Full transcript of “1 Million Browsers Turned Into Bots - Is Yours One of Them?”. Click a timestamp to open the video at that moment. Need another video? Use the YouTube transcript generator.
0:00 If you use browser extensions, which is probably almost all of you watching this video, you need to listen up because this incident exposed some really interesting things that a browsers extensions can do, as well as some interesting ethical questions that maybe we should be asking ourselves. SARS Technica put out this uh paper that pretty much said browser extensions turn nearly 1 million browsers into website scraping bots. And I'm going to show you why that is and what to do about it. First, I want to walk you through the extensions that this specific problem impacted even before I cover the problem because this sets the the scene a little bit better. Some of these look like obvious issues like extra dim or mimic AI chrome compare. I don't know what these do, but they just look like problems. Some of these though look like
0:46 pretty reasonable things like Netflix 1080p light. No, I'm kidding. Like Blue Sky Media Downloader. Uh, also idle forest is one that I feel like I've seen before and also some of these are privacy oriented like user agent switcher. Now these uh change your user agent to try to you know get rid of fingerprinting. I've covered fingerprinting in this whole master class to see if those are even effective. Uh sneak preview they're mostly not. But my point is this is a huge list of a variety of extensions and any of you could have at least installed one of these at some point. I don't keep up with these but some of these are extensions I might have installed 5 years ago. Some of these allow you to use dark mode on sites that don't support dark mode. Some of these add functionality to sites that don't support certain features. Now, here's where things get really interesting. This isn't formally malware because this
1:35 actually comes from something called Melotellgs. And this was covered by someone called Secure Annex. Um, and what this is, they have a whole response, but this is actually an open- source library that uh essentially allows developers to monetize their browser plugins. Now, you might already start to see the ethical considerations here because they are very much in the camp that they're doing something good and they're offering a monetization strategy for developers that doesn't otherwise really exist. And so, this is a good alternative to the maybe advertising industry or the surveillance industry. So, here's how Melat works. So, you as a developer essentially implement this so that you can monetize off of your users. What this does, it declares a couple permissions that you need to add. Um, and then those permissions are used to
2:21 essentially uh generate incognito windows without you seeing. And this all happens in the background. And you can see the example here of idle forest is what they use. Um, what you do is you click start planting. And that now allows you to contribute your unused bandwidth to this extension. And then the researcher says that it sends device info like location, bandwidth, available, heartbeats, and status. Now what's interesting is this loads an iframe. Now, if you don't know what iframes are, uh, all you really need to know is that they can be manipulated in a lot of ways to steal data about you or a lot of security vulnerabilities can actually utilize iframes. And so, websites a lot of times, properly designed websites will have things called content security policies and x-frame options and different things that are designed to prevent this kind of stuff from happening. And the way
3:07 that this works, the way that this these extensions work actually bypass um the way that web browsing is supposed to work so that sites can be properly secure. So, when you use extensions like this, not only is there this potential privacy issue that we're going to talk about shortly, but there's this security issue as well because sites are actually not being utilized in a way that they're intended to be utilized based on their own security policies. The way the author describes this is the weakening of all web browsing can open users up to attacks like cross-sight scripting that would generally be prevented under normal conditions. Not only are your users unintentionally becoming bots, but their actual web browsing is more vulnerable as well. The researcher actually dives a little bit more into like the personal stuff and covers how the owner of this extension also owns a lot of the extensions that it doesn't
3:52 seem like it's owned by them, which is a bit sketchy. And actually, they came forward and gave a lot of the rebuttals and pretty much addressed like, oh yeah, we do do this. We don't do this. Here's context behind why we do this. I recommend reading all of it cuz it's a pretty complicated situation. But here's my problem. Actually, multiple problems that I have with this story. One, I don't think a lot of people understand what contributing bandwidth means if they were actually trying to contribute bandwidth. But most likely, like most people, if you're using one of these extensions, um, you're not actually freaking aware that stuff is happening in the background, which is this entire consent problem that really needs to be addressed. This seriously matters and could impact a lot of people. Not only is there a potential performance impact if again you're not opting in to use a service like this where you're
4:38 contributing your bandwidth to a developer's paycheck which fully understandable. I know it's hard to be a developer but if you weren't aware you were doing that that's a bit shady. There are of course privacy implications with this as well. Um like we said there is some sort of data transmission that's happening here and they do say that they're more private um and they are better for privacy than the traditional advertising industry but I don't think that's the best bar for us to try to shoot for. Now, as for the actual privacy implications, it seems to be pretty hard to figure out what's going on. So, either way, the fact that this is in question should be a concern for many of you. And of course, we talked about the security risks, how the entire way that this extension works actually breaks the model of how you're supposed to have proper security on websites. Now, before I touch on uh what to do about this and how to make sure your extensions aren't caught in this, I want
5:24 to also touch on another important tool that's also the sponsor of our video, where we're death. I'm a firm believer there is no magic bullet for privacy and security and that you need to use multiple tools in different areas of your life for maximum effectiveness. And I think redact.dev is a perfect solution that fits into a lot of people's workflows. If you've ever wanted to delete any social media accounts or specific messages or maybe just attachments in your DMs, redact.dev helps you automatically find and delete old messages, attachments, images. The customization just lets you do whatever you want. so you can actually take control of your data. It works with major platforms like Twitter and Discord. It has automated services so that you can just run it in the background. And my personal favorite feature is it lets you do things like
