Threat Research Team identified a cross-store browser extension, “Twitch Enhanced Viewer | JeetBot,” that forwards each user’s live Twitch OAuth session token to proxy servers operated by a Russian commercial bot service. The extension ships on both the Chrome Web Store (extension ID pnhhdhhcadcjfckjhpmjneldiegbojfb, 30,000 users) and Firefox Add-ons (twitchenhancedviewer@example.com, 552 users). Both listings are live at time of writing.

no comments (yet)

sorted by: hot top controversial new old
there doesn't seem to be anything here
25 comments in c/technology@lemmy.world view that post
[–] 51 points 1 month ago

I am shocked. Shocked, I say!

Well not that shocked.

  • source
  • [–] 26 points 1 month ago
    [–] 36 points 1 month ago (2 children)

    Damn, now the Russians know what vtubers I've been gooning to.

  • source
  • hideshow 2 child comments
  • [–] 3 points 1 month ago

    Realistically those oath tokens get sold to scrapers and bots. The suspicious activity goes on your account and you can get an account ban

    (don’t know if that bans you from Amazon, but if we were all banned from Amazon, that would be better for the world).

  • source
  • parent
  • [–] 14 points 1 month ago (3 children)

    There is a script you can find that autoblocks twitch ads if you set it up properly. It’s popular but, I forgot it, it uses Ublock origin.

  • source
  • hideshow 3 child comments
  • [–] 21 points 1 month ago (2 children)

    Twitch Adblock Solutions on github? Developer rage quit in disgust of Amazon and archived the repo.

    This is the current darling extension to use:

    https://github.com/GosuDRM/TTV-AB

    It'll use the standard definition preview stream until the ads stop playing, then switch to the regular stream.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 13 points 1 month ago (3 children)

    Twitch ad blocker

    Does uBlock do a bad job?

  • source
  • hideshow 3 child comments
  • [–] 18 points 1 month ago

    For Twitch it does, they inline the video ads with the stream, uBlock can't do anything about that, and if you have a blocker that does work Twitch just infinitely refreshes the stream trying to force the video ad.

  • source
  • parent
  • [–] 5 points 1 month ago

    Probably how they fuel their viewbot operations.

  • source
  • [–] 1 point 1 month ago (10 children)

    Just wanted to say that's a great little pixel art graphic for the story. I'm confident it's not ai, because i like it.

  • source
  • hideshow 10 child comments
  • [–] 3 points 1 month ago* (last edited 1 month ago) (4 children)

    Sorry but I really think it's AI. The only time I played around with AI of any kind was to see how it'd handle pixelart and it looked very similar to this. It's good at a very quick glance but quickly falls apart (like a lot of AI things) as soon as you actually look at it.

    I don't see how a human could mess it up that oddly and badly. It would take more effort to make it this bad than just make actual pixel art, there are so many small things that make no sense as errors or sloppy/lazy human art.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 1 point 1 month ago (3 children)

    What's wrong and bad about it, in your opinion? I'm no pixel art expert, but it sounds like you may be?

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 1 month ago (2 children)

    I can’t speak to the pixel are but the website itself also looks ai generated (as in the design not necessarily the writing). Also its homepage advertises its services as ai powered.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 1 month ago (1 child)

    Yeah, I had a peek too. It might be ai, but I haven't seen any actual evidence of it - they use this pixel art style on a lot of their posts and it seems consistently decent.

    Looking at their company photo they're very well funded and also have a team of like 60 people, so there's no reason they couldn't have an in-house graphics artist or a freelancer they contract. Or it could be ai.

    But in times where every modern graphics artists is being accused of being AI, I'm inclined to assume not rather than assume it is, without evidence to the contrary.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 1 month ago (3 children)

    This should not even be in a pixel art

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 1 month ago (2 children)

    Uhh.. Its the icon for a browser plugin.. To illustrate that it was a Twitch browser plugin.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 1 month ago (1 child)

    Yeah but you see, it's a pixel art, it should not be there and should be bigger, to match the pixel grid, this image has a ton of pixel not matching a grid and mixel (mixel can be an artistic choice but here they were clearly abused, i can give it the benefit of the doubt but that icon is too sus...)

  • source
  • parent
  • hideshow 1 child comment
  • 11 comments in c/privacy@lemmy.dbzer0.com view that post

    A Google vetted source allowing code that compromises the end user? That's simply not possible. The developer had to provide an ID to publish the code. It MUST be safe! /s

  • source
  • [–] 19 points 1 month ago (9 children)

    And that's why you only use open-source addons if possible - less risk of this issue

  • source
  • hideshow 9 child comments
  • [–] [S] 1 point 1 month ago (8 children)

    There are closed sourced web browser addons‽
    I swear all Manifest V3 & XPI are source readable.
    Though Russian is a req..

  • source
  • parent
  • hideshow 8 child comments
  • [–] 6 points 1 month ago (7 children)

    Also, not sure how readable is a compressed, obfuscated source code on release.

  • source
  • parent
  • hideshow 7 child comments
  • [+] [S] -9 points 1 month ago (6 children)

    nah, I earnest believe every person ðt installd ↓ just didn't boðer readŋ éðr code. Decompression is somθŋ every1 does. Ur internet connection can't work wo/it. I haven't botherd checkŋ if it has obfuscation.

  • source
  • parent
  • hideshow 6 child comments
  • [–] 6 points 1 month ago (5 children)

    Mate what is this language
    I’ve made a v2 extension for Firefox, you CAN have obfuscated code in an extension by compiling it. HOWEVER, Mozilla requires you to submit the source code for any compiled/obfuscated code. Google has no reason not to catch it.
    Compressed XPI packages can still be read afaik, they’re just JavaScript, CSS and HTML files at the end of the day.

  • source
  • parent
  • hideshow 5 child comments
  • [–] [S] -1 points 1 month ago (4 children)

    Google has no reason not to catch it.

    Apparently lying on threadiverse is also a requirement, seeing as you have no problems with it. JeetBot made no attempt to obfuscate their credential requiring addon, for other API means than to do both.

    This was “Я верю в это.” No afterthought, no review.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 3 points 1 month ago (3 children)

    Apologies, but I do not understand the argument you’re trying to make nor the part in my comment where I lied.

  • source
  • parent
  • hideshow 3 child comments
  • [–] [S] 1 point 1 month ago (2 children)

    After Google created v3 manifests, all chrome addons MUST be readable. It's simply JS, HTML, & JSON in a ZIP.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 1 month ago (1 child)

    I did not mention Google not having this measure (nor was I aware of it), I only stated what I knew. And this only proves my argument further anyway: Google has no reason not to catch it. (“it” being the malicious extension)
    There were no lies in my comment but you jumped the gun, accused me of lying and were rude about it too.

    Calling out misinformation is good, just please be politer.

  • source
  • parent
  • hideshow 1 child comment
  • [–] [S] 1 point 1 month ago

    Politeness is a ladder. The extension isn't still malicious: it does what it says. It just the tradeoff is getting your API credentials stolen. Calling twitchenhancedviewer “obfuscated” is pure disinformation, as we can both see both codes, Firefox's & Chrome’s.

  • source
  • parent