8 ms·

Screenshot URL tracking and niki-bot

200 points by jpoesen 12y ago

ecommercewiz 12y ago
Wow, I didn't acknowledge this at all. Thanks for sharing your discoveries!
splitbrain 12y ago
Can anyone recommend a similar extension as AwesomeScreenshot without this shady behaviour?
- iaskwhy 12y ago
  Google's Screen Capture[0]? I never used AwesomeScreenshot so I'm not sure they are that similar. [0] https://chrome.google.com/webstore/detail/screen-capture-by-google/cpngackimfmofbokmjmljamhdncknpmg https://chrome.google.com/webstore/detail/screen-capture-by-...
  - netrus 12y ago
    "Save to Google Drive" will create screenshots when applied on common websites. I use this now instead of bookmarking, as the screenshots are OCRed by Google Drive, giving me a searchable archive of interesting sites!
    - simias 12y ago
      Heh, so you take a text format, make a picture out of it and let google OCR back it to text? Are you sure you don't just want to save the HTML and resources (i.e. ctrl-s)?
      - netrus 12y ago
        A page nowadays is easily composed out of hundreds of different files, several MB in size. A jpg is small, easy to store and share. I'd go as far that the OCR of a screenshot gives me a ways better search base than the source code, with all its formatting, meta-tags, variable-names etc.
  - psteinweber 12y ago
    Unfortunately that's half broken since months (years?). It's not possible to take full page screenshots, and the option panel creates error messages all the time. There is a fork out there, unfortunately it's not in the Chrome Web Store yet. Maybe it will if it gets some love from HN: https://github.com/chrisvanpatten/chrome-screen-capture https://github.com/chrisvanpatten/chrome-screen-capture
    - lazylizard 12y ago
      hmmm..i been using lightshot..
    - mrcoles 12y ago
      I made a simple open source alternative a couple years ago after seeing that nothing in the webstore could accurately take full page screenshots: https://chrome.google.com/webstore/detail/full-page-screen-capture/fdpohaocaechififmbbbbbknoalclacl https://chrome.google.com/webstore/detail/full-page-screen-c... https://github.com/mrcoles/full-page-screen-capture-chrome-extension https://github.com/mrcoles/full-page-screen-capture-chrome-e...
- kawsper 12y ago
  I am using Full Page Screen Capture[0], which is a similar extension, but it still asks for "Access your data on all websites" and "Access your tabs and browsing activity". I find it very hard to verify that an extension needs that to take screenshots, but now I have disabled that as well. I guess the only real way to fix this is using something like PhantomJS to take pictures of public websites. [0] https://chrome.google.com/webstore/detail/full-page-screen-capture/fdpohaocaechififmbbbbbknoalclacl https://chrome.google.com/webstore/detail/full-page-screen-c...
  - mrcoles 12y ago
    Hi—I built that extension! Thank you for using it. You can view the source code here: https://github.com/mrcoles/full-page-screen-capture-chrome-extension https://github.com/mrcoles/full-page-screen-capture-chrome-e... It’s malware & spyware free. I built the extension to take a screen cap of a seating chart that I built as a web page for my wedding—since all the other extensions at the time were broken. Why a web page for my seating chart? IDK, I wanted to play with CSS3 columns, alas I should have used photoshop… I have been contacted by people who want to buy the extension, but it seems too dangerous, since they could easily install their own malware—I wonder if anything like this happened to “Awesome Screenshot”? My own conscience and, more importantly, my personal brand is too important to me to sell it. In terms of the permissions, when I built it, I had to ask for those permissions in order to make it work. If you find any changes to chrome permissions that let me ask for fewer, please let me know or, better, submit a pull request. Also, instead of PhantomJS, if you have a Mac, try out `webkit2png`, which works great as long as you don't need to login or interact with a page before the screenshot: http://www.paulhammond.org/webkit2png/ http://www.paulhammond.org/webkit2png/