6:10 ephemeral timelines so that maybe your tweets get automatically deleted after a month. My favorite thing about Redact 2 is that it's trustless. They don't actually store your credentials on their end. It's all done locally on your machine. In fact, if you set up Redact on a second device, you have to sign into your accounts again on that device because it's all done locally on each device, so they never get your credentials. To put it simply, if you're trying to improve your digital footprint, make yourself a little more minimal, make it harder for data brokers to track you, redact.dev is probably the best thing you can use. Visit them using the link here on the screen or down in the description. And now, back to the video. Before I get into the protection tips, I want to just cover some basic things that are pretty much staples in the tech lore community, which is this channel. It's a digital rights community. Um, always advocated for
6:56 digital minimalism. And what this means in the context of extensions is you only should be installing extensions you absolutely need. And if you actually go up here, you're going to see that uh my browser right here literally has one extension that comes pre-installed, and it's Ublock Origin, which is a very safe and trusted extension. And then I have another browser that has Ublock Origin as well as a password manager, but that's it. Now, why I recommend keeping extensions to a minimum besides this story, extensions are notoriously not very security first nor privacy first. And so, it's one of the things that we want to reduce um the usage as much as possible. On top of that, extensions have a lot of access to your system, especially if you grant it access to every website you're on. So, you want to be very aware of this and make sure you're reducing the amount of people
7:41 that have access to that data to lower the likelihood that someone's doing something wrong with it. With that said, let's talk about what you should do. First, go through this list and see if your extensions are impacted by this specific problem. But realistically, there are so many issues that extensions can pose that aren't only represented in this problem. So, what I would do, and this is step one, go through your extensions and just remove things that you literally never use. Um, I know a lot of people that are like, "Oh, I don't know why I have this extension anymore. I haven't used it in months." That's the extension to remove right now. Next, you want to have a little bit of discomfort and apply like remove a few extra ones beyond that. Uh in terms of how to choose the ones to go from there, I like to look for extensions
8:26 that are tied to um some kind of broader business model where it's not just the extension. A really good example of this is password managers. Your password manager, if you're using something like Proton Pass, if you're using something like Bit Warden, if you're using something like One Password, these all have their own business model that's independent of their extension. And their extension is just an extension of their service. And that's what they should be. What you need to avoid is extensions. That is their whole product. This reminds me of Shark Tank where sometimes they say like, "Oh, this is a product, not a business." And this is the same situation. An extension should be the equivalent of a product, uh, but not the entire business. So, try to go through your extensions, uninstall what you don't need, see what actually has a
9:12 real business model with a real company behind it that doesn't need to just monetize off of your browsing data. And of course, if you need something done, see if there's a better dedicated solution for it. In the context of dark mode readers, maybe what that means is moving over to a browser that just has a better dark mode support. Bray, for example, has a reader mode that you can use to read articles in dark mode, even if the site doesn't have a dark mode. And Safari, I believe, has something similar as well nowadays. But that's an example of how you can repurpose uh different tools to avoid needing to install an extension that has access to a lot of sites and can cause a lot of damage. So, please pause this video right now, go check your extensions, and do it on all your browsers. But keep in mind that this also has broader implications that I really want to remind people about. First, this really
9:59 implicates extension stores, right? because there's a lot of trust that you give when you go to the Google Chrome store or the Misilla Firefox store and you say install extension, it's assumed that extension is safe and it's not doing anything nefarious. But it's not really always the case as we see over and over and over. So this story is a good reminder to not have absolute faith in browser extension stores and that they need to step up their game in terms of being transparent about what each extension actually does on your system. Browsers are also moving in a positive direction in this way because browsers are developing extension systems that uh reduce the amount of permissions and things extensions can do which does have some benefits to security. And of course this isn't an issue just for extensions. Uh this is a good reminder that you need
10:45 to really watch your digital hygiene everywhere. These issues I'm talking about plague apps on the app store. There are third party SDKs that essentially just are there to track your data, share it with data brokers and that's purchased by either governments or private companies and that's all through just kind of whatever apps that you wouldn't think twice about using also programs in your computer and really everything else you do on your systems. So I really want all of you to treat this incident as a reminder to audit everything on your devices, remove things you don't need and really see if you have trustworthy solutions in place for the rest of it. Now, I want to take a minute to address the ethical questions because this is something that I think everybody should reflect on. I don't have answers, but as a content creator and somebody who publishes to the internet and does make money off of this, um, it's a really tough place to
11:33 be in because Templar makes money off of YouTube advertising. Not a huge amount, but some of the money that we make comes from YouTube advertising. But also uh we make money from the community, we make money from sponsors, we make money from affiliates and uh we have this really diverse source of income. But if you're a developer, it's you know of an extension. It's really hard to have that kind of diversity and all these different revenue models that hold each other accountable and also ensure that you're not over prioritizing just one thing over all the others. Maybe Melo has a point. They are trying to build an alternative to the you know traditional surveillance system. At minimum, it's open source. They try to be more privacy respecting. Um, and they're trying to essentially create a new revenue revenue model for developers. And that mission
12:18 in itself is a noble one. What's worth asking though is is that the correct one? And really, what is the best long-term sustainable solution for situations like this? How are we going to allow developers to grow and be sustainable and build the cool stuff that we enjoy using while making sure they still get food on their plates? This whole story has really introduced a lot of questions for me and I don't have that many answers but I think it's really worth all of us reflecting on um what this means for the digital landscape and I would love to hear your comments. So like please it's not just like a engagement thing like no please leave your comments down below. I'd love to read them and kind of get some third party perspectives on this. Check your extensions right now. Share this with friends or family cuz a lot of people don't know that extensions do this stuff. And of course join our community for more security updates. Uh we have a
13:04 good forum. It's open source and it's all down in the description. And uh I also want to thank redact.dev for sponsoring our content and making this stuff possible. Thank you all for watching and I'll see you next time on Techlorore. Stay safe out there.
