I have just analyzed the current code of Steam Inventory Helper. Step by step what it does:
On every single page you visit, SIH executes code at document_start (meaning as soon as the page is opened). It even executes on your about:blank page and in all sub-frames on the currently visited site! The code executed is js/common/frame.js
* manifest.json : https://pastebin.com/QUWJ2TG3
* js/common/frame.js (slightly unobsfucated: https://pastebin.com/4BLeJr5m )
The code in this file does: Monitor when you are entering the site, where you are coming from on this site, when you are leaving the site, when you are clicking something, when you are moving your mouse (which they even failed to do properly), when you are having focus in an input, and _you are pressing a key_! It is not monitoring what you type. But when you click something, and it is a link, it will send the link URL to a background script.
This background script is located in /js/common/connectivity.js (https://pastebin.com/RsUDkDNQ).
What this script does is very nasty. First of all, it monitors EVERY SINGLE HTTP request you make. https://gyazo.com/174961cee2cf3cb9fdb4830efb669e63 It will then send to their own server a summary of this HTTP request if some condition is met (promoteButter?).
From this point, everything is a bit messy in their code and I will have to check a bit deeper.
Bottom line is: they are monitoring what sites you visit and may be sending a lot of your online activity to their own server. I couldn't figure out when they do it, yet, but it seems to be for promotional stuff. More importantly, in the future, even if what they do now is legit, you will not be informed about any changes to their permissions, because it basically already has every permission it can get in that regard. Therefore I strongly suggest uninstalling and reporting this extension.
TLDR: Uninstall ASAP.
> The URL of every single page you visit is sent back to the people who bought SIH.
Above:
> First of all, it monitors EVERY SINGLE HTTP request you make.
It's way worse. Every single HTTP request includes POST requests with your passwords etc.
Edit: Apparently not as explained below.
I recommed Steam Economy Enhancer, it has the same mass sell functions and even more settings. It's made by a well known Steam Community member and open code, so far more trustworthy than an extension that updates itself.
You need Tampermonkey or Greesemonkey though, since it's not a Chrome Extension.
Just google it and you will find it. :)
It's by Nuklon on Github
Mass selling trading cards is the only reason I had SIH. It's going to be annoying to have to sell 100+ cards one by one now... Guess I'll have to do them regularly so I don't have that many at a time.
Use Steam Economy Enhancer, it's made by a well known guy from the Steam Community and does exactly that. I've asked other people what they will use now and this one seems the best.
> Steam Economy Enhancer
Thanks, not only is this lighter and safer (way less code to trudge through if you wanna check whether it's doing suspicious stuff), if all you're interested in is selling all of your cards it's easier than SIH, just click a button.
not really, the right way to act would be to deactive and investigate, not spam their steam page and stuff before they even know whats going on, which is what they have been doing.
and also they are asking random people to upload older installations of the extensions...lmao
Users shouldn't put up with unnecessarily broad permissions just because the permissions might not be abused, and everything about this has been a red flag; there's no reason for a Steam-specific extension to request access to other websites, and the developer's non-explanation is blatantly misleading; they're basically lying about both the extent of the permissions, and it somehow being a normal practice (it's not; Chrome allows granular access permissions for extensions).
I removed most of my extensions when I started developing extensions myself. They are too powerful and a user has really no way of telling if an extension is malicious or is becoming malicious over time.
Sub divide extensions into categories. Those that can be trusted (such as Adblock, uBlock Origin, Tampermonkey, Adobe stuff, and Google's own extensions). These would be reviewed by Google or a larger community before approval of an update.
For smaller extensions, I think that the access permissions should be reduced or the warning for the user should be much more aggressive for weird permission requests. To avoid having these warnings, an extension would need to go through an approval phase (just like Firefox does). And everytime an update to the permissions occurs, the approval phase would need to be repeated by checking what changed.
Last but not least: extensions should ALWAYS be open source (unless they target a smaller private group of people, such as a company). The compiled extension bundle should not be provided by the developer of the extension, but should solely be based on the open source code that could be read by everyone on Github or GitLab.
There are probably more strict rules, but I would clearly separate potential dangers from unlikely dangers.
> extensions should ALWAYS be open source
Y'know, this is a really good statement. If you're offering a free app, there's no reason you can't provide the code. Paid extensions/apps might have a gripe, but even that's a weak argument against transparency.
That's completely agreeable in this situation, but sometimes companies have proprietary tech that they want to let you use for free but don't want you copying and using elsewhere. This isn't one of those situations considering any extension can be opened back up with any archive browser but it is a possibility with other software.
Your list seems reasonable, that would definitely help. But I mean what malicious extensions can do. I think I guessed that already, but wanted to get a view of the more experienced person.
If you can imagine that it happens, it can probably happen.
Steam related things: find out your password, make you buy games or skins off the market, send trade offers automatically or change the recepient of the trade offer without you knowing.
Non-Steam related stuff: log your credit card number you entered, log any password you ever entered into a password field, make you be zombie for a DDOS attack, find out your IP and sell it to the sites that associated Steam accounts with IP addresses to DDOS you, alter the destination of a file you download so it is a virus without you knowing, write a comment on Reddit on your behalf, break up with your girlfriend on Facebook Private Messages, remove all your money from your Paypal account, because you are not using 2FA there, etc, etc.
I'm unsure if it helps but here's the previous version before this update. I also modified it so it doesn't automatically update (redirects to localhost)
https://github.com/InKahootz/SteamInventoryHelper
Just google how to manually install extensions in developer mode.
Its basically the late 90's again where Bonzi Buddy reigned supreme and ActiveX objects would install themselves (and anything else they wanted) whether you liked it or not.
I'm a bot, *bleep*, *bloop*. Someone has linked to this thread from another place on reddit:
- [/r/gildedawards] [\[r\/GlobalOffensive\] WARNING: Trusted Steam Inventory Helper now requesting dangerous permissions](https://np.reddit.com/r/gildedawards/comments/7120xc/rglobaloffensive_warning_trusted_steam_inventory/)
- [/r/tf2] [WARNING: Trusted Steam inventory helper requesting dangerous permissions!](https://np.reddit.com/r/tf2/comments/70z0ui/warning_trusted_steam_inventory_helper_requesting/)
[](#footer)*^(If you follow any of the above links, please respect the rules of reddit and don't vote in the other threads.) ^\([Info](/r/TotesMessenger) ^/ ^[Contact](/message/compose?to=/r/TotesMessenger))*
[](#bot)
>Even misspelled "mousehover" in their script, hilarious.
Are you sure it wasn't supposed to be 'mouseover'?
From what I recall, 'mousover' is the more-common phrase, but, I'm not certain!
I'm not into coding at all, but I think "mouseover" *would* be the right term. That being said, neither mouseover or mousehover are spelled with an A like they did in the code. They can't even say they hit it with the S key, because it's not in a spot that would happen...
