User:Basicotter1919 - Revision history

AnotherConsumerRightsPerson: Oh, this was for a section that you already copypasted over anyway🤦

2026-04-25T05:21:45Z

Oh, this was for a section that you already copypasted over anyway🤦

← Older revision		Revision as of 05:21, 25 April 2026
Line 10:		Line 10:

	In a statement responding to contact by Kate O'Flaherty, a cybersecurity and privacy journalist, a Google spokesperson says: "We want Chrome extensions to be safe and privacy-preserving, and detecting policy violations is essential to that effort."<ref>{{Cite web \|last=O'Flaherty \|first=Kate \|date=2019-07-19 \|title=Data Leak Warning Issued To Millions Of Google Chrome And Firefox Users \|url=https://www.forbes.com/sites/kateoflahertyuk/2019/07/19/data-leak-warning-issued-to-millions-of-google-chrome-and-firefox-users/ \|url-status=live \|access-date=2025-11-22 \|website=Forbes}}</ref> The spokesperson went on to mention, referring to Manifest V3, changes to extensions that "will mitigate or prevent this behavior," and "new policies that improve user privacy." Sam Jadali disagreed that Manifest V3 would make any meaningful change. <ref name=":1">{{Cite web \|last=Miagkov \|first=Alexei \|last2=Gillula \|first2=Jeremy \|last3=Cyphers \|first3=Bennett \|date=2019-07-31 \|title=Google’s Plans for Chrome Extensions Won’t Really Help Security \|url=https://www.eff.org/deeplinks/2019/07/googles-plans-chrome-extensions-wont-really-help-security \|url-status=live \|access-date=2025-11-22 \|website=EFF}}</ref> This is because Manifest V3 doesn't make changes to how "content scripts" work, or how extensions are allowed to observe data.<ref name=":1" /> According to the EFF, "The only part of Manifest V3 that goes directly to the heart of stopping DataSpii-like abuses is banning remotely hosted code."<ref name=":1" />		In a statement responding to contact by Kate O'Flaherty, a cybersecurity and privacy journalist, a Google spokesperson says: "We want Chrome extensions to be safe and privacy-preserving, and detecting policy violations is essential to that effort."<ref>{{Cite web \|last=O'Flaherty \|first=Kate \|date=2019-07-19 \|title=Data Leak Warning Issued To Millions Of Google Chrome And Firefox Users \|url=https://www.forbes.com/sites/kateoflahertyuk/2019/07/19/data-leak-warning-issued-to-millions-of-google-chrome-and-firefox-users/ \|url-status=live \|access-date=2025-11-22 \|website=Forbes}}</ref> The spokesperson went on to mention, referring to Manifest V3, changes to extensions that "will mitigate or prevent this behavior," and "new policies that improve user privacy." Sam Jadali disagreed that Manifest V3 would make any meaningful change. <ref name=":1">{{Cite web \|last=Miagkov \|first=Alexei \|last2=Gillula \|first2=Jeremy \|last3=Cyphers \|first3=Bennett \|date=2019-07-31 \|title=Google’s Plans for Chrome Extensions Won’t Really Help Security \|url=https://www.eff.org/deeplinks/2019/07/googles-plans-chrome-extensions-wont-really-help-security \|url-status=live \|access-date=2025-11-22 \|website=EFF}}</ref> This is because Manifest V3 doesn't make changes to how "content scripts" work, or how extensions are allowed to observe data.<ref name=":1" /> According to the EFF, "The only part of Manifest V3 that goes directly to the heart of stopping DataSpii-like abuses is banning remotely hosted code."<ref name=":1" />

	~~==References==~~
	<references />		<references />

AnotherConsumerRightsPerson: Just a little bit of help, if you don't mind - references are meant to go in their own section

2026-04-25T05:20:17Z

Just a little bit of help, if you don't mind - references are meant to go in their own section

← Older revision		Revision as of 05:20, 25 April 2026
Line 10:		Line 10:

