Sunday, September 14, 2025

Polaris of Enlightenment

The most dangerous thing in your browser

The dark side of browser extensions.

Published 26 April 2025
– By Naomi Brockwell
6 minute read
You’re browsing the web, trying to make life a little easier. Maybe you install an extension to block annoying popups, write better emails, or even just save a few bucks with coupon codes.

Seems harmless, right?

Extensions are way more permissive and dangerous than people realize.

They might be spying on you, logging your browsing history, injecting malicious code, even stealing your passwords and cookies – all without you even realizing it.

Let’s talk about the dark side of browser extensions. Because once you see what they’re capable of, you might think twice before installing another one.

DON’T Install That Extension

Real-world attacks: From spyware to crypto theft

This isn’t a “worst-case scenario”. It’s already happening.

  • North Korean hackers have used malicious browser extensions to spy on inboxes and exfiltrate sensitive emails.
  • The DataSpii scandal exposed the private data of over 4 million users—collected and sold by innocent-looking productivity tools.
  • Mega.nz, a privacy-respecting file storage service, had its Chrome extension hacked. Malicious code was pushed to users, silently stealing passwords and crypto wallet keys. It took them four hours to catch it—more than enough time for real damage.
  • Cyberhaven, a cybersecurity company, was breached in late 2024. Their extension was hijacked and used to scrape cookies, session tokens, and authentication credentials—compromising over 400,000 users.

How is this even allowed to happen?

  1. Extensions can silently update themselves. The code running on your device can change at any time—without your knowledge or approval.
  2. Permissions are ridiculously broad. Even if a malicious extension has the same permissions as a good one, it can abuse them in ways the browser can’t distinguish. Once you grant access, it’s basically an honor system.
  3. Extensions can’t monitor each other. If you think that installing a malware-blocking extension is going to protect you, think again. Your defense extensions have no way of knowing what your other extensions are up to. Malicious ones can lurk undetected, even alongside security tools.

A Shadow market for extensions

Extensions aren’t just targets for hackers—they’re targets for buyers. Once an extension gets popular, developers often start getting flooded with offers to sell. And because extensions can silently update, a change in ownership can mean a complete change in behavior—without you ever knowing.

Got an extension with 2 million Facebook users? Buy it, slip in some malicious code, and suddenly you’re siphoning data from 2 million people.

There are entire marketplaces for buying and selling browser extensions—and a thriving underground market too.

Take The Great Suspender, for example. It started as a widely trusted tool that saved memory by suspending unused tabs. Then the developer quietly sold it. The new owner injected spyware, turning it into a surveillance tool. Millions of users were compromised before it was finally flagged and removed.

The danger is in the permissions

One of the biggest challenges? Malicious extensions often ask for the same permissions as good ones. So it’s helpful to understand exactly what each permission is capable of, so that you realize how vulnerable it could make you in the wrong hands.

We spoke to Matt Frisbie, author of Building Browser Extensions, to explain the capabilities of some of these permissions:

Browsing history

Matt Frisbie:

The browser will happily dump out your history as an array.

The browsing history permission grants full access to every site you visit—URLs, timestamps, and frequency. This can help build out a detailed profile on you.

Cookies

The cookie permission exposes your browser’s cookies—including authentication tokens. That means a malicious extension can impersonate you and access your accounts without needing a password or 2FA.

Matt Frisbie:

“If someone steals your cookies, they can pretend to be you in all sorts of nasty ways.”

This is exactly how Linus Tech Tips had their YouTube account hijacked.

Screen capture

Allows extensions to take screenshots of what you’re viewing. Some types trigger a popup, but tab capture does not—it silently records the visible browser tab, even sensitive pages like banking or crypto dashboards.

Matt Frisbie:

“It just takes a screengrab and sends it off, and you will never know what’s happening.”

Web requests

This lets the extension monitor all your browser’s traffic, including data sent to and from websites. Even if the data is being sent over HTTPS, to the extension it’s all in the clear. They can read form data, credit card details, everything.

Matt Frisbie:

“It’s basically a man-in-the-middle… I can see what you’re sending to stripe.com—even if their security is immaculate.”

Web navigation

Provides a live feed of your browsing behavior—what pages you visit, how you get there, and when.

Keystroke logging

Records everything you type—searches, passwords, messages—without needing any special permissions. All it takes is a content script, which runs invisibly on websites.

Matt Frisbie:

“It’s incredibly dangerous and very easy to do.”

Input capture

Watches for changes in form fields, allowing extensions to steal autofilled passwords or credit card numbers—even if you don’t type anything.