    - mrcoles 12y ago
      actually, I’ll try out the activeTab permission… hopefully that will work. It’s hard to find time to maintain a side-project :)
      - mrcoles 12y ago
- ronjouch 12y ago
  Firefox's Developer Toolbar features a `screenshot` command out of the box. Just hit Shift + F2 and type the command: https://developer.mozilla.org/en-US/docs/Tools/GCLI#Commands https://developer.mozilla.org/en-US/docs/Tools/GCLI#Commands . Also, Firefox >=32 has a button for taking a full-page screenshot in the DevTools: https://developer.mozilla.org/en-US/docs/Tools/Tools_Toolbox#Extra_tools https://developer.mozilla.org/en-US/docs/Tools/Tools_Toolbox... Alternatively, for the use cases not needing to be in-browser, why restricting to extensions? Your platform has full featured apps doing the job out of the browser: - Linux: I use http://shutter-project.org/ http://shutter-project.org/ - Windows: I use (payware, but worth it, it does a lot) http://www.faststone.org/FSCaptureDetail.htm http://www.faststone.org/FSCaptureDetail.htm , or (foss) http://getgreenshot.org/ http://getgreenshot.org/
  - StavrosK 12y ago
    I'll second Shutter, it's fantastic.
  - UltraMagnus 12y ago
    Seconding FastStone Capture...worth every $ I spent and more.
  - dublinben 12y ago
    Windows has a built-in tool for taking screenshots called Snipping Tool.
  - nitrogen 12y ago
    GIMP is also capable of taking screenshots on Windows and Linux, and Mac has the cmd+alt+shift+4 shortcut IIRC.
- uptown 12y ago
  My favorite tool for quickly grabbing part or all of a screen is SnappyApp. It does what I need, and gets out of the way: http://snappy-app.com/ http://snappy-app.com/
- notduncansmith 12y ago
  Puush is fantastic: http://puush.me/ http://puush.me/
- drewg123 12y ago
  On linux, there is no need for an extension if you're familiar with the command line. Just run this pipeline in a terminal: xwd | xwdtopnm | pnmtojpeg > /tmp/screenshot.jpg Then click on the window you want to capture.
walterbell 12y ago
> You can drop api28.webovernet.com and the other site into your browser to see where they lead, but we’ll save you the suspense: they are actually redirects for the API for a company called Similar Web, which is one of many companies doing this kind of tracking, and selling the data so other companies can spy on what their competitors are doing. Is that part of SimilarWeb Pro? It's not clear from the website how their service could be used to monitor the web client traffic of specific companies. An independent reference on the quoted claim would be helpful.
roh26it 12y ago
Free tools that provide value should hence be avoided. While evaluating a tool, I've always checked for if a company runs on 1.subscription money, 2. ads, 3. selling my data Usually stay wary of signing up for anything which tilts towards 3.
- seszett 12y ago
  Quite a lot of tools are actually really just free. Say, the Linux kernel, or most of the free software we all use everyday. Then there are also the miscellaneous services run by someone on the internet mostly for themselves or a small community (or just to get some publicity for themselves) which are also free and don't run on ads, selling data or subscription. I do that, myself. Do you trust Naptha[0]? It was posted on HN some time ago, from the comments[1] I don't even see anyone bringing up the issue of trust. [0] http://projectnaptha.com/ http://projectnaptha.com/ [1] https://news.ycombinator.com/item?id=7629396 https://news.ycombinator.com/item?id=7629396
  - roh26it 12y ago
    Usually these projects are open source which enable the community to make sure that no fishy stuff happens. Thats probably product type 4.
orf 12y ago
