Slashdot Mirror
Browser Extensions Are Undermining Privacy (vortex.com)
pizzutz writes: Chrome's popular Web Developer plugin was briefly hijacked on Wednesday when an attacker gained control of the author's Google account and released a new version (0.49) which injected ads into web pages of more than a million users who downloaded the update. The version was quickly replaced with an uncompromised version (0.5) and all users are urged to update immediately.
Lauren Weinstein has a broader warning: While the browser firms work extensively to build top-notch security and privacy controls into the browsers themselves, the unfortunate fact is that these can be undermined by add-ons, some of which are downright crooked, many more of which are sloppily written and poorly maintained. Ironically, some of these add-on extensions and apps claim to be providing more security, while actually undermining the intrinsic security of the browsers themselves. Others (and this is an extremely common scenario) claim to be providing additional search or shopping functionalities, while actually only existing to silently collect and sell user browsing activity data of all sorts.
Lauren also warns about sites that "push users very hard to install these privacy-invasive, data sucking extensions" -- and believes requests for permissions aren't a sufficient safeguard for most users. "Expecting them to really understand what these permissions mean is ludicrous. We're the software engineers and computer scientists -- most users aren't either of these. They have busy lives -- they expect our stuff to just work, and not to screw them over."
Lauren Weinstein has a broader warning: While the browser firms work extensively to build top-notch security and privacy controls into the browsers themselves, the unfortunate fact is that these can be undermined by add-ons, some of which are downright crooked, many more of which are sloppily written and poorly maintained. Ironically, some of these add-on extensions and apps claim to be providing more security, while actually undermining the intrinsic security of the browsers themselves. Others (and this is an extremely common scenario) claim to be providing additional search or shopping functionalities, while actually only existing to silently collect and sell user browsing activity data of all sorts.
Lauren also warns about sites that "push users very hard to install these privacy-invasive, data sucking extensions" -- and believes requests for permissions aren't a sufficient safeguard for most users. "Expecting them to really understand what these permissions mean is ludicrous. We're the software engineers and computer scientists -- most users aren't either of these. They have busy lives -- they expect our stuff to just work, and not to screw them over."
While the browser firms work extensively to build top-notch security and privacy controls into the browsers themselves, the unfortunate fact is that these can be undermined by add-ons
Not false, but it's also true that ad-blocking (ublock) and script-blocking (flashblock, noscript) extension have done more for user privacy and security than most any other software, sometimes by working against the aims of the browser makers. I fear this story may be part of an anti-extension (and anti-user-control in general) narrative.
Because you know... Google.
I guess they don't like it when lose their data-sucking monopoly.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
Part of the problem is that extensions are not properly restricted because they can get/send data to/from anywhere regardless of the permissions you give it. What they really need to do is restrict arbitrary URL requests. If the domain name isn't part of the [content of] requested page then it should require explicit permissions to access it.
Anons need not reply. Questions end with a question mark.
Chrome forces extension updates from the mothership. No way of disabling it. Even editing out update server address in extension .xml doesnt do it. = its all Googles fault in the end.
Who logs in to gdm? Not I, said the duck.
by requiring any extension developer to have 2FA enabled on their Google account, which will make it much harder to compromise accounts. That's really the only thing I see Google doing wrong here, ultimately it's the developer's responsibility to maintain control of the account used to publish updates.
That, and maybe requiring extension updates be signed with the developer's private key. I believe Android's Play Store requires this. Last I checked Chrome Web Store just accepted plain ZIP uploads? The thing is, Chrome has the ability to sign extensions built in. So they could do this today.
But I think the bigger problem is extension devs who sell out their extensions... and their user bases... to individuals who embed malware or ads into it. That's not a technological problem that can be solved that way, unfortunately.
Thats why Firefox is good.
The ads stop with a nice selection of quality add ons.
The next step is to ensure the add ons are correct in what they offer and do.
Domestic spying is now "Benign Information Gathering"
Data is not fact. Who fucking cares.
"Interesting! AC there doesn't seem to be capable of putting together a grammatical sentence. Let's steer some advertisements for grammar books his way. Slant the ads so he feels inadequate with his present, sad command of the language. Couldn't hurt."
https://a9t9.com/blog/chrome-e...
Open source always means no privacy violations!
Just ask Canonical!
They can't take away open source software that we already have.
If they muck it up, we'll select a fork and be done with it.
Solved, easy.
The title is misleading or there are more idiots out there than I thought. "Why do my privacy add-ons not work right?" Maybe it's because Google, a search engine company, made the browser? You know that web browser, Tor...something or other I think it is, that's based off of Chrome? *sarcasm. Me neither. -_- It would be interesting to see a security comparison between Chrome and Chromium for these privacy add-ons. I'm sure there are plenty convinced a derivative = same, but if that were true, then I guess all us Linux users are nut-cases. Don't answer that. Chrome needs to be renamed to Chrime.
I actually missed that story. The most interesting thing about it appears to be the reaction of Danielle Brown at Google: "...expressing views on the natural abilities and characteristics of different genders, as well as whether one can speak freely of these things at Google. And like many of you, I found that it advanced incorrect assumptions about gender. I’m not going to link to it here as it’s not a viewpoint that I or this company endorses, promotes or encourages...."
Google does not approve of linking to stuff that it doesn't endorse promote or encourage? That made me smile.
Most of the extensions I have installed are there for the express purpose of improving my privacy: privacy badger, sharemenot, ublock, etc.
Comment removed based on user account deletion
Ask systemd.
You mean they are writing these extensions in rust ???
Inconceivable !! Not only is in impossible to have insecure rust code, it will also bake and put an apple pie on your window sill :)