Matt Frisbie:

“Anytime an input changes—login box, search bar, credit card entry—this extension can capture what’s changed.”

Geolocation

Extensions can’t access your location in the background. But they can render a user interface—like a popup window—and collect your location when you interact with it. If you’ve granted the extension geolocation permission, it can capture your location every time you open that popup.

Even sneakier? Extensions can piggyback off websites that already have location access. If you’ve allowed a site like maps.google.com or hulu.com to use your location, an extension running on that site can silently grab it—no popup required.

Matt Frisbie:

“If the user goes to maps.google.com and they’ve previously said maps.google.com can read my location… then the extension can piggyback on that and grab their location. No pop-ups generated.”

Other Piggybacking

If you’ve granted a site permission—like location, notifications, or potentially even camera and microphone—an extension running on that same site can sometimes piggyback off that access and silently collect the same data.

Matt Frisbie:

“It is actually possible to piggyback off the page’s permissions. … It really shouldn’t work that way.”

So… How Do You Protect Yourself?

Here are some smart rules to follow:

  • Understand permissions
    Know what you’re granting access to, and what that permission might be capable of.
  • Be careful granting any permissions
    Whether it’s a browser setting, a site request, or an extension prompt, even a single permission can open the door to surveillance.
  • Use extensions sparingly
    The more extensions you install, the larger your attack surface—and the more unique your browser fingerprint becomes.
  • Use a privacy-first browser instead
    Browsers like Brave build privacy protections—like ad and tracker blocking—directly into the browser itself, so you don’t need extensions just to stay private.
  • Follow the principle of least privilege
    Only allow an extension to run when you click it, instead of “on all websites.”
  • Use code review tools
    Sites like Extension Total and Secure Annex can help you vet extensions before you install them.

Takeaway

We all want our browser to be faster, cleaner, and more functional. Extensions can help—but they can also turn into powerful surveillance tools. Even a single line of malicious code, slipped in through an update or new owner, can put your most sensitive information at risk.

So before you install that next extension, ask yourself:
Do I really trust this extension not to be hacked, sold, or misused—and is the extra risk worth it?

Stay sharp. Stay private. Stay safe out there.

 

Yours in privacy,
Naomi

Naomi Brockwell is a privacy advocacy and professional speaker, MC, interviewer, producer, podcaster, specialising in blockchain, cryptocurrency and economics. She runs the NBTV channel on Rumble.

TNT is truly independent!

We don’t have a billionaire owner, and our unique reader-funded model keeps us free from political or corporate influence. This means we can fearlessly report the facts and shine a light on the misdeeds of those in power.

Consider a donation to keep our independent journalism running…

A Bell Labs for privacy

What Bell Labs taught us about orchestrating breakthroughs, and how we can use those lessons to push back against surveillance today.

Published yesterday 8:25
– By Naomi Brockwell
9 minute read

I’ve been reading The Idea Factory by Jon Gertner, and it’s fascinating. It tells the story of Bell Labs, the research arm of AT&T, and a singular moment in history when a small community of scientists and engineers played a huge role in inventing much of the modern world. From the transistor to information theory, from lasers to satellites, a staggering number of breakthroughs can trace their origins from this one place.

The book asks: what made this possible?

It wasn’t luck. It was a deliberate design. Bell Labs proved that invention could be engineered: You can create the right environment to deliberately make breakthroughs more likely. With the right structure, culture, and incentives, it’s possible to give technological progress its best possible chance.

And this got me thinking: what’s the most effective way to move privacy and decentralized tech forward? Perhaps the internet itself taken on the role Bell Labs once played, and become the shared space where ideas collide, disciplines mix, and breakthroughs emerge? If so, how do we best harness this potential?

A factory for ideas

After World War II, Mervin Kelly, Bell Labs’ president, asked a radical question: could invention itself be systematized? Instead of waiting for breakthroughs, could he design an environment that produced them more reliably?

He thought the answer was yes, and reorganized Bell Labs accordingly. Metallurgists worked alongside chemists, physicists with mathematicians, engineers with theorists. Kelly believed the greatest advances happened at the intersections of fields.

There were practical reasons for cross-disciplinary teams too. When you put a theorist beside an experimentalist or engineer, hidden constraints surface early, vague ideas become testable designs, bad ideas die faster, and good ones escape notebooks and turn into working devices.

Bell Labs organized its work into a three-stage pipeline for innovation:

  1. Basic research: scientists exploring fundamental questions in physics, chemistry, and mathematics. This was the source of radical, sometimes “impractical” ideas that might not have an immediate use but expanded the frontier of knowledge.
  2. Applied research: engineers and theorists who asked which discoveries could actually be applied to communication technology. Their role was to translate abstract science into potential uses for AT&T’s vast network.
  3. Development and systems engineering: practical engineering teams who built the devices, refined the systems, and integrated them into the company’s infrastructure so they could work at scale in the real world.