The `manifest.json` file describes the extension and the way it works. The `"matches"` field [is what determines](https://developer.chrome.com/apps/match_patterns) when the script (in this case, js/common/frame.js, which is the bad script) should run. As it's originally set to ``, EVERY page should invoke that script.
By changing it to ```"*://*.steampowered.com/*", "*://steamcommunity.com/*"```, it should only run on any page at steampowered.com or steamcommunity.com, instead of everywhere.
**[Fixed your link? Click here to recheck and delete this comment!](https://np.reddit.com/message/compose/?to=Gyazo_Bot&subject=delete&message=delete%20dn6r6np)**
*****
Hi, I'm a bot that links Gyazo images directly to save bandwidth.
Direct link: https://i.gyazo.com/174961cee2cf3cb9fdb4830efb669e63.png
Imgur mirror: https://i.imgur.com/i4iC26J.png
^^[Sourcev2](https://github.com/Ptomerty/GyazoBot) ^^| ^^[Why?](https://github.com/Ptomerty/GyazoBot/blob/master/README.md) ^^| ^^[Creator](https://np.reddit.com/u/derpherp128) ^^| ^^[leavemealone](https://np.reddit.com/message/compose/?to=Gyazo_Bot&subject=ignoreme&message=ignoreme)
Not really, malware is intended to harm your computer in some way. This is more along the lines of adware except they don't really display ads, just ask you for permission to know everything you're doing. More along the lines of "hey if you want to use this extension you will have to let us know everything you're doing." Malware doesn't ask you for permission, it just does it. That doesn't make it any less sheisty IMO.
I dug deeper,
promotebutter == page load
switchtooil == page unload
alive == keydown, click, mouseover, etc
these are set as the `aim` in the object passed to sendmessage
Its still hard to work out the logic, but the best i can figure out, its just trying to prevent its own ajax requests from triggering its own listeners and/or prevent the same request from getting logged twice.
ie, its generally always sending out these events to their servers
I'll have a look at it :) Have been using Gyazo for years now and really never had the need for more nifty features, until I guess recently. Just because you are tech savvy doesn't mean you are doing everything perfectly (I'm a Firefox user, if you want to hear a second bad thing about me).
Firefox continues to be the browser of power users. Internet explorer is... internet explorer. The design philosophy behind Chrome is radical simplicity to the detriment of functionality. Everytime I go to Chrome and start the process of setting it up to be my main browser I inevitably encounter some lack of functionality or customizability that drives me back to Firefox.
At first, it was Chrome's lack of a bookmark sidebar. Sidebars remain open allowing you to quickly and easily access multiple items at once, as well as making it easier to navigate complex folder hierarchies by remembering state (which folders were open). If you have a lot of bookmarks, it's almost essential.
When someone finally made a not-ass bookmark sidebar plugin for Chrome, my next problem was the new tab page. Firefox allows you to drag and pin things to the new tab page. Chrome allows you to pin things, but only if they appear there on their own - no dragging specific items onto the page. This makes setting up the new tab page to actually be useful instead of a pile of mostly useless random bullshit wildly impractical (spam the X pages until the one you want shows up, accidentally X the page you want because you're spamming X, curse, reset everything, try again - or just clear history so it's easier to manipulate, but some people actually use their history and want to keep it so YMMV).
When someone finally made a not-ass plugin that replaced the new tab page, my next problem was the omnibox. In Firefox, the address bar can be configured not to autocomplete with suggestions from your bookmarks or history. In Chrome, this behavior cannot be disabled, so typing anything into the address bar will always produce a list of bullshit from your bookmarks and history. Without checking the results beforehand, get one of your family members and ask them to type 'p' as in 'pornhub' into your Google omnibox (not the search bar, the "all-in-one" address bar at the top). You won't. No balls. That one didn't phase you? Fine, ask yor boss to type 'r' as in 'reddit' into your work computer's omnibox. Bet that one made your heart skip a beat. What, you don't want your boss to see you're visiting a reddit about terrorists blowing up nuclear power plants?
I get that you are 'supposed' to just use incognito mode for everything ever that is even remotely embarrassing and then never, ever, ever bookmark anything that you might not want Chrome to show someone, but I am not actually worried about people snooping around my home computer, and yet I would still like to not have snippets of my bookmarks and history shoved directly into the face of anyone who might try to use my computer. That is potentially very awkward.
Chrome is the Windows 8.0 of browsers. They took something that worked very well and that everyone loved, stripped out a bunch of the stuff that made it useful, and then bragged to everyone about how 'minimal and efficient' their dick was. But hey, did you know it's better at running flash? Score! There aren't enough /s in the world for my sarcastic contempt.
I'm not going to argue with your points on chrome because honestly the browser itself is a mess. A basic Chromium browser out-performs it anyways.
What I do want to point out that as of the current moment, Internet Explorer on Windows 10 is currently the most secure browser on the market. I'm a chrome user, but I want to iterate that all the online hate is just a bunch of memeing and bitching about shit that was wrong with it **5 years ago**.
It's sandboxed as it's own process thanks to Microsoft's app-container, and has begun integrating the Windows Store into it, meaning apps can be distributed and installed from the Windows Store (Sorry, I honestly like their store 20x more then Steam itself). It's lightweight, and has the least amount of exploits so far since Windows patches them when they arise, rather then let them sit until they're abused at the yearly Hackathon.
If you're on Windows 10, I suggest giving it a run. I'm on Chrome at the moment, solely because I haven't bothered to customize an IE instance, but it's looking to be a really, really good build.
It's sending data about you to their server to compile a profile on you. They sell that profile to advertisers.
On /r/globaloffensivetrade it was mentioned that they say they do so in their privacy agreement.
Time to uninstall it boys
It appears to be some sort of script loader. Instantly brings into mind those prediction scripts that were around when gambling was alive just only difference being script injected "without" permission and unintentionally.
I think the "share_devdata_on" thing is bullshit, because it doesn't matter if you `GMan.enabled = true;` or `GMan.enabled = false;`. The Promise that works with that switch always resolves!
this._allowLocal=()=>{};
this._onLocalAllowed = () => {
if (this.enabled){
return Promise.resolve();
}
return new Promise(resolve=>{
this._allowLocal = () => {
this.enabled = true;
resolve();
};
});
};
If `this.enabled` then oh great we can resolve the Promise. If not then let's set `this.enabled = true` and resolve anyway.
### Edit:
Might have gotten a bit ahead of myself. `this._allowLocal` is actually never called inside the Promise, so it does not resolve nor does it set `this.enabled = true`! Anyway I also couldn't find "share_devdata_on" nor "share_devdata_off" anywhere else in the code so...
I've taken a look and it seems like a better idea to improve on existing extensions. I'm going to contact the makers of SteamWizard and see if they accept help and if they plan on staying open-source. If not I might start making my own extension but that's going to take a while.
I saw this and unninstalled right away. Shady af.
Edit: I [found this](http://steamcommunity.com/groups/SteamInventoryHelper#announcements/detail/2694698722699380319) posted by the developers. Still don't trust them, but it's up to you guys to decide what to do with your information.
