Slashdot Mirror
Websites Can Detect What Chrome Extensions You've Installed
dsinc writes "A Polish security researcher, Krzysztof Kotowicz, makes an worrisome entry in his blog: with a few lines of Javascript,
any web site could list the extensions installed in Chrome (and the other browsers of the Chromium family). Proof of concept is provided here. As there are addons which deal with very personal things like pregnancy or religion, the easiness of access to those very private elements of your life is really troubling." Note: the proof of concept works, so don't click that link if the concept bothers you.
Yet another way that IE is better than Chrome.
I'd be amazed
The proof-of-concept listed only four out of my ten enabled extensions. Among those left out were Google Calendar, UA Spoofer, and Pastebin, among others. I'd say this 'exploit', if we can call it that, has a long way to go...
Hyperbole: I use it liberally!
Only got about half mine. I speculate that it only works for the ones you've installed straight from the store; the other half of mine are modded in various ways and loaded unpacked. Not that this is a great help for non-hackers, but worth noting.
But I use Opera
This can be used in a much more mundane way - a website can check if you have Adblock installed, and it can refuse to display its content to you then unless you uninstall it.
This kind of thing is EXACTLY why I don't like to use google products.
They base their income on targeted ads. Any wonder these kinds of things could happen?
Wow. Browser sniffing. What year is it?
If you want news from today, you have to come back tomorrow.
Doesn't list anything, even if I enable Javascript for its site in NotScripts (yet another reason to install this little lifesaver).
"ease" not "easiness" !!! *cringe*
It only picked up 2 out of my 12 ext installed, nothing I would say that would be remotely embarrassing or uncommon. Lets just log this under meh...
What's the matter loser? Too scared to post in one of your 1 million shill accounts?
So let me get this straight - I can click on that link right now in Firefox and it's going to tell me what Chrome extensions I have installed? Unbelievable!
#DeleteChrome
our ability to EFNet, and apply their parting out how t0 make the Butts are exposed
Guess someone should really post this on the SRWare Iron's forums/mailing list (and other privacy-centered Chromium based browers) so they can disable the functionality in their builds...
The only problem for me are those "Web Experience" folks who think they have to make web pages more entertaining.
And don't get me started on that useless enterprise-y software with heavy-handed Javascript dependency (Jira, I'm looking very especially at you).
Detected two of my 8 extensions and listed one that I don't have installed.
This "exploit" looks more like begging the question to me. As far as I can remember, every single Chrome extension I have installed warned me that it might share data with the websites I visit before I installed it. It stands to reason that if an extension can share data with a website, that website can detect the extension, does it not?
I'm not saying that it's ideal behavior, only that it seems to me that Chrome users have already been warned about it by Google itself. If you don't like the behavior, you have quite a few options: Remove the extension, disable it, go incognito when you don't want your extensions detected, or simply use another browser come immediately to mind.
Disclaimer: the original (and only) NoScript can be detected as well, but at least you couldn't be notified by a JavaScript alert() box on a page where JavaScript isn't supposed to run ;)
There's a browser safer than Firefox, it is Firefox, with NoScript
As far back as I can remember, any extension that interacts with the page does so by editing the actual page. Sometimes in specific ways that are unique to certain extensions.
I figured this out, funnily enough, by using *{display:block} on a page that absolutely destroyed it, and for some reason displayed source code of the page to me... (don't ask me why I done that)
And this happens across 2 separate CSS insertion scripts, and versions as far back as last spring I think, webkit just buckles with that statement for some reason.
And during this, I noticed some script and CSS in the page that came from certain extensions.
Here is an example on the No FTL Neutrinos article. Why webkit, whyyy
Admittedly it could a Chrome(ium) error. I'm never installing Safari ever again to find out, holy painful browser, I'd sooner use IE again.
It would appear that Belgium was cunningly and carefully chosen by the West to function as a Secret Shadow United Nations; or to describe it more precisely a Shadowy Disunited Nations, with the main centre of its secret scheming and private dealings being done in Brussels for practical reasons.
This is because Britain and America need to appear to be above suspicion, and we know that Herman Van Rompuy is the first President of the European Council after the Lisbon Treaty became the European Union’s current Constitution.
I cannot proof of what is happening, but I can state what I would advise, and what my human weaknesses are, what tactics I would use if I were one of the more senior People who are the Real and Shadow Government of the West.
I realise that others in such a group would have other advice, human weaknesses, and tactics, and it could be that if I were to hear of their advice and their tactics, then I could easily agree that their advice and tactics could be superior to mine, but my human weaknesses would remain my own, even as their human weaknesses would remain their own.
There seems that a lot of these perpetrators mentioned in this Article are described as suffering mental problems, and I would build a Mental Institution with a Luxurious underground Palace for my People if they were ever captured.
People would volunteer to be Terrorists for me, after they have seen the underground Palace, where they are free and can satisfy their desires.
The Staff would all be Shadow CIA, and there could easily be Chauffeur driven weekend passes or longer in cars, trucks, or vans with dark windows to conceal these Puppet Criminals.
These People would have a Person that looks like them to replace them, when needed, and even if any of them were alive, I would falsely say that they had died, and I would move them to a different locality or Country.
