Browser Push Notifications – A Security Concern | SNM Consulting
By Aruneesh Salhotra / May 19, 2023
Browser-based push notification adoption is on the rise, and mostly for the right reason. However, like everything, comes with potential risks. Push notifications should be allowed only with caution as the chance of receiving malicious notifications is high.
Let’s talk through what the Online Security browser extension does, how Chrome push notifications work, and why you need Online Security’s new features to defend against any issues that Chrome push notifications may present.
What are Web Push Notifications?
Web push notifications are small message alerts that are displayed on a visitor’s desktop when they have their web browser open. Websites use web push to connect with users after they’ve left their website to drive greater user engagement and conversions as well as to improve the digital user experience. Compared to more traditional communication channels such as email, web push is easier for visitors to enable and much harder for them to overlook.
Web Push Notifications are messages that are sent by a website or by a web app to your device, making these notifications significantly visible and also easy to respond to.
Chrome push notifications are messages used to communicate with you, even though you may not be on the particular website that is looking to engage with you. Sites sometimes request permission for Chrome push notifications. If the user approves the permissions, the sites can pop the notifications whenever they want, including outside of the browser.
Elements of a Web Push Notification Web push notifications often include a title, body content, a notification URL, a banner image, a browser icon, the web domain, and action buttons. These messages appear differently across operating systems and browsers. Although these notifications are small in size and content, brands put thought into their notification strategy to convey the right message, visuals, and calls-to-action (CTA’s) at the right moment in time.
Understanding the Permission Process Before websites can send web push, site visitors must opt-in to receive communication via this channel. Gaining user permission is a delicate art. Some companies will default to using a browser’s native permission prompt, which appears as soon as a visitor arrives on site. Others customize the prompt content and delay the permission request to give users more context and site experience to increase the likelihood of an opt-in.
What are the High-Level Benefits?
High Visibility
High Opt-in Rate
Versatility
Real-time Communication
Unique Audience
Low Opt-Out Rate
Security and privacy risks involved in accepting Push Notifications?
- Ads and 3rd-Parties: Websites sometimes sell these capabilities to ad networks and 3rd-parties to display ads
- Hackers: Threat actors can use these capabilities to spread fake or deceptive messages, flood the user’s device with spam, and trick people into installing malicious apps.
- Embedded Malware: The purpose of malware hidden in push notifications is either to deliver a flood of more ads (malvertising) to your browsing activities or to help hackers break into your accounts and steal money, data, or identity.
- General annoyance: Aside from anything else, having to click so many times to close the pop-ups before you can read what you are actually trying to see online can be very frustrating!
- Bandwidth pressure: When the amount of push notifications become truly aggressive, they can use up all the bandwidth on your device.
How to Review Push Notifications in Browsers (and Remove Them)
Don’t worry, removing push notifications (when they are legit) is very easy. Here is how. (For malicious push notifications, things can be more complicated, and I’ll discuss it in more detail below).
For Google Chrome, just go to Settings/content /notifications, or directly copy-paste this link into the browser address: chrome://settings/content/notifications?search=notifications
This will reveal the list of websites you are allowed to send you push notifications, as well as the list of websites you blocked push notifications from. If you see one you don’t remember approving or wish to take back permission from, just click the vertical dots bar for that domain and select ‘Remove’.
A more comprehensive guide to removing the push notifications is available here
Browser push notifications: a feature asking to be abused
Signs that push notifications are malicious
- Ads appear even in places where they shouldn’t (like your desktop, even when the browser is closed)
- The browser home page changes without your permission
- The websites you used to visit without issues are now not displaying properly, or you get redirected to another address.
- You get pop-ups that are advertising fake software or updates, or warnings that you are infected, followed by prompts to install a specific clean-up tool (DON’T!)
- You see apps and programs installed on your device (with shortcuts and everything) that you don’t remember to install.
