[iamartnez]

Since Chrome auto-updates extensions, users are likely not aware of this change.

I've been using the extension for several months until I noticed the transparent redirection. In fact, the only reason I noticed the redirect is when it failed. I clicked on a Google search result and got stuck on a blank page like this:

    http://ecolink3.ecosia.org/?key=3cdcd4dc082e3c7b860abe4608b6925d&out=http%3A%2F%2Fwww.usatoday.com%2Fstory%2Fpopcandy%2F2013%2F01%2F15%2Ffred-armisen-ira-glass-this-american-life%2F1836079%2F&cuid=2

[Encosia]

It's kind of creepy how close that domain name is to my own domain (and username here). Definitely elicited a double take when I saw it.

[charlesism]

Google made a big mistake by not including a GUI option to manageme auto-updates. I write an extension that interacts with data on a financial website, and this policy of forcing automatic updates on all extensions is dangerous. It means I can not guarantee my users my extension is 100% safe, even if they audit its javascript files, because if I were a bad guy, I would still have the power to update the code in the dead of night. It's not very attractive to tell users they can only protect themselves if they both understand javascript, and also dig through files to manually disable auto-updates.

[wfunction]

> Since Chrome auto-updates extensions

How do you disable this?

[joshschreuder]

Not sure if you can or not, but you can use this: https://chrome.google.com/webstore/detail/extensions-update-...

Which pops up a toast notification whenever an extension gets updated so you can investigate (Chrome doesn't force changelogs on updates either so you might have to dig deeper into the code).

If you don't mind having another extension which could be doing nefarious things.

[wfunction]

Thanks, it's better than nothing at least.

[Rant: the whole concept of auto-update-by-default is stupid. /Rant]

[ygra]

If there was something like »Updates for your extensions are available, install them now?« would it really help or would most users just say »yes«? They'd have no way of verifying that the update is benign or not anyway.

[wfunction]

It should be more like "Updates for your extensions are available; they will be installed when Chrome is restarted. [OK] [Cancel automatic updates]".

Or basically anything that gives you the option to avoid doing so.

[userbinator]

I've never been a fan of automatic updates for this reason. Changing things silently, while seemingly praised by some "usability experts", implies taking away user choice and replacing it with submissiveness. It's creepy.

[jelled]

Same thing happened to me. Wouldn't have noticed if the redirect hadn't failed a couple of times.