Skip to content
This repository has been archived by the owner on Dec 23, 2019. It is now read-only.

Removed from Chrome Store! 😭 #13

Closed
EranSch opened this issue Aug 8, 2017 · 25 comments
Closed

Removed from Chrome Store! 😭 #13

EranSch opened this issue Aug 8, 2017 · 25 comments

Comments

@EranSch
Copy link
Owner

EranSch commented Aug 8, 2017

As noted in #12, this extension was removed from the Chrome Store. The full email can be reviewed below however the reason for removal is stated that the extension "has one or more file(s) that contain minified or obfuscated code which is not human readable".

As a reminder, this extension's source code was copied from an original version which was fully obfuscated. I did my best to deobfuscate and placed it here on Github for those who wish to use it to review and use if they felt comfortable.

As far as I have been able to tell, the extension is safe to use and I have done so personally for several years now. That said, the Chrome review department remains unsatisfied with the extension which leaves myself and fellow users of the extension in a bind.

For some time now, I have wanted to re-write this extension to better support new features and improve the comprehensibility of the code base. Time, of course, is the limiting factor. If there is a compelling interest in a rewrite from the extension's userbase then I may be compelled to invest the time but I'm having a tough time justifying it at the moment. I'd love to hear feedback from you all regarding this.

Chrome Store Takedown Notice Dear Developer,

Your Google Chrome item, "openMultiLogin", with ID: plaahcaagklllbcjognjgcnldgjnjhpb did not comply with our policies and was removed from the Google Chrome Web Store.

We routinely review items in the Chrome Web Store for compliance with our Program policies to ensure a safe and trusted experience for our users. Per our policies, where possible, make as much of your code visible in the package as you can. If some of your app's logic is hidden and it appears to be suspicious, we may remove it. During the course of a review, your item was found to be suspicious and has one or more file(s) that contain minified or obfuscated code which is not human readable.

To have your item reinstated, please make any necessary changes to ensure that all of the files and code are included in the item’s package and are human readable.

If you'd like to re-submit your item, please make appropriate changes to the item so that it complies with our policies, then re-publish it in your developer dashboard. Please reply to this email for issues regarding this item removal.

*Please keep in mind that your re-submitted item will not be immediately published live in the store. All re-submitted items undergo a strict compliance review and will be re-published if the item passes review.

*Important Note- Repeated or egregious violations in the store may result in your developer account being banned from the store. This may also result in the suspension of related Google services associated with your Google account. All re-submitted items will continue to be subject to Chrome Web Store policies and terms of service.

Thank you for your cooperation,
Google Chrome Web Store team


Developer Terms of Service:
https://developers.google.com/chrome/web-store/terms

Program Policies:
https://developers.google.com/chrome/web-store/program_policies

Branding Guidelines:
https://developers.google.com/chrome/web-store/branding

This was referenced Aug 8, 2017
@caspertone2003
Copy link

Sorry for opening as a pull request, my knowledge of github is very reduced and did not find other way.
I am a happy user of your cleaned up extension but i am unable either to program or understand externsion inside workings...
I feel that the store started to take extension security seriously, some of the extensions that I use have been taken down... I imagine that for the use of non-human-readable code. Many authors use it as an IP protection mechanism but it is rather dangerous for users. I myself developed a way to stop authomatic updates to avoid hack replacements.
Please, make available a .crx of the last cleaned up version so we can sideload it ...

@drothenberger
Copy link

I was very sorry to find this extension pulled from the Chrome Store. I use it often as part of my work and have been recommending it to all my coworkers. So please take this comment as one vote for reworking the code base to allow it to be added back to the Chrome Store.

@frozenfire98
Copy link

frozenfire98 commented Aug 12, 2017

I run a large website where I'm an admin and writer. I frequently have multiple profiles open, as do thousands of my members. All of the knockoffs of this program are infecting us with adware, viruses, popups, and phishing stuff. We're having nothing but issues. We even used the unpacked files in developer mode for awhile, until Google started disabling that too. Please please please rework to get it added back. Even if you have to charge $5-$10 for it. We will PAY IT. Yours is the best out there, hands down.

@Damianonymous
Copy link

https://chrome.google.com/webstore/detail/openmultilogin-with-gmail/kdncofkhdkmlkfocicapmfajbjomanac

What's different about this version, why was not locked in the store?