	In a statement responding to contact by Kate O'Flaherty, a cybersecurity and privacy journalist, a Google spokesperson says: "We want Chrome extensions to be safe and privacy-preserving, and detecting policy violations is essential to that effort."<ref>{{Cite web \|last=O'Flaherty \|first=Kate \|date=2019-07-19 \|title=Data Leak Warning Issued To Millions Of Google Chrome And Firefox Users \|url=https://www.forbes.com/sites/kateoflahertyuk/2019/07/19/data-leak-warning-issued-to-millions-of-google-chrome-and-firefox-users/ \|url-status=live \|access-date=2025-11-22 \|website=Forbes}}</ref> The spokesperson went on to mention, referring to Manifest V3, changes to extensions that "will mitigate or prevent this behavior," and "new policies that improve user privacy." Sam Jadali disagreed that Manifest V3 would make any meaningful change. <ref name=":1">{{Cite web \|last=Miagkov \|first=Alexei \|last2=Gillula \|first2=Jeremy \|last3=Cyphers \|first3=Bennett \|date=2019-07-31 \|title=Google’s Plans for Chrome Extensions Won’t Really Help Security \|url=https://www.eff.org/deeplinks/2019/07/googles-plans-chrome-extensions-wont-really-help-security \|url-status=live \|access-date=2025-11-22 \|website=EFF}}</ref> This is because Manifest V3 doesn't make changes to how "content scripts" work, or how extensions are allowed to observe data.<ref name=":1" /> According to the EFF, "The only part of Manifest V3 that goes directly to the heart of stopping DataSpii-like abuses is banning remotely hosted code."<ref name=":1" />		In a statement responding to contact by Kate O'Flaherty, a cybersecurity and privacy journalist, a Google spokesperson says: "We want Chrome extensions to be safe and privacy-preserving, and detecting policy violations is essential to that effort."<ref>{{Cite web \|last=O'Flaherty \|first=Kate \|date=2019-07-19 \|title=Data Leak Warning Issued To Millions Of Google Chrome And Firefox Users \|url=https://www.forbes.com/sites/kateoflahertyuk/2019/07/19/data-leak-warning-issued-to-millions-of-google-chrome-and-firefox-users/ \|url-status=live \|access-date=2025-11-22 \|website=Forbes}}</ref> The spokesperson went on to mention, referring to Manifest V3, changes to extensions that "will mitigate or prevent this behavior," and "new policies that improve user privacy." Sam Jadali disagreed that Manifest V3 would make any meaningful change. <ref name=":1">{{Cite web \|last=Miagkov \|first=Alexei \|last2=Gillula \|first2=Jeremy \|last3=Cyphers \|first3=Bennett \|date=2019-07-31 \|title=Google’s Plans for Chrome Extensions Won’t Really Help Security \|url=https://www.eff.org/deeplinks/2019/07/googles-plans-chrome-extensions-wont-really-help-security \|url-status=live \|access-date=2025-11-22 \|website=EFF}}</ref> This is because Manifest V3 doesn't make changes to how "content scripts" work, or how extensions are allowed to observe data.<ref name=":1" /> According to the EFF, "The only part of Manifest V3 that goes directly to the heart of stopping DataSpii-like abuses is banning remotely hosted code."<ref name=":1" />

			==References==
	<references />		<references />

Basicotter1919 at 04:36, 25 April 2026

2026-04-25T04:36:31Z

← Older revision		Revision as of 04:36, 25 April 2026
Line 9:		Line 9:
	In February 2019<ref name=":0">{{Cite web \|last=Goodin \|first=Dan \|date=2019-07-18 \|title=My browser, the spy: How extensions slurped up browsing histories from 4M users \|url=https://arstechnica.com/information-technology/2019/07/dataspii-inside-the-debacle-that-dished-private-data-from-apple-tesla-blue-origin-and-4m-people/ \|url-status=live \|website=Ars Technica}}</ref>, Sam Jadali begins investigating suspicious browser extensions and the developers behind them. Over time he would find eight browser extensions, primarily for Chromium-based browsers, to be collecting sensitive data from unsuspecting users, which would then be sold for profit.<ref>{{Cite web \|title=DataSpii \|url=https://dataspii.com/ \|url-status=live \|website=dataspii.com}}</ref> This would compromise the private data of as many as 4 million Chrome and Firefox users. Also impacted were companies such as Bank of America, AT&T, and even the Pentagon.<ref>{{Cite web \|last=Jadali \|first=Sam \|date=2019-12-05 \|title=Tweet by Sam Jadali \|url=https://x.com/sam_jadali/status/1202691665451864064 \|website=X}}</ref> Each extension, as he reported them for their suspicious activity, would be removed from the Chrome Web store. However data collection '''continued for months after this'''. It's only in early July, when Google remotely disabled the extensions, that the data collection finally stopped.<ref name=":0" /> Though the disabled extensions had a notice saying, "This extension violates the Chrome Web Store policy.", the notice said nothing of the data collection or the selling of said data. At the same time the extensions could be forcibly re-enabled.<ref name=":0" />		In February 2019<ref name=":0">{{Cite web \|last=Goodin \|first=Dan \|date=2019-07-18 \|title=My browser, the spy: How extensions slurped up browsing histories from 4M users \|url=https://arstechnica.com/information-technology/2019/07/dataspii-inside-the-debacle-that-dished-private-data-from-apple-tesla-blue-origin-and-4m-people/ \|url-status=live \|website=Ars Technica}}</ref>, Sam Jadali begins investigating suspicious browser extensions and the developers behind them. Over time he would find eight browser extensions, primarily for Chromium-based browsers, to be collecting sensitive data from unsuspecting users, which would then be sold for profit.<ref>{{Cite web \|title=DataSpii \|url=https://dataspii.com/ \|url-status=live \|website=dataspii.com}}</ref> This would compromise the private data of as many as 4 million Chrome and Firefox users. Also impacted were companies such as Bank of America, AT&T, and even the Pentagon.<ref>{{Cite web \|last=Jadali \|first=Sam \|date=2019-12-05 \|title=Tweet by Sam Jadali \|url=https://x.com/sam_jadali/status/1202691665451864064 \|website=X}}</ref> Each extension, as he reported them for their suspicious activity, would be removed from the Chrome Web store. However data collection '''continued for months after this'''. It's only in early July, when Google remotely disabled the extensions, that the data collection finally stopped.<ref name=":0" /> Though the disabled extensions had a notice saying, "This extension violates the Chrome Web Store policy.", the notice said nothing of the data collection or the selling of said data. At the same time the extensions could be forcibly re-enabled.<ref name=":0" />