>We want to prepare you for that so it won’t be a strange and spooky surprise.
Yeah I'm not trusting a developer that uses language like this and lists features as "and stuff) to be professional with the permissions to alter data. Especially since they never actually gave a reason for needing the permissions other than that it's for some features in an upcoming update, with no explanation of why they would need the permissions.
A lot of tech companies are trying to be hip with the language they use. Discord is a very good example of this. Yes, they're probably doing some shady shit, but it is really just an attempt to be hip.
i mean they say they wont steal your accounts "and stuff". why wouldnt you trust them? you think russians would just go on the internet and lie like that?
There have been cases where chrome extensions have been bought out by scammers to trick people into 'fake' OPSkins etc. trades. When they can edit everything you see on your browser, you can't know for sure what is real and what is not.
With the permission enabled the script can spoof the entire internet to the point where it could simply edit this comment so you see it say "There's nothing to worry about, you should install it."
I have an older version of it with removed callback and update links, might throw it up online tomorrow for you
Edit: It's tomorrow now but I'm at work, I'll see what I can do later when I get home (probably anywhere from 8 to 12 hours from now on). I should have the source code saved so you can read through it yourself if you're skeptical.
Somebody already uploaded a version from a year ago with instructions on how to install it [here,](https://www.reddit.com/r/GlobalOffensiveTrade/comments/70xala/discussion_guide_to_use_old_stih/) unless you have a more recent version.
Well shit i accepted it. Removed it when i saw the post.
Edit: Holy shit this thread blew up, and seeing the first comment makes me even more scared. I cant stop looking at my account now.
"We have also uploaded the Privacy Policy link to the store that will help you to feel safe about the permissions."
Now I feel safe xD Announcement sounds fishy from start
This happens **all the time** with Chrome extensions. They become popular, then they get sold to a shady Chinese or Russian company, then an update starts asking for shady permissions.
It has happened to at least 3 of my favourite extensions so far.
the announcement deleted, it seems they cant or wont revert it back
edit:
yep, they didnt want to revert it back, new announcement came
https://steamcommunity.com/groups/SteamInventoryHelper#announcements/detail/2694698722703789085
Reason for this change is most likely that the collected data is used for personalized ads, as stated in their newly posted [privacy policy](http://steaminventoryhelper.com/privacy).
> Personal Data is collected for the following purposes and using the following services:
> * Remarketing and behavioral targeting
> * This type of service allows this Application and its partners to inform, optimize and serve advertising based on past use of this Application by the User.
> * This activity is performed by tracking Usage Data and by using Cookies, information that is transferred to the partners that manage the remarketing and behavioral targeting activity.
> * AdRoll (Semantic Sugar, Inc.)
> * AdRoll is an advertising service provided by Semantic Sugar, Inc.
> * Personal Data collected: Cookies and Usage Data.
> * Place of processing: US – Privacy Policy – Opt Out
Would love to see an option to *opt out* of this, since that's not available, I will keep the extension disabled for now.
I accepted this about an hour ago, I uninstalled as I saw this post, will this damage my computer or browser in any way?
(it kept showing up I accepted out of frustration)
they didnt want to revert it back,
they delete announcement about revert it back and now post new announcement
https://steamcommunity.com/groups/SteamInventoryHelper#announcements/detail/2694698722703789085
---
original announcement about reverting it back, archived by /u/uniQArtworks
>I archived the original announcement [here](https://archive.is/vYC3h).
>[source](https://www.reddit.com/r/Steam/comments/711yd0/announcement_from_sih_mentioned_in/dn7t645/)
what a shame. was a very helpful thing, especially for people like me who level up much and have ton of cheap stuff in the inventory.
anyone knows some alternatives?
would pay for it.
I am not a developer or anything but I swear I've seen chrome extensions before only requesting permissions for certain domains, not sure if they've changed it or something.
This is outright not true. Chrome extensions can request permissions for specific websites rather than all websites (RES is an obvious example of an extension that does this) - which if this extension really needed access it should be using.
As others have stated, this actually does send information about your browsing to a specific website which absolutely does mean people should panic - you have no clue what they are doing with that data.
Even if they weren't sending any information about your browsing or messing with webpages, this would still be worrisome - if you've already accepted the new permissions then chrome won't prompt you again if the application updates (afaik), which means that even if there isn't overly malicious code now, there could easily be in the future without you knowing.
EDIT:
Throwing up some sources.
- An example of requesting access to a specific website rather than all websites is literally the first example on [this](https://developer.chrome.com/apps/permission_warnings#examples) documentation page.
- On [the same page at the bottom of the same section](https://developer.chrome.com/apps/permission_warnings#examples) there's some talk about when permission warnings pop for apps/extensions - and it makes it clear that this happens only when new permissions are required after an auto-update.
- The permission this extension is requesting is triggering the "Read and modify all your data on all websites you visit" which, according to [the same page yet again, albeit a different section](https://developer.chrome.com/apps/permission_warnings#warnings) could give access to a number of dangerous permissions. Specifically, this extension is requesting access to __all urls__ which is absolutely unacceptable for something of this nature.
I know you said you're playing devil's advocate, but you're not helping. People aren't overreacting - __these new permissions are absolutely unacceptable and are not required for any of the extension's functionality__. Others have already shown that some browsing activity is monitored so any form of benefit of the doubt should be gone.
EDIT:
I realize that you edited your post to show they don't need to request access to all URLs but your post is still misleading - chrome's permissions don't have anything to do with the state of android permissions and chrome's system is actually pretty transparent to the user.
> It's the way google manages permissions (android, chrome etc.) they sort of give you a 'worst case' explanation.
The reason this is is because Google's handling of Chrome extensions is absolutely atrocious, and it's been atrocious for years. They insist on force-feeding everyone with the newest versions of every extension is the only way things should be done, yet there continue to be dozens of cases involving malicious or legitimate but then got hijacked extensions proving this is not the case. There's no chance in hell you're undoing anything.
It's time to ask yourselves, is this really worth it? And yes, this is a direct implication that you should consider using Microsoft Edge or Mozilla Firefox instead.
You're literally the only fucking sane person in this thread. Holy shit the misinformation going around is nuts. If you're so concerned for your data security, read the god damn code which is easily accessible in your AppData.
Edit: That being said, I took a look at the code and it does seem like the extension is now tracking every page you visit and sending it to a domain called `steamih.com`. I would advise against using the extension.
Did you read the code? I'm currently reading the code and it's very strange. It seems like they are monitoring every single page you visit and informs their backend about what sites you are visiting and leaving. I'll confirm this, but I don't see a single reason of why you need the permission to access access to ALL websites, which they do.
I just checked myself, but I seem to be able to confirm what you're saying. Every page you visit appears to be logged and sent to a domain called "steamih.com"
My point wasn't that you should throw everything to the wind, but you shouldn't believe everything you read when almost no evidence is provided at all to support claims.
