The browser (or an extension if possible) should include a list of extensions sorted by when they were last added/updated. Beyond helping determine why you're now seeing extra ads, this could help debug why certain sites are no longer working.
deleted 13y ago
[deleted]
ch0wn 13y ago
That shouldn't come as a surprise to anyone who has an app on any app store. I get at least two emails per week from some shady advertiser that wants to place ads, add notifications, gather user data or some else equally awful. I had at least one app where I didn't pay close enough attention to the permissions it required upfront and at some point it started injecting ads into random pages (it was a stopwatch, by the way). I guess the only way to effectively counter this is a better permission system.
- dredmorbius 13y ago
  While the app developers may not be surprised, I strongly suspect the overwhelming majority of app users are. And for Google to allow this to happen is unconscionable.
becherovka 13y ago
I've been informed that Chrom Extension advertising malware is a highly efficient and key source of money laundering. The market size of this is only limited by Google Chrome users. This is just the tip of that iceberg.
ronnier 13y ago
I was contacted and offered some payments to start including some sort of ads in my Chrome extension. As I understood it, it would inject ads and/or replace links on web pages with affiliate links. I declined their offer.
- eksith 13y ago
  That's just creepy. Replacing page content, unless ad/spam blocking or specifically user-selected filtering, is completely unethical and totally falls under malware in my book. Good on you for turning that down. You've saved your users a lot of aggravation.
  - dredmorbius 13y ago
    If you think about it: as formulated, virtually all present Web advertising works via content injection. You're just (nominally) limiting who gets to insert content.
wanda 13y ago
Why use any extensions ever?
- Zr40 13y ago
  Because extensions can provide useful functionality that's not provided by the browser. For instance, ad blocking or developer tools.
  - wanda 13y ago
    Chromium has all the dev tools I need OOTB. Adblock? Perhaps one risk I'll take on extensions. What else? Nothing. Unnecessary shit for people who want to configure every detail but can't be bothered to hack it themselves with uzbl or one of its equivalents.
- zoom 13y ago
  Or a browser for that matter.
taivare 13y ago
While on the subject of Chrome Extensions,could someone explain why? the React: Dev tools extension has Incognito mode.
aluhut 13y ago
I have the feeling that every "good" message about Chrome is followed by a disastrous one. This time it was the funky "audio feature" on tabs, followed by this. Chrome developed a scary creativity with good and evil stuff. I used Chrome once because everybody was telling me how fast it is. It wasn't. People just couldn't add all the processes properly. Since then it was a roller coaster I won't jump on anymore. I use Opera as an reference alternative to FF. btw: my parents end up with Chrome every time I come by on the Windows. Installed through some update (Java maybe?). Is there any way to block this without taking all installation rights from them?
- username223 13y ago
  > my parents end up with Chrome every time I come by on the Windows. Installed through some update My guess would be the tooltip-like thing that Google puts on its search page telling them to "make the web better with Chrome." I've never clicked on the thing, but it probably changes your default browser and installs a bunch of shortcuts.
mjbellantoni 13y ago
I think Google are already taking steps to address this. * http://blog.chromium.org/2013/12/keeping-chrome-extensions-simple.html http://blog.chromium.org/2013/12/keeping-chrome-extensions-s...
rubiquity 13y ago
Being the solution to the problems you create.
GigabyteCoin 13y ago
I wouldn't be surprised if some of the instances of this happening was the result of the original extension writer trying to boost his bottom line. (And not the work of shady malware marketers). It's easy to convince yourself you have been cheated when you know your extension has over 1M+ downloads and you only have ~!$100 sent to your donation button.
- gazarsgo 13y ago
  I forked an extension released under MIT license because of this -- original author pushing shady updates. After I re-released it on the Chrome Store, now I get emails trying to buy "my" extension from me.
  - Danieru 13y ago
    That sounds like a fine grey-hat tactic. Fork existing extensions, generate several thousand fake installs. Then sell to the first bidder. Rinse & Repeat and you'll make a profit and turn the market for second hand extensions into a market for lemons. If it happened enough the buyers would start being more cautious. The bar for minimal installs will go up and more proof will be expected. Soon enough the buyer's intentions will be clear to any extension owner.
    - MasterScrat 13y ago
      I wouldn't be so optimistic. > The bar for minimal installs will go up and more proof will be expected. Or the Store would be flooded with infected cloned extensions that some idiots will install anyway. > Soon enough the buyer's intentions will be clear to any extension owner. That's not the problem: developers could trivially be informed of this risk when they submit their extension on the Store.
hendersoon 13y ago
First, Chrome needs to alert the user before updating an addon that has changed owners, and the default should be "do not update". This change should be pretty uncontroversial. Second, Google needs to modify their policy towards Chrome addons to disallow ad injections and all user tracking. There should be a clear demarcation between addons and "apps" in the Chrome store. Apps can be legitimately supported by ads. Addons shouldn't be.
eksith 13y ago
