Chrome, Firefox pull very unstylish Stylish invasive browser plugin

Add-on made sites look pretty while getting away with ugly data slurpage

Published Thu 05 Jul 2018 // 01:04 UTC

Firefox and Chrome have removed a browser extension from their stores following revelations it was phoning home with users' web-surfing histories.

The "Stylish" plug-in gained popularity because it let users configure sites' appearance, rather than accepting the designers' decisions.

However – stop us if you've heard this one before – the code changed hands last year and the new owners expanded its data slurping activities.

REG AD

Software engineer Robert Heaton decided to take a look at what was being sent to Stylish's owners, analytics company SimilarWeb, and was horrified.

REG AD

As Heaton blogged, “HTTP requests that send a large blob of obfuscated data to a URL ending in /stats are almost never good news for users.”

While the SimilarWeb privacy policy for Stylish says it only collects anonymous data, Heaton found it was attaching an identifier to the data returned to the company.

“I looked closer at the decoded payload and noted a unique tracking identifier”, he wrote, adding “it only takes one tracking request containing one session cookie to permanently associate a user account with a Stylish tracking identifier. This means that Stylish and SimilarWeb still have all the data they need to connect a real-world identity to a browsing history, should they or a hacker choose to.”

Mozilla's add-on assessors decided Stylish, as it now stands, is out of line and made the extension unavailable to Firefox users (although it requires manual removal for current users).

A post from Andreas Wagner was blunt about the reason: “We decided to block because of violation of data practises outlined in the review policy.”

Stylish in Google search — Still popular after it's gone

As you can see above, Stylish was popular enough to be a front-page search result for “Chrome extensions”, but it's now gone from the Google extensions store.

The Register asked SimilarWeb for comment. ®

PS: There is an open-source fork of Stylish sans analytics and tracking – Stylus.

REG AD

systems

Chrome, Firefox pull very unstylish Stylish invasive browser plugin

Intel knows it needs to ‘leapfrog’ ARM and AMD, says CEO Lip-Bu Tan

Microsoft fiber foul-up cut off Azure California for almost five hours

Gobi X: Creating more energy for AI, not taking it from society

OpenAI-Hugging Face attack doesn't mean agents are evil – unless you tell them to be

Airbus takes flight from AWS. What happens next is critical

Researchers replace downloaded macOS apps with evil twins, Apple shrugs

MOST POPULAR

Anyone with a shed, an extension cord, a couple of GPUs and an overdraft is building datacenters. Fujitsu just offloaded five

Linux kernel team publishes 432 CVEs in two days

OpenAI admits it was the source of the agent swarm that attacked Hugging Face

AWS customer learns the hard way how even the smallest oversight can be mission-critical

Airbus takes flight from AWS. What happens next is critical

AI

AMD and Cerebras join forces against Nvidia’s Groq LPUs

Codeberg gives vibe-coded projects the toss, promotes human FLOSS

AMD attacks the rack with Helios systems that rival Nvidia's

Model Context Protocol prepares to break with its stateful past

Tesla burns through a billion as Musk bets the farm on chips and bots

Infosec

Russians are posing as Signal support to launch phishing attacks

Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attack

DEF CON Franklin project enlists hackers to harden critical infrastructure

EQT buys majority share in Swiss cybersecurity biz Acronis

Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sight

FOSS

GNOME can look like Windows – and Flashback can do it without extensions

A moment of silence, please, for the final release of Debian on x86-32

Baddies caught exploiting extensions bugs with perfect 10 scores on vulnerable Joomla websites

Frame: A new X11 server – implemented directly in assembly

Cinnamon 6.8 will support Wayland – if you want it

KDE Plasma users face a dire omen of change: 6.6.6 arrives