Is Easy Login safe?
Easy Login sends Gamer.com.tw page-load hostnames to Google Analytics with a persistent client ID.
When its content script runs on Gamer.com.tw pages, it reports a page-load event to the background worker. The worker extracts the tab's hostname and posts it to Google Analytics with a client ID stored in browser sync storage or generated locally.
Who publishes itEasy Login - 1 other listing from the same operator, none carrying a finding
Easy Login - 1 other listing from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 10k+ users between them, none of them carrying a finding.
Shared hosts - 3 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Sign-in helper reports every Gamer.com.tw page you load to Google Analytics
Every time you load a Gamer.com.tw page, the extension sends the site's hostname to Google Analytics along with a client ID that stays the same across every request, letting the destination link your visits together over time.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open any page on gamer.com.tw while the extension is installed.
The extension sends that page's hostname to Google Analytics with a client ID that never changes.
The Chrome Web Store listing only describes the extension as a daily sign-in helper.
{ "client_id": "9e8d8093-0c92-44ab-b221-9dc6e0628dbf", "non_personalized_ads": true, "events": [ { "name": "view", "params": { "hostname": "user.gamer.com.tw" } } ]}Message handler and Analytics client (background.js)
Navigation message handler
js/background.jschrome.runtime.onMessage.addListener((message, sender) => { if (message.action === "page-load") { const tabUrl = sender.tab?.url; if (tabUrl) { const hostname = new URL(tabUrl).hostname; sendGaEvent("view", "hostname", hostname); } }});Analytics client and event sender
js/background.jsconst gaClient = new MeasurementProtocolClient({ measurementId: "G-NX79VZYHXW", apiSecret: "<redacted>",});async function sendGaEvent(name, paramKey, paramValue) { await gaClient.send({ client_id: await getOrCreateClientId(), non_personalized_ads: true, events: [{ name, params: { [paramKey]: paramValue } }], });}HTTP send
js/background.jsclass MeasurementProtocolClient { async send(payload) { await fetch( `https://www.google-analytics.com/mp/collect?measurement_id=${this.measurementId}&api_secret=${this.apiSecret}`, { method: "POST", body: JSON.stringify(payload) } ); }}- Hostnameuser.gamer.com.tw
The specific Gamer.com.tw subdomain you're on right now, sent on every page load.
- Client ID9e8d8093-0c92-44ab-b221-9dc6e0628dbf
A random ID generated once and reused for every request, letting the destination link your visits together.
- google-analytics.com
Google's Measurement Protocol endpoint; receives the hostname and a persistent client ID via a server-side POST.
Where it sends data
Destinations our analysis observed Easy Login contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.google-analytics.comwidely used
Easy Login sends data to www.google-analytics.com. A widely used service: 346 other extensions we have analysed send data here.