From the comments: It sounds like Google needs to flag ownership changes and NOTIFY USERS about them before the next auto-update of that extension. ------------ NoteBuddy has been transferred from Joe Garage to Russian Mafia LLC. Do you want to keep this extension enabled? [ Da ] [ Nyet ] ----------- - DaveSimmons While this may seem like the most convenient step, it's actually not that simple either. The majority of users don't want to be notified of too many things and more notices may just be ignored. This is especially true of users with many extensions. As an alternative, it's possible to put extensions into a probationary period (I don't know if they already do this) when it's first created or the ownership has changed. Extensions are reaching the wild-west of Play and no one's happy about that except malware/adware authors. If Google continues to serve more free users than their quality capacity (already a problem with every other service they offer), it won't be long before people move on. And they will move on. Contrary to what most people believe, no one rules one domain forever. Whether it's the big iron of IBM, telecom of Bell, OS of Microsoft or the services of Google. Someone else will eventually wrestle in on your domain.
- deleted 13y ago
  [deleted]
mmanfrin 13y ago
Going through the few extensions that got caught doing this, I've noticed a commonality: Ecosia. This 'charity' is paying app developers to install adware.
atesti 13y ago
There is an easy solution: Follow http://superuser.com/questions/290280/how-to-download-chrome-extensions-for-installing-in-another-computer http://superuser.com/questions/290280/how-to-download-chrome... in order to download the crx file manually. Then unzip it and vet it manually to be clean. Copy it in a folder, enable extension developer mode in Chrome and install the local copy of the extension. No autoupdate, everything's fine. Unfortunately Google plans to disallow local extensions, which is a major disaster and very evil: http://thenextweb.com/google/2013/11/07/google-block-local-chrome-extensions-windows-starting-january-limit-installs-chrome-web-store/ http://thenextweb.com/google/2013/11/07/google-block-local-c... What happened to that?
- edtechdev 13y ago
  I mistakenly installed a Minecraft modloader for my son without checking it out first. It silently installed a couple of local Chrome extensions that injected ads in every page. It would reinstall them (again, silently) every time you deleted them. It wasn't detected by Microsoft Defender or Avast until I ran Malwarebytes which took care of the problem. So, pardon my french, but no freaking way do I want any local Chrome extensions allowed by default anymore. For extensions from the Chrome store, perhaps Chrome should make updates more like on Android, where you are notified and can click for more info.
  - MichaelGG 13y ago
    If you are running arbitrary code on your box, then local installed Chrome extensions aren't the real problem now, are they? That code could, I dunno, run a local HTTP/S proxy (install a trusted cert) and MiTM your HTTP requests and inject ads that way. Or about a million other things. And it's funny Chrome is trying to prevent apps from doing that, when they themselves do the same thing: In Windows, pinning to the taskbar is supposed to be user-only. But Chrome circumvents that and pins anyways, actively avoiding user preference. (And they drop an icon on the desktop, without asking.)
- wmt 13y ago
  Easy solution to any chrome extension possibly getting sold to spam ads is to disable automatic updates and manually inspect and install all updates for all of my extensions?
turshija 13y ago
I had similar problem few days ago ... I'm using "Super Awesome New Tab Page" for Chrome, and since few days ago random ads started popping on youtube, ebay, dx.com, amazon etc ... Took me ~30 mins to figure out which extension it was, and removed it... They also injected <script> tags to ALL websites I visited (that loaded external JS), tracking my history and they could easily put any form/input logging and silently insert keylogger into my Chrome if they wanted. I have reported the extension then, but nothing happened yet. Link: https://chrome.google.com/webstore/detail/awesome-new-tab-page/mgmiemnjjchgkmgbeljfocdjjnpjnmcg/reviews https://chrome.google.com/webstore/detail/awesome-new-tab-pa...
zoom 13y ago
Hey Google, knock it the fuck off.
rithi 13y ago
Noticed link injection last week and tracked it down to a very useful extension called World Clocks [1]. Had a hard time trying to report it - finally tracked down the Report abuse button inside the details tab on the store. One thing I noticed is that recent reviews of an extension are more accurate than the rating of the extension. Of course Google could mine these comments to track down problematic extensions and yank them. [1] http://goo.gl/DGqW1 http://goo.gl/DGqW1
midas007 13y ago
It's surprising there are still people foolish enough to believe Google cared about privacy when their business model depends on monetizing people trading their life's intimate details for services.
deanclatworthy 13y ago
I created an extension for Facebook that had 30k active users. I sold it after I was contacted like this. I was suspicious immediately from the outset about who the buyer was, but I figured I'd sell anyway as it took me about an hour to write. Strangely the app was deleted from the store within an hour of my purchase and has yet to re-appear: https://chrome.google.com/webstore/detail/facebook-chat-fix/ojeeafjafadjmbpojlogpipohgkpplkk https://chrome.google.com/webstore/detail/facebook-chat-fix/...
tuananh 13y ago
OT: Honey developers (a popular Chrome extension ~ 700k user) was approached by malware companies and are doing AMA on reddit http://www.reddit.com/r/IAmA/comments/1vjj51/i_am_one_of_the_developers_of_a_popular_chrome/ http://www.reddit.com/r/IAmA/comments/1vjj51/i_am_one_of_the...
ChikkaChiChi 13y ago
How about a little 'Stranger Danger' prevention as well? Don't run extensions from sources you don't trust in a browser profile you need to trust. I have one profile for development and one for browsing. development browser can get any old extension but the normal browser gets extensions from known, trusted companies like Google and LastPass.
snambi 13y ago
auto updating the extensions is not a good idea.

