Hacker News Reader

Comment by erichurkman | Hacker News Reader

Extensions that do this terrify me. Imagine a popular Chrome extension, say, Fireshot, with 2 million active installs, selling out. The next update of the app gets shipped with a screen scraper that looks at coinbase.com. Some time after you've last visited your dashboard, it opens a connection on some entirely unrelated site and posts to the 'send' page to send all of your BTC to a third party address.

Or if you have 2FA enabled for sends, just intercept the send POST with an address of your choice, but display the user's originally input address on the confirmation screen. To make it even more confusing, keep a list of transactions:intended accounts so any time the user looks on _any_ bitcoin site it shows the transaction was going to the right account.

View on HN

The bitcoin people will tell you that if you're using the same computer to browse the web as to hold a bitcoin wallet, you're doing it wrong.

(there are other conclusions one could reach from this, such as the disadvantages of being your own uninsured bank)

Isn't that how silk road guy got caught by the feds.

i thought he signed up for a forum with an email tied to his real life identity but used his previously anon handle

It was a StackOverflow question he posted while creating Silk Road, in which he used his real name (before switching to the "frosty" alias in under a minute).

And his SSH key had both the username and hostname set to that alias ("frosty@frosty"), which is how they connected him to Silk Road.

Specifically, it was this question: https://stackoverflow.com/questions/15445285/how-can-i-conne...

You can set a flag on Chrome (chrome://flags/#extension-active-script-permission) to block the extension by default and only activate it when you click the pageAction/browserAction or if you whitelist it (for that website only or for all websites).

Also, two extensions come in handy: "Chrome extension source viewer" [1] and "Extensions Update Notifier" [2] (self-descriptive titles). The second one can automatically disable extensions when they're updated.

They're honestly a little annoying if you have more than a handful of extensions since they lack some essential features (e.g. viewing a code diff from the previous version), but at least they're open source! :)

[1]: https://chrome.google.com/webstore/detail/chrome-extension-s...

[2]: https://chrome.google.com/webstore/detail/extensions-update-...

We should try and be more sinister. Imagine a company purchases or influences a plugin so much that when a news article is read about E Corp dumping toxic waste into drinking water the content is changed to play down the numbers and sentiment.

I always use incognito mode (disable all extensions) when visiting relevant sites. I wonder if it's enough.

Reply on news.ycombinator.com