Unimania: I Need Your Facebook Data, Location, and Your Browsing History | Hacker News Reader

Unimania: I Need Your Facebook Data, Location, and Your Browsing History

adguard.com

80 pointskrn13 comments

> UPD (Jun 3): The Android apps mentioned in the article are no more available on Google Play.

> UPD (Jun 5): The Chrome extensions are finally taken down from the Chrome Web Store.

And yet, as of today, Google Play offers two more apps by Unimania., both of which promise to provide "a better Facebook experience" in exchange for your credentials[1]. The question is then, how many similar Chrome extensions are still there on Chrome Web Store.

[1] https://play.google.com/store/apps/developer?id=Unimania. ("." at the end belongs to the URL)

Chrome extensions are gold mine for data collectors. There are no checks and balances and its extremely hard to tell what these extensions really do under the hood. A well funded data collector can make "free" extension that competes with other top extensions like AdBlock and slip in the malware to track pretty much everything that goes in the browser. I've already seen several variations where you go on some bad website and you see ad for "People are saving 40% on Amazon using this Extension! Are you using it?". I can imagine legions of gullible people falling for this and handing over control of their browser.

It's quite unfortunate the position Chrome developers have taken on extensions ("it's your problem if you use them"). We are sitting on a time bomb that one day would explode with same fervor as what happened with FB's ignorance policies.

I've been developing a few internal chrome apps for my company recently and you're mostly right. Most chrome applications ask for essentially r/w access to the page and users don't understand what it means to click yes. With this you are essentially keylogging yourself on every single website you visit. Like damn.

I will say it is possible to view the manifest.json file of any installed application, meaning you can get a complete list of all allowed permissions and any host based restrictions 'good' chrome apps will often include.

Google and other browser vendors know what's happening. They know how many users have agreed to what permissions. They know most chrome apps ask for excessive permissions. It's just like Android. The right thing is to invest in more robust permission systems and training users indirectly to understand permissions better, but that would lose them money so they don't.

Is Firefox better? If so, how?

Yes. When submitting an extension on the Firefox Add-Ons store, the extension is validated by a human (you need to provide the source and steps to build the extension if the submitted package contains minified code). It can be frustrating sometimes to wait hours or days for the extension to be published compared to the Chrome Store where it is almost instant. But from a user perspective, I prefer it that way and Mozilla seems to care more.

It should be added that Mozilla isn't perfect either, there were a few extensions that slipped through that got uncovered recently. It's still a lot better than Chrome's.

Thanks. That was my hope. And it's great to have an informed opinion.

The sole Twitch extension, Twitch Now, requires access “See and modify your data across all websites.”

There’s no reason for this, but there’s also nothing I can do about it. I’m not going to develop my own competing extension, and no other extensions exist. It’s quite annoying.

They could theoretically be harvesting all of my Gmail emails, making changes to my GitHub repositories, monitoring my Slack conversations, and more.

The "Pocket" extension required something similar so I built my own: https://chrome.google.com/webstore/detail/save-to-pocket-min...

However it seems to maybe have broken recently (only on some of my devices, maybe some API change by Pocket?) and I can't be bothered to fix it.

Why can't someone develop a sandbox app that feeds in network connectivity while faking inputs?

Twitch just needs to display video and a button that autoprints the Donger.

> There’s no reason for this, but there’s also nothing I can do about it.

Have you considered sending a pull request?

https://github.com/Ndragomirov/twitch-now

Also, you could build it from source if you're paranoid of the author pulling a switcheroo.

OK, so there's also a Unimania Card that apparently harvests social media and shopping data.

https://www.coffeemania.com/icerik/goster/unimania via Google Translate:

> The Unimania Card Project is a collection of applications that will translate every moment you socialize with a card and assisted QR code. With this card, every shopping you make in Coffeemanialar will become more advantageous, as you shop, your points will accumulate and offer you delicious campaigns. At the same time, the infrastructure that will keep you informed of seasonal campaigns and all the moments you enjoy outside will return to you as a gift. When you receive your Unimania card, you can start to receive discounts and opportunities from your specially prepared campaigns.

http://www.unimania.ge/ via Google Translate:

    უნიმანიაზე განთავსებული რეკლამის
    ყურებისას ქულების დასაგროვებლად
    გაიარეთ ავტორიზაცია უნიქარდის ან
    ფეისბუქ მომხმარებლის მონაცემებით

    Advertising on the Unmanya
    To get points while watching
    Log in Unicard or
    Facebook user data

> Unicard

That's an interesting choice of name; it's also the name of an essay[1] by John Walker[2] (who also wrote about "The Digital Imprimatur"[3]). He warned about this type of privacy problem in 1994:

> Unicard - Ubiquitous Computation, Global Connectivity, and the End of Privacy

> ABSTRACT: Threats to privacy are often seen as efforts launched by governments or large corporations, using their power to circumscribe individuals' rights. Yet often individuals voluntarily surrender their privacy for promises of security or, more frequently, pure convenience. Based on technologies already available or certain to appear within the next few years, this paper explores how much convenience could be gained, and how much privacy lost as these technologies enter the mainstream.

[1] https://www.fourmilab.ch/documents/unicard.html

[2] Co-founder & chairman of Autodesk, one of the designers/programmers of AutoCAD

[3] https://www.fourmilab.ch/documents/digital-imprimatur/

Reply on news.ycombinator.com