browser

Millions of users data leaked by browser extensions

Posted on by VA3DBJ

From: Geekbots

Now, a research report reveals that some popular browser extensions are collecting and even selling users data including a list of visited sites and photos that users have looked at.

Most recently, security researchers found that a number of popular extensions were harvesting user data without consent. Not only their browsing histories but also exposing tax returns, medical records, credit card information and other sensitive data to a database. The exposed data also include vehicle identification, numbers of recently bought automobiles along with the names and addresses of the buyers.

Security researcher Sam Jadali discussed the presence of some data-harvesting extensions available on the Chrome and Firefox app stores. Once the extensions installed in the system, it started tracking your browsing and spending habits and also harvesting sensitive data to sell online.

The report said,

This non-stop flow of sensitive data over the past seven months has resulted in the publication of links to home and business surveillance videos hosted on Nest and other security services.

Tax returns, billing invoices, business documents, and presentation slides posted to, or hosted on, Microsoft OneDrive, Intuit.com, and other online services” have been exposed.

Reports also showed that the affected extensions were used by millions of people, including HoverZoom, SpeakIt!, SuperZoom, SaveFrom.net Helper, Branded Surveys, Panel Community Surveys, FairShare Unlock, and PanelMeasurement.

Google and Firefox both said,

The extensions have been remotely removed or disabled in consumers’ browsers and are no longer available for download.

That’s why Google is trying to make Chrome extensions safer to use. Later this year, the company is rolling out a change that’ll restrict extensions from intercepting and modifying sensitive data flowing through the Chrome browser.

Mozilla is also aware of the changing security landscape and told that they have created a list of  “Recommended Extensions” that are editorially vetted, security-reviewed, and monitored for safety and privacy.

A Mozilla spokesperson said,

Mozilla has blocked all of the extensions that were found to be in violation of our policies. We looked into these extensions and found them to be in violation of our Distribution Agreement and Review Policies. As a result, they have been blocked from Firefox.

If you make use of extensions on Chrome or Firefox, you’ll want to make sure that your browser wasn’t affected by this catastrophic data breach.

Need a Reason to Drop Google Chrome?

Posted on by VA3DBJ

Google is planning to restrict modern ad blocking Chrome extensions to enterprise users only. This is despite a backlash to an announcement by Google in January proposing changes that will stop certain ad blockers from working efficiently.

The proposal–dubbed Manifest V3–will see a major transformation to Chrome extensions that includes a revamp of the permissions system. It will mean modern ad blockers such as uBlock Origin—which uses Chrome’s webRequest API to block ads before they’re downloaded–won’t work. This is because Manifest V3 sees Google halt the webRequest API’s ability to block a particular request before it’s loaded.

A single sentence buried in the text of Google’s response to the complaints, which clarified the changes: “Chrome is deprecating the blocking capabilities of the webRequest API in Manifest V3, not the entire webRequest API (though blocking will still be available to enterprise deployments).”

In other words, paid enterprise-only users will still have the ability to block unwanted content. It probably means enterprise customers can develop in-house Chrome extensions, not for ad blocking use. For everyone else, the changes announced in January will remain the same.

It’s annoying, to say the least, but the reason for these changes is obvious: Ads are at the heart of Google’s business model.

There are many users who won’t use Chrome without an ad blocker, so it will see some switch to other providers such as Firefox. However, Firefox has had its own issues over recent weeks.

So, now might be the time to switch to another browser, such as Brave. Brave is built upon Chromium so all existing Chrome plugins and even themes work on it and reduces your digital footprint, protecting your privacy.

Another option is using DNS level methods that blacklists adverts as well as malicious URLs.

Safe and Ad Free Browsing

Posted on by VA3DBJ

Ever since my bad experience with Facebook and their other products, I have been working on ways to minimize my digital footprint. I moved over to other social media sites that have no ads and don’t ask or use your private information. With the demise of Google Plus in April (2019), I decided that it was the perfect opportunity to research and move to other products that decrease my digital footprint and at least work to safe guard my web browsing. This is a living post, per-se, that I will be maintaining with new and updated information.