	In a statement responding to contact by Kate O'Flaherty, a cybersecurity and privacy journalist, a Google spokesperson says: "We want Chrome extensions to be safe and privacy-preserving, and detecting policy violations is essential to that effort."<ref>{{Cite web \|last=O'Flaherty \|first=Kate \|date=2019-07-19 \|title=Data Leak Warning Issued To Millions Of Google Chrome And Firefox Users \|url=https://www.forbes.com/sites/kateoflahertyuk/2019/07/19/data-leak-warning-issued-to-millions-of-google-chrome-and-firefox-users/ \|url-status=live \|access-date=2025-11-22 \|website=Forbes}}</ref> The spokesperson went on to mention, referring to Manifest V3, changes to extensions that "will mitigate or prevent this behavior," and "new policies that improve user privacy." Sam Jadali disagreed that Manifest V3 would make any meaningful change. <ref name=":1">{{Cite web \|last=Miagkov \|first=Alexei \|last2=Gillula \|first2=Jeremy \|last3=Cyphers \|first3=Bennett \|date=2019-07-31 \|title=Google’s Plans for Chrome Extensions Won’t Really Help Security \|url=https://www.eff.org/deeplinks/2019/07/googles-plans-chrome-extensions-wont-really-help-security \|url-status=live \|access-date=2025-11-22 \|website=EFF}}</ref> This is because Manifest V3 doesn't make changes to how "content scripts" work, or how extensions are allowed to observe data. According to the EFF, "The only part of Manifest V3 that goes directly to the heart of stopping DataSpii-like abuses is banning remotely hosted code."<ref name=":1" />		In a statement responding to contact by Kate O'Flaherty, a cybersecurity and privacy journalist, a Google spokesperson says: "We want Chrome extensions to be safe and privacy-preserving, and detecting policy violations is essential to that effort."<ref>{{Cite web \|last=O'Flaherty \|first=Kate \|date=2019-07-19 \|title=Data Leak Warning Issued To Millions Of Google Chrome And Firefox Users \|url=https://www.forbes.com/sites/kateoflahertyuk/2019/07/19/data-leak-warning-issued-to-millions-of-google-chrome-and-firefox-users/ \|url-status=live \|access-date=2025-11-22 \|website=Forbes}}</ref> The spokesperson went on to mention, referring to Manifest V3, changes to extensions that "will mitigate or prevent this behavior," and "new policies that improve user privacy." Sam Jadali disagreed that Manifest V3 would make any meaningful change. <ref name=":1">{{Cite web \|last=Miagkov \|first=Alexei \|last2=Gillula \|first2=Jeremy \|last3=Cyphers \|first3=Bennett \|date=2019-07-31 \|title=Google’s Plans for Chrome Extensions Won’t Really Help Security \|url=https://www.eff.org/deeplinks/2019/07/googles-plans-chrome-extensions-wont-really-help-security \|url-status=live \|access-date=2025-11-22 \|website=EFF}}</ref> This is because Manifest V3 doesn't make changes to how "content scripts" work, or how extensions are allowed to observe data.<ref name=":1" /> According to the EFF, "The only part of Manifest V3 that goes directly to the heart of stopping DataSpii-like abuses is banning remotely hosted code."<ref name=":1" />
	<references />		<references />

Basicotter1919 at 04:26, 25 April 2026

2026-04-25T04:26:01Z

← Older revision		Revision as of 04:26, 25 April 2026
Line 4:		Line 4:

	====Early disapproval by developers====		====Early disapproval by developers====
	Almost as soon as a design draft for Manifest V3 was made public, on November 9th 2018, developers disapproved of the changes proposed by it, including the developers of privacy and security-focused tools such as NoScript, AdGuard, uMatrix, and uBlock Origin.<ref>{{Cite web \|date=2018-10-18 \|title=Extensions: Implement Manifest V3 \|url=https://issues.chromium.org/issues/40598795 \|url-status=live \|website=issues.chromium.org}}</ref> On January 22, 2019, in response to the design draft, the developer for uBlock Origin and uMatrix would go on to write, "if this [...] API ends up being the only way content blockers can accomplish their duty, this essentially means that content blockers I have maintained for years, uBlock Origin ("uBO") and uMatrix, can no longer exist." And also, "[...] deprecating the blocking ability of the [...] API will essentially decrease the level of user agency in Chromium, to the benefit of web sites which obviously would be happy to have the last word in what resources their page can fetch/execute/render."<ref>{{Cite web \|date=2019-01-22 \|title=Extensions: Implement Manifest V3, comment #24 \|url=https://issues.chromium.org/issues/40598795#comment24 \|website=issues.chromium.org}}</ref> A developer for AdGuard would second his points. ~~In response, a~~ Chromium developer did not immediately answer these points, but instead directed the discussion to take place over ~~email~~ rather than the bug tracker.<ref>{{Cite web \|date=2019-01-22 \|title=Extensions: Implement Manifest V3, comment #34 \|url=https://issues.chromium.org/issues/40598795#comment24 \|url-status=live \|website=issues.chromium.org}}</ref>		Almost as soon as a design draft for Manifest V3 was made public, on November 9th 2018, developers disapproved of the changes proposed by it, including the developers of privacy and security-focused tools such as NoScript, AdGuard, uMatrix, and uBlock Origin.<ref>{{Cite web \|date=2018-10-18 \|title=Extensions: Implement Manifest V3 \|url=https://issues.chromium.org/issues/40598795 \|url-status=live \|website=issues.chromium.org}}</ref> On January 22, 2019, in response to the design draft, the developer for uBlock Origin and uMatrix would go on to write, "if this (quite limited) [...] API ends up being the only way content blockers can accomplish their duty, this essentially means that content blockers I have maintained for years, uBlock Origin ("uBO") and uMatrix, can no longer exist." And also, "[...] deprecating the blocking ability of the [...] API will essentially decrease the level of user agency in Chromium, to the benefit of web sites which obviously would be happy to have the last word in what resources their page can fetch/execute/render."<ref>{{Cite web \|date=2019-01-22 \|title=Extensions: Implement Manifest V3, comment #24 \|url=https://issues.chromium.org/issues/40598795#comment24 \|website=issues.chromium.org}}</ref> A developer for AdGuard would second his points. A Chromium developer did not immediately answer these points, but instead directed the discussion to take place over private emails rather than the bug tracker.<ref>{{Cite web \|date=2019-01-22 \|title=Extensions: Implement Manifest V3, comment #34 \|url=https://issues.chromium.org/issues/40598795#comment24 \|url-status=live \|website=issues.chromium.org}}</ref>