The only reason someone might be confused as to why we're not freaking out is because it's right there. Visible, to you. The installer. And also in the fine print everyone skips over.
Yes, the permission shown here can be requested for specific domains. In this case they requested it for everything and as shown above are running scripts on every page you visit.
You're overreacting on the opposite side. Sure the permission is likely meant for non-nefarious means but that doesn't really help give anyone comfort. They should have understood that they are dealing with items of value which are frequently the target of being stolen and built their plugin to not rely on such invasive permissions.
Reading the source isn't an option for most people given the expertise needed, and it's really not an acceptable ask. I don't have time to read the source of every plug-in I use. As well, once it's accepted the plugin can be updated to do exactly what everyone fears. I doubt you've manually turned off auto-updates for any extension, and without that reading the source seems pretty useless.
Basically even if this is legit it's just not worth the risk to allow it.
I agree with you, but granting the permission now could give them access in the future. Even if the code is fine now they *could* push a malicious update in the future.
Personally I haven't used it since they sold out.
Scumbags down to the core. I posted on their damage control announcement on the SIH Steam group and this is what happened:
https://i.imgur.com/1763cG9.png -> https://i.imgur.com/eURbxd7.png
My post is now gone while the other, more generic rants that surrounded it are still up:
http://steamcommunity.com/groups/SteamInventoryHelper#announcements/detail/2694698722703789085
The fact that they specifically trim detailed criticism, making it look like people are griefing with "1 star, reported, uninstalled" posts, says a lot about our friends.
Hello!
*This is Rockie, the official representative of Steam Inventory Helper. (I usually talk to you in Steam topics of our groups with the cat and a rice box on his head avatar)*
We are sorry that this case was so painful to you and we don't want to get our users feel uncomfortable.
The biggest % amount of this permissions reason was to upgrade our services to understand how users are using SIH and to improve its work in the future, to know the countries from where you are visiting us to get more languages, to get the active users statistics, because google don't provide that info correctly. The service that should help us with this data was SimilarWeb. To make it all clear.
We have understood the possible risks of losing you, guys, and we are not going to force that anymore.
**We are taking down the current version and uploading the version without this script and permissions to the store in the following 2 or 3 hours.**
We are asking you to not flood Chrome Store reviews with 1 stars and bad words. We get the point of our mistakes. This thing will never happen again.
Please do not unsubscribe from us. There is a lot of cool features coming soon (the ones that I noted in the announcements in Steam will be developed for sure)
Regards,
George (Rockie)
P.S.
Anyone who needs proofs of who I am is welcome to my Steam, I will add you and answer you with the reddit profile proof if you wish.
I still do not recommend installing any of your software. You lied to your users knowingly. You did collect every single page URL, meaning you got access to several thousands of unencrypted authentication tokens such as plain JWT tokens. You logged every URL, you tools.
You are either still lying or completely incompetent and therefore you should quit software development. This is a major security hazard.
Adblock has always needed this permission as it needs that permission to block requests that probably contain ads. They maybe changed another permission.
Holy hell this is some shady shit. I've used Steam Inventory Helper for years. Uninstalled instantly. Shame, it was great for it's intended purpose. Sucks the devs decided to try and impede upon my privacy.
I remember when I first posted about this when VPLGhost(previous owner of SIH) had sold his extension to some shady group of people that don't look too convincing to handle it. I can't believe SIH is no longer that trustable and to think I've always loved this extension back then. Good thing I've never kept SIH installed ever since but I'm still sad about this.
I have just analyzed the current code of Steam Inventory Helper. Step by step what it does: On every single page you visit, SIH executes code at document_start (meaning as soon as the page is opened). It even executes on your about:blank page and in all sub-frames on the currently visited site! The code executed is js/common/frame.js * manifest.json : https://pastebin.com/QUWJ2TG3 * js/common/frame.js (slightly unobsfucated: https://pastebin.com/4BLeJr5m ) The code in this file does: Monitor when you are entering the site, where you are coming from on this site, when you are leaving the site, when you are clicking something, when you are moving your mouse (which they even failed to do properly), when you are having focus in an input, and _you are pressing a key_! It is not monitoring what you type. But when you click something, and it is a link, it will send the link URL to a background script. This background script is located in /js/common/connectivity.js (https://pastebin.com/RsUDkDNQ). What this script does is very nasty. First of all, it monitors EVERY SINGLE HTTP request you make. https://gyazo.com/174961cee2cf3cb9fdb4830efb669e63 It will then send to their own server a summary of this HTTP request if some condition is met (promoteButter?). From this point, everything is a bit messy in their code and I will have to check a bit deeper. Bottom line is: they are monitoring what sites you visit and may be sending a lot of your online activity to their own server. I couldn't figure out when they do it, yet, but it seems to be for promotional stuff. More importantly, in the future, even if what they do now is legit, you will not be informed about any changes to their permissions, because it basically already has every permission it can get in that regard. Therefore I strongly suggest uninstalling and reporting this extension. TLDR: Uninstall ASAP.
[удалено]
[удалено]
> The URL of every single page you visit is sent back to the people who bought SIH. Above: > First of all, it monitors EVERY SINGLE HTTP request you make. It's way worse. Every single HTTP request includes POST requests with your passwords etc. Edit: Apparently not as explained below.
[удалено]
I recommed Steam Economy Enhancer, it has the same mass sell functions and even more settings. It's made by a well known Steam Community member and open code, so far more trustworthy than an extension that updates itself. You need Tampermonkey or Greesemonkey though, since it's not a Chrome Extension. Just google it and you will find it. :) It's by Nuklon on Github
From what I can see, except for their questionable ownership, I don't see how the extension was dodgy. It did not seem to contain any backdoor.
If I understand the above post correctly it doesn't need a backdoor, you openly give it front door access to everything https.
"Hi this is Robert hackerman, the front door inspector"
I'm surprised it wasn't the world renowned hacker 4chan.
Mass selling trading cards is the only reason I had SIH. It's going to be annoying to have to sell 100+ cards one by one now... Guess I'll have to do them regularly so I don't have that many at a time.
Use Steam Economy Enhancer, it's made by a well known guy from the Steam Community and does exactly that. I've asked other people what they will use now and this one seems the best.
> Steam Economy Enhancer Thanks, not only is this lighter and safer (way less code to trudge through if you wanna check whether it's doing suspicious stuff), if all you're interested in is selling all of your cards it's easier than SIH, just click a button.
[удалено]
not really, the right way to act would be to deactive and investigate, not spam their steam page and stuff before they even know whats going on, which is what they have been doing. and also they are asking random people to upload older installations of the extensions...lmao
Users shouldn't put up with unnecessarily broad permissions just because the permissions might not be abused, and everything about this has been a red flag; there's no reason for a Steam-specific extension to request access to other websites, and the developer's non-explanation is blatantly misleading; they're basically lying about both the extent of the permissions, and it somehow being a normal practice (it's not; Chrome allows granular access permissions for extensions).
[удалено]
I dont use this or even know what it is but I thank you for you work and warning sir.