Ad Free DNS

AdGuard DNS is a free Domain Name System service provided by the AdGuard company. You can use this DNS service to block advertising and trackers. It works like this: when a website sends a request to an ad network, the DNS sends back a “null” response. For example, when a web page looks up the domain name “ads.facebook.com” the DNS will not find that name. This means all networks request are never loaded — this is the most efficient way to block them. This blocking may even speed up your web browser slightly.

Besides blocking advertising, AdGuard DNS will also blocks trackers and malware phishing sites.

Default Ad-Blocking DNS

Use these servers to block ads, tracking and phishing:

  • 176.103.130.130
  • 176.103.130.131

Or use IPv6 addresses:

  • 2a00:5a60::ad1:0ff
  • 2a00:5a60::ad2:0ff

Family Protection DNS

Default + blocking adult (porn) websites + safe search:

  • 176.103.130.132
  • 176.103.130.134

Or use IPv6 addresses

  • 2a00:5a60::bad1:0ff
  • 2a00:5a60::bad2:0ff

For more information on AdGuard DNS, click here.

Web Browsers

Your web browser knows a lot about you, and tells the sites you visit a lot about you as well—if you let it. I have been testing out a number of browsers that specifically caters to those that want safer browsing experience and free of most ads.

Brave Browser

Here is one that I have been using for a while and it works pretty well, when used with the AdGuard DNS protection.

Brave is the latest unique browser to join the ever-expanding market. The open source and free browser from Brave Software Inc. has positioned itself as the browser that loads faster with better privacy protection. The firm was co-founded by Brendan Eich, the creator of JavaScript and a co-founder of Mozilla. Brave keeps data safe and provides users with the power to save or delete it. It features a built-in ad tracker and blocker. Unlike most common browsers, Brave also helps to fight phishing and malware.

Brave blocks ads automatically. Users are no longer required to search the web for a perfect ad blocker. The auto-blocking protects your device from malware and extensive tracking by advertisers. Brave is also working on a plan to replace ads that appear harmful.

Tracking ads by Brave is accurate. Users are served with the right ads because Brave does the tracking using local data. If an ad is irrelevant to the user, it is pulled down. You get the appropriate ads based on this model. A user’s data stays within the device since they have no third parties involved.

While Brave blocks third-party cookies, the first party cookies are not blocked by default. Users have the option to prevent or enable cookies on a given website.

However, Brave does not block ads displayed in search results. You will be able to see AdWords advertisements within Google’s results. This is because Ad blocking extensions don’t stymie search ads either.

Blocking of malicious ads automatically allows safe browsing. Brave does not have access to identifiable user data. The anonymity aggregated ad campaign related data is used for accounting. However, this data cannot be traced back to a user’s device.

Brave also comes with additional tactics to boost privacy while browsing. The incorporation of HTTPS everywhere allows usage of web encryption whenever available.

The fingerprinting feature bars third parties from tracking your activity. This feature can be activated in the settings tab.

Brave offers a clean and crisp interface that is intuitive to use. It has all the elements you would expect in your ideal browser. Furthermore, Brave’s individual tabs sport icons for quick identification, and hovering the cursor over a tab offers details on the page in that tab without having to click on the tab and activate it.

The browser also displays statistics about the content the browser has blocked. These statistics are very useful. Furthermore, it displays photos, the current time and shortcuts to your favorite sites. Like other websites, one would expect these features to have an effect on speed. However, this is not the case. Brave is very easy to use, with a streamlined design and the useful option to preview the content of tabs.

Brave’s load speeds emerge on top. The fast browsing is supported by Brave’s lack of thirds party ads. You, therefore, have less content to download before accessing your favorite website. However, Brave’s rendering speeds come a bit after Google Chrome and Mozilla.

Brave is set up on the Chromium platform. Chromium is an open-source system that also powers popular browsers like Google Chrome and soon Microsoft Edge. Based on the Chromium capability, you can almost use all Chrome extensions on Brave. The extensions on Chrome can be added to Brave through the Chrome Web Store.

For more information and downloads, click here.