News for hackers. Stuff that matters.

A comment on 37k Chrome users downloaded a fake Adblock Plus extension.

Re:37k Chrome users downloaded a fake Adblock Plus extension by topranks on Tuesday October 10, 2017 @05:10AM (#15440428)
What are Google's rules about names? Only difference I can see here is the fake one is called "AdBlock" and the real one "Adblock".

Is changing the case of one letter enough to get an extension into the Chrome store? Or even worse are overlapping names allowed?

[ Parent | on HN ]
Re:37k Chrome users downloaded a fake Adblock Plus extension by extrapickles on Tuesday October 10, 2017 @05:30AM (#15440505)
It’s hard enough to tell someone which is best, telling them the particular capitalization is impossible without giving them a direct link.

In addition, preventing duplicate names is fairly hard if you support unicode. Characters like the zero width space, Mongolian vowel separator and many others make it algorithmically different but visually they are the same.

[ Parent | on HN ]
Re:37k Chrome users downloaded a fake Adblock Plus extension by myle on Tuesday October 10, 2017 @04:55PM (#15445241)
That's not really n issue. You can always compared normalized versions of the name.
[ Parent | on HN ]
Re:37k Chrome users downloaded a fake Adblock Plus extension by sp332 on Tuesday October 10, 2017 @09:50AM (#15441731)
The fake one is in the "Apps" section and the real one is in the "Extensions" section. Since apps aren't as popular overall as extensions, it's easier to game that section to get to the top.
[ Parent | on HN ]
Re:37k Chrome users downloaded a fake Adblock Plus extension by styfle on Tuesday October 10, 2017 @06:29AM (#15440701)
Google should make the extension name case insensitive like domain names. That should help a little bit.
[ Parent | on HN ]
Re:37k Chrome users downloaded a fake Adblock Plus extension by marindez on Tuesday October 10, 2017 @07:29AM (#15440902)
Then people will use cyrillic letters, etc. That approach simply does not work.
[ Parent | on HN ]
Re:37k Chrome users downloaded a fake Adblock Plus extension by styfle on Tuesday October 10, 2017 @12:17PM (#15443001)
Yeah its a problem for domain names too: https://www.xudongz.com/blog/2017/idn-phishing/
[ Parent | on HN ]