IdeaWell

Project ideas from Hacker News discussions.

Chrome extensions spying on users' browsing data

Original Article

Hacker News Discussion

📝 Discussion Summary (Click to expand)

1. Browser extensions can read password fields and exfiltrate data

“Browser extensions have much looser security than you would think: any extension, even if it just claims to change a style of a website, can see your input type=password fields” – mentalgear
“Even scripts within the page itself cannot read the value of password input fields. This is less of an issue than you are presenting it as.” – drdec

2. Trust is built on auditability and open‑source code

“I only run open source extensions that I can actually audit.” – singularfutur
“Open source at least gives you a chance to see what you're installing before it starts exfiltrating your data to some server in a country you've never heard of.” – singularfutur
“Extensions are local files on disk… Diffing it vs what's released in its open source repo would be a quick way to see if anything has been adjusted.” – nickjj

3. The extension ecosystem is vulnerable to supply‑chain attacks and buy‑outs

“I have a 100k+ user extension… I've probably received hundreds of emails over the years asking me to sell out in one way or another.” – mcjiggerlog
“If someone would like to replicate, a good approach would be to reduce the cost by removing a full‑chromium engine.” – captn3m0
“The same modality is used by gamers to sell off their high‑level characters… The same pattern is used by malicious actors to buy legitimate extensions.” – RupertSalt

4. Users are encouraged to minimize extensions, disable auto‑updates, or use built‑in browser features

“Installing new extensions is sometimes appealing, but the risk is just too high.” – stevekemp
“I only trust uBlock Origin, Bitwarden and my own extensions.” – mcjiggerlog
“I have a password manager, Privacy Badger and Firefox Multi‑Account Containers… The only one of these I feel should actually be a plugin is my password manager.” – mrweasel

These four themes—security risk, trust & auditability, supply‑chain threats, and user‑side mitigation—dominate the discussion.

🚀 Project Ideas

ExtVerify

Summary

  • A browser extension that automatically verifies that every installed extension matches a cryptographically signed hash from its source repository.
  • Provides instant alerts if an extension’s binary differs from the published source, protecting against supply‑chain tampering and malicious updates.

Details

Key Value
Target Audience Privacy‑conscious users, security researchers, enterprises managing many extensions
Core Feature Hash‑based provenance check, real‑time mismatch alerts, signed manifest verification
Tech Stack WebExtension APIs, Node.js for background worker, OpenPGP.js for signature verification, IndexedDB for local cache
Difficulty Medium
Monetization Revenue‑ready: freemium with paid audit reports for enterprises

Notes

  • HN users like “Imustaskforhelp” and “qcontinuum1” want a way to confirm that an extension hasn’t been altered after publishing.
  • The tool directly addresses the “extension supply‑chain attack” pain point and would spark discussion on how to standardize provenance in the Chrome Web Store.

MalExtWatch

Summary

  • A community‑driven, open‑source list of known malicious extensions plus a CLI/web scanner that checks a user’s installed extensions against that list.
  • Enables users to quickly audit their environment and contributes to a living threat database.

Details

Key Value
Target Audience Individual users, security teams, open‑source contributors
Core Feature GitHub‑hosted list of malicious IDs, automated scanner, webhook for updates
Tech Stack Python CLI, Go web service, GitHub Actions, SQLite for local cache
Difficulty Low
Monetization Hobby

Notes

  • “Imustaskforhelp” and “qcontinuum1” already discuss building such a list; this project gives a ready‑to‑use tool.
  • The scanner would be useful for “extensioncheck.val.run” style services and could become a standard in security tooling.

DomainGuard Wrapper

Summary

  • A lightweight wrapper that takes any existing extension and scopes its permissions to a user‑defined domain whitelist, while logging all network traffic for audit.
  • Allows users to keep useful extensions (e.g., ad blockers) but with strict domain control and transparency.

Details

Key Value
Target Audience Power users, developers, enterprises needing fine‑grained control
Core Feature Permission scoping, traffic logging, UI for domain rules
Tech Stack WebExtension APIs, Service Workers, WebSocket for live logs, React for UI
Difficulty Medium
Monetization Revenue‑ready: subscription for advanced logging and analytics

Notes

  • Addresses concerns from “notpushkin” and “coldtea” about extensions having blanket access.
  • Would generate discussion on whether browsers should expose such scoping natively.

ExtUpdateGuard

Summary

  • A browser extension + dashboard that monitors extension updates, tracks ownership changes, and notifies users of suspicious modifications or new permissions.
  • Helps users detect when an extension they trust has been compromised or sold.

Details

Key Value
Target Audience Security‑aware users, IT admins, extension developers
Core Feature Update monitoring, ownership audit, notification system
Tech Stack WebExtension APIs, Node.js backend, PostgreSQL, WebSocket for real‑time alerts
Difficulty High
Monetization Revenue‑ready: SaaS tier for enterprise monitoring

Notes

  • Resonates with “rbg” and “chrisjj” who want to be alerted when an extension’s owner changes.
  • Provides a practical utility for

Read Later