@EranSch
Copy link
Owner Author

EranSch commented Aug 14, 2017

Hey Guys,

Thanks for the support, I started working on a rewrite to get the extension back into the store. Between work/family/life my time will be a little irregular but I'm hopeful to make some good strides in the near future. In the meantime, I packaged a CRX file which you can use to sideload the extension, you can download it from the releases page on this repo. Installing the CRX doesn't seem to work for me. If it doesn't work for you, down the ZIP file from the same link and then you can follow these instructions to load the unpacked extension.

I'll try and keep you guys posted but hopefully that will tide you over for now.

Thanks!

@EranSch
Copy link
Owner Author

EranSch commented Aug 14, 2017

@Damianonymous That showed up a short while after I published openMultiLogin, it seemed a bit strange that the published didn't open a pull request to this repo but I didn't think much of it.

Looking at the reviews, it looks like the developer released the original, obfuscate MultiLogin version which still reported back to an unknown source:

image

I'm not sure why this version was removed and not that one but maybe it just has to do with the sheer number of extensions out there.

Suffice to say, use at your own discretion...

@caspertone2003
Copy link

Thanks Eran for the packaged crx.

For me it is good enough, now that I start to have so many extensions loaded using the unpacked mechanism. Let us see how long they keep open this door... Yes, you are right, sideload, traditional way, was blocked in the most recent chrome versions. Nobody can "sideload" crx.

Anyhow, uploading an acceptable version to the store is a very good idea - perhaps the issue here is that the very essence of this extension goes against the interests of some big moguls in internet...

@frozenfire98
Copy link

frozenfire98 commented Aug 31, 2017

Unfortunately when I upload it after checking "developer" in the extension section, it works for a few days, and then malwarebytes starts throwing up popups saying that it's blocking things. All on a website that I run, that has no adserver installed or active. :(

@EranSch
Copy link
Owner Author

EranSch commented Sep 6, 2017

@frozenfire98 That's very interesting. Does malwarebytes give any additional info on why it's flagging it? The plugin does, by design, interfere with outgoing http requests so I wonder if that's what it's picking up on or if there's something else.

@frozenfire98
Copy link

It works fine for a bit, but then starts doing this. Today it's image.bb.co

Before this it was
contributiontried.men

It's a different outbound website each time, but it comes up every time I refresh my website to get back to the main dashboard. once it starts, it doesn't stop until I uninstall this extension.

Below is what Malwarebytes says in the Protection Event thing-

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 8/11/17
Protection Event Time: 10:35 PM
Log File: e06014d2-7f06-11e7-8586-00ffa59c563b.json
Administrator: Yes

-Software Information-
Version: 3.1.2.1733
Components Version: 1.0.160
Update Package Version: 1.0.2565
License: Premium

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: System

-Blocked Website Details-
Malicious Website: 1
, , Blocked, [-1], [-1],0.0.0

-Website Data-
Domain: contributiontried.men
IP Address: 104.27.140.244
Port: [49306]
Type: Outbound
File: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

And today's-

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 9/6/17
Protection Event Time: 10:18 PM
Log File: e6a0587c-9372-11e7-bbc0-00ffa59c563b.json
Administrator: Yes

-Software Information-
Version: 3.2.2.2018
Components Version: 1.0.188
Update Package Version: 1.0.2741
License: Premium

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: System

-Blocked Website Details-
Malicious Website: 1
, , Blocked, [-1], [-1],0.0.0

-Website Data-
Domain: image.ibb.co
IP Address: 104.27.127.62
Port: [54361]
Type: Outbound
File: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

@cozuya
Copy link

cozuya commented Sep 8, 2017

Not sure if its chrome 60 or whatever but this was disabled for me today when I started up. I use it every day and without it I am thoroughly f-ed.

@tambnguyen
Copy link

Same. How hard is it to write this from scratch?

@niksosf
Copy link

niksosf commented Sep 11, 2017

Can we not package it so that we can use it in dev mode?