	====Dataspii====		====Dataspii====

Basicotter1919: /* Dataspii */

2026-04-25T04:21:32Z

Dataspii

← Older revision		Revision as of 04:21, 25 April 2026
Line 4:		Line 4:

	====Early disapproval by developers====		====Early disapproval by developers====
	Almost as soon as a design draft for Manifest V3 was made public, on November 9th, developers disapproved of the changes proposed by it, including the developers of privacy and security-focused tools such as NoScript, AdGuard, uMatrix, and uBlock Origin.<ref>{{Cite web \|date=2018-10-18 \|title=Extensions: Implement Manifest V3 \|url=https://issues.chromium.org/issues/40598795 \|url-status=live \|website=issues.chromium.org}}</ref> On January 22, 2019, in response to the design draft, the developer for uBlock Origin and uMatrix would go on to write, "if this [...] API ends up being the only way content blockers can accomplish their duty, this essentially means that content blockers I have maintained for years, uBlock Origin ("uBO") and uMatrix, can no longer exist." And also, "[...] deprecating the blocking ability of the [...] API will essentially decrease the level of user agency in Chromium, to the benefit of web sites which obviously would be happy to have the last word in what resources their page can fetch/execute/render."<ref>{{Cite web \|date=2019-01-22 \|title=Extensions: Implement Manifest V3, comment #24 \|url=https://issues.chromium.org/issues/40598795#comment24 \|website=issues.chromium.org}}</ref> A developer for AdGuard would second his points. In response, a Chromium developer did not immediately answer these points, but instead directed the discussion to take place over email rather than the bug tracker.<ref>{{Cite web \|date=2019-01-22 \|title=Extensions: Implement Manifest V3, comment #34 \|url=https://issues.chromium.org/issues/40598795#comment24 \|url-status=live \|website=issues.chromium.org}}</ref>		Almost as soon as a design draft for Manifest V3 was made public, on November 9th 2018, developers disapproved of the changes proposed by it, including the developers of privacy and security-focused tools such as NoScript, AdGuard, uMatrix, and uBlock Origin.<ref>{{Cite web \|date=2018-10-18 \|title=Extensions: Implement Manifest V3 \|url=https://issues.chromium.org/issues/40598795 \|url-status=live \|website=issues.chromium.org}}</ref> On January 22, 2019, in response to the design draft, the developer for uBlock Origin and uMatrix would go on to write, "if this [...] API ends up being the only way content blockers can accomplish their duty, this essentially means that content blockers I have maintained for years, uBlock Origin ("uBO") and uMatrix, can no longer exist." And also, "[...] deprecating the blocking ability of the [...] API will essentially decrease the level of user agency in Chromium, to the benefit of web sites which obviously would be happy to have the last word in what resources their page can fetch/execute/render."<ref>{{Cite web \|date=2019-01-22 \|title=Extensions: Implement Manifest V3, comment #24 \|url=https://issues.chromium.org/issues/40598795#comment24 \|website=issues.chromium.org}}</ref> A developer for AdGuard would second his points. In response, a Chromium developer did not immediately answer these points, but instead directed the discussion to take place over email rather than the bug tracker.<ref>{{Cite web \|date=2019-01-22 \|title=Extensions: Implement Manifest V3, comment #34 \|url=https://issues.chromium.org/issues/40598795#comment24 \|url-status=live \|website=issues.chromium.org}}</ref>

