Google Cracks Down on Rogue Browser Extensions

Google is cracking down on Chrome browser extensions that risk user privacy. The new policies err on the side of caution and follow a Washington Post investigation that claimed millions of users had data stolen by rogue browser extensions.

A browser extension, also called an "add-on" in some browsers, is a third-party tool that users can incorporate into their web browser. It's designed to add extended functions to the browser, which then make using the browser and web much easier.

Examples of extensions include: a password manager, which can remember user passwords and automatically fill login information into a page automatically;  another example is one that can take an article online and send it to a Kindle e-reader device, or quickly take a screenshot of part of a page.

Rogue Extensions Removed

While browser developers like Google and Mozilla do have policies to reduce associated privacy risks to users, the fact that an extension comes from an official "web store" (such as the Chrome Web Store or Mozilla's Addons page) doesn't guarantee it is safe.

Perhaps the biggest problem associated with extensions is their access level. For example, once an extension is downloaded, users are asked to confirm if they agree to allow the extension to "read and change ... browsing history". While most users may click "yes" simply to allow the extension to run based on promises from the developer, the rationale behind the access is usually not clear.

The Washington Post recently identified several extensions that were collecting and sharing data that didn't appear necessary for the stated purpose. The names include:

• FairShare Unlock
• Hover Zoom
• Panel Measurement
• SpeakIt!
• SuperZoom

The extensions, which had an estimated total of four million users, have since been disabled. Google appears to have concluded it needs to make more fundamental changes to its browser extensions access, rather than play whack-a-mole with rogue developers. (Source: washingtonpost.com)

Privacy Policies Become More Common

One change is that extensions must now be designed to only "request access to the least amount of data" needed to carry out their tasks. Previously that was merely a guideline.

The other big change is that more extensions will need to publish a privacy policy explaining what data they collect and how they use it. Until now, a privacy policy has only been needed if an extension handles data classes as sensitive or personal. Now any extension that accesses personal communications or any content the user provides will need a privacy policy as well. (Source: 9to5google.com)

What's Your Opinion?

Do you use browser extensions? Do you pay much attention to what data they can collect and how they use it? Do Google's new policies go far enough to reduce the risk of data misuse?