160 points by uladzislau 13y ago

Can we start a petition for Google to let us disable extensions on specific sites? After reading the last few stories about this, I am quite sure I don't want any extensions whatsoever running in the same tab as my Gmail account. I think there is some extension that does this for you (turns off other extensions per site), but then we get into a "who guards the guardians" situation. Not to mention we need better and finer grained permissions for extensions in general, now that we use so many web apps with crucial data.

pasbesoin 13y ago
Look into running separate sessions of your browser(s). Both Firefox and Google Chrome (or Chromium) allow you to do this, although the interfaces for doing so differ. A simple way to do this is to use different brands of browser, e.g. Gmail in Chrome and everything else in Firefox. But... if you really prefer one browser over another, for all use, then the separate profiles thing works. Note that in Chrome, this is now confused by the ability to change Google account log-ins. That is not a separate, browser-level profile with separate configuration. Instead, you are looking for the command line invocation argument --user-data-dir (in *NIX, at least; IIRC the flag name may differ slightly in the Windows version). For Firefox, there is the -p flag. IIRC, you have to combine it with another flag in order to ensure both that the profiles are running in separate invocations and that you can be prompted to choose what profile to use when you invoke Firefox. Of course, you can create menu items / icons for these invocations to make them "clicky" and avoid having to go to the command line and enter them each time, if you prefer. P.S. Yes, this will help you less if you insist upon clicking directly on/through links that are are e.g. mailed to you or, if you have Facebook in its own "box", posted on Facebook. From that perspective, having per site browser extension variability might still be useful. But then, you're still looking at also controlling referer passing, cookies and other local data, etc., etc.
- yaakov34 13y ago
  I tried running a Chromium session with no extensions for the stuff I want to be more secure (email/banking/etc.), while using Chrome for everything else, and this does work in a way. But I find that I tend to forget to switch to the other browser sometimes. A solution which said "don't run extensions on mail.google.com and online.my_bank.com" would be a lot more convenient. The separate browser solution does protect from tracking, but with the security threats of today, like these malicious extensions with access to all your data, I've become desensitized to mere tracking.
  - pasbesoin 13y ago
    I changed the color scheme for one profile (although, that involved installing and trusting the color scheme; I got mine directly from Google's site as opposed to a third party site). An extra cue, when the border background, tabs, etc. look different in one versus the other. Still hardly foolproof...
- riquito 13y ago
  To run a new, separated Firefox with a (possibly) different profile firefox -no-remote -ProfileManager It's always handy to have a "vanilla" profile, to compare how much the extensions tuned down the browser or try to understand if the error that you're seeing is caused by an extension. Having a "privacy" profile with some ad-hoc extensions helps too.
  - pasbesoin 13y ago
    Thanks. Sorry I mis-remembered the flag(s) from memory. And be sure you're using both, to make sure the separate profiles do not share the same process or something like that (again, from memory; Google can quickly turn up the details).
    - riquito 13y ago
      Your memory is right. Without -no-remote you would end up spawning another windows from the currently running firefox. Without -ProfileManager you can't choose a different profile. It's also a good idea to use different themes per profile (and I see you suggested it too).
johnpmayer 13y ago
> petition for Google Don't you mean a PR on the Chromium project?
anonymfus 13y ago
Opera 12 has ability to disable access of specific extensions to https sites and/or private tabs (by default access to https sites is enabled and to private tabs is disabled). May be there is a hope that they implement it in Blink based Opera, but now they only have ability to disable access of specific extensions to private windows and have no private tabs at all.
- midas007 13y ago