I'm not fond of Chrome's app permissions at all. Too many apps just ask for permission to access everything, and there is little insight into what they exactly do. I run the Ghostery extension and a year or so ago I noticed that when visiting YouTube ~15 analytic trackers were being blocked. Turns out a couple of extensions were injecting tens of trackers into popular sites (without my express permission), and I would have had no idea unless I had another extension to block and report this activity. My girlfriends computer is worse - her extensions seem to inject actual adverts into lots of her pages. I asked her why there was an obnoxious "click the bottle to win 1000000$" flash advert on Facebook and she thought it was just how Facebook is. Same thing for YouTube and other popular sites.
- kolev 12y ago
  I stopped using ANY extensions for the same reasons. In most cases, the risks outweigh the benefits in orders of magnitude. Well, there are few exceptions, of course, but those are widely used developer tools.
  - forca 12y ago
    For me, the Internet is largely unusable without adblock at the very least. I removed Ghostery and started using Disconnect instead. It does a much better job methinks. In addition to this on Firefox at least I invoke about:config and make several settings changes: - I disable prefetch. - I disable media.peerconnect. - I disable geo tracking. - I disable HTTP/S referer. - I disable DOM storage. - I disable visited link tracking. I also use EasyList, EasyPrivacy, and Malware domains adblock subscriptions. In addition, as a Linux user, I want to use Flash on those sites that use it, but I don't want to deal with LSOs tracking me, so I take advantage of Flash by sending those LSOs to /dev/null. The Website is none the wiser and I get the benefit of the Website. rm -rf .adobe rm -rf .macromedia ln -s /dev/null .adobe ln -s /dev/null .macromedia Surf with relative comfort knowing that you've already paid for your Internet connection with cash, no need to give away more of your privacy than needed. Blocking ads is great if you use any social media, as you don't have to see the sodden ads.
    - 12y ago
fmavituna 12y ago
6 years ago I reported reported 2 important issues [1] to Diigo (XSS in all URLs if their extension is installed and information leakage for SSL pages - similar to what author said). Due to their response and lack of ability to understand security issues I stopped using them, it's a shame to see they are not any better after 6 years! [1] http://www.securityfocus.com/archive/1/493531 http://www.securityfocus.com/archive/1/493531
laggyluke 12y ago
Hm, whoever edited the title should reconsider - "Awesome Screenshot" is the actual name of the tool.
spyder 12y ago
Yes, be careful because probably all of the developers of popular extensions are regularly getting offers to share their users' browsing data or to insert/replace ads on websites.
osxman 12y ago
For Mac it's also possible to use 'Stache' from the app store. This has a full-page screenshot functionality built in. It cost's $6,99 but it is also possible to store collections of interesting or inspiring pages/websites in a nice looking library. https://itunes.apple.com/us/app/stache/id870659406 https://itunes.apple.com/us/app/stache/id870659406
diminish 12y ago
I have suspicions that some firefox extensions trigger full page ads such as this on https://github.com/gantt/downloadyoutube https://github.com/gantt/downloadyoutube.
- zz1 12y ago
  I suggest http://rg3.github.io/youtube-dl/ http://rg3.github.io/youtube-dl/
insky 12y ago
Regarding tracking. We had a hickup at work, with a url that triggered an expensive cronjob. It was being hit mysteriously. It turned out to be the new tab page in Chrome or Firefox (I can't remember which one), which was requesting the url routinely. This basically shows that whenever you open your browser a group of sites get requests, whether you have them open or not. Therefore if you have FriendFace say as a most visited site, they'll get a request from you everytime you sit in front of your machine pretty much.