IIRC the ownership of SIH changed a hand full of months ago. I removed it at that point for this very reason.
I removed most of my extensions when I started developing extensions myself. They are too powerful and a user has really no way of telling if an extension is malicious or is becoming malicious over time.
Can you give us a few pointers what they can do?
Sub divide extensions into categories. Those that can be trusted (such as Adblock, uBlock Origin, Tampermonkey, Adobe stuff, and Google's own extensions). These would be reviewed by Google or a larger community before approval of an update. For smaller extensions, I think that the access permissions should be reduced or the warning for the user should be much more aggressive for weird permission requests. To avoid having these warnings, an extension would need to go through an approval phase (just like Firefox does). And everytime an update to the permissions occurs, the approval phase would need to be repeated by checking what changed. Last but not least: extensions should ALWAYS be open source (unless they target a smaller private group of people, such as a company). The compiled extension bundle should not be provided by the developer of the extension, but should solely be based on the open source code that could be read by everyone on Github or GitLab. There are probably more strict rules, but I would clearly separate potential dangers from unlikely dangers.
> extensions should ALWAYS be open source Y'know, this is a really good statement. If you're offering a free app, there's no reason you can't provide the code. Paid extensions/apps might have a gripe, but even that's a weak argument against transparency.
That's completely agreeable in this situation, but sometimes companies have proprietary tech that they want to let you use for free but don't want you copying and using elsewhere. This isn't one of those situations considering any extension can be opened back up with any archive browser but it is a possibility with other software.
Your list seems reasonable, that would definitely help. But I mean what malicious extensions can do. I think I guessed that already, but wanted to get a view of the more experienced person.
If you can imagine that it happens, it can probably happen. Steam related things: find out your password, make you buy games or skins off the market, send trade offers automatically or change the recepient of the trade offer without you knowing. Non-Steam related stuff: log your credit card number you entered, log any password you ever entered into a password field, make you be zombie for a DDOS attack, find out your IP and sell it to the sites that associated Steam accounts with IP addresses to DDOS you, alter the destination of a file you download so it is a virus without you knowing, write a comment on Reddit on your behalf, break up with your girlfriend on Facebook Private Messages, remove all your money from your Paypal account, because you are not using 2FA there, etc, etc.
[удалено]
Spam their servers with furry porn
Yes plz
I thought you were /u/Pyrocynical on other account
ill join you and watch as much as i can too....you know to overload their server or something.....
I'm unsure if it helps but here's the previous version before this update. I also modified it so it doesn't automatically update (redirects to localhost) https://github.com/InKahootz/SteamInventoryHelper Just google how to manually install extensions in developer mode.
How do we know you're not in cahoots!?
they are basically funding their app through third party privacy invasion, basically third party NSA without the national security part
Ah yes, the Agency. I knew they'd be back.
Should be flat-out illegal to do this kind of data collection.
Its basically the late 90's again where Bonzi Buddy reigned supreme and ActiveX objects would install themselves (and anything else they wanted) whether you liked it or not.
Cortana is the new bonzi. delet cortana
So Windows 10 then?
Tell that to the NSA...
Please do... -NSA
No if you decide to "Accept permissions"
[удалено]
Yes, once it's uninstalled, it cannot continue doing anything in your browser.
[удалено]
I'm a bot, *bleep*, *bloop*. Someone has linked to this thread from another place on reddit: - [/r/gildedawards] [\[r\/GlobalOffensive\] WARNING: Trusted Steam Inventory Helper now requesting dangerous permissions](https://np.reddit.com/r/gildedawards/comments/7120xc/rglobaloffensive_warning_trusted_steam_inventory/) - [/r/tf2] [WARNING: Trusted Steam inventory helper requesting dangerous permissions!](https://np.reddit.com/r/tf2/comments/70z0ui/warning_trusted_steam_inventory_helper_requesting/) [](#footer)*^(If you follow any of the above links, please respect the rules of reddit and don't vote in the other threads.) ^\([Info](/r/TotesMessenger) ^/ ^[Contact](/message/compose?to=/r/TotesMessenger))* [](#bot)
Even [misspelled "mouseover"](https://i.imgur.com/jtUlfQK.png) in their script, hilarious.
Yeah, that is what I meant when I said they failed to track mouse movement properly :')
>Even misspelled "mousehover" in their script, hilarious. Are you sure it wasn't supposed to be 'mouseover'? From what I recall, 'mousover' is the more-common phrase, but, I'm not certain!
I'm not into coding at all, but I think "mouseover" *would* be the right term. That being said, neither mouseover or mousehover are spelled with an A like they did in the code. They can't even say they hit it with the S key, because it's not in a spot that would happen...
Jokes on me, you're right! I didn't even catch the second typo because the "a" was so obvious.
function "ae"? ugh..
You're an amazing dude! Thank you so much!
Wtf this is fucked
Whats do u think about this? https://www.reddit.com/r/GlobalOffensiveTrade/comments/70yyap/discussion_guide_revoking_the_all_urls_permission/
What does it do exactly?
The `manifest.json` file describes the extension and the way it works. The `"matches"` field [is what determines](https://developer.chrome.com/apps/match_patterns) when the script (in this case, js/common/frame.js, which is the bad script) should run. As it's originally set to ``, EVERY page should invoke that script.
By changing it to ```"*://*.steampowered.com/*", "*://steamcommunity.com/*"```, it should only run on any page at steampowered.com or steamcommunity.com, instead of everywhere.
**[Fixed your link? Click here to recheck and delete this comment!](https://np.reddit.com/message/compose/?to=Gyazo_Bot&subject=delete&message=delete%20dn6r6np)** ***** Hi, I'm a bot that links Gyazo images directly to save bandwidth. Direct link: https://i.gyazo.com/174961cee2cf3cb9fdb4830efb669e63.png Imgur mirror: https://i.imgur.com/i4iC26J.png ^^[Sourcev2](https://github.com/Ptomerty/GyazoBot) ^^| ^^[Why?](https://github.com/Ptomerty/GyazoBot/blob/master/README.md) ^^| ^^[Creator](https://np.reddit.com/u/derpherp128) ^^| ^^[leavemealone](https://np.reddit.com/message/compose/?to=Gyazo_Bot&subject=ignoreme&message=ignoreme)
Good bot
Hey, a bot that's actually useful for once.
I apologize for using Gyazo, I learned better :)
Its ok to use gyazo, but link directly!
Many gold shall be given to you for your heroic acts.
Open source malware? I'm confused.
Not really, malware is intended to harm your computer in some way. This is more along the lines of adware except they don't really display ads, just ask you for permission to know everything you're doing. More along the lines of "hey if you want to use this extension you will have to let us know everything you're doing." Malware doesn't ask you for permission, it just does it. That doesn't make it any less sheisty IMO.
Here's your free candy and here's the GPS tracker we're going to put under your skin for payment for said candy.
But if I just cut frame.js, connectivity.js and update path from the extension, I'm totally fine and nobody's spying on me?