  Opera 12 is ancient history. Opera 18 is now basically Chrome without the ability to set a custom search engine as default. Even with sqlite hacks, there's no way to set DDG as default on the stable release versions. (I use FF.)
  - ernesth 13y ago
    Opera 12 is the latest version on Linux.
Houshalter 13y ago
That's a good idea but only a crutch. I don't want extensions invading my privacy on any site. Finer grained permissions would be ideal.
- riquito 13y ago
  Once an extension can modify the DOM (and most extensions need it) you loose any hope of permissions. From injecting javascript to sending data modifying an img[src], there's no way to protect your privacy. I don't think that permissions are a viable model here, it's more a problem of trust and auditing.
  - gcb0 13y ago
    extensions have the option of working only on a set of domain. So you could only install gmail extensions that work only on gmail.com and not on * as 99.999% of the extensions does. Most need to, like referrer blockers and user agent spoofers. But we only need those global extensions because google actively removes those functionalities from chromium, on a regular basis, after someone in the community adds it. over and over again.
oniTony 13y ago
Chrome doesn't run extensions by default in incognito mode. > Because Google Chrome does not control how extensions handle your personal data, all extensions have been disabled for incognito windows. You can reenable them individually in the extensions manager. Keeping your gmail tab in an incognito window might be a good approach.
- beefsack 13y ago
  While it's a decent workaround, I wouldn't call it ideal, namely because it requires a second window open when you might be starved for screen real estate and also because accidentally opening your mail once in a normal window could cause damage.
  - uptown 13y ago
    The Ghost Incognito extension allows you to force certain sites to always use Incognito mode. I realize using an extension to accomplish this objective is somewhat ironic, but seems like it'd work in this case if you can trust that one extension. https://chrome.google.com/webstore/detail/ghost-incognito/gedeaafllmnkkgbinfnleblcglamgebg?hl=en-US https://chrome.google.com/webstore/detail/ghost-incognito/ge...
- mynameishere 13y ago
  Or just using thunderbird. I can't be the only one who doesn't like gmail's wonky interface.
  - eli 13y ago
    If I didn't use gmail through the web, I probably would use a different provider.
deleted 13y ago
[deleted]
nikcub 13y ago
I achieve this by having multiple users in Chrome. My main user is signed into my google account and has no extensions installed and all plugins disabled, I only access gmail and google services with it. My second user account is logged into basic services like HN, reddit, amazon and has only adblock and disconnect installed. A third user is not logged in anywhere and has adblock and a half-dozen other extensions installed including UA switcher. No plugins installed and cookies + cache cleared every day. 4th user has all the anonimity extensions installed and has privoxy + tor set as the proxy I use Facebook in a completely different browser again, YouTube and video watching in yet another and development in chromium. 7 or 8 different cookie stores, and a throwaway temp email account associated with the 3rd and 4th user for signing up to services. Start out by creating a separate user for browsing sites and eventually develop your own way to split up your web browsing profiles. This can get a bit messy when you try and access from tablet or mobikle , but I'd rather not have a single large profile and a huge exploit surface and sacrifice browsing history and remembering passwords.
- broolstoryco 13y ago
  honestly this sounds like a pain in the ass
  - nikcub 13y ago
    Start off with two profiles and go from there. I use virtual desktops (spaces on OS X) to manage it. Space 2 is gmail, space 3 is logged in sites, space 4 is development, etc. Once you get used to it you instinctively switch without thinking about it I also created an app for OS X that creates temporary throwaway browser sessions for any supported browser you have installed: https://github.com/nikcub/tmpbrowser https://github.com/nikcub/tmpbrowser Makes it easier than using command line options and creating users
- unbeli 13y ago
  What exactly are you trying to achieve with that, if I may ask?
  - 13y ago

