Slashdot Mirror
Google Is Too Slow At Clearing Junkware From the Chrome Extension Store
Mark Wilson writes Malware is something computer users — and even mobile and tablet owners — are now more aware of than ever. That said, many people do not give a second thought to installing a browser extension to add new features to their most frequently used application. Despite the increased awareness, malware is not something a lot of web users think of in relation to extensions; but they should.
Since the beginning of 2015 — just over three months — Google has already received over 100,000 complaints from Chrome users about 'ad injectors' hidden in extensions. Security researchers have also discovered that a popular extension — Webpage Screenshot — includes code that could be used to send browsing history back to a remote server. Google is taking steps to clean up the extension store to try to prevent things like this happening, but security still needs to be tightened up.
Since the beginning of 2015 — just over three months — Google has already received over 100,000 complaints from Chrome users about 'ad injectors' hidden in extensions. Security researchers have also discovered that a popular extension — Webpage Screenshot — includes code that could be used to send browsing history back to a remote server. Google is taking steps to clean up the extension store to try to prevent things like this happening, but security still needs to be tightened up.
It looks like the ones behind Nada software were right: the only bug free software is the most useless one.
Please reckon with your failure!!!!
And all is forgiven, right?
Why do we need Google to be our App Nanny? The faster they remove bad stuff, the more false positives they get in their removal process, and independent developers will lose out in the process.
I've had to remove many of those from my brother's PC. All of them are something like "ad punisher", which makes you think it'd be an adblock... but no, it put ads in webpages instead. I'm questioning where he even got those extensions, quite frankly, because he also has the legit adblock extension... My guess is Facebook.
Malware is something computer users are now more aware of than ever.
You might say we're... *sunglasses* mal-aware of it.
YEEEAAAAH!
systemd is Roko's Basilisk.
it's an application you store all your passwords in and yet you install extensions coded by some anonymous stranger you have never met with a web based email address? and you wonder why things go wrong?
I don't know what it is about Google-run platforms that makes them so awful, but they seem to shovel on tons of features with a corporate agenda but without the ability to really understand the underlying user experience. I'm not an Apple fan myself, but at least their app store for a non-jailbroken iOS device is much much cleaner from a malware perspective than the equivalent Android app stores. We aren't even talking about the ever-present developer inconsistencies version-to-version in the Android platform, especially for DRM and media playback, which make life hell for developers.
In the desktop browser environment where average users have no idea what the root of trust really is other than "oh it's Google so it's ok", the potential for malware intrusion is huge and there's no excuse for this nonsense. Google's leadership needs to crack their whip at their product management and get things back on track so they not only test add-ons but randomly audit code for backdoors on the Play store and for Chrome add-ons if they want to retain customers' trust.
Partway through writing a small browser extension last year, and realizing how much access they have to everything you look at, I stopped using all but a couple trusted browser extensions. Seriously, it was like 15 lines of code to take a screenshot of whatever page you're looking at and send it to a server every 2 seconds with no indication that anything is happening.
Granted, you have to accept a permissions dialog, but most extensions ask for way too many permissions. That cloud-to-butt extension? It already has all the permissions it needs to send the text on every page to a database somewhere, and unless you carefully audit the source of every extension you install (obviously google isn't), you'd never notice, you're just trusting some extension author.
(points at junkware) Hideki!
Ad blocking is a must until all ads stop tracking of any kind. Just show the ad. Let alone malvertising like this.
At what point did these monkeys "increase" their "awareness" about anything that didn't involve some cultural grievance? The only reason they aren't still opening every single word doc they receive is because the MUAs impede them enough to allow laziness to dominate.
Maw! Fire up the karma burner!
The really bad thing about Chrome is the way it is impossible to stop extensions from automatically updating.
An extension can be perfectly good, when first installed, but if the author goes rogue, has a security breach or just sells the extension to a third party, there is no way to stop it from automatically updating.
worldmobilenet.com -- World Prepaid Wireless Internet plans
rm -rf /home/pub/chrome-extensions/
Get rid of *all* Chrome extensions, aka "apps". Every single "app" is worthless.
It's not Google saying, "only these extensions may install"
Did you miss the Slashdot article titled Google Starts Blocking Extensions Not In the Chrome Web Store from May of last year?
But they are very quick to remove any Youtube downloader.
I don't know what it is about Google-run platforms that makes them so awful
Because they don't run them with an iron fist like Apple does. That's a good thing for developers because it makes it easier and more flexible for them but it means that end users then need to be much more knowledgeable and careful of something they really shouldn't need to know about. So the question then becomes: Is the advantage worth the tradeoff? Well I see a lot of great developer/tech/admin tools that you can get on Android that you can't on iOS for example, but I don't see what the specific advantage is to the average end user. Sure you can pontificate about how free software and the open market could theoretically benefit users and how a walled garden approach could theoretically harm users but in practice neither of these things actually happen.
Point is that with the walled garden approach most users can do everything they need to and not have to really worry about malware so since the non-walled-garden approach has the proven clear and obvious disadvantage of needing to be concerned about malware there needs to be some explicit tangible advantage to the user to outweigh that and Im not sure that exists.
Perhaps the advantage found in the garden with lower walls is the ability to do something outside the plans of the people in charge of the platform. One of my biggest turn-offs with iOS is its keyboard. The screen doesn't change to indicate upper or lower case characters. I have no idea who thinks that's a good idea, but on iOS there wasn't until very recently any ability to charge that. In the Android world, there are of great on screen keyboards. The idea that someone might want something else was simply outside Apple's vision.
There are all kinds of tools that exist on Android because the whole thing is open to development. There are plenty of things that can't be done on iOS and Windows Mobile because no one considered the possibility that someone might want to do them. I believe that Android is the primary place where innovation is occurring in mobile devices at this point and most of that is because everything is open to be changed.
-- I wanna decide who lives and who dies - Crow T. Robot, MST3K
is still faster than Microsoft. The windows phone store is damn sad.
tried to report an extension once. No chance, without logging in to a google (plus?) account.
Your problem, google.
You can install non-Store extensions in Developer Mode, but Google Chrome will automatically uninstall them when you close and reopen Google Chrome. There exists a workaround, but this workaround requires editing Group Policy, and editing Group Policy appears to require a Pro version of Windows. So you end up paying around $100 to Microsoft to have the ability to use a non-Store Chrome extension more than once.