Blockify update: I had Claude strip it's tracking capabilities

After Blockify being blocked from the Store I had Claude look up the reason for it by uploading the CRX file. This is what it gave me back:

1. It uploads your entire browsing history. The background script (analytics.js) registers listeners on every tab navigation and, with no opt-in or consent gate, sends the full URL of every http(s) page you visit, plus the referrer, a persistent per-user UUID, your user agent, OS, browser version, and timezone to insights.getblockify.com. The payload is encrypted with a key hardcoded in the extension (ej0hie1MThoo8Ri2), which hides it from you, not from them. stat.init() runs unconditionally at startup. This is the single most damning finding — it's a browsing-history harvester.

2. It can post YouTube comments from your account. opt/yt_autocomment.js (injected into every YouTube page) posts promotional comments like "loving this video ad-free with Blockify!!" via a hidden iframe while you're logged in, up to one per 24 hours. The comment texts are fetched remotely from blockify.b-cdn.net/cc.json, meaning the developer can change what your account posts at any time. The code claims it's opt-in via a promo popup, but the mechanism itself — remotely controlled comments posted silently from your identity — is a spam-bot capability.

3. Remote configuration / kill switches. It regularly fetches switches190.json from a CDN to toggle behaviors remotely, and there's dormant (currently commented-out) code for injecting hidden iframes from browsebetter.io — a domain associated with monetization frames — into pages.

4. Excessive footprint. It requests host permissions for every website (*://*/*), runs content scripts on all sites, and exposes all its resources (web_accessible_resources: "*") to every page and every other extension, which makes you fingerprintable and is a security anti-pattern.

Therefore I had Claude strip these capabilities and give me the hardened version of the add-on:

I stripped (each is now an early return; before the network call, or removed outright — the ad-blocking code paths are untouched):

• Browsing-history upload — analytics.js reportAction no longer POSTs every visited URL + referrer + UUID to insights.getblockify.com/process.
• YouTube auto-commenter — removed from the manifest's content scripts and the file stubbed to a no-op, so it can't post comments from your account or fetch remote comment text (cc.json).
• Three /metrics beacons — the Spotify, YouTube, and promo-opt-in event pings (each sending your persistent UUID) are disabled.
• Two Sentry error beacons — reportErrorToSentry / reportErrorToSentry2 no longer send your UUID + diagnostics to sentry.getblockify.com.
• Auto-update removed — deleted update_url so Chrome can't silently pull the original tracking build back over your clean one.
• Store verification metadata removed — deleted _metadata/ so the edited files load without a content-verification mismatch.

PM me if you want the ZIP file.

submitted by /u/Emergency-Court8298
[link] [comments]