Hacker News Reader

Comment by ro_bit | Hacker News Reader

Why is my Chrome telling random websites which extensions I have installed?

It isn’t exactly. They created a list of known extensions by their id and a file which is known to exist in that extension. The site iterates over each pair and tries to load that file, if it doesn’t error it knows the extension is installed. It’s a clever and difficult manual process, but it does bypass the security trying to prevent this kind of thing.

I read that their reasoning is it exists to block users that use known scraper extensions which bypass their terms of use. But don’t entirely buy that.

So the follow up question, is why is a random website, allowed to try and load arbitrary files?

This is how I interpreted the original question and indeed it makes no sense, JavaScript from a website should not be allowed to interact with extensions like this.

It's actually the extension injecting itself into the webpage, often to interact with it. (I imagine much of this is just looking for global ExtensionName objects.)

Actually, the article is clear about what is happening technically, and it’s both. Chrome does, in fact, allow the page to make requests for resources stored in the extension bundle, and this is one of the two fingerprinting methods that the article describes.

>JavaScript from a website should not be allowed

Agreed 100%.

I agree, and this is why I built 404. If you poke around the page a bit, you'll see a tool that prevents browser fingerprinting.

404 catches JS calls in JS proxies and returns mocked-up values (assigned by a profile), it also has protections against TLS fingerprinting, canvas fingerprinting, device enumeration, TCP/IP fingerprinting, HTTP header fingerprinting, and more.

The predatory practices that browser fingerprinting have enabled guised behind "fraud protection" are atrocious. Even with a VPN, even in incognito mode, a website can track me and see what I've been doing EVEN IF ITS NOT ON THEIR SITE.

Then a data broker buys all this data and uses an AI model to put it all into a pretty little package and sell it to Google, or the gov't, or something. It's scary.

Chrome exposes these files via a URL that you can fetch in javascript like you would any other file on a normal website. These local extension files usually contain code, styles or images that your browser needs to run the extensions.

Why is it not a CORS violation?

The browser needing access and a random website having access are quite different. Seems like a big ol' pile of vulns waiting to happen.

CORS is a server setting to tell the browser not to load its data from potentially unsafe origins. If you set a server to send access-control-allow-origin: *, then your browser will happily load these resources for you regardless of where you currently are. And chrome extensions need to be loadable from everywhere to be able to inject code or images into pages, so enabling CORS for them would defeat their main purpose. The extensions themselves might even need to bypass an existing CORS setup for the website you are currently on to fetch additional data.

From the other end, yes extensions access all page data, but pages shouldn't access extension data at all; it feels like that should be the CORS violation.

You have it backwards. For an extension to work on a page, it's data/code needs to be accessible from said page. If your extension server in chrome enforced CORS to prevent access from tabs on other websites, extensions wouldn't work anywhere.

Because extensions can and often do contain stuff like images or JS bundles that they inject into a target page's DOM. Not allowing a tab's context to load files from the chrome-extension:// namespace would break a lot of things.

True, but you'd expect the same CORS rules to apply for extensions. Only pages originating from an extension are by default able to load resources from said extension.

Does the same scan is happening on firefox? Random websites invoking extensions do seem to be a security hole to me.

This was posted before and it seems that Firefox randomizes the extension URLs.

Firefox at least randomizes extension IDs per install. Chrome hands all of that to extension devs, basically a "your problem now".

If that were the case, the list wouldn't have extensions that relate to a users religion, income, demographics, and more.

Here's the relevant bit from the original source:

"Chrome extensions can expose internal files to web pages through the web_accessible_resources field in their manifest.json. When an extension is installed and has exposed a resource, a fetch() request to chrome-extension://{id}/{file} will succeed. When the extension is not installed, Chrome blocks the request and the promise rejects.

LinkedIn tests every extension in the list this way."

Can ask the same question about so many horrible security blunders web browsers have made over the decades.

They are only blunders if they aren't being used as features by someone

Is that information available to websites? I figured they were doing some kind of novel hackery to self-detect extensions based on behaviour that would only happen if X extension was installed.

But that would be a lot of work for 6,300 extensions. Unless someone offers that as a service?

Brave explicitly blocks this

Last time this was discussed the consensus was Brave does not block it. Brave's fingerprinting protection does not include extensions.

https://news.ycombinator.com/item?id=46904361

Well, just because LinkedIn still tries to send the requests on Brave doesn't mean the blocking doesn't work. The question is whether any request will give a valid response.

That said, I can't find conclusive info on whether this is blocked exactly. Brave does block "plugins" (which is why I assumed this includes this specific kind of fingerprinting), and the getExtension() call (which is probably unrelated), according to this page: https://brave.com/privacy-updates/4-fingerprinting-defenses-...

But since they don't explicitly mention the chrome-extension URL, you might be right.

Chrome is a browser produced by an advertising company. Its reason for existence is to track you.

Not that I disagree but Google's tracking motivation in making the browser seems irrelevant to why it lets competitors do this fingerprinting

They want fingerprinting to work for everyone because the more effective it is, the higher the value of the ad inventory they sell.

> Its reason for existence is to track you.

Source:

because Chrome lets sites probe "installed", and LinkedIn turns that into telemetry.

Chrome always makes tracking easier. It’s their blind spot, because google.

So that websites can track and identify you "for improved personalized advertising" in exactly this way.

Browser fingerprinting is massively valuable to Google's surveillance/advertising apparatus. This is all working exactly as intended.

Reply on news.ycombinator.com