hackinthebochs 13y ago

I was thinking about this just the other day. The movement towards auto-update-everything is a massive security breech. Browser extensions are a prime example. So much of what we do is centered around the browser, and yet we allow essentially random pieces of code complete access to all that activity. Even worse, this code is allowed to download and run new versions without any user interaction. Needless to say, the potential for harm here cannot be understated. Auto updating anything but the most critical and most trusted software is absolutely bone-headed and we're going to look back and wonder how we could be so stupid.

username223 13y ago
> Auto updating anything but the most critical and most trusted software is absolutely bone-headed Yep. It's kind of mind-blowing that Crome defaults to auto-updating extensions, then lets just anyone upload new versions of them. (Is it even possible to disable this idiocy?) I take some perverse joy in the fact that someone has "monetized" the auto-update treadmill. Maybe it will encourage people to think about the consequences of installing random code to your computer whenever someone else decides to do so.
aboodman 13y ago
If a piece of software can connect to the internet, it can implement its own autoupdate. For extensions it would be trivial. People even commonly did it with Greasemonkey scripts. The reason Chrome includes this functionality is because the hand-rolled solutions people come up with frequently have security problems. Also, auto update gives good developers a way to fix their own security bugs when they are discovered.
- hackinthebochs 13y ago
  We should be asking ourselves why we allow extensions with so much power and no meaningful security model. Auto update is a misfeature if I've ever seen one (again for anything but the most critical pieces of software).
  - 13y ago

ufmace 13y ago

This is a disturbing situation, but it's hard to say what the best way of dealing with it is. The first thing most people reach for first is that extensions shouldn't auto-update. Personally, I disagree - I love silent auto-updates in general. It's a huge drag on the computing experience to have dozens of different widgets all requiring manual updates, all with different mechanisms and all on their own schedules. If I had to pick the one most annoying thing about running Windows, that would be it. The biggest appeal to me of Chromebooks is silent auto-update of everything. Don't bug me about updates, just make everything always run the latest, most feature-filled and bug-fixed versions. I'd lean towards using a finer-grained permission model for extensions, and javascript in general. As far as I know, most extensions now can only request permissions to run arbitrary JS on every page you visit, and send arbitrary AJAX to any URL. Perhaps we could do a better job of locking that down. Have no such thing as a permission to AJAX any URL, but instead make AJAXing any particular TLD a new permission. Maybe we can also only allow access to DOM elements originating from particular domains. Then you could keep auto-update, but require a new user authorization for any new URL/domain access that an extension needs. It'd probably get pretty complex, but I think we could put together something reasonable. But then the other problem is the pile of plugins out there already with those arbitrary permissions. Maybe you could let them stay, but not allow any updates without switching to the new permission model?

kzahel 13y ago
The problem is with users. They ignore the scary "access to all websites" dialogs and install extensions. Sites like pinterest have extensions that request these permissions, when they don't even need them. There's a way to have the extension only have access to the site you're on when you CLICK somewhere in your toolbar. There are fine grained permissions and optional permissions to specific hosts and ports and URL patterns. It's all very well thought out. The problem is with users. For example, I have an extension that enables autocomplete on all web pages: https://chrome.google.com/webstore/detail/autocomplete-on/gdhbgagnmhdafendedikgjimegoipbnk https://chrome.google.com/webstore/detail/autocomplete-on/gd..., and it has access to all data on all websites. People install it every day, I don't know why. I would never install or trust anybody else with such an extension. I have to manually clone any extension I like and upload it to the chrome web store; that way I know it's not going to auto update and do nefarious things.

quadrangle 13y ago

Obligatory note: Another example of why we should only run Free Software and only from trusted sources. Users of Trisquel or gNewSense never have problems like this.

