Browser Extensions Spying On You - Security Warning

Google Chrome Extensions: Data Tracking and Privacy Concerns

Recent reports have highlighted the sale of Google Chrome extensions compromised with adware. However, a more significant issue has come to light: many extensions are actively monitoring user activity and selling browsing data to third-party companies.

Here’s a concise summary of the situation:

• Browser extensions for Chrome, Firefox, and potentially other browsers are recording every webpage visited. This data is then transmitted to external companies in exchange for payment.
• Certain extensions are also injecting advertisements into visited webpages, a practice Google permits provided it’s “clearly disclosed”.
• A vast number of users are unaware that their online activity is being tracked in this manner.

Defining the Issue: Is it Spyware?

The question arises whether this practice constitutes spyware. While a strict definition of spyware, as outlined by Wikipedia, involves unauthorized information gathering and transmission, the situation is nuanced. Not all data collection is inherently malicious.

However, when an extension developer deliberately conceals the fact that all visited pages are being recorded and sold, framing it as “anonymous usage statistics” buried within settings, a clear problem emerges. Users reasonably expect usage tracking to pertain only to the extension itself, not their entire browsing history.

This practice is further complicated by the use of the term “anonymous”. This suggests data is scrubbed of identifying information, but this isn’t necessarily the case. While an anonymous token may be used instead of a name or email, every webpage visited is still linked to that token for the duration of the extension’s installation.

Prolonged tracking of browsing history can ultimately reveal an individual’s identity.

Consider how often users access personal profiles on platforms like Facebook, Pinterest, or Google+. URLs often contain identifying information. Even without visiting such sites, determining a user’s identity remains possible.

Many individuals consider their browsing history to be private, and access should be restricted to themselves. The use of passwords and browser history deletion are common practices to protect this personal information. Online activity is inherently personal, and the list of visited pages should remain confidential.

Google’s Policies and Privacy

The Google Developer Program Policies for Chrome extensions explicitly prohibit the publication of personal information:

We don't allow unauthorized publishing of people's private and confidential information, such as credit card numbers, government identification numbers, driver's and other license numbers, or any other information that is not publicly accessible.

Given this policy, how can browsing history not be considered personal information? It is certainly not publicly available!

The Pervasive Issue of Ad Injection by Browser Extensions

A significant concern arises from the widespread practice of browser extensions inserting advertisements into webpages. These extensions often inject ads indiscriminately, placing them in various locations on a page.

The disclosure requirement for these advertisements is minimal, typically limited to a small text identifier indicating the source. This subtlety often goes unnoticed by users, as most individuals do not actively scrutinize advertisements.

The Role of Cookies in Advertising

The presence of advertisements invariably leads to the deployment of cookies. It’s important to acknowledge that this website, like the vast majority of online platforms, relies on advertising revenue and utilizes cookies for this purpose.

While we do not consider cookies to be a major privacy threat, users concerned about them can readily manage their cookie settings within their browser.

Adware vs. Tracking: A Matter of Transparency

Interestingly, adware extensions may present a lesser problem than tracking extensions. The actions of adware are generally apparent to users, prompting potential feedback and requests for modification from the developer.

We advocate for Google and Mozilla to revise their policies to explicitly prohibit such intrusive behavior, though this remains outside of our direct control.

The Stealthy Nature of Tracking

Tracking, conversely, is often conducted covertly. Details regarding tracking activities are frequently obscured within the legal jargon of extension descriptions.

Consequently, users rarely review these lengthy descriptions to determine if an extension is engaged in data collection practices.

Here's a breakdown of the key concerns:

• Ad Injection: Extensions adding unwanted ads to webpages.
• Cookie Usage: Advertisements relying on cookies for tracking.
• Lack of Transparency: Tracking activities hidden in extension descriptions.

Data Collection Practices Hidden Within Agreements

Many browser extensions are permitted to track user activity due to disclosures made within their description pages or settings menus. For example, the HoverZoom extension, utilized by over a million individuals, includes the following statement at the bottom of its description:

Hover Zoom collects anonymous usage statistics. This functionality can be deactivated within the options page without impacting core features. By maintaining this feature enabled, users consent to the collection, transfer, and utilization of anonymous usage data, potentially including transfer to third-party entities. 

The description fails to explicitly state that every webpage visited will be monitored and the corresponding URL transmitted to a third party in exchange for compensation. Instead, the extension emphasizes revenue generation through affiliate links, obscuring its data surveillance practices.

Furthermore, the extension injects advertisements across various webpages. The question then becomes whether users are more concerned with the presence of advertisements or the transmission of their complete browsing history to external parties.