News for hackers. Stuff that matters.

A comment on Massive spying on users of Google's Chrome shows new security weakness. Parent comment

Re:Massive spying on users of Google's Chrome shows new secu... by aembleton on Thursday June 18, 2020 @05:14AM (#23561286)
> asking for updated ad block lists

You could only allow GET requests and require the user to whitelist this the first time the extension does it.

Subsequent calls to the same blocklist would go through without a user prompt, but if it suddenly started trying to send your email address or some other param, it would stand out.

[ Parent | on HN ]
Re:Massive spying on users of Google's Chrome shows new secu... by jcranmer on Thursday June 18, 2020 @09:28AM (#23562885)
A trivial way way to get around that:

Make calls to two seemingly benign requests early on. Now you can send whatever data you want to without triggering another prompt by successively requesting the first resource to indicate a '0' and the second resource to indicate a '1'.

[ Parent | on HN ]