	====Dataspii====		====Dataspii====

Basicotter1919 at 02:06, 23 November 2025

2025-11-23T02:06:00Z

← Older revision		Revision as of 02:06, 23 November 2025
Line 3:		Line 3:
	Manifest V3 is an update to the manifest structure used by browser extensions across the majority of the browser market. It was first mentioned on October 1st 2018 in a Chromium blog post<ref>{{Cite web \|last=Wagner \|first=James \|date=2018-10-01 \|title=Trustworthy Chrome Extensions, by default \|url=https://blog.chromium.org/2018/10/trustworthy-chrome-extensions-by-default.html \|url-status=live \|website=Chromium Blog}}</ref>, saying it's aim was "to create stronger security, privacy, and performance guarantees". In the same blog post, Wagner wrote "We want to help all developers fall into the pit of success; writing a secure and performant extension in Manifest v3 should be easy, while writing an insecure or non-performant extension should be difficult."		Manifest V3 is an update to the manifest structure used by browser extensions across the majority of the browser market. It was first mentioned on October 1st 2018 in a Chromium blog post<ref>{{Cite web \|last=Wagner \|first=James \|date=2018-10-01 \|title=Trustworthy Chrome Extensions, by default \|url=https://blog.chromium.org/2018/10/trustworthy-chrome-extensions-by-default.html \|url-status=live \|website=Chromium Blog}}</ref>, saying it's aim was "to create stronger security, privacy, and performance guarantees". In the same blog post, Wagner wrote "We want to help all developers fall into the pit of success; writing a secure and performant extension in Manifest v3 should be easy, while writing an insecure or non-performant extension should be difficult."

	==== Early disapproval by developers ====		====Early disapproval by developers====
	Almost as soon as a design draft for Manifest V3 was made public, on November 9th, developers disapproved of the changes proposed by it, including the developers of privacy and security-focused tools such as NoScript, AdGuard, uMatrix, and uBlock Origin.<ref>{{Cite web \|date=2018-10-18 \|title=Extensions: Implement Manifest V3 \|url=https://issues.chromium.org/issues/40598795 \|url-status=live \|website=issues.chromium.org}}</ref> On January 22, 2019, in response to the design draft, the developer for uBlock Origin and uMatrix would go on to write, "if this [...] API ends up being the only way content blockers can accomplish their duty, this essentially means that content blockers I have maintained for years, uBlock Origin ("uBO") and uMatrix, can no longer exist." And also, "[...] deprecating the blocking ability of the [...] API will essentially decrease the level of user agency in Chromium, to the benefit of web sites which obviously would be happy to have the last word in what resources their page can fetch/execute/render."<ref>{{Cite web \|date=2019-01-22 \|title=Extensions: Implement Manifest V3, comment #24 \|url=https://issues.chromium.org/issues/40598795#comment24 \|website=issues.chromium.org}}</ref> A developer for AdGuard would second his points. A Chromium developer did not immediately answer these points, but instead directed the discussion to take place over email rather than the bug tracker.<ref>{{Cite web \|date=2019-01-22 \|title=Extensions: Implement Manifest V3, comment #34 \|url=https://issues.chromium.org/issues/40598795#comment24 \|url-status=live \|website=issues.chromium.org}}</ref>		Almost as soon as a design draft for Manifest V3 was made public, on November 9th, developers disapproved of the changes proposed by it, including the developers of privacy and security-focused tools such as NoScript, AdGuard, uMatrix, and uBlock Origin.<ref>{{Cite web \|date=2018-10-18 \|title=Extensions: Implement Manifest V3 \|url=https://issues.chromium.org/issues/40598795 \|url-status=live \|website=issues.chromium.org}}</ref> On January 22, 2019, in response to the design draft, the developer for uBlock Origin and uMatrix would go on to write, "if this [...] API ends up being the only way content blockers can accomplish their duty, this essentially means that content blockers I have maintained for years, uBlock Origin ("uBO") and uMatrix, can no longer exist." And also, "[...] deprecating the blocking ability of the [...] API will essentially decrease the level of user agency in Chromium, to the benefit of web sites which obviously would be happy to have the last word in what resources their page can fetch/execute/render."<ref>{{Cite web \|date=2019-01-22 \|title=Extensions: Implement Manifest V3, comment #24 \|url=https://issues.chromium.org/issues/40598795#comment24 \|website=issues.chromium.org}}</ref> A developer for AdGuard would second his points. In response, a Chromium developer did not immediately answer these points, but instead directed the discussion to take place over email rather than the bug tracker.<ref>{{Cite web \|date=2019-01-22 \|title=Extensions: Implement Manifest V3, comment #34 \|url=https://issues.chromium.org/issues/40598795#comment24 \|url-status=live \|website=issues.chromium.org}}</ref>