27182818284 13y ago
Obligatory response that not everyone has time or training to examine code for problems. Google is a trusted source.
- dublinben 13y ago
  >Google is a trusted source Hardly, if this kind of thing is allowed in their marketplace.
  - 27182818284 13y ago
    You're missing the point. Google and Apple are trusted sources in the real world. In the real world, people say things like "I have an Android" and advertisements say "Get a free Android with contract" If the distinction there is lost, I don't think you can expect the general consumer to know that Google isn't a "trusted source" by the definition of FSF advocates, right? Nor, I would contest, that they need to. >Hardly, if this kind of thing is allowed in their marketplace. They'll move on this just like they started actively patrolling the Play Store for malware. Because they are a trusted source, even if they aren't an FSF definition of trusted source.
- dredmorbius 13y ago
  Obligatory response that you're not relying solely on your own ability to examine code for problems, but the entire universe of those able to do so. With proprietary code, you're restricted to audits done by those whom the code author has allowed to do so (or who have surreptitiously obtained the source ... and having done so, put themselves at legal risk by disclosing their findings).
nl 13y ago
All Chrome Extensions are completely opensource (lowercase - in the sense you can unzip them and inspect the source). The evidence seems to be that this does actually work - people do look, and find out suspicious looking issues. However, that is insufficient to protect users of extensions that were previously trustworthy and then become malicious.

deleted 13y ago

[deleted]

jaredsohn 13y ago

I would like it if the browser's DOM view would highlight changes made by an extension (at least directly; if the user injects JavaScript, it might be easier to just show that JavaScript rather than the changes that that code made to the DOM.) Also, it should log it (although this may create security concerns) so that one could occasionally look over what their extensions are doing. Similarly, there should be a log for AJAX requests made by the extension directly.

deleted 13y ago

[deleted]

riquito 13y ago

It's not just a DOM change problem. What if an extension change owner and start sending pairs (domain/user's credentials) to someone else? What if one buy an extension to get bank sites accesses?

MasterScrat 13y ago
What's surprising is that extensions are by default not "Allowed in incognito", however they are allowed when using HTTPS and there is no option to disable them there.
- shadowfox 13y ago
  Opera seems to allow this (and it seems to give a bit more fine grained control over when/where extensions are allowed).
- blibble 13y ago
  if adblock didn't work on https that'd be one way to see it massively deployed ;)
- MichaelGG 13y ago
  HTTPS shouldn't be thought as just for secure sites, but just as the default. 4chan and this site run on HTTPS yet I wouldn't want to disable extensions for them because of that.

jaredsohn 13y ago

The browser (or an extension if possible) should include a list of extensions sorted by when they were last added/updated. Beyond helping determine why you're now seeing extra ads, this could help debug why certain sites are no longer working.

deleted 13y ago

[deleted]

ch0wn 13y ago

That shouldn't come as a surprise to anyone who has an app on any app store. I get at least two emails per week from some shady advertiser that wants to place ads, add notifications, gather user data or some else equally awful. I had at least one app where I didn't pay close enough attention to the permissions it required upfront and at some point it started injecting ads into random pages (it was a stopwatch, by the way). I guess the only way to effectively counter this is a better permission system.

dredmorbius 13y ago
While the app developers may not be surprised, I strongly suspect the overwhelming majority of app users are. And for Google to allow this to happen is unconscionable.

becherovka 13y ago

I've been informed that Chrom Extension advertising malware is a highly efficient and key source of money laundering. The market size of this is only limited by Google Chrome users. This is just the tip of that iceberg.

ronnier 13y ago

I was contacted and offered some payments to start including some sort of ads in my Chrome extension. As I understood it, it would inject ads and/or replace links on web pages with affiliate links. I declined their offer.

eksith 13y ago
That's just creepy. Replacing page content, unless ad/spam blocking or specifically user-selected filtering, is completely unethical and totally falls under malware in my book. Good on you for turning that down. You've saved your users a lot of aggravation.
- dredmorbius 13y ago
  If you think about it: as formulated, virtually all present Web advertising works via content injection. You're just (nominally) limiting who gets to insert content.

wanda 13y ago

Why use any extensions ever?

