Link to the list is the last word on the page...
post
Yeah the link to affected extensions (245 across 3 platforms)
This is why I cringe when people recommend random ass addons to do random shit. Better to just literally stick to ublock origin and maybe 1 other. I really don't trust most extensions.
This is fucked up. Dark Reader?
Thankfully it seems that this is only for Dark Reader on Edge (not Firefox or Chrome).
Still worrying to see them integrate this fraudulent service.
I think that this may be some duplicate extension trying to generate and take advantage of user confusion between the real Dark Reader extension for Edge and this one.
Real Dark Reader:
https://microsoftedge.microsoft.com/addons/detail/dark-reader/ifoakfbpdcdoeenechcleahebpibofpc
What appears to be the copycat with the malware:
I suppose that that potential to impersonate addons is also a security concern, though.
Thanks for the clarification!
The web is unusable without Dark Reader and uBlock Origin.
The firefox list is pretty much entirely overly specific youtube tweaks (that you should be using uBlock or a more fully featured Youtube extension for), "games in sidebar", and custom cursors. Bonzi buddy and toolbars, anyone?
Seriously, an NES emulator? As a browser addon? That needs permission to access "your data on all websites"?
Who in the hell would use a volume booster extension? Just turn your volume up? Wut.
This kind of extension is used when your device's output sucks and "cranking it to 140%" is the only way to make it audible (usually mangling the quality). Possibly used by hard-of-hearing users too. Or maybe they're stuck on monitor speakers and "just pay $15 for cheapo cans" isn't an option, and the monitor's OSD controls are clunky and awful (they always are).
I've used "volume booster" features in apps before when listening to badly mixed podcasts/audiobooks, because turning up the system volume on a phone makes other apps too loud. I could see a desktop situation that mirrors this for someone, a setting in FF is faster/easier than the windows volume mixer.
You can check if you have an affected extension installed by going to the mellowtel settings page, where you can configure mellowtel if its installed (or get a message that you don't run mellowtel): https://www.mellow.tel/user-control
Still sounds gross. While the developer might have opted in to selling your processing power to scrape websites, I doubt the users of each extension opted in.
I use the inbuild Dark Mode in Vivaldi (on/off with shortcut, wors even in intern pages and menus) and none of the extensions from the list, most extensions from the Store anyway are redundant in Vivaldi translation, reader mode, tabs, feeds, ad/tracker blocker..........)
-
I'll save everybody a click because it's what we all want to know. "Dog Facts Unlimited" extension is on the list.
Dark Reader is on the list :(
It's disheartening seeing screen readers on this list. That seems predatory.
Definitely read the original SecureAnnex article as well. The behavior of this software and the people behind it are damning.
I used Youtube unhook in the past but before the AI craze so I'm probably good.
I know a lot of people use Dark Reader so that's gotta hurt.
Other than that I think I'm safe.
I see Dark Reader for Edge but not Firefox. Are they the same extension?
This is from Mozilla
Dark Reader doesn't show ads and doesn't send user's data anywhere. It is fully open-source https://github.com/darkreader/darkreader
They seem to all link back to the same github page.
https://github.com/darkreader/darkreader
Edit: not the same one as on the list
a lot of these seem to be accessibility extensions.
how nice, preying on the disabled
The common thread among all of them: They incorporate MellowTel-js, an open source JavaScript library that allows developers to monetize their extensions.
This is why im extremely careful using browser extensions. The access they have is pretty wide as far as software goes these days. So many people install malicious ones without thinking.
Dark Reader for edge is on here but the Firefox one isn't listed so I'm good there i guess? Super sad i had to uninstall my cat fact extensions. It was nice to have instant access to cat facts in the menu bar.
You can check if you have an affected extension installed by going to the mellowtel settings page, where you can configure mellowtel if its installed (or get a message that you don't run mellowtel): https://www.mellow.tel/user-control
This is confirmed btw. I was just fired from a company who hired a new vp who worked in ad tech. Part of the gig was scraping. But how do they get around Ip blocks and so many guardrails?
Easy. They started a sister business that had an extension they gave away for free, some menial task like taking a screenshot or something to dupe people into getting it
And in the piles of ToS it gave the extension the legal ability to grab random websites, scrape them, and send the data home. Now you have a internet wide scraper platform, and best parts is that you can't be up blocked and even better, you aren't paying for compute.
all 2 comments