	==== Dataspii ====		====Dataspii====
	In February 2019<ref name=":0">{{Cite web \|last=Goodin \|first=Dan \|date=2019-07-18 \|title=My browser, the spy: How extensions slurped up browsing histories from 4M users \|url=https://arstechnica.com/information-technology/2019/07/dataspii-inside-the-debacle-that-dished-private-data-from-apple-tesla-blue-origin-and-4m-people/ \|url-status=live \|website=Ars Technica}}</ref>, Sam Jadali begins investigating suspicious browser extensions and the developers behind them. Over time he would find eight browser extensions, primarily for Chromium-based browsers, to be collecting sensitive data from unsuspecting users, which would then be sold for profit.<ref>{{Cite web \|title=DataSpii \|url=https://dataspii.com/ \|url-status=live \|website=dataspii.com}}</ref> This would compromise the private data of as many as 4 million Chrome and Firefox users. Also impacted were companies such as Bank of America, AT&T, and even the Pentagon.<ref>{{Cite web \|last=Jadali \|first=Sam \|date=2019-12-05 \|title=Tweet by Sam Jadali \|url=https://x.com/sam_jadali/status/1202691665451864064 \|website=X}}</ref> Each extension, as he reported them for their suspicious activity, would be removed from the Chrome Web store. However data collection '''continued for months after this'''. It's only in early July, when Google remotely disabled the extensions, that the data collection finally stopped.<ref name=":0" /> Though the disabled extensions had a notice saying, "This extension violates the Chrome Web Store policy.", the notice said nothing of the data collection or the selling of said data. At the same time the extensions could be forcibly re-enabled.<ref name=":0" />		In February 2019<ref name=":0">{{Cite web \|last=Goodin \|first=Dan \|date=2019-07-18 \|title=My browser, the spy: How extensions slurped up browsing histories from 4M users \|url=https://arstechnica.com/information-technology/2019/07/dataspii-inside-the-debacle-that-dished-private-data-from-apple-tesla-blue-origin-and-4m-people/ \|url-status=live \|website=Ars Technica}}</ref>, Sam Jadali begins investigating suspicious browser extensions and the developers behind them. Over time he would find eight browser extensions, primarily for Chromium-based browsers, to be collecting sensitive data from unsuspecting users, which would then be sold for profit.<ref>{{Cite web \|title=DataSpii \|url=https://dataspii.com/ \|url-status=live \|website=dataspii.com}}</ref> This would compromise the private data of as many as 4 million Chrome and Firefox users. Also impacted were companies such as Bank of America, AT&T, and even the Pentagon.<ref>{{Cite web \|last=Jadali \|first=Sam \|date=2019-12-05 \|title=Tweet by Sam Jadali \|url=https://x.com/sam_jadali/status/1202691665451864064 \|website=X}}</ref> Each extension, as he reported them for their suspicious activity, would be removed from the Chrome Web store. However data collection '''continued for months after this'''. It's only in early July, when Google remotely disabled the extensions, that the data collection finally stopped.<ref name=":0" /> Though the disabled extensions had a notice saying, "This extension violates the Chrome Web Store policy.", the notice said nothing of the data collection or the selling of said data. At the same time the extensions could be forcibly re-enabled.<ref name=":0" />

	In a statement responding to contact by Kate O'Flaherty, a cybersecurity and privacy journalist, a Google spokesperson says: "We want Chrome extensions to be safe and privacy-preserving, and detecting policy violations is essential to that effort."<ref>{{Cite web \|last=O'Flaherty \|first=Kate \|date=2019-07-19 \|title=Data Leak Warning Issued To Millions Of Google Chrome And Firefox Users \|url=https://www.forbes.com/sites/kateoflahertyuk/2019/07/19/data-leak-warning-issued-to-millions-of-google-chrome-and-firefox-users/ \|url-status=live \|access-date=2025-11-22 \|website=Forbes}}</ref> The spokesperson went on to mention, referring to Manifest V3, changes to extensions that "will mitigate or prevent this behavior," and "new policies that improve user privacy." Sam Jadali disagreed that Manifest V3 would make any meaningful change. <ref name=":1">{{Cite web \|last=Miagkov \|first=Alexei \|last2=Gillula \|first2=Jeremy \|last3=Cyphers \|first3=Bennett \|date=2019-07-31 \|title=Google’s Plans for Chrome Extensions Won’t Really Help Security \|url=https://www.eff.org/deeplinks/2019/07/googles-plans-chrome-extensions-wont-really-help-security \|url-status=live \|access-date=2025-11-22 \|website=EFF}}</ref> This is because Manifest V3 doesn't make changes to how "content scripts" work, or how extensions are allowed to observe data. According to the EFF, "The only part of Manifest V3 that goes directly to the heart of stopping DataSpii-like abuses is banning remotely hosted code."<ref name=":1" />		In a statement responding to contact by Kate O'Flaherty, a cybersecurity and privacy journalist, a Google spokesperson says: "We want Chrome extensions to be safe and privacy-preserving, and detecting policy violations is essential to that effort."<ref>{{Cite web \|last=O'Flaherty \|first=Kate \|date=2019-07-19 \|title=Data Leak Warning Issued To Millions Of Google Chrome And Firefox Users \|url=https://www.forbes.com/sites/kateoflahertyuk/2019/07/19/data-leak-warning-issued-to-millions-of-google-chrome-and-firefox-users/ \|url-status=live \|access-date=2025-11-22 \|website=Forbes}}</ref> The spokesperson went on to mention, referring to Manifest V3, changes to extensions that "will mitigate or prevent this behavior," and "new policies that improve user privacy." Sam Jadali disagreed that Manifest V3 would make any meaningful change. <ref name=":1">{{Cite web \|last=Miagkov \|first=Alexei \|last2=Gillula \|first2=Jeremy \|last3=Cyphers \|first3=Bennett \|date=2019-07-31 \|title=Google’s Plans for Chrome Extensions Won’t Really Help Security \|url=https://www.eff.org/deeplinks/2019/07/googles-plans-chrome-extensions-wont-really-help-security \|url-status=live \|access-date=2025-11-22 \|website=EFF}}</ref> This is because Manifest V3 doesn't make changes to how "content scripts" work, or how extensions are allowed to observe data. According to the EFF, "The only part of Manifest V3 that goes directly to the heart of stopping DataSpii-like abuses is banning remotely hosted code."<ref name=":1" />
	<references />		<references />