The Article mentioned Paedophilia; and the human weaknesses of those People in that group would be accommodated, as long as it was kept secret.
I want to say that I would not commit Paedophilia, unless I loved Money and Power that much, and it was necessary to be Filmed in Acts of Bestiality and Paedophilia to ensure Loyalty to that group.
We know that a Person would be unlikely to go to jail if a Video of that Person was on the Internet, but if a Video of that Person in Acts of Paedophilia were on the Internet, then they would go to jail.
We have seen with the Stratfor Scandal would use, bribes, sex, drugs, alcohol, secret bank accounts, and blackmail etc; and could easily include threats to achieve the goals of their Clients who wanted to manipulate matters of interest to them in order to make Money, and they would pay Stratfor for their services.
There could be situations where a Person was deliberately led in temptation, and others were Secretly Filming him in Acts of Paedophilia, but not to go to the Police with it, but to Puppetize that Person for the cause of the Western Elites, or they will go to jail.
Obviously, a compliant Puppet Main Stream Media is vital for this, and this is why the Elites fear and detest the Internet, and they detest Whistle Blowers like Bradley Manning, and Real Journalists like Julian Assange, and the Western Judges know these things.
Even though a Person may claim to be a Christian, it could be that he has become a Secret Muslim, because of having a Secret Harem, and even if a Person claims to be Right Wing, he could be Left Wing, and possibly Breivik was attempting a reverse of what others are doing.
It is interesting that Breivik had a manifesto, and the purpose of it was to find self incriminating evidence, not only on Breivik to show that he was mentally unstable at the trial, but importantly to Slander others and somehow show that they were working toward the same purpose, thus reinforcing the lie that America and its Media has spread.
For those who have read Articles on this Website, and other Websites where there is proper Journalism, th
Google Chrome extensions documentation - Manifest files - web_accessible_resources (linked from TFA):
The real bug is Google leaving spying backdoors open. Note that by "you" they mean extension developers, not browser users. I don't see why a web site should need access to a browser extension at all. If an extension wants to modify a page, it can just do that without communicating with the website. If an extension wants to communicate with a website, it can inject a script into the page that sends an XMLHttpRequest. Of course DOM changes can also be detected, but in most cases that doesn't allow direct inference of _what_ changed the DOM.
Btw "pregnancy or religion" as the most private things in life? That's new. Usually the safe-for-work example is "you have a terrible but shameful disease and need to access online information about it".
How many Polish security experts does it take to outsmart everyone and prove (once again) that the whole "Poles are stupid" thing is bullshit?
Just one.
A lot of extensions request access to your browser's X, Y, & Z... and sometimes your entire file system (???) But since we (the user/s) wants to use the provided functionality in the extension, we all click "OK". Just from reading those notifications, it is still unclear WHY the extension needs those access permissions, or WHAT the extension might be doing with said access. How can we know/understand more about this process? Where is the source path of the extension & should we just be looking at the source code (assuming dev experience)?
Idiots. Why do morons (or should I say "morans", like so many AMERICANS write) keep putting "an" instead of "a"? It isn't rocket science.
/. has at least one article, last year I think, that mentioned this fact already.
This is not a secret and a moderately well known fact.
Troll is not a replacement for I disagree.
People who use typically choose Chrome (the Google Browser) don't strike me as people who are all THAT concerned about their privacy. It might be a nice browser, but it is closed-source, and heavy into the "Google way" (which to me means to share all your information with Google).
At least with Chromium, people can see what is going on inside...
Well, yeah it knows I run vimium. I'd like an extension that could hide the address bar or at least the tab bar. Using tiling here... sigh.
I'm willing to use other browsers though, at this point I prefer webkit, but I must have vim keys.
I use privoxy to handle all the ads and crap.
I've tried out uzbl, conkeror, but hmm... Suggestions (preferably in the debian repos?) Also something that supports whitelists, I'm kind of annoyed that I need javascript on every site to use vimium...
I think somebody jumped the gun here, 'cause I'm using Chrome 17.0.963.79 on Ubuntu 11.10, and that "proof of concept" link didn't list any of my extensions.
You can do this with Firefox as well. Internet Explorer does not enumerate plugins but you can do the same thing, and even turn other PLUGINS off. For IE, you have to install a plugin, to get access to the plugin list. I have done it.
Good find on the part of the researcher...one more reason to use NotScript :). I went to the Proof of Concept and it didn't show anything. I looked at NotScript to see the blocked scripts and there was a long list of names that I would never allow on any Web site (I never allow anything if I don't know what it is). At the bottom it warned me that this was probably a malicious site (it apparently made that determination based on the high number of scripts it was trying to load).
Note that I have no affiliation with NotScript. I just highly recommend it for Chrome users, or NoScript if you're using Firefox.
It only detected half of the plugins I have installed.....
Since that's my first and foremost extension for everything at all times.
The proof of concept proves that you are okay if you have disabled JavaScript by default.
huh!
:)
Last 3 months I developed my tiny web-coding sandboxie, and it was my first work:
http://www.browserleaks.com/chrome
Same idea, but it more visual demo, cos it uses apps icons detection.
By some reason I didn't try to use manifest, and write huge parser to collect 10k db...