Maybe You Shouldn’t Stream Torrents In Your Browser

Maybe You Shouldn’t Stream Torrents In Your Browser

Torrents-Time is an interesting little browser plugin that lets you stream torrents without needing to download a whole separate client. It’s a boon for anyone who needs a simple way to torrent, but as a few people are pointing out, it’s also horribly insecure.

The plugin works with Firefox, Internet Explorer or Chrome, and the premise is simple: with it installed, navigate to any Pirate Bay torrent page, and you’ll get a link to stream the torrent, rather than just downloading it. Sounds great! But there are a few worries.

A dissection by Andrew Sampson, as well as people on the /r/Piracy subreddit, has thrown up a few worries about how the plugin works. At heart, Torrents-Time is trying to run an entire torrent client in a webpage and using a service, which leads to some “creative” programming, and some serious security flaws.

The most egregious is the abuse of cross-origin resource sharing (CORS), a mechanism that lets one webpage request resources from another webpage. Sampson shows that because of how it’s set up, it proves to be a gaping security hole that could compromise what you download, not to mention your real IP address.

There’s a few other concerns as well: it seems to run persistently in the background on your computer, which could fry battery life and annoy anyone who tries to put their PC to sleep, and Sampson found a CPU bug that is not just annoying, but potentially symptomatic of a more serious coding flaw.

All in all, Torrents Time is a neat plugin, but probably not worth the effort. Legions of much better, more robust and far more secure torrent clients live out there; sacrifice three seconds of convenience, in order to not compromise your entire computing setup.

[Andrew Sampson]


The Cheapest NBN 50 Plans

It’s the most popular NBN speed in Australia for a reason. Here are the cheapest plans available.

At Gizmodo, we independently select and write about stuff we love and think you'll like too. We have affiliate and advertising partnerships, which means we may collect a share of sales or other compensation from the links on this page. BTW – prices are accurate and items in stock at the time of posting.