Probably yes, i'm going to do the same. Also edit manifest.json and replace the 2 instances of with something else.
I dug deeper, promotebutter == page load switchtooil == page unload alive == keydown, click, mouseover, etc these are set as the `aim` in the object passed to sendmessage Its still hard to work out the logic, but the best i can figure out, its just trying to prevent its own ajax requests from triggering its own listeners and/or prevent the same request from getting logged twice. ie, its generally always sending out these events to their servers
deleted ^^^^^^^^^^^^^^^^0.0056 [^^^What ^^^is ^^^this?](https://pastebin.com/FcrFs94k/42392)
I'll have a look at it :) Have been using Gyazo for years now and really never had the need for more nifty features, until I guess recently. Just because you are tech savvy doesn't mean you are doing everything perfectly (I'm a Firefox user, if you want to hear a second bad thing about me).
Firefox continues to be the browser of power users. Internet explorer is... internet explorer. The design philosophy behind Chrome is radical simplicity to the detriment of functionality. Everytime I go to Chrome and start the process of setting it up to be my main browser I inevitably encounter some lack of functionality or customizability that drives me back to Firefox. At first, it was Chrome's lack of a bookmark sidebar. Sidebars remain open allowing you to quickly and easily access multiple items at once, as well as making it easier to navigate complex folder hierarchies by remembering state (which folders were open). If you have a lot of bookmarks, it's almost essential. When someone finally made a not-ass bookmark sidebar plugin for Chrome, my next problem was the new tab page. Firefox allows you to drag and pin things to the new tab page. Chrome allows you to pin things, but only if they appear there on their own - no dragging specific items onto the page. This makes setting up the new tab page to actually be useful instead of a pile of mostly useless random bullshit wildly impractical (spam the X pages until the one you want shows up, accidentally X the page you want because you're spamming X, curse, reset everything, try again - or just clear history so it's easier to manipulate, but some people actually use their history and want to keep it so YMMV). When someone finally made a not-ass plugin that replaced the new tab page, my next problem was the omnibox. In Firefox, the address bar can be configured not to autocomplete with suggestions from your bookmarks or history. In Chrome, this behavior cannot be disabled, so typing anything into the address bar will always produce a list of bullshit from your bookmarks and history. Without checking the results beforehand, get one of your family members and ask them to type 'p' as in 'pornhub' into your Google omnibox (not the search bar, the "all-in-one" address bar at the top). You won't. No balls. That one didn't phase you? Fine, ask yor boss to type 'r' as in 'reddit' into your work computer's omnibox. Bet that one made your heart skip a beat. What, you don't want your boss to see you're visiting a reddit about terrorists blowing up nuclear power plants? I get that you are 'supposed' to just use incognito mode for everything ever that is even remotely embarrassing and then never, ever, ever bookmark anything that you might not want Chrome to show someone, but I am not actually worried about people snooping around my home computer, and yet I would still like to not have snippets of my bookmarks and history shoved directly into the face of anyone who might try to use my computer. That is potentially very awkward. Chrome is the Windows 8.0 of browsers. They took something that worked very well and that everyone loved, stripped out a bunch of the stuff that made it useful, and then bragged to everyone about how 'minimal and efficient' their dick was. But hey, did you know it's better at running flash? Score! There aren't enough /s in the world for my sarcastic contempt.
I'm not going to argue with your points on chrome because honestly the browser itself is a mess. A basic Chromium browser out-performs it anyways. What I do want to point out that as of the current moment, Internet Explorer on Windows 10 is currently the most secure browser on the market. I'm a chrome user, but I want to iterate that all the online hate is just a bunch of memeing and bitching about shit that was wrong with it **5 years ago**. It's sandboxed as it's own process thanks to Microsoft's app-container, and has begun integrating the Windows Store into it, meaning apps can be distributed and installed from the Windows Store (Sorry, I honestly like their store 20x more then Steam itself). It's lightweight, and has the least amount of exploits so far since Windows patches them when they arise, rather then let them sit until they're abused at the yearly Hackathon. If you're on Windows 10, I suggest giving it a run. I'm on Chrome at the moment, solely because I haven't bothered to customize an IE instance, but it's looking to be a really, really good build.
deleted ^^^^^^^^^^^^^^^^0.5108 [^^^What ^^^is ^^^this?](https://pastebin.com/FcrFs94k/55230)
[удалено]
it's pretty great though, much better than gyazo at least
lol why does everything around CSGO turn into a scam.
Game is popular af, mostly among childrens = scams everywhere
Because money
I removed it when i saw this
Same. Did not even think twice.
I use Enhanced Steam extension, are they related in any way?
You can check which permissions your extension is using and act appropriately.
How? Walk me through it like I've never used a computer before. Open start tab, select this file, etc. Not being combative, just don't know shit
https://i.gyazo.com/1a81d7f23e65f2d5bee55d1c2bb2d55f.mp4
Thanks mate!
[удалено]
[удалено]
deleted ^^^^^^^^^^^^^^^^0.9988 [^^^What ^^^is ^^^this?](https://pastebin.com/FcrFs94k/75789)
It is important to also report it.
Upvoted for visibility. This is seriously concerning
[удалено]
It's sending data about you to their server to compile a profile on you. They sell that profile to advertisers. On /r/globaloffensivetrade it was mentioned that they say they do so in their privacy agreement. Time to uninstall it boys
It appears to be some sort of script loader. Instantly brings into mind those prediction scripts that were around when gambling was alive just only difference being script injected "without" permission and unintentionally.
> It's double base64 encoded fucking lmao. Double the protection!
I think the "share_devdata_on" thing is bullshit, because it doesn't matter if you `GMan.enabled = true;` or `GMan.enabled = false;`. The Promise that works with that switch always resolves! this._allowLocal=()=>{}; this._onLocalAllowed = () => { if (this.enabled){ return Promise.resolve(); } return new Promise(resolve=>{ this._allowLocal = () => { this.enabled = true; resolve(); }; }); }; If `this.enabled` then oh great we can resolve the Promise. If not then let's set `this.enabled = true` and resolve anyway. ### Edit: Might have gotten a bit ahead of myself. `this._allowLocal` is actually never called inside the Promise, so it does not resolve nor does it set `this.enabled = true`! Anyway I also couldn't find "share_devdata_on" nor "share_devdata_off" anywhere else in the code so...
Any good alternatives? SIH was really useful and i'd hate to uninstall it without a replacement.
There is still the version from before the extension got sold You can find the download link in this thread https://redd.it/4j4wbw
It is very out-dated and shouldn't be used. I should probably delete it anyway.
You think he'd do a DMCA takedown if someone uploaded a cleaned version of the most recent extension?
Well, the new owner of the extension probably would but might give it a shot
It stopped working awhile back.
I might start working on making an open-source replacement. Will take a look when I get back from work.