200 points by jpoesen 12y ago

ecommercewiz 12y ago

Wow, I didn't acknowledge this at all. Thanks for sharing your discoveries!

splitbrain 12y ago

Can anyone recommend a similar extension as AwesomeScreenshot without this shady behaviour?

iaskwhy 12y ago
Google's Screen Capture[0]? I never used AwesomeScreenshot so I'm not sure they are that similar. [0] https://chrome.google.com/webstore/detail/screen-capture-by-google/cpngackimfmofbokmjmljamhdncknpmg https://chrome.google.com/webstore/detail/screen-capture-by-...
- netrus 12y ago
  "Save to Google Drive" will create screenshots when applied on common websites. I use this now instead of bookmarking, as the screenshots are OCRed by Google Drive, giving me a searchable archive of interesting sites!
  - simias 12y ago
    Heh, so you take a text format, make a picture out of it and let google OCR back it to text? Are you sure you don't just want to save the HTML and resources (i.e. ctrl-s)?
    - netrus 12y ago
      A page nowadays is easily composed out of hundreds of different files, several MB in size. A jpg is small, easy to store and share. I'd go as far that the OCR of a screenshot gives me a ways better search base than the source code, with all its formatting, meta-tags, variable-names etc.
- psteinweber 12y ago
  Unfortunately that's half broken since months (years?). It's not possible to take full page screenshots, and the option panel creates error messages all the time. There is a fork out there, unfortunately it's not in the Chrome Web Store yet. Maybe it will if it gets some love from HN: https://github.com/chrisvanpatten/chrome-screen-capture https://github.com/chrisvanpatten/chrome-screen-capture
  - lazylizard 12y ago
    hmmm..i been using lightshot..
  - mrcoles 12y ago
    I made a simple open source alternative a couple years ago after seeing that nothing in the webstore could accurately take full page screenshots: https://chrome.google.com/webstore/detail/full-page-screen-capture/fdpohaocaechififmbbbbbknoalclacl https://chrome.google.com/webstore/detail/full-page-screen-c... https://github.com/mrcoles/full-page-screen-capture-chrome-extension https://github.com/mrcoles/full-page-screen-capture-chrome-e...
kawsper 12y ago
I am using Full Page Screen Capture[0], which is a similar extension, but it still asks for "Access your data on all websites" and "Access your tabs and browsing activity". I find it very hard to verify that an extension needs that to take screenshots, but now I have disabled that as well. I guess the only real way to fix this is using something like PhantomJS to take pictures of public websites. [0] https://chrome.google.com/webstore/detail/full-page-screen-capture/fdpohaocaechififmbbbbbknoalclacl https://chrome.google.com/webstore/detail/full-page-screen-c...
- mrcoles 12y ago
  Hi—I built that extension! Thank you for using it. You can view the source code here: https://github.com/mrcoles/full-page-screen-capture-chrome-extension https://github.com/mrcoles/full-page-screen-capture-chrome-e... It’s malware & spyware free. I built the extension to take a screen cap of a seating chart that I built as a web page for my wedding—since all the other extensions at the time were broken. Why a web page for my seating chart? IDK, I wanted to play with CSS3 columns, alas I should have used photoshop… I have been contacted by people who want to buy the extension, but it seems too dangerous, since they could easily install their own malware—I wonder if anything like this happened to “Awesome Screenshot”? My own conscience and, more importantly, my personal brand is too important to me to sell it. In terms of the permissions, when I built it, I had to ask for those permissions in order to make it work. If you find any changes to chrome permissions that let me ask for fewer, please let me know or, better, submit a pull request. Also, instead of PhantomJS, if you have a Mac, try out `webkit2png`, which works great as long as you don't need to login or interact with a page before the screenshot: http://www.paulhammond.org/webkit2png/ http://www.paulhammond.org/webkit2png/
  - mrcoles 12y ago
    actually, I’ll try out the activeTab permission… hopefully that will work. It’s hard to find time to maintain a side-project :)
    - mrcoles 12y ago
ronjouch 12y ago
Firefox's Developer Toolbar features a `screenshot` command out of the box. Just hit Shift + F2 and type the command: https://developer.mozilla.org/en-US/docs/Tools/GCLI#Commands https://developer.mozilla.org/en-US/docs/Tools/GCLI#Commands . Also, Firefox >=32 has a button for taking a full-page screenshot in the DevTools: https://developer.mozilla.org/en-US/docs/Tools/Tools_Toolbox#Extra_tools https://developer.mozilla.org/en-US/docs/Tools/Tools_Toolbox... Alternatively, for the use cases not needing to be in-browser, why restricting to extensions? Your platform has full featured apps doing the job out of the browser: - Linux: I use http://shutter-project.org/ http://shutter-project.org/ - Windows: I use (payware, but worth it, it does a lot) http://www.faststone.org/FSCaptureDetail.htm http://www.faststone.org/FSCaptureDetail.htm , or (foss) http://getgreenshot.org/ http://getgreenshot.org/
- StavrosK 12y ago
  I'll second Shutter, it's fantastic.
- UltraMagnus 12y ago
  Seconding FastStone Capture...worth every $ I spent and more.
- dublinben 12y ago
  Windows has a built-in tool for taking screenshots called Snipping Tool.
- nitrogen 12y ago
  GIMP is also capable of taking screenshots on Windows and Linux, and Mac has the cmd+alt+shift+4 shortcut IIRC.
uptown 12y ago
My favorite tool for quickly grabbing part or all of a screen is SnappyApp. It does what I need, and gets out of the way: http://snappy-app.com/ http://snappy-app.com/
notduncansmith 12y ago
Puush is fantastic: http://puush.me/ http://puush.me/
drewg123 12y ago
On linux, there is no need for an extension if you're familiar with the command line. Just run this pipeline in a terminal: xwd | xwdtopnm | pnmtojpeg > /tmp/screenshot.jpg Then click on the window you want to capture.

walterbell 12y ago

> You can drop api28.webovernet.com and the other site into your browser to see where they lead, but we’ll save you the suspense: they are actually redirects for the API for a company called Similar Web, which is one of many companies doing this kind of tracking, and selling the data so other companies can spy on what their competitors are doing. Is that part of SimilarWeb Pro? It's not clear from the website how their service could be used to monitor the web client traffic of specific companies. An independent reference on the quoted claim would be helpful.

roh26it 12y ago

Free tools that provide value should hence be avoided. While evaluating a tool, I've always checked for if a company runs on 1.subscription money, 2. ads, 3. selling my data Usually stay wary of signing up for anything which tilts towards 3.

