Firefox and Chrome Pull Popular Browser Extension Stylish From Their Stores After Report Claimed It Logs and Shares Browsing History, Credentials 68
sombragris writes: Stylish, a popular extension available for Chrome and Firefox which allows for easy customization of any website, now phones home and shares its users' browser history with its corporate parent, according to blogger Robert Heaton. This prompted Firefox to ban the extension from its addons site and prompt all users to disable it. The discussion can be seen in the relevant bug report. In Heaton's words:
Stylish is no longer a well-meaning product with your best interests at heart. If you use and like Stylish, please uninstall it and switch to an alternative like Stylus, an offshoot from the good old version of Stylish that works in much the same way, minus the spyware.
Google too has pulled the extension from its extension store. This is not the first time Stylish is at the centre of a privacy debacle
Bad - but not surprising or unexpected (Score:5, Insightful)
We now live in "The Internet Economy" where everything is based on "monetizing" the customer.
But how bad? (Score:5, Interesting)
The title suggests that not just browsing history but credentials are uploaded. The latter is potentially much worse than the former. Does anyone have verifiable data on exactly what was uploaded? Does everyone who got caught out by this need to reset their IDs/passwords/whatever on every site they visited while using the extension? Or every site they've ever visited and allowed their browser to store login credentials?
The new owners could be in pretty deep brown stuff anyway given that this sort of behaviour without explicit consent is now very illegal throughout Europe, but if they were stealing credentials then it would be prudent to reset everything, which of course could mean dozens or hundreds of different sites for some people.
Re: (Score:2)
That's essentially what happened with alternatives like Stylus that are now being recommended instead. What we can't figure out so easily is the past behaviour of all relevant versions of the Stylish extension itself.
Re: (Score:2, Interesting)
The "credentials" part of the title is misleading.
Stylish sends our complete browsing activity back to its servers, together with a unique identifier. [] The SimilarWeb Privacy Policy says that they only collect “non-personal” data, and I assume that this is technically true.
There is only evidence that Stylish sends home browsing history, but TFA discusses how visited URLs may contain credentials or one-time keys, and how Stylish can link them to a userstyles.org account.
Re: (Score:2)
I saw that as well; that was what prompted my question. Any sanely implemented site isn't going to be sending things like plain text IDs and passwords as part of a query string, only one-time tokens and the like. It was whether Stylish was intercepting things like form submissions over HTTPS, or somehow scanning saved login credentials stored in the browser, that I was concerned about when I read the title. That would have suggested that users should be advised to change all of those passwords.
Re: (Score:2)
Indeed - the later would be criminal in most legislations around the world. There is nothing brown about it, it is a clear black hat activity.
We need an extention protection mechanism (Score:4, Informative)
Re:We need an extention protection mechanism (Score:4, Insightful)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
More data moving out would need user agreement and browser support?
Make the browser much more aware of what its extensions can do and what more they are allowed to do.
Re: (Score:2)
And then we can complain that browsers are limiting what extensions can do (like the complaints firefox gets.)
This is just one of the risks you take when you install an extension. It's up to you to decide if what the extension does is worth the risk.
I'm down to using almost no extensions and just using my host file to block domains.
We need to not keep trusting everyone's software (Score:5, Interesting)
There is a plague in the modern tech industry, where everything from browser extensions to microlibraries for your favourite programming language is written by someone you've never met, supplied via some sort of centralised repository or distribution channel that you trust instead, and then winds up on your machine doing who-knows-what because that trusted distribution mechanism missed something, or even because the trusted developer of some code you're running, which you downloaded via a trusted source, itself trusted someone else unwisely.
The solution to this isn't just proper validation of where the code you're downloading actually came from, it's also to have security models more sophisticated than the 1980s in the Internet age. For example, why the hell could a browser extension that was there to modify the appearance of pages you were visiting suddenly choose to upload anything to the mothership without requiring additional permissions?
Re: (Score:2)
Yes, you can do all kinds of things if the browser lets you. But there is no reason a browser couldn't simply impose a 100% firewall by default and let any extensions that genuinely do have a need to do something like your example ask for explicit permission. I would argue that the sort of behaviour you illustrated is relatively unusual for browser extensions, while sadly trying to exfiltrate data no longer is.
Re: (Score:2, Interesting)
As the grandparent pointed out, you haven't solved anything.
Even if the plugin is only allowed to insert valid css into the page, it can send information back to any site on the internet, by using css properties which take url values, including background. The ability to send data to an arbitrary server is implicit in the ability to inject css into a page.
