“Stylish” browser extension steals all your internet history

Re:“Stylish” browser extension steals all your internet history by Zren on Tuesday July 03, 2018 @08:23AM (#17449538)

I've gotten annoyed enough to just copy the source from most of my extensions (located at `~/.config/google-chrome/Default/Extensions/`), remove the update stuff from the `metadata.json` and load them as developer extensions so they never update.

It's easy enough to update them + audit the code when something breaks. The hardest part is downloading the new code (.crx) without installing it, I had to write javascript I paste into the console. StackOverflow can unzip a crx by striping the first 306 bytes.

I forked Stylish v1.5.2 a year ago before I heared of Stylus, but I've no need to to switch since the original extension was pretty good. https://github.com/Zren/chrome-extension-stylish#fork

[ Parent | on HN ]

Re:“Stylish” browser extension steals all your internet history by kav2k on Sunday July 08, 2018 @04:42PM (#17486080)

Would recommend this extension: https://chrome.google.com/webstore/detail/chrome-extension-s...

Allows to easily audit and download the extension right from the Web Store page.

[ Parent | on HN ]

Re:“Stylish” browser extension steals all your internet history by HelenePhisher on Tuesday July 03, 2018 @01:58PM (#17452327)

You can extract the .crx without Javascript using this webservice: http://crxextractor.com/

Used it a couple of times in the past, it is a good one.

[ Parent | on HN ]

Re:“Stylish” browser extension steals all your internet history by Zren on Tuesday July 03, 2018 @05:00PM (#17453586)

All you need to do is remove the first 306 bytes to turn it into a normal zip file.

    tail -c +307 in.crx > out.zip

Credit to this guy in the comments. https://superuser.com/questions/139190/how-to-unpack-a-chrom...

[ Parent | on HN ]

Re:“Stylish” browser extension steals all your internet history by e1ven on Tuesday July 03, 2018 @10:52AM (#17450659)

I'm glad that workflow works for you.

I'm curious though - What about it is better than turning off automatic updates for addons?

[ Parent | on HN ]

Re:“Stylish” browser extension steals all your internet history by _bxg1 on Tuesday July 03, 2018 @11:00AM (#17450752)

Last I checked, there is no option to turn off automatic updates. Maybe that's changed.

[ Parent | on HN ]

Re:“Stylish” browser extension steals all your internet history by e1ven on Tuesday July 03, 2018 @01:41PM (#17452188)

Interesting - It looks like Firefox has an easy option to block them, but I don't see one in Chrome.

[ Parent | on HN ]