After Blockify being blocked from the Store I had Claude look up the reason for it by uploading the CRX file. This is what it gave me back:
1. It uploads your entire browsing history. The background script (analytics.js) registers listeners on every tab navigation and, with no opt-in or consent gate, sends the full URL of every http(s) page you visit, plus the referrer, a persistent per-user UUID, your user agent, OS, browser version, and timezone to insights.getblockify.com. The payload is encrypted with a key hardcoded in the extension (ej0hie1MThoo8Ri2), which hides it from you, not from them. stat.init() runs unconditionally at startup. This is the single most damning finding — it's a browsing-history harvester.
2. It can post YouTube comments from your account. opt/yt_autocomment.js (injected into every YouTube page) posts promotional comments like "loving this video ad-free with Blockify!!" via a hidden iframe while you're logged in, up to one per 24 hours. The comment texts are fetched remotely from blockify.b-cdn.net/cc.json, meaning the developer can change what your account posts at any time. The code claims it's opt-in via a promo popup, but the mechanism itself — remotely controlled comments posted silently from your identity — is a spam-bot capability.
3. Remote configuration / kill switches. It regularly fetches switches190.json from a CDN to toggle behaviors remotely, and there's dormant (currently commented-out) code for injecting hidden iframes from browsebetter.io — a domain associated with monetization frames — into pages.
4. Excessive footprint. It requests host permissions for every website (*://*/*), runs content scripts on all sites, and exposes all its resources (web_accessible_resources: "*") to every page and every other extension, which makes you fingerprintable and is a security anti-pattern.
Therefore I had Claude strip these capabilities and give me the hardened version of the add-on:
I stripped (each is now an early return; before the network call, or removed outright — the ad-blocking code paths are untouched):
- Browsing-history upload —
analytics.js reportActionno longer POSTs every visited URL + referrer + UUID toinsights.getblockify.com/process. - YouTube auto-commenter — removed from the manifest's content scripts and the file stubbed to a no-op, so it can't post comments from your account or fetch remote comment text (
cc.json). - Three
/metricsbeacons — the Spotify, YouTube, and promo-opt-in event pings (each sending your persistent UUID) are disabled. - Two Sentry error beacons —
reportErrorToSentry/reportErrorToSentry2no longer send your UUID + diagnostics tosentry.getblockify.com. - Auto-update removed — deleted
update_urlso Chrome can't silently pull the original tracking build back over your clean one. - Store verification metadata removed — deleted
_metadata/so the edited files load without a content-verification mismatch.
PM me if you want the ZIP file.
[link] [comments]