This pipeline meant that raw science didn’t just stay theoretical. It became transistors in radios, satellites in orbit, and digital switching systems that powered the modern telephone network.

Bell Labs’ building architecture was designed to spark invention as well. At the Murray Hill campus, famously long corridors linked departments to trigger chance encounters. A physicist might eat lunch with a metallurgist. A chemist might bump into an engineer puzzling over a problem. And there was a cultural rule: if a colleague came to your door for help, you didn’t turn them away.

Causation is hard to prove, but the lab’s track record in the years that followed was remarkable:

  • The transistor (1947): John Bardeen, Walter Brattain, and William Shockley replaced bulky vacuum tubes and launched the electronics age.
  • Information theory (1948): Claude Shannon created the mathematics of communication, the foundation of everything from the internet to data encryption.
  • And much more: semiconductor and silicon device advances; laser theory and early lasers (including a 1960 continuous-wave gas laser); the first practical silicon solar cell (1954); major contributions to digital signal processing and digital switching; Telstar satellite communications (1962). The list goes on.

The Secret Sauce… it’s not what you think

Some people may argue that Bell Labs succeeded for other reasons. They point to government protection, a regulated market, defense contracts, and deep pockets. Those things were real, but they are not a sufficient explanation. Plenty of money is poured into research that goes nowhere. And protected monopolies often stagnate, because protection reduces the incentive to improve.

What Bell Labs’ resources did buy was proximity. Kelly’s goal was to gather great talent under one roof, and strategically try to increase the chances they would interact and work together. He built a serendipity machine.

The real lesson to take away from Bell Labs isn’t about money. It’s about collaboration and chance encounters.

By seating different disciplines side by side, they could connect, collaborate, and share insights directly. Building on one another’s ideas and sparking new ones led to a staggering array of advances at Bell Labs in the post-war decade.

Now in Kelly’s day, the best ways to give cross-pollination a real chance was to get people together in person, and that took a large amount of money from a behemoth corporation like AT&T.

If we wanted to manufacture the same kind of world-changing collaboration to push the privacy movement forward today, would we need AT&T-level resources?

Not necessarily. The internet can’t replicate everything Bell Labs offered, but it does mimic a lot of the value. Above all, it gives us the most powerful tools for connection the world has ever seen. And if we use those tools with intent, it’s possible to drive the same kind of serendipity and collaboration that once made Bell Labs extraordinary.

A decentralized Bell Labs

Kelly emphasized that casual, in-person encounters were irreplaceable.

A phone call didn’t suffice because it was usually scheduled, purposeful, and limited.

What he engineered was serendipity, like bumping into someone, overhearing a problem, and having an impromptu brainstorm.

Today, the internet in many ways mimics similar chance encounters. What once required hundreds of millions of dollars and government contracts can now be achieved with a laptop and an internet connection.

  1. Open work in public: GitHub issues, pull requests, and discussions can now be visible to anyone. A stranger can drop a comment, file a bug, or propose a fix. This is the digital version of overhearing a whiteboard session and joining in.
  2. Frictionless publishing: Research papers, blog posts, repos, and demos can go live in minutes and reach millions. People across disciplines can react the same day with critiques, code, or data.
  3. Shared problem hubs: Kaggle competitions, open benchmarks, and Gitcoin-style bounties concentrate diverse talent on the same challenge. Remote hackathons add the social, time-bound pressure that sparks rapid collaboration, like at Bell Labs where clusters of scientists would swarm the same puzzle, debate approaches in real time, and push each other toward breakthroughs. At Bell Labs, Kelly deliberately grouped many of the smartest people around the same hard problem to force progress.
  4. Topic subscriptions, not just people: Following tags, keywords, or RSS feeds brings in ‘weak-tie’ expertise from outside your circle. ‘Weak ties’ comes from social network theory: ‘strong ties’ are your close friends and colleagues, and you often share the same knowledge. ‘Weak ties’ are acquaintances, distant colleagues, or people in other fields, and they’re more likely to introduce new information or perspectives you don’t already have. So when you follow topics (like ‘post-quantum cryptography’ or ‘homomorphic encryption’) instead of just following individual people, you start seeing insights from strangers in different circles. That’s where fresh breakthroughs often come from — not the people closest to you, but the weak ties on the edges of your network.
  5. Remixes and forks: On places like GitHub, instead of just commenting on someone’s work, you can copy it, modify it, and publish your own version. That architecture encourages people to extend ideas. It’s like in a Bell Labs meeting where instead of only talking, someone picks up the chalk and adds to the equation on the board.
  6. Chance discovery: Digital town halls expose you to reposts, recommendations, and trending threads you might never have gone looking for. Maybe someone tags you in a post they think you’d find useful, or you have cultivated a “list”, where you follow a group of accounts that consistently have interesting thoughts. These small nudges can create a digital form of the ‘hallway collision’ Kelly tried to design into Bell Labs.
  7. Cross-linking and citation trails: Hyperlinks, related-paper tools, and citation networks help you move from one idea to another, revealing useful work you did not know to look for. It’s like walking past ten doors you didn’t know you needed to knock on.
  8. Lightweight face time: AMAs, livestream chats, and open office hours give people a simple way to drop in, ask questions, and get unstuck, and are the digital equivalent of popping by someone’s desk.