Basicotter1919: Dataspii section

2025-11-23T02:03:53Z

Dataspii section

← Older revision		Revision as of 02:03, 23 November 2025
Line 1:		Line 1:

	=== Manifest V3 (WIP rewrite) ===		===Manifest V3 (WIP rewrite)===
	Manifest V3 is an update to the manifest structure used by browser extensions across the majority of the browser market. It was first mentioned on October 1st 2018 in a Chromium blog post<ref>{{Cite web \|last=Wagner \|first=James \|date=2018-10-01 \|title=Trustworthy Chrome Extensions, by default \|url=https://blog.chromium.org/2018/10/trustworthy-chrome-extensions-by-default.html \|url-status=live \|website=Chromium Blog}}</ref>, saying it's aim was "to create stronger security, privacy, and performance guarantees". In the same blog post, Wagner wrote "We want to help all developers fall into the pit of success; writing a secure and performant extension in Manifest v3 should be easy, while writing an insecure or non-performant extension should be difficult."		Manifest V3 is an update to the manifest structure used by browser extensions across the majority of the browser market. It was first mentioned on October 1st 2018 in a Chromium blog post<ref>{{Cite web \|last=Wagner \|first=James \|date=2018-10-01 \|title=Trustworthy Chrome Extensions, by default \|url=https://blog.chromium.org/2018/10/trustworthy-chrome-extensions-by-default.html \|url-status=live \|website=Chromium Blog}}</ref>, saying it's aim was "to create stronger security, privacy, and performance guarantees". In the same blog post, Wagner wrote "We want to help all developers fall into the pit of success; writing a secure and performant extension in Manifest v3 should be easy, while writing an insecure or non-performant extension should be difficult."

	Almost as soon as a design draft for Manifest V3 was made public, on November 9th, developers disapproved of the changes proposed by it, including the developers of privacy and security-focused tools such as NoScript, AdGuard, uMatrix, and uBlock Origin.<ref>{{Cite web \|date=2018-10-18 \|title=Extensions: Implement Manifest V3 \|url=https://issues.chromium.org/issues/40598795 \|url-status=live \|website=issues.chromium.org}}</ref> On January 22, 2019, in response to the design draft, the developer for uBlock Origin and uMatrix would go on to write, "if this [...] API ends up being the only way content blockers can accomplish their duty, this essentially means that content blockers I have maintained for years, uBlock Origin ("uBO") and uMatrix, can no longer exist." And also, "[...] deprecating the blocking ability of the [...] API will essentially decrease the level of user agency in Chromium, to the benefit of web sites which obviously would be happy to have the last word in what resources their page can fetch/execute/render."<ref>{{Cite web \|date=2019-01-22 \|title=Extensions: Implement Manifest V3, comment #24 \|url=https://issues.chromium.org/issues/40598795#comment24 \|website=issues.chromium.org}}</ref> A developer for AdGuard would second his points. A Chromium developer did not immediately answer these points, but instead directed the discussion to take place over email rather than the bug tracker.<ref>{{Cite web \|date=2019-01-22 \|title=Extensions: Implement Manifest V3, comment #34 \|url=https://issues.chromium.org/issues/40598795#comment24 \|url-status=live \|website=issues.chromium.org}}</ref>		==== Early disapproval by developers ====
			Almost as soon as a design draft for Manifest V3 was made public, on November 9th, developers disapproved of the changes proposed by it, including the developers of privacy and security-focused tools such as NoScript, AdGuard, uMatrix, and uBlock Origin.<ref>{{Cite web \|date=2018-10-18 \|title=Extensions: Implement Manifest V3 \|url=https://issues.chromium.org/issues/40598795 \|url-status=live \|website=issues.chromium.org}}</ref> On January 22, 2019, in response to the design draft, the developer for uBlock Origin and uMatrix would go on to write, "if this [...] API ends up being the only way content blockers can accomplish their duty, this essentially means that content blockers I have maintained for years, uBlock Origin ("uBO") and uMatrix, can no longer exist." And also, "[...] deprecating the blocking ability of the [...] API will essentially decrease the level of user agency in Chromium, to the benefit of web sites which obviously would be happy to have the last word in what resources their page can fetch/execute/render."<ref>{{Cite web \|date=2019-01-22 \|title=Extensions: Implement Manifest V3, comment #24 \|url=https://issues.chromium.org/issues/40598795#comment24 \|website=issues.chromium.org}}</ref> A developer for AdGuard would second his points. A Chromium developer did not immediately answer these points, but instead directed the discussion to take place over email rather than the bug tracker.<ref>{{Cite web \|date=2019-01-22 \|title=Extensions: Implement Manifest V3, comment #34 \|url=https://issues.chromium.org/issues/40598795#comment24 \|url-status=live \|website=issues.chromium.org}}</ref>