Re: (Score:2)
This is true if you allow insertion of arbitrary CSS (or running of arbitrary code that can trigger requests via JS etc.) and then process it with no questions asked. However, browsers already deal with related concerns in areas like the same-origin policy and CORS. They could apply similar safeguards to locally generated requests.
Re: (Score:1)
Re:We need an extention protection mechanism (Score:4, Insightful)
While we're at it, could we also have a mechanism to override auto-updating? It sucks when a developer sells his extension, and then everything auto-updates to the all-new system without appropriate disclosure. One of many reasons I don't want ANYTHING to auto-update anymore.
Re: (Score:3, Informative)
If you're on Firefox, go to about:config and flip "extensions.update.autoUpdateDefault" to "false". You can also change this per-extension by clicking on the "More" link on each extension. The first field is "Automatic Updates" and you can choose between Default, On, and Off.
Re: (Score:2)
Sad (Score:2)
Re: (Score:3, Insightful)
the real blame lies squarely with the FF devs.
Wrong.
On what fscking planet is there justification for ALLOWING an extension to access history in the first place?!
For examples, try searching for Firefox extensions involving history [mozilla.org].
Maybe there needs to be some kind of permissions system for extensions so that the user is prompted to grant access to things like history, credentials, form fields, user key-strokes, etc. Until there is, understand that you need to trust your extensions just as much as you have to trust the browser itself. This shouldn't be a surprise to anyone.
Re: (Score:2, Informative)
Maybe there needs to be some kind of permissions system for extensions so that the user is prompted to grant access to things like history, credentials, form fields, user key-strokes, etc.
There is. [mozilla.org] That's part of the new extension system. The concept of permissions is fundamentally at odds with the old extensions system and was one of reasons for the new extension system.
Unfortunately, as pointed out elsewhere in this thread, there's no way to implement Stylish such that it doesn't have the rights to leak every URL you visit, since it can just add extra CSS that sends that information back via loading an image on its remote server. Of course, uMatrix or similar could block such a thing, but
Re: (Score:2)
Sure, this is clearly a shitty thing for an extension to do - but the real blame lies squarely with the FF devs. On what fscking planet is there justification for ALLOWING an extension to access history in the first place?!
Your criticism is misdirected. Stylish does not need to access your browsing history (something that Firefox can block). But Stylish is designed to be active on every page that you visit so that it can apply custom styles for that site or tell you if some user styles exist for that site, Stylish sees every page that you visit, so it can collect and transmit its own view of your history. And unfortunately, that history can include some sensitive information as explained in the article.
Why do people do this? (Score:2)
Why do companies / people do this when there is *100 percent chance* that they will be discovered and excommunicated from the Internet Universe? One would think they would be a little more sneaky about it.
Re: (Score:1)
Use Stylus Instead (Score:1)
As the summary notes, stylish has been suspicious for a while. I switched to stylus [mozilla.org] last time and have been more than happy with it.
If you were using stylish on Firefox.... (Score:5, Informative)
I was using stylish for quite some-time. I'm disappointed that this kind of breaking of trust occurred with that extension. I've now switched over to stylus instead. It works great (even better than stylish). It seems to behave better, have a better UI, and more stability. So, if you're unsure what to use, definitely give stylus a try.
Re: (Score:2, Informative)
Can confirm, Stylus works just as well. No modification of my styles were needed.
Stylish still exists? We moved on years ago, fam (Score:2)
Stylish still exists? We moved on years ago to Tampermonkey.
Re: (Score:1)
Are you sure you aren't confusing Stylish with Scriptish [mozilla.org]?
Re: (Score:2)
Nope, Tampermonkey et.al are supersets of the functionality provided by Stylish.
Bigger deal than what Facebook's doing (Score:3)
Peer review (Score:2)
Someone needs to start a peer-review system for firefox extensions.
The other day I installed a gestures extension and reviewed the source code myself before installing it for possible telemetry leaking. I didn't have any and it would be nice to upload my results to a website.
If someone made it nice like stackexchange with points I bet it would take off.
Re: (Score:2)
Re: (Score:2)
Nope. It's easy to game an extension but a review system? Impossible! lol
Re: (Score:2)
I think it reflects pretty poorly on Chrome how most of the comments are about show we are shocked that this could happen on Firefox. I guess we just took it for granted that it would happen using Chrome.
Legal system (Score:2)
Is this not a crime? Who perpetrated it? Or did everyone who installed the extension agree to a EULA explaining that it did this? If so, I believe the problem is the existence of a EULA. They are too long and complex, nobody reads them, and so they have all kinds of stuff in them. Since people agree to them automatically, they lose their rights to use the legal system that should be punishing these criminals.