Zr40 13y ago
Because extensions can provide useful functionality that's not provided by the browser. For instance, ad blocking or developer tools.
- wanda 13y ago
  Chromium has all the dev tools I need OOTB. Adblock? Perhaps one risk I'll take on extensions. What else? Nothing. Unnecessary shit for people who want to configure every detail but can't be bothered to hack it themselves with uzbl or one of its equivalents.
zoom 13y ago
Or a browser for that matter.

taivare 13y ago

While on the subject of Chrome Extensions,could someone explain why? the React: Dev tools extension has Incognito mode.

aluhut 13y ago

I have the feeling that every "good" message about Chrome is followed by a disastrous one. This time it was the funky "audio feature" on tabs, followed by this. Chrome developed a scary creativity with good and evil stuff. I used Chrome once because everybody was telling me how fast it is. It wasn't. People just couldn't add all the processes properly. Since then it was a roller coaster I won't jump on anymore. I use Opera as an reference alternative to FF. btw: my parents end up with Chrome every time I come by on the Windows. Installed through some update (Java maybe?). Is there any way to block this without taking all installation rights from them?

username223 13y ago
> my parents end up with Chrome every time I come by on the Windows. Installed through some update My guess would be the tooltip-like thing that Google puts on its search page telling them to "make the web better with Chrome." I've never clicked on the thing, but it probably changes your default browser and installs a bunch of shortcuts.

mjbellantoni 13y ago

I think Google are already taking steps to address this. * http://blog.chromium.org/2013/12/keeping-chrome-extensions-simple.html http://blog.chromium.org/2013/12/keeping-chrome-extensions-s...

rubiquity 13y ago

Being the solution to the problems you create.

GigabyteCoin 13y ago

I wouldn't be surprised if some of the instances of this happening was the result of the original extension writer trying to boost his bottom line. (And not the work of shady malware marketers). It's easy to convince yourself you have been cheated when you know your extension has over 1M+ downloads and you only have ~!$100 sent to your donation button.

gazarsgo 13y ago
I forked an extension released under MIT license because of this -- original author pushing shady updates. After I re-released it on the Chrome Store, now I get emails trying to buy "my" extension from me.
- Danieru 13y ago
  That sounds like a fine grey-hat tactic. Fork existing extensions, generate several thousand fake installs. Then sell to the first bidder. Rinse & Repeat and you'll make a profit and turn the market for second hand extensions into a market for lemons. If it happened enough the buyers would start being more cautious. The bar for minimal installs will go up and more proof will be expected. Soon enough the buyer's intentions will be clear to any extension owner.
  - MasterScrat 13y ago
    I wouldn't be so optimistic. > The bar for minimal installs will go up and more proof will be expected. Or the Store would be flooded with infected cloned extensions that some idiots will install anyway. > Soon enough the buyer's intentions will be clear to any extension owner. That's not the problem: developers could trivially be informed of this risk when they submit their extension on the Store.

hendersoon 13y ago

First, Chrome needs to alert the user before updating an addon that has changed owners, and the default should be "do not update". This change should be pretty uncontroversial. Second, Google needs to modify their policy towards Chrome addons to disallow ad injections and all user tracking. There should be a clear demarcation between addons and "apps" in the Chrome store. Apps can be legitimately supported by ads. Addons shouldn't be.

eksith 13y ago

From the comments: It sounds like Google needs to flag ownership changes and NOTIFY USERS about them before the next auto-update of that extension. ------------ NoteBuddy has been transferred from Joe Garage to Russian Mafia LLC. Do you want to keep this extension enabled? [ Da ] [ Nyet ] ----------- - DaveSimmons While this may seem like the most convenient step, it's actually not that simple either. The majority of users don't want to be notified of too many things and more notices may just be ignored. This is especially true of users with many extensions. As an alternative, it's possible to put extensions into a probationary period (I don't know if they already do this) when it's first created or the ownership has changed. Extensions are reaching the wild-west of Play and no one's happy about that except malware/adware authors. If Google continues to serve more free users than their quality capacity (already a problem with every other service they offer), it won't be long before people move on. And they will move on. Contrary to what most people believe, no one rules one domain forever. Whether it's the big iron of IBM, telecom of Bell, OS of Microsoft or the services of Google. Someone else will eventually wrestle in on your domain.

deleted 13y ago
[deleted]

mmanfrin 13y ago

Going through the few extensions that got caught doing this, I've noticed a commonality: Ecosia. This 'charity' is paying app developers to install adware.

