Hacker News Reader

Comment by orf | Hacker News Reader

I'm not fond of Chrome's app permissions at all. Too many apps just ask for permission to access everything, and there is little insight into what they exactly do.

I run the Ghostery extension and a year or so ago I noticed that when visiting YouTube ~15 analytic trackers were being blocked. Turns out a couple of extensions were injecting tens of trackers into popular sites (without my express permission), and I would have had no idea unless I had another extension to block and report this activity.

My girlfriends computer is worse - her extensions seem to inject actual adverts into lots of her pages. I asked her why there was an obnoxious "click the bottle to win 1000000$" flash advert on Facebook and she thought it was just how Facebook is. Same thing for YouTube and other popular sites.

View on HN

Hijacking your comment, sorry.

I just downloaded the app and went hunting. It indeed connect to some service, more specifically it creates a webview (think iframe but better separated) with url "https://www.diigo.com/account/thirdparty/openid?openid_url=h... (which you should totally not access with a logged in google account, or in any other way).

It then adds several callbacks one of which handles loading stopped which causes the app to send a command "handshake" to the app. I have so far found two, one of which is a response to the handshake and the other is a command "launch" which opens the index.html command with a given title and data url.

This shit has China written all over it - and I mean so literally because the bg.js file has the following user information at the top, with a Chinese date:

/ * User: xiaoge * At: 14-5-19 5:52下午 * Email: abraham1@163.com */

Will keep digging. So far I haven't found out what it is it sends, but it does request access to both your google drive account and (most worringly) to your EMAIL.

This is definite no install.

_Edit_: Remember what I said about your email info? Awesome screenshot can upload your screenshots to your gdrive, it does so using oauth2, which tells us the client that has access to it. In this case the app signs in as awesomescreenshot.com/client, but use https://secure.diigo.com/kree as the actual signin url - which means that they now have access to your gdrive files.

Would you consider putting the URL in a code block (double indented), or in some way mangling the URL so that it's not auto-hyperlinked?

That's why I started to build a list of trusted extensions which I've reviewed every line myself. Except for ones like Pushbullet, Pocket, and Lastpass

https://github.com/kolodny/extensions

I stopped using ANY extensions for the same reasons. In most cases, the risks outweigh the benefits in orders of magnitude. Well, there are few exceptions, of course, but those are widely used developer tools.

For me, the Internet is largely unusable without adblock at the very least. I removed Ghostery and started using Disconnect instead. It does a much better job methinks.

In addition to this on Firefox at least I invoke about:config and make several settings changes:

- I disable prefetch.

- I disable media.peerconnect.

- I disable geo tracking.

- I disable HTTP/S referer.

- I disable DOM storage.

- I disable visited link tracking.

I also use EasyList, EasyPrivacy, and Malware domains adblock subscriptions.

In addition, as a Linux user, I want to use Flash on those sites that use it, but I don't want to deal with LSOs tracking me, so I take advantage of Flash by sending those LSOs to /dev/null. The Website is none the wiser and I get the benefit of the Website.

rm -rf .adobe

rm -rf .macromedia

ln -s /dev/null .adobe

ln -s /dev/null .macromedia

Surf with relative comfort knowing that you've already paid for your Internet connection with cash, no need to give away more of your privacy than needed. Blocking ads is great if you use any social media, as you don't have to see the sodden ads.

I use several web browsers, so rather than installing a different 'adblock' plugin for each one, I use Dan Pollock's excellent list as part of my hosts file:

  http://someonewhocares.org/hosts/

(Mentioned in HN previously.)

Works well for MacOS X, Linux and Windows, and doesn't care what browser you're using.

I have been using it for 3+ years now without any problems.

I have a script to toggle moving the file out of the way and then back again, mostly so that I can give ad revenue to those sites that I feel are deserving.

I have toyed with the idea of using hosts files instead, but what bothers me is the lack of daily updates. Granted, there is so much bad crap out there that it's impossible to avoid it all.

Another thing I want to do is find a router that allows host files and script regular updates. It would be great to never have to install extensions or tinker with hosts file for every box on the network. I've also said I'd be interested in seeing a proxy server that strips out all of this stuff so no maintenance on the user end is required.

A bit of a late reply, but I have switched to using this on my home LAN now: https://github.com/jodrell/unbound-block-hosts

Basically, a Perl script to massage the data from Dan Pollock's list into a format suitable for unbound (http://www.unbound.net/)

You could also use a global proxy, with a PAC filtering out those ads.

You might also want to block some automatic connections in Firefox http://www.ghacks.net/2014/06/02/block-automatic-connections...

Why do you find Disconnect.me better than Ghostery? I tried the former for a few days, but found its UI unwieldy, and couldn't find a way to disable just some things for specific sites (e.g. Disqus comments).

Ghostery is owned by a company that has ties to ad networks. I am, by principle, opposed to ads in Web content, so I want to use a product that loathes the idea as much as I do.

I have the right to browse the Internet without being tracked, my data sold without my permissions, have targeted ads delivered my way, you name it.

I've often thought about setting up a colo proxy server for people that strips out all ads, beacons, tracking cookies, you name it -- and give it away for free. With cheap hosting and unlimited bandwidth, this could be a good thing.

Disabling media.peerconnect does nothing to improve your anonymity. peerconnect (and, well, all websockets datachannels) requires user action to be enabled

One word: webrtc

Can have security issues if not done correctly.

http://techpageone.dell.com/technology/open-source-webrtc-cr...

Uh, that entire article is FUD and bullshit.

Care to elaborate on your claim? It's one thing to claim it's FUD, but yet another to refute it.

The entire premise is that somehow hole punching is dangerous and unstoppable with webrtc. Enterprise grade NAT environments can easily deal with both STUN and TURN hole punching.

If leaking internal IP's from your network is a security risk, you need to reevaluate what you're calling "security".

None of the article's concerns are concerns to any competent sysamin

E: replaced 'exposing' to 'leaking' to avoid confusion

To clarify (because I misunderstood the meaning of the comment before clicking the link), the parent is referring to leaking the IP addresses themselves, not 'exposing' access to them.

Yeah, I see how my wording is confusing. I've edited my post to use leaking instead of exposing

Almost all of those can be reversed by one malicious extension.

Did you know you could actually read the source code of most extensions that are on the chrome webstore. I'd rather that people start publishing their privacy policy honestly else Google blocks them from the webstore.

Of course I know - at a point in time though. With Chrome autoupdate mechanism, unless permissions change, I don't have to approve. I'm sorry, but if I multiply by my hourly rate the time I need to invest to secure the benefit of using extensions, which work only on the desktop anyway, this will be a huge investment I'm not willing to do. I was thinking at some point to create a bunch of Chrome profiles and silo different web activities, but this is too much work, and to be able to sync across machines, I need separate Google accounts, i.e. too much effort still.

Agreed. I use profiles to keep myself safe but have been struggling when I switch between different machines.

There are so many users on the webstore. Time to solve a BIG problem? (App monitoring service?)

Reply on news.ycombinator.com