Hacker News Reader

Comment by timmclean | Hacker News Reader

I'm most concerned about the keylogging claims. Does anyone have a copy of the CRX so that we can determine if keystrokes were in fact being transmitted?

View on HN

Holly crap, this really got out of hand!

NO! It wasn't logging anything! The only thing it was doing was proxying clicks on search results through Ecosia's analytics servers instead of Google's.

Anyone who still has the extension installed can view the source code by looking in their /%USER_FOLDER%/<PATH_TO_CHROME>/Extensions/kkelicaakdanhinjdeammmilcgefonfh The extension is also available at http://ionut-botizan.net/window-resizer/ both as a .zip and .crx file.

Seems as though he's aware of such a thing.

"No, that's bundled adware. If I wanted to give you malware, I would have added a keylogger which you wouldn't have ever discovered (ask around; it's technically possible). So stop whining already, uninstall the extension and move on with your life!" http://productforums.google.com/d/msg/chrome/mlAD1ygc0v0/FL6...

(Also, he's now posting on the linked thread. 7 minutes ago last reply.)

> I would have added a keylogger

seems to imply that he was not logging keystrokes, which conflicts directly with the first post in that thread:

> they are tracking all data and keystrokes. checked with wireshark.

It'd be nice to have a copy so that we can find out for ourselves.

It is passing the search string I submit via google to ecosia which I elaborated on a few posts after the initial one. It is logging all search traffic keywords and then serving related ads in a backdoor manner. It is not sitting on my desktop logging or anything like that. But it is breaching my privacy expecations with Google by logging my user submitted keystrokes and sending them to Ecosia for sure. What are they doing with that info?

I agree that logging search queries has severe privacy implications, but "tracking all data and keystrokes" is unnecessarily alarming. If this extension were tracking all data and keystrokes available to Chrome, the end user might spend the next week tracking down and securing online accounts, cancelling credit cards, informing clients of potential breaches of confidentiality, etc.

I looked at the source and it did not capture keystrokes for this purpose. His comments also indicate he did not add this behavior to the extension.

Unfortunately, the developer was such a douche about everything, I would find it difficult to trust him just based upon his behavior alone. Would I want my data in his hands? NOPE.

It looks like the developer still has a copy hosted on his own site:

http://ionut-botizan.net/window-resizer/

Reply on news.ycombinator.com