atesti 13y ago

There is an easy solution: Follow http://superuser.com/questions/290280/how-to-download-chrome-extensions-for-installing-in-another-computer http://superuser.com/questions/290280/how-to-download-chrome... in order to download the crx file manually. Then unzip it and vet it manually to be clean. Copy it in a folder, enable extension developer mode in Chrome and install the local copy of the extension. No autoupdate, everything's fine. Unfortunately Google plans to disallow local extensions, which is a major disaster and very evil: http://thenextweb.com/google/2013/11/07/google-block-local-chrome-extensions-windows-starting-january-limit-installs-chrome-web-store/ http://thenextweb.com/google/2013/11/07/google-block-local-c... What happened to that?

edtechdev 13y ago
I mistakenly installed a Minecraft modloader for my son without checking it out first. It silently installed a couple of local Chrome extensions that injected ads in every page. It would reinstall them (again, silently) every time you deleted them. It wasn't detected by Microsoft Defender or Avast until I ran Malwarebytes which took care of the problem. So, pardon my french, but no freaking way do I want any local Chrome extensions allowed by default anymore. For extensions from the Chrome store, perhaps Chrome should make updates more like on Android, where you are notified and can click for more info.
- MichaelGG 13y ago
  If you are running arbitrary code on your box, then local installed Chrome extensions aren't the real problem now, are they? That code could, I dunno, run a local HTTP/S proxy (install a trusted cert) and MiTM your HTTP requests and inject ads that way. Or about a million other things. And it's funny Chrome is trying to prevent apps from doing that, when they themselves do the same thing: In Windows, pinning to the taskbar is supposed to be user-only. But Chrome circumvents that and pins anyways, actively avoiding user preference. (And they drop an icon on the desktop, without asking.)
wmt 13y ago
Easy solution to any chrome extension possibly getting sold to spam ads is to disable automatic updates and manually inspect and install all updates for all of my extensions?

turshija 13y ago

I had similar problem few days ago ... I'm using "Super Awesome New Tab Page" for Chrome, and since few days ago random ads started popping on youtube, ebay, dx.com, amazon etc ... Took me ~30 mins to figure out which extension it was, and removed it... They also injected <script> tags to ALL websites I visited (that loaded external JS), tracking my history and they could easily put any form/input logging and silently insert keylogger into my Chrome if they wanted. I have reported the extension then, but nothing happened yet. Link: https://chrome.google.com/webstore/detail/awesome-new-tab-page/mgmiemnjjchgkmgbeljfocdjjnpjnmcg/reviews https://chrome.google.com/webstore/detail/awesome-new-tab-pa...

zoom 13y ago

Hey Google, knock it the fuck off.

rithi 13y ago

Noticed link injection last week and tracked it down to a very useful extension called World Clocks [1]. Had a hard time trying to report it - finally tracked down the Report abuse button inside the details tab on the store. One thing I noticed is that recent reviews of an extension are more accurate than the rating of the extension. Of course Google could mine these comments to track down problematic extensions and yank them. [1] http://goo.gl/DGqW1 http://goo.gl/DGqW1

midas007 13y ago

It's surprising there are still people foolish enough to believe Google cared about privacy when their business model depends on monetizing people trading their life's intimate details for services.

deanclatworthy 13y ago

I created an extension for Facebook that had 30k active users. I sold it after I was contacted like this. I was suspicious immediately from the outset about who the buyer was, but I figured I'd sell anyway as it took me about an hour to write. Strangely the app was deleted from the store within an hour of my purchase and has yet to re-appear: https://chrome.google.com/webstore/detail/facebook-chat-fix/ojeeafjafadjmbpojlogpipohgkpplkk https://chrome.google.com/webstore/detail/facebook-chat-fix/...

tuananh 13y ago

OT: Honey developers (a popular Chrome extension ~ 700k user) was approached by malware companies and are doing AMA on reddit http://www.reddit.com/r/IAmA/comments/1vjj51/i_am_one_of_the_developers_of_a_popular_chrome/ http://www.reddit.com/r/IAmA/comments/1vjj51/i_am_one_of_the...

ChikkaChiChi 13y ago

How about a little 'Stranger Danger' prevention as well? Don't run extensions from sources you don't trust in a browser profile you need to trust. I have one profile for development and one for browsing. development browser can get any old extension but the normal browser gets extensions from known, trusted companies like Google and LastPass.

snambi 13y ago

auto updating the extensions is not a good idea.