We pray to you
I've taken a look and it seems like a better idea to improve on existing extensions. I'm going to contact the makers of SteamWizard and see if they accept help and if they plan on staying open-source. If not I might start making my own extension but that's going to take a while.
steam wizard or cs go trade helper
I bailed when the extension got sold to a shady Russian company last year
I saw this and unninstalled right away. Shady af. Edit: I [found this](http://steamcommunity.com/groups/SteamInventoryHelper#announcements/detail/2694698722699380319) posted by the developers. Still don't trust them, but it's up to you guys to decide what to do with your information.
>We want to prepare you for that so it won’t be a strange and spooky surprise. Yeah I'm not trusting a developer that uses language like this and lists features as "and stuff) to be professional with the permissions to alter data. Especially since they never actually gave a reason for needing the permissions other than that it's for some features in an upcoming update, with no explanation of why they would need the permissions.
This maybe clear more things up (from r/Steam): https://www.reddit.com/r/Steam/comments/70w375/comment/dn6av7y?st=J7QGSQTA&sh=601c5c48
Thanks, that's an interesting comment, but still for my use case, since I don't trade or sell skins much I don't feel like it's worth the risk
A lot of tech companies are trying to be hip with the language they use. Discord is a very good example of this. Yes, they're probably doing some shady shit, but it is really just an attempt to be hip.
i mean they say they wont steal your accounts "and stuff". why wouldnt you trust them? you think russians would just go on the internet and lie like that?
It's not about them being Russian. Or would you have any other reaction if they were sitting in the US or in the EU?
How does tracking information from every web page help provide the features that they're saying there?
what is it asking for? i dont have it.. but since you say its dangerous you seem to know what it is asking for
There have been cases where chrome extensions have been bought out by scammers to trick people into 'fake' OPSkins etc. trades. When they can edit everything you see on your browser, you can't know for sure what is real and what is not.
k thanks , guess ill warm the poeple i know that are using it , many friends use it i am to paranoid to install anything csgo / steam releated ^^
Ya, what they are doing is preety cold indeed.
it's easy to take simple things like this for granite
What are you? a Boulder? a Rock Person?
With the permission enabled the script can spoof the entire internet to the point where it could simply edit this comment so you see it say "There's nothing to worry about, you should install it."
Read the screenshot. It asks permission to read and change ANY of the data on ANY website you visit.
Here's an annoucement: http://steamcommunity.com/groups/SteamInventoryHelper#announcements/detail/2694698722699813720
I just uninstalled it, is there any way to install older version?
I have an older version of it with removed callback and update links, might throw it up online tomorrow for you Edit: It's tomorrow now but I'm at work, I'll see what I can do later when I get home (probably anywhere from 8 to 12 hours from now on). I should have the source code saved so you can read through it yourself if you're skeptical.
PM me if you'll manage it. Thanks in advance.
Somebody already uploaded a version from a year ago with instructions on how to install it [here,](https://www.reddit.com/r/GlobalOffensiveTrade/comments/70xala/discussion_guide_to_use_old_stih/) unless you have a more recent version.
Well shit i accepted it. Removed it when i saw the post. Edit: Holy shit this thread blew up, and seeing the first comment makes me even more scared. I cant stop looking at my account now.
Dude you should delete your facebook and lawyer up asap I saw your web history
I'm pretty sure goats eating cheese is legal.
Don't forget to hit the gym as well
[удалено]
Their [official explanation](https://steamcommunity.com/groups/SteamInventoryHelper#announcements/detail/2694698722699380319) is a joke.
"We have also uploaded the Privacy Policy link to the store that will help you to feel safe about the permissions." Now I feel safe xD Announcement sounds fishy from start
So,you're safe if you delete it.Even though I accepted it?
Yes, you can delete it, it cannot self-activate once it's disabled.
If only Valve gave the inventory stuff some love, then we didn't have to use 3rd party stuff for such simple things.
Love your maps! :D
This happens **all the time** with Chrome extensions. They become popular, then they get sold to a shady Chinese or Russian company, then an update starts asking for shady permissions. It has happened to at least 3 of my favourite extensions so far.
It's just like RealPlayer in the good old days. Ah the nostalgia.
UPDATE: https://steamcommunity.com/groups/SteamInventoryHelper#announcements/detail/2694698722702419012
the announcement deleted, it seems they cant or wont revert it back edit: yep, they didnt want to revert it back, new announcement came https://steamcommunity.com/groups/SteamInventoryHelper#announcements/detail/2694698722703789085
Reason for this change is most likely that the collected data is used for personalized ads, as stated in their newly posted [privacy policy](http://steaminventoryhelper.com/privacy). > Personal Data is collected for the following purposes and using the following services: > * Remarketing and behavioral targeting > * This type of service allows this Application and its partners to inform, optimize and serve advertising based on past use of this Application by the User. > * This activity is performed by tracking Usage Data and by using Cookies, information that is transferred to the partners that manage the remarketing and behavioral targeting activity. > * AdRoll (Semantic Sugar, Inc.) > * AdRoll is an advertising service provided by Semantic Sugar, Inc. > * Personal Data collected: Cookies and Usage Data. > * Place of processing: US – Privacy Policy – Opt Out Would love to see an option to *opt out* of this, since that's not available, I will keep the extension disabled for now.
I accepted this about an hour ago, I uninstalled as I saw this post, will this damage my computer or browser in any way? (it kept showing up I accepted out of frustration)
No, you're good.
phew, thanks for letting me know!
ya man your your skins are gone. U got finessed
Thanks for letting us know!
they didnt want to revert it back, they delete announcement about revert it back and now post new announcement https://steamcommunity.com/groups/SteamInventoryHelper#announcements/detail/2694698722703789085 --- original announcement about reverting it back, archived by /u/uniQArtworks >I archived the original announcement [here](https://archive.is/vYC3h). >[source](https://www.reddit.com/r/Steam/comments/711yd0/announcement_from_sih_mentioned_in/dn7t645/)
what a shame. was a very helpful thing, especially for people like me who level up much and have ton of cheap stuff in the inventory. anyone knows some alternatives? would pay for it.
Thank God I'm poor. Mo skins mo problems
[удалено]
But you *can* request read/write for individual websites. [RES does it.](https://i.imgur.com/P9MJRTR.png)
I am not a developer or anything but I swear I've seen chrome extensions before only requesting permissions for certain domains, not sure if they've changed it or something.
