Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

We were only able to name one extension (the one named in the presentation), as we did not have conclusive proof that data from other extensions which we found to be suspicious ended up in the data set (as the access to incremental data was limited to a short time period):

We developed a sandboxing framework to test whether Chrome extensions send URL data to a third party using a MITM proxy, the code is available on Github:

https://github.com/adewes/chrome-extension-behavior-analysis

There's also a large study on this that uses a very similar technique:

https://arxiv.org/pdf/1612.00766.pdf

In general, you should be careful about any extension that regularly sends data to a third party. You can check this in Chrome by opening the extensions list (chrome://extensions/), checking "Developer Mode" on the top right corner and clicking on "Inspect views: background page" of the extension. You can then open the "Network" tab and see all requests the extension makes while you surf the web.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: