Slashdot Mirror
A Third of All Chrome Extensions Request Access To User Data on Any Site
More than a third of all Google Chrome extensions ask users for permission to access and read all their data on any website, a recent survey conducted by US cyber-security firm Duo Labs of over 120,000 Chrome extensions has revealed. From a report: The same survey also found that roughly 85 percent of the 120,000 Chrome extensions listed on the Chrome Web Store don't have a privacy policy listed, meaning there's no legally-binding document describing how extension developers are committing to handling user data. Additional survey findings include the fact that 77 percent of the tested Chrome extensions didn't list a support site, 32 percent used third-party JavaScript libraries that contained publicly known vulnerabilities, and nine percent could access and read cookie files, some of which are used for authentication operations.
So are these extensions up to something nefarious, or are they being forced to request this "all data / any web site" access because finer grained permissions aren't there?
1/3rd of Chrome extensions request a required permission for the extension to actually do what it says.
Seriously... 1/3rd? I'm surprised it's that low.
More than a third of all Google Chrome extensions ask users for permission to access and read all their data on any website
But we were assured that Google takes our privacy seriously! Glad to see Google is really on top of this.
a recent survey conducted by US cyber-security firm Duo Labs of over 120,000 Chrome extensions has revealed.
What possible utility could there be in 120,000 different extensions? Who in the name of Thor's ugly sweater is actually using these things? I use about 5 extension on my browser of choice (Firefox for me), all fairly popular and I really cannot see any circumstance where I would use more than 10. There is no sane argument for that many extensions without a huge number of them being malware.
Until devs become clearer on privacy.
Sent as ripples into the electromagnetic field. No single photon has been harmed in the process.
So are these extensions up to something nefarious, or are they being forced to request this "all data / any web site" access because finer grained permissions aren't there?
My guess would be that they ask because they can and because most users will not pay enough attention to choose some other option even if one is provided - which it won't be. Never mind that with 120,000 (!?!) extensions a HUGE number of these have to be malware of some description. There just isn't that much need for that many different extensions.
Isn't most of it just legit ad blocking? You have to scan the page to remove ads and it seems like 75% of the extensions are somehow related to ad blocking or content manipulation or password management. They all need those permissions.
... are finer grained permissions available? Or for many extensions, even logically possible?
If the extension is going to filter for ads, or change the colors, or inject user CSS, or tell you if products on the page are cheaper at Amazon, or whatever - it kind of needs to access the webpage data. Right?
I'm using Google [Cute cat GIF!!!] Chrome right now and I've [~~~ BUY XBOX ONE TODAY! ~~~] never had problems with [~~~You won't believe which celebrities use teeth whitener! ~~~] any of the 124 extensions I installed.
#DeleteFacebook
"We take your privacy seriously."
Sorry, our motto is missing a period. It should read:
"We take your privacy. Seriously."
#DeleteFacebook
Let's not forget these apps are flourishing in a Google-built ecosystem.
The surprising thing is that two thirds of them DON'T spend their time harvesting every bit of information they can from devices owned by you, your family, your friends, your workmates and probably every person you have had a random encounter with over the last six months.
Only two things are infinite, the universe and human stupidity, and I'm not sure about the former.
What extensions do you use that wouldn't require access to the whole page?
This. The whole POINT of running the few extensions I do is that I want them to be functional on any site I visit, and thus I have to trust them well enough to have access to all of my browsing data.
- uBlock Origin: absolutely essential for browsing these days, and I trust Raymond Hill. You just have to be careful of the various clones/forks out there, which are often NOT trustworthy.
- Noscript: Just as essential. I don't know much about the developer, but from what I've seen I do know that the community can vouch for them.
- Greasemonkey: Used to load a few scripts that I wrote myself, as well as some scripts from people I know personally, to change the functionality of some very specific pages.
- LastPass: Eh, I'm a bit leery of this one, but it's widespread enough that if there's some major privacy breech, I hope that news would spread quickly.
What extensions do you use that wouldn't require access to the whole page?
Permissions are more than just access to the whole page. Host permissions, API permissions, permissions per tab, clipboard access, storage access, cookie access, etc. Relatively few extensions need access to all of these and few bother to ask.
I actually like that there is a lot of choices or overlap for ad blockers, javascript blockers, etc.
Sure but 120,000 choices? Let's keep it real. That's not choices, that's spam.
I agree that there is a ridiculous number of extensions but I'm not forced to install them.
Not the point. The point is that there is no reason for most of these to even exist unless a LOT of them are malware of one form or another.
Mass media propaganda conditions people to love the taste of bootleather.