2d ago

Browser extensions turn nearly 1 million browsers into website-scraping bots

arstechnica.com

14 comments

This is fucked up. Dark Reader?
- Thankfully it seems that this is only for Dark Reader on Edge (not Firefox or Chrome).
  Still worrying to see them integrate this fraudulent service.
  
  I think that this may be some duplicate extension trying to generate and take advantage of user confusion between the real Dark Reader extension for Edge and this one.
  Real Dark Reader:
  https://microsoftedge.microsoft.com/addons/detail/dark-reader/ifoakfbpdcdoeenechcleahebpibofpc
  What appears to be the copycat with the malware:
  https://microsoftedge.microsoft.com/addons/detail/dark-reader-%E2%80%93-ultimate-da/lgjebhldhklllbkkbfcfgibifbfcpepa
  I suppose that that potential to impersonate addons is also a security concern, though.
- The firefox list is pretty much entirely overly specific youtube tweaks (that you should be using uBlock or a more fully featured Youtube extension for), "games in sidebar", and custom cursors. Bonzi buddy and toolbars, anyone?
  Seriously, an NES emulator? As a browser addon? That needs permission to access "your data on all websites"?
Who in the hell would use a volume booster extension? Just turn your volume up? Wut.
- This kind of extension is used when your device's output sucks and "cranking it to 140%" is the only way to make it audible (usually mangling the quality). Possibly used by hard-of-hearing users too. Or maybe they're stuck on monitor speakers and "just pay $15 for cheapo cans" isn't an option, and the monitor's OSD controls are clunky and awful (they always are).
  I've used "volume booster" features in apps before when listening to badly mixed podcasts/audiobooks, because turning up the system volume on a phone makes other apps too loud. I could see a desktop situation that mirrors this for someone, a setting in FF is faster/easier than the windows volume mixer.
  
  Yea you make a good point. Well clearly avoid the extensions lol.
This is why I cringe when people recommend random ass addons to do random shit. Better to just literally stick to ublock origin and maybe 1 other. I really don't trust most extensions.
- Besides random extensions, I also recommend checking when the last update was if possible.
  I used to use the KDE Plasma Integration extension but have since ditched it when I found out the last update was in 2024, a little over a year ago now. Unless they update it, I'mma treat that 1 year old extension like a 10 year old extension in terms of security.
- Ublock origin, noscript and canvas anti fingerprinting. Works great
  
  Yea those are well known. But I see people recommending sketchy extensions for small things.

14 comments