Now, anyone can tap into a global brain trust. A metallurgist in Berlin, a cryptographer in San Francisco, and a coder in Bangalore can share code, publish findings, and collaborate on the same project in real time. Open-source repositories let anyone contribute improvements. Mailing lists and forums connect obscure specialists instantly. Digital town squares recreate the collisions Kelly once designed into Murray Hill.

What once depended on geography and monopoly rents has been democratized. And we already have proof this model works. For example, Linux powers much of the internet today, and it is the product of a largely decentralized, voluntary collaboration across borders. It is a commons built by thousands of contributors.

The internet is nothing short of a miracle. It is the infrastructure that makes planetary-scale cross-pollination possible.

The question now is: what are the great challenges of our time, and how can we deliberately accelerate progress on them by applying the lessons Bell Labs taught us?

The privacy problem

Of all the challenges we face, privacy is among the most urgent. Surveillance is no longer the exception, it is the norm.

The stakes for advancing privacy in our everyday lives are high: surveillance is growing day by day, with governments buying massive databases from brokers, and corporations tracking our every move. The result is a chilling effect on human potential. Under constant observation people self-censor, conform, and avoid risk; creativity fades and dissent weakens.

Privacy reverses that. It creates the conditions for free thought and experimentation. In private, people can test controversial ideas, take risks, and fail without fear of judgment. That freedom is the soil in which innovation grows.

Privacy also safeguards autonomy. Without control over what we reveal and to whom, our decisions are subtly manipulated by those who hold more information about us than we hold about them. Privacy rebalances that asymmetry, letting us act on our own terms.

At a societal level, privacy prevents conformity from hardening into tyranny. If every action and association is observed, the boundaries of what is acceptable shrink to the lowest common denominator. Innovation, whether in science, art, or politics, requires the breathing room of privacy to flourish.

In short, privacy is not just a shield. It is a precondition for human flourishing, and for the breakthroughs that push civilization forward.

If we want freedom to survive in the digital age, we must apply the Bell Labs model to accelerate privacy innovation with the same deliberate force that once created the transistor and the laser.

Just as Bell Labs once directed its collective genius toward building the information age, we must now harness the internet’s collaborative power to advance the lived privacy of billions across the globe.

The call to build

Kelly’s insight was that breakthroughs do not have to be random. They can be nurtured, given structure, and accelerated. That is exactly what we need in the privacy space today.

The internet already gives us the structure for invention at a global scale. But privacy has lagged, because surveillance has stronger incentives: data is profitable, governments demand back doors, and convenience keeps people locked in. The internet is not a cure-all either: it produces noise, and unlike Bell Labs, there is no Kelly steering the ship. It’s up to us to curate what matters, chart our own course, and use these tools deliberately if we want them to move privacy forward.

The best future is not one of mass surveillance. It is one where people are free to think, create, and dissent without fear. Surveillance thrives because it is organized. Privacy must be too.

The future will not hand us freedom. We have to build it.

 

Yours in Privacy,
Naomi

Naomi Brockwell is a privacy advocacy and professional speaker, MC, interviewer, producer, podcaster, specialising in blockchain, cryptocurrency and economics. She runs the NBTV channel on Rumble.

AI company pays billions in damages to authors

Published 10 September 2025
– By Editorial Staff
The AI company has used pirated books to train its AI bot Claude.
1 minute read

AI company Anthropic is paying $1.5 billion to hundreds of thousands of authors in a copyright lawsuit. The settlement is the first and largest of its kind in the AI field.

It was last year that authors Andrea Bartz, Charles Graeber and Kirk Wallace Johnson filed a lawsuit against Anthropic for using pirated books to train their AI Claude.