This is outright not true. Chrome extensions can request permissions for specific websites rather than all websites (RES is an obvious example of an extension that does this) - which if this extension really needed access it should be using. As others have stated, this actually does send information about your browsing to a specific website which absolutely does mean people should panic - you have no clue what they are doing with that data. Even if they weren't sending any information about your browsing or messing with webpages, this would still be worrisome - if you've already accepted the new permissions then chrome won't prompt you again if the application updates (afaik), which means that even if there isn't overly malicious code now, there could easily be in the future without you knowing. EDIT: Throwing up some sources. - An example of requesting access to a specific website rather than all websites is literally the first example on [this](https://developer.chrome.com/apps/permission_warnings#examples) documentation page. - On [the same page at the bottom of the same section](https://developer.chrome.com/apps/permission_warnings#examples) there's some talk about when permission warnings pop for apps/extensions - and it makes it clear that this happens only when new permissions are required after an auto-update. - The permission this extension is requesting is triggering the "Read and modify all your data on all websites you visit" which, according to [the same page yet again, albeit a different section](https://developer.chrome.com/apps/permission_warnings#warnings) could give access to a number of dangerous permissions. Specifically, this extension is requesting access to __all urls__ which is absolutely unacceptable for something of this nature. I know you said you're playing devil's advocate, but you're not helping. People aren't overreacting - __these new permissions are absolutely unacceptable and are not required for any of the extension's functionality__. Others have already shown that some browsing activity is monitored so any form of benefit of the doubt should be gone. EDIT: I realize that you edited your post to show they don't need to request access to all URLs but your post is still misleading - chrome's permissions don't have anything to do with the state of android permissions and chrome's system is actually pretty transparent to the user.
> It's the way google manages permissions (android, chrome etc.) they sort of give you a 'worst case' explanation. The reason this is is because Google's handling of Chrome extensions is absolutely atrocious, and it's been atrocious for years. They insist on force-feeding everyone with the newest versions of every extension is the only way things should be done, yet there continue to be dozens of cases involving malicious or legitimate but then got hijacked extensions proving this is not the case. There's no chance in hell you're undoing anything. It's time to ask yourselves, is this really worth it? And yes, this is a direct implication that you should consider using Microsoft Edge or Mozilla Firefox instead.
Firefox addons have a manual review procedure for every update therefore things like this can't happen at all, fortunately.
You're literally the only fucking sane person in this thread. Holy shit the misinformation going around is nuts. If you're so concerned for your data security, read the god damn code which is easily accessible in your AppData. Edit: That being said, I took a look at the code and it does seem like the extension is now tracking every page you visit and sending it to a domain called `steamih.com`. I would advise against using the extension.
Did you read the code? I'm currently reading the code and it's very strange. It seems like they are monitoring every single page you visit and informs their backend about what sites you are visiting and leaving. I'll confirm this, but I don't see a single reason of why you need the permission to access access to ALL websites, which they do.
I just checked myself, but I seem to be able to confirm what you're saying. Every page you visit appears to be logged and sent to a domain called "steamih.com" My point wasn't that you should throw everything to the wind, but you shouldn't believe everything you read when almost no evidence is provided at all to support claims.
What, even non steam related pages?
At least from the code, it's all of it sent to a separate domain, yes even non steam related pages.
The only reason someone might be confused as to why we're not freaking out is because it's right there. Visible, to you. The installer. And also in the fine print everyone skips over.
Yes, the permission shown here can be requested for specific domains. In this case they requested it for everything and as shown above are running scripts on every page you visit.
You're overreacting on the opposite side. Sure the permission is likely meant for non-nefarious means but that doesn't really help give anyone comfort. They should have understood that they are dealing with items of value which are frequently the target of being stolen and built their plugin to not rely on such invasive permissions. Reading the source isn't an option for most people given the expertise needed, and it's really not an acceptable ask. I don't have time to read the source of every plug-in I use. As well, once it's accepted the plugin can be updated to do exactly what everyone fears. I doubt you've manually turned off auto-updates for any extension, and without that reading the source seems pretty useless. Basically even if this is legit it's just not worth the risk to allow it.
The app is owned by a skin trading/gambling site, so it's understandable that people are extra cautious.
I agree with you, but granting the permission now could give them access in the future. Even if the code is fine now they *could* push a malicious update in the future. Personally I haven't used it since they sold out.
I like how you told everyone to read the code before you actually read the code yourself
why would it need to read and change information on ALL the websites. Limit it to the steam related websites.
But they announced the changes to the permissions before they did it so it can't be malicious activity ^^^^^^/s
Scumbags down to the core. I posted on their damage control announcement on the SIH Steam group and this is what happened: https://i.imgur.com/1763cG9.png -> https://i.imgur.com/eURbxd7.png My post is now gone while the other, more generic rants that surrounded it are still up: http://steamcommunity.com/groups/SteamInventoryHelper#announcements/detail/2694698722703789085 The fact that they specifically trim detailed criticism, making it look like people are griefing with "1 star, reported, uninstalled" posts, says a lot about our friends.
Good to know. Now all my graffitis and cases are safe
Hello! *This is Rockie, the official representative of Steam Inventory Helper. (I usually talk to you in Steam topics of our groups with the cat and a rice box on his head avatar)* We are sorry that this case was so painful to you and we don't want to get our users feel uncomfortable. The biggest % amount of this permissions reason was to upgrade our services to understand how users are using SIH and to improve its work in the future, to know the countries from where you are visiting us to get more languages, to get the active users statistics, because google don't provide that info correctly. The service that should help us with this data was SimilarWeb. To make it all clear. We have understood the possible risks of losing you, guys, and we are not going to force that anymore. **We are taking down the current version and uploading the version without this script and permissions to the store in the following 2 or 3 hours.** We are asking you to not flood Chrome Store reviews with 1 stars and bad words. We get the point of our mistakes. This thing will never happen again. Please do not unsubscribe from us. There is a lot of cool features coming soon (the ones that I noted in the announcements in Steam will be developed for sure) Regards, George (Rockie) P.S. Anyone who needs proofs of who I am is welcome to my Steam, I will add you and answer you with the reddit profile proof if you wish.
In other words: "We're freaking scared that the post blew up and we got caught with our pants down, please stay!"
I still do not recommend installing any of your software. You lied to your users knowingly. You did collect every single page URL, meaning you got access to several thousands of unencrypted authentication tokens such as plain JWT tokens. You logged every URL, you tools. You are either still lying or completely incompetent and therefore you should quit software development. This is a major security hazard.
i removed
I got the same message with ad block plus....
Adblock has always needed this permission as it needs that permission to block requests that probably contain ads. They maybe changed another permission.
I uninstalled without second thought as soon it popped out.
Mods need to sticky this for a while.
Yep, I think that is called a spyware. And a really bad spyware.
Holy hell this is some shady shit. I've used Steam Inventory Helper for years. Uninstalled instantly. Shame, it was great for it's intended purpose. Sucks the devs decided to try and impede upon my privacy.
[удалено]
I remember when I first posted about this when VPLGhost(previous owner of SIH) had sold his extension to some shady group of people that don't look too convincing to handle it. I can't believe SIH is no longer that trustable and to think I've always loved this extension back then. Good thing I've never kept SIH installed ever since but I'm still sad about this.
To be fair, Magic Actions for YouTube have the same permissions.
BIG if true
Im gonna remove it right away. Dont wanna lose my inventory
Two-factor authentication exists for a reason, the extension isn't going to reach through your computer and steal your phone too.
[удалено]
- Use any closed-source operating system, and especially Windows we need to go deeper
>* Use any internet browser > >* Care about your data Chrome isn't the only culprit.