			==== Dataspii ====
			In February 2019<ref name=":0">{{Cite web \|last=Goodin \|first=Dan \|date=2019-07-18 \|title=My browser, the spy: How extensions slurped up browsing histories from 4M users \|url=https://arstechnica.com/information-technology/2019/07/dataspii-inside-the-debacle-that-dished-private-data-from-apple-tesla-blue-origin-and-4m-people/ \|url-status=live \|website=Ars Technica}}</ref>, Sam Jadali begins investigating suspicious browser extensions and the developers behind them. Over time he would find eight browser extensions, primarily for Chromium-based browsers, to be collecting sensitive data from unsuspecting users, which would then be sold for profit.<ref>{{Cite web \|title=DataSpii \|url=https://dataspii.com/ \|url-status=live \|website=dataspii.com}}</ref> This would compromise the private data of as many as 4 million Chrome and Firefox users. Also impacted were companies such as Bank of America, AT&T, and even the Pentagon.<ref>{{Cite web \|last=Jadali \|first=Sam \|date=2019-12-05 \|title=Tweet by Sam Jadali \|url=https://x.com/sam_jadali/status/1202691665451864064 \|website=X}}</ref> Each extension, as he reported them for their suspicious activity, would be removed from the Chrome Web store. However data collection '''continued for months after this'''. It's only in early July, when Google remotely disabled the extensions, that the data collection finally stopped.<ref name=":0" /> Though the disabled extensions had a notice saying, "This extension violates the Chrome Web Store policy.", the notice said nothing of the data collection or the selling of said data. At the same time the extensions could be forcibly re-enabled.<ref name=":0" />

			In a statement responding to contact by Kate O'Flaherty, a cybersecurity and privacy journalist, a Google spokesperson says: "We want Chrome extensions to be safe and privacy-preserving, and detecting policy violations is essential to that effort."<ref>{{Cite web \|last=O'Flaherty \|first=Kate \|date=2019-07-19 \|title=Data Leak Warning Issued To Millions Of Google Chrome And Firefox Users \|url=https://www.forbes.com/sites/kateoflahertyuk/2019/07/19/data-leak-warning-issued-to-millions-of-google-chrome-and-firefox-users/ \|url-status=live \|access-date=2025-11-22 \|website=Forbes}}</ref> The spokesperson went on to mention, referring to Manifest V3, changes to extensions that "will mitigate or prevent this behavior," and "new policies that improve user privacy." Sam Jadali disagreed that Manifest V3 would make any meaningful change. <ref name=":1">{{Cite web \|last=Miagkov \|first=Alexei \|last2=Gillula \|first2=Jeremy \|last3=Cyphers \|first3=Bennett \|date=2019-07-31 \|title=Google’s Plans for Chrome Extensions Won’t Really Help Security \|url=https://www.eff.org/deeplinks/2019/07/googles-plans-chrome-extensions-wont-really-help-security \|url-status=live \|access-date=2025-11-22 \|website=EFF}}</ref> This is because Manifest V3 doesn't make changes to how "content scripts" work, or how extensions are allowed to observe data. According to the EFF, "The only part of Manifest V3 that goes directly to the heart of stopping DataSpii-like abuses is banning remotely hosted code."<ref name=":1" />
	<references />		<references />

Basicotter1919: Chromium: Manifest V3 Controversy WIP rewrite

2025-11-19T02:17:21Z

Chromium: Manifest V3 Controversy WIP rewrite

New page

=== Manifest V3 (WIP rewrite) ===
Manifest V3 is an update to the manifest structure used by browser extensions across the majority of the browser market. It was first mentioned on October 1st 2018 in a Chromium blog post<ref>{{Cite web |last=Wagner |first=James |date=2018-10-01 |title=Trustworthy Chrome Extensions, by default |url=https://blog.chromium.org/2018/10/trustworthy-chrome-extensions-by-default.html |url-status=live |website=Chromium Blog}}</ref>, saying it's aim was "to create stronger security, privacy, and performance guarantees". In the same blog post, Wagner wrote "We want to help all developers fall into the pit of success; writing a secure and performant extension in Manifest v3 should be easy, while writing an insecure or non-performant extension should be difficult."

Almost as soon as a design draft for Manifest V3 was made public, on November 9th, developers disapproved of the changes proposed by it, including the developers of privacy and security-focused tools such as NoScript, AdGuard, uMatrix, and uBlock Origin.<ref>{{Cite web |date=2018-10-18 |title=Extensions: Implement Manifest V3 |url=https://issues.chromium.org/issues/40598795 |url-status=live |website=issues.chromium.org}}</ref> On January 22, 2019, in response to the design draft, the developer for uBlock Origin and uMatrix would go on to write, "if this [...] API ends up being the only way content blockers can accomplish their duty, this essentially means that content blockers I have maintained for years, uBlock Origin ("uBO") and uMatrix, can no longer exist." And also, "[...] deprecating the blocking ability of the [...] API will essentially decrease the level of user agency in Chromium, to the benefit of web sites which obviously would be happy to have the last word in what resources their page can fetch/execute/render."<ref>{{Cite web |date=2019-01-22 |title=Extensions: Implement Manifest V3, comment #24 |url=https://issues.chromium.org/issues/40598795#comment24 |website=issues.chromium.org}}</ref> A developer for AdGuard would second his points. A Chromium developer did not immediately answer these points, but instead directed the discussion to take place over email rather than the bug tracker.<ref>{{Cite web |date=2019-01-22 |title=Extensions: Implement Manifest V3, comment #34 |url=https://issues.chromium.org/issues/40598795#comment24 |url-status=live |website=issues.chromium.org}}</ref>
<references />