In June, a federal judge ruled that it was not illegal to train AI chatbots on copyrighted books, but that Anthropic had wrongfully obtained millions of books via pirate sites.

Now Anthropic has agreed to pay approximately $3,000 for each of the estimated 500,000 books covered. In total, this amounts to $1.5 billion.

First of its kind

The settlement is the first in a series of legal proceedings ongoing against AI companies regarding the use of copyrighted material for AI training. Among others, George R.R. Martin together with 16 other authors has sued OpenAI for copyright infringement.

As best as we can tell, it’s the largest copyright recovery ever, says Justin Nelson, lawyer for the authors, according to The Guardian. It’s the first of its kind in the AI era.

If Anthropic had not agreed to the settlement, experts say it could have cost significantly more.

We were looking at a strong possibility of multiple billions of dollars, enough to potentially cripple or even put Anthropic out of business, says William Long, legal analyst at Wolters Kluwer.

Spyware takes photos of porn users for blackmail

Published 9 September 2025
– By Editorial Staff
Strangely enough, Stealerium is distributed as free open source code on Github.
2 minute read

Security company Proofpoint has discovered malicious software that automatically photographs users through their webcams when they visit pornographic sites. The images are then used for extortion purposes.

The new spyware Stealerium has a particularly disturbing function: it monitors the victim’s browser for pornography-related search terms like “sex” and “porn”, while simultaneously taking screenshots and webcam photos of the user, sending everything to the hacker.

Security company Proofpoint discovered the software in tens of thousands of email messages sent since May this year. Victims were tricked into downloading the program through fake invoices and payment demands, primarily targeting companies in hospitality, education and finance.

— When it comes to infostealers, they typically are looking for whatever they can grab, says Selena Larson, researcher at Proofpoint to Wired.

— This adds another layer of privacy invasion and sensitive information that you definitely wouldn’t want in the hands of a particular hacker. It’s gross. I hate it, she adds.

Available openly on Github

In addition to the automated sextortion function, Stealerium also steals traditional data such as banking information, passwords and cryptocurrency wallet keys. All information is sent to the hacker via services like Telegram, Discord or email.

Strangely, Stealerium is distributed as free open source code on Github. The developer, who calls himself witchfindertr and claims to be a “malware analyst” in London, maintains that the program is “for educational purposes only”.

— How you use this program is your responsibility. I will not be held accountable for any illegal activities. Nor do i give a shit how u use it, the developer writes on the page.

Kyle Cucci, also a researcher at Proofpoint, calls automated webcam images of users browsing porn “pretty much unheard of”. The only similar case was an attack against French-speaking users in 2019.

New trend among cybercriminals

According to Larson, the new type of attacks may be part of a larger trend where smaller hacker groups are turning away from large-scale ransomware attacks that attract authorities’ attention.

— For a hacker, it’s not like you’re taking down a multimillion-dollar company that is going to make waves and have a lot of follow-on impacts. They’re trying to monetize people one at a time. And maybe people who might be ashamed about reporting something like this, Larson explains.

Proofpoint has not identified specific victims of the sextortion function, but believes that the function’s existence suggests it has likely already been used.

New robot takes on household chores

The future of AI

Published 7 September 2025
– By Editorial Staff
1 minute read

The AI robot Helix can wash dishes, fold laundry and collaborate with other robots. It is the first robot of its kind that can control the entire upper part of the body.

The American robotics company Figure AI’s new humanoid robot has visual perception, language understanding and full control over fingers, wrists, torso and head. This enables the robot to pick up small objects and thereby help with household tasks.

Helix is powered by a so-called dual-system architecture, which can be explained as having a unique “two-brain” AI architecture where one part interprets language and vision while another part controls movements quickly and precisely.

Among other things, the company demonstrates that the robot can load dishes into the dishwasher, fold laundry and sort groceries. The robot can also sort and weigh packages at postal facilities.

It can also handle thousands of new objects in cluttered environments, without prior demonstrations or custom programming. This means it can perform tasks it is not programmed for and is designed to solve problems independently in an unpredictable environment.

It can follow voice commands in a similar way to talking with a human and act accordingly. What also makes the robot special is that it can collaborate with other robots. In tests, for example, two Helix robots have successfully been able to work together to unpack groceries.

Our independent journalism needs your support!
We appreciate all of your donations to keep us alive and running.

Our independent journalism needs your support!
Consider a donation.

You can donate any amount of your choosing, one-time payment or even monthly.
We appreciate all of your donations to keep us alive and running.

Dont miss another article!

Sign up for our newsletter today!

Take part of uncensored news – free from industry interests and political correctness from the Polaris of Enlightenment – every week.