seszett 12y ago
Quite a lot of tools are actually really just free. Say, the Linux kernel, or most of the free software we all use everyday. Then there are also the miscellaneous services run by someone on the internet mostly for themselves or a small community (or just to get some publicity for themselves) which are also free and don't run on ads, selling data or subscription. I do that, myself. Do you trust Naptha[0]? It was posted on HN some time ago, from the comments[1] I don't even see anyone bringing up the issue of trust. [0] http://projectnaptha.com/ http://projectnaptha.com/ [1] https://news.ycombinator.com/item?id=7629396 https://news.ycombinator.com/item?id=7629396
- roh26it 12y ago
  Usually these projects are open source which enable the community to make sure that no fishy stuff happens. Thats probably product type 4.

orf 12y ago

I'm not fond of Chrome's app permissions at all. Too many apps just ask for permission to access everything, and there is little insight into what they exactly do. I run the Ghostery extension and a year or so ago I noticed that when visiting YouTube ~15 analytic trackers were being blocked. Turns out a couple of extensions were injecting tens of trackers into popular sites (without my express permission), and I would have had no idea unless I had another extension to block and report this activity. My girlfriends computer is worse - her extensions seem to inject actual adverts into lots of her pages. I asked her why there was an obnoxious "click the bottle to win 1000000$" flash advert on Facebook and she thought it was just how Facebook is. Same thing for YouTube and other popular sites.

kolev 12y ago
I stopped using ANY extensions for the same reasons. In most cases, the risks outweigh the benefits in orders of magnitude. Well, there are few exceptions, of course, but those are widely used developer tools.
- forca 12y ago
  For me, the Internet is largely unusable without adblock at the very least. I removed Ghostery and started using Disconnect instead. It does a much better job methinks. In addition to this on Firefox at least I invoke about:config and make several settings changes: - I disable prefetch. - I disable media.peerconnect. - I disable geo tracking. - I disable HTTP/S referer. - I disable DOM storage. - I disable visited link tracking. I also use EasyList, EasyPrivacy, and Malware domains adblock subscriptions. In addition, as a Linux user, I want to use Flash on those sites that use it, but I don't want to deal with LSOs tracking me, so I take advantage of Flash by sending those LSOs to /dev/null. The Website is none the wiser and I get the benefit of the Website. rm -rf .adobe rm -rf .macromedia ln -s /dev/null .adobe ln -s /dev/null .macromedia Surf with relative comfort knowing that you've already paid for your Internet connection with cash, no need to give away more of your privacy than needed. Blocking ads is great if you use any social media, as you don't have to see the sodden ads.
  - 12y ago

fmavituna 12y ago

6 years ago I reported reported 2 important issues [1] to Diigo (XSS in all URLs if their extension is installed and information leakage for SSL pages - similar to what author said). Due to their response and lack of ability to understand security issues I stopped using them, it's a shame to see they are not any better after 6 years! [1] http://www.securityfocus.com/archive/1/493531 http://www.securityfocus.com/archive/1/493531

laggyluke 12y ago

Hm, whoever edited the title should reconsider - "Awesome Screenshot" is the actual name of the tool.

spyder 12y ago

Yes, be careful because probably all of the developers of popular extensions are regularly getting offers to share their users' browsing data or to insert/replace ads on websites.

osxman 12y ago

For Mac it's also possible to use 'Stache' from the app store. This has a full-page screenshot functionality built in. It cost's $6,99 but it is also possible to store collections of interesting or inspiring pages/websites in a nice looking library. https://itunes.apple.com/us/app/stache/id870659406 https://itunes.apple.com/us/app/stache/id870659406

diminish 12y ago

I have suspicions that some firefox extensions trigger full page ads such as this on https://github.com/gantt/downloadyoutube https://github.com/gantt/downloadyoutube.

zz1 12y ago
I suggest http://rg3.github.io/youtube-dl/ http://rg3.github.io/youtube-dl/

insky 12y ago

Regarding tracking. We had a hickup at work, with a url that triggered an expensive cronjob. It was being hit mysteriously. It turned out to be the new tab page in Chrome or Firefox (I can't remember which one), which was requesting the url routinely. This basically shows that whenever you open your browser a group of sites get requests, whether you have them open or not. Therefore if you have FriendFace say as a most visited site, they'll get a request from you everytime you sit in front of your machine pretty much.