@snow-berry
Copy link

Unless I am utterly missing something obvious, I think Google must be complaining about one or more of the following files that are part of the package
icon.sketch
openMultiLogin.sublime-project
openMultiLogin.sublime-workspace
readme.md

I don't think any of these files are actually needed in the package

@EranSch
Copy link
Owner Author

EranSch commented Sep 15, 2017

Howdy folks! Thanks for all of the feedback, it's inspiring to see some activity here.

@frozenfire98 Thanks for the info, I'll keep a lookout for anything that could be the culprit here but I haven't seen anything quite that nefarious so far nor have I heard of any similar accounts. Be cautious and if you don't feel comfortable using this extension, please don't— I'd hate for it burn you in some way!

@cozuya The extension was removed from the Chrome Store due to an ambiguous issue as described in the initial comment on this issue thread. You should be able to install it via developer mode, [following these instructions]((#13 (comment)).

@tambnguyen Theoretically not that hard but there are a variety of edge cases and tricky things to address. My inclination has been to refactor the existing source rather than try and discover all the edge cases along the way. I've started that process on this branch but it's time consuming and I'm weary of premptively releasing it without running it thorough the paces to ensure I didn't create any regressions.

@niksosf I packaged the last released version and included links with instructions on how to enable developer mode in chrome and load the extension. That comment can be found here.

@snow-berry That's an interesting though. My refactor effort hasn't been getting much love lately so I will go ahead and make a new release excluding those assets, submit it, and see how it goes. 🤞

@BetaBreaker
Copy link

@Swingline0 Thank you for your work on this! At this point it seems that the extension just needs acceptance from Google. If you determine that you would like some testing done, let me know. I can setup some test scenarios and run them against Windows and Mac.

@EranSch
Copy link
Owner Author

EranSch commented Sep 15, 2017

Thanks @BetaBreaker! I'll definitely let you know! Some collaboration for this project would be greatly appreciated!

@EranSch
Copy link
Owner Author

EranSch commented Sep 15, 2017

As for @snow-berry's suggestion and in order to help standardize the release process, I updated the project with some automated build config so now the releases that we're submitting to the Chrome Webstore are archived on this repo's releases page. I'll be pulling the bundles uploaded to Chrome from here so we should have some nice transparency there.

At any rate, I've submitted v0.1625 for review and will report back here when I hear back.

image

@BetaBreaker
Copy link

v0.1625 loaded. Will report if I see anything "buggy".

@JustusGS
Copy link

I use this extension daily for work and, like @drothenberger, regularly recommend it to my teammates, so I was very disappointed to see it had been pulled from the store. I have a new home PC I was hoping to install it on, so I'm glad to hear that it may be back up soon!

@EranSch
Copy link
Owner Author

EranSch commented Sep 16, 2017 via email

@swbabe08
Copy link

What makes this even more annoying from Google is the fact that another multilogin extension adds ads to your search results and nothing has come about it. Even with multiple reviews pointing this out. I have never had a problem with this extension until it got yanked by them.

@EranSch
Copy link
Owner Author

EranSch commented Sep 17, 2017 via email

@EranSch
Copy link
Owner Author

EranSch commented Sep 18, 2017

Just to include some final closure on this issue: I responded to Google regarding their rejection of the last build, inquiring as to the particular portion of offending code. This was their response...

Dear Developer,

Thank you for reaching out to us.

Upon a subsequent review, we’ve reinstated your item and it is now available in the Chrome Web Store.

Thank you for your cooperation,
Chrome Web Store team

Not really sure what was flagging the extension for issues in the first place but I suppose we're past it now. Going to close this issue now and remove the warning from the readme.

All that said, I still would really like to continue to refactor modernize the extension and make it completely transparent. It's been great to interact with others who use the extension and definitely inspiring to put some more time into. Thanks everyone!

@EranSch EranSch closed this as completed Sep 18, 2017
EranSch added a commit that referenced this issue Sep 18, 2017
Discussion of this can be found in issue #13
@BetaBreaker
Copy link

BetaBreaker commented Sep 19, 2017

Congratulations @Swingline0 and other contributors! I saw notifications coming in over the weekend, but did not have a chance to catch up until this morning when I had an Extension conflict. 0.1625 that I loaded in Developer mode and 0.1625 from the store were in conflict. Removed Dev mode version and back in business.

I, too, am someone that uses this extension every day to do my job and find it invaluable.

Until the next iteration.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests