Light

Episode #1013 Quiz

Chrome Web Store Is a Mess
Date: 2025-02-18 | Length: 2.25 hrs | Episode page at twit.tv

About this episode

This episode covers the problematic Chrome Web Store security, highlighting poor Google moderation of extensions despite major market share. Researcher Wladimir Palant reveals widespread malicious and spammy extensions, inconsistent enforcement, fake reviews, and ineffective developer reporting.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode's detailed discussion, why is the term 'backdoor' considered a misnomer in the context of the UK's encryption order to Apple?

Question 1

According to the episode's detailed discussion, why is the term 'backdoor' considered a misnomer in the context of the UK's encryption order to Apple?

Because a backdoor is by definition secret, but UK-mandated access cannot be secret and thus is a 'front door' with a key held by Apple. Because the UK order requests only cryptographic weakness disclosure, not access, so 'backdoor' is inaccurate. Because Apple already holds all encryption keys, so no new 'backdoor' is required or requested. Because 'backdoor' implies physical hardware vulnerabilities, which is unrelated to software encryption mandates.

Question 2: What is the primary reason Google's Chrome Web Store is described as a 'mess' by developer Wladimir Palant, as discussed in the episode?

Question 2

What is the primary reason Google's Chrome Web Store is described as a 'mess' by developer Wladimir Palant, as discussed in the episode?

Google Chrome's extension architecture does not support sandboxing, causing security issues. Google's reliance on automated moderation fails to prevent malicious or deceptive browser extensions effectively. Google's Web Store has too few extensions, limiting user choice and encouraging malicious activity. Google imposes excessively strict manual review that delays extension publication and frustrates developers.

Question 3: Regarding the ransomware group RansomHub analyzed in the episode, which statement accurately reflects their methods and targets?

Question 3

Regarding the ransomware group RansomHub analyzed in the episode, which statement accurately reflects their methods and targets?

RansomHub relies exclusively on exploiting zero-days and never attempts brute-force attacks on VPNs for initial access. RansomHub primarily targets personal computers using novel zero-day vulnerabilities in Windows XP. RansomHub exploits known Microsoft Active Directory and Netlogon flaws patched years earlier to compromise domain controllers and encrypt data. RansomHub's ransomware only encrypts data without exfiltration and avoids extorting victims via data leaks.

Question 4: What mitigation strategy does the episode describe regarding Google's new 'TOAD' feature in Android 16 Beta 2?

Question 4

What mitigation strategy does the episode describe regarding Google's new 'TOAD' feature in Android 16 Beta 2?

Requiring biometric authentication for any app installation initiated over a phone call. Disabling all SMS messaging capabilities during phone calls to prevent scam message delivery. Automatically uninstalling apps installed from unknown sources immediately after a phone call ends. Blocking users from changing app install or accessibility settings during a phone call to prevent scammer-guided malicious app sideloading.

Question 5: Why does the episode suggest that using DNS over TLS directly on a local router might be more beneficial than configuring it only on individual browsers?

Question 5

Why does the episode suggest that using DNS over TLS directly on a local router might be more beneficial than configuring it only on individual browsers?

Because router-level DNS over TLS preserves local DNS caching, benefiting all LAN clients and improving resolution speed compared to browser-only configurations. Because router DNS over TLS allows bypassing ISP DNS servers entirely, whereas browsers cannot bypass them properly. Because browsers cannot natively support DNS over TLS, requiring routers to handle DNS encryption instead. Because DNS over TLS on routers provides stronger encryption than browser-level implementation, protecting against man-in-the-middle attacks.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.