Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla shouldn't copy Chrome's permission prompt for extensions

palant.de

Post reply on HN
Print view View original

21–30 of 77 posts

Re: Mozilla shouldn't copy Chrome's permission prompt for extensions

#21

Post by roblabla »

dgoldstein0 wrote: post #18
ytpete wrote: post #3

Earlier quoted context omitted.

> It's safer for an ad blocker to read and modify a page if it has no method of exfiltrating the content. The problem is that being able to modify the page is a method of exfiltrating information - e.g. you can add an img tag triggering a GET to an arbitrary URL. I suspect it would be surprisingly tricky to try restricting page modification in such a way that information can't be sent anywhere the page wouldn't have…

couldn't we just give adblockers an api for filtering network requests, that they could just decide to allow or deny requests? And then give them no other internet access? This seems like an API failure that common jobs for extensions can't be done without scary permissions.

The problem is, many adblockers also have a feature to disable certain DOM nodes inside websites, to avoid embedded ads or remove anti-adblockers. So you'd also need an API to filter out certain selectors... And the list of specialized APIs could continue on and on.

Re: Mozilla shouldn't copy Chrome's permission prompt for extensions

#22

Post by kettl2 »

Having spent some time looking at the code of popular Chrome extensions recently I was left really shaken about whats happening under the hood.

Google's position seems to be, if a website can track you and monitor your behavior when you are on the page, then an extension should be able to do so too. But the extensions have a whole lot more capability. They can look at my history, bookmarks, all the fucking tabs I have open and whats happening in each one and send nice reports of to god knows who.

If I download a simple task list extension and every word typed, mouse move, click etc is being sent to Google Analytics I would like to know that! Cause my expectation is its a simple list being stored locally on my device not being shared with anyone. Same goes for history stats extensions. Or reddit\youtube filtering extensions. Every single extension I looked at was hooked up to some analytics framework/cloud backup/sync service or the other. If some third party dev sitting in his mom's basement is collecting all this data. I want to know!

The best was the history stats extension I had installed. Very useful/pretty reports/code on Github/nice backstory about a benevolent developer building something cool for the world in his free time etc. When I dig around the story changes to the dev disappearing after selling it off to shady characters, who then proceed to do things like randomly redirect pages to ad sites.

At install time there is no reason Google can't say this extension uses Google Analytics to track where you are clicking etc and what data and how much data is being sent off everyday to god knows who.

Re: Mozilla shouldn't copy Chrome's permission prompt for extensions

#23

Post by DougBTX »

dgoldstein0 wrote: post #18
ytpete wrote: post #3

Earlier quoted context omitted.

> It's safer for an ad blocker to read and modify a page if it has no method of exfiltrating the content. The problem is that being able to modify the page is a method of exfiltrating information - e.g. you can add an img tag triggering a GET to an arbitrary URL. I suspect it would be surprisingly tricky to try restricting page modification in such a way that information can't be sent anywhere the page wouldn't have…

couldn't we just give adblockers an api for filtering network requests, that they could just decide to allow or deny requests? And then give them no other internet access? This seems like an API failure that common jobs for extensions can't be done without scary permissions.

That's close to the content blocker api in Safari: https://webkit.org/blog/3476/content-blockers-first-look/

Re: Mozilla shouldn't copy Chrome's permission prompt for extensions

#25

Post by Manishearth »

J_Darnley wrote: post #24

Why? They shouldn't be copying chrome's extensions in the first place.

More like building a much more powerful, standardized, extensions API that is backwards compatible with chrome extensions (which offer relatively limited tools)

It isn't copying, all the browsers want a standardized extensions system and they have agreed on using Chrome as a starting point.

Re: Mozilla shouldn't copy Chrome's permission prompt for extensions

#27

Post by robryk »

dgoldstein0 wrote: post #18
ytpete wrote: post #3

Earlier quoted context omitted.

> It's safer for an ad blocker to read and modify a page if it has no method of exfiltrating the content. The problem is that being able to modify the page is a method of exfiltrating information - e.g. you can add an img tag triggering a GET to an arbitrary URL. I suspect it would be surprisingly tricky to try restricting page modification in such a way that information can't be sent anywhere the page wouldn't have…

couldn't we just give adblockers an api for filtering network requests, that they could just decide to allow or deny requests? And then give them no other internet access? This seems like an API failure that common jobs for extensions can't be done without scary permissions.

It could still exfilter information if it could share any state between domains: the evil adblocker is associated with a site that many users visit. The site makes a lot of requests when it's loaded and adblocker exfiltrates information by selectively blocking those requests.

Re: Mozilla shouldn't copy Chrome's permission prompt for extensions

#28

Post by robryk »

deno wrote: post #14
ytpete wrote: post #3

Earlier quoted context omitted.

> It's safer for an ad blocker to read and modify a page if it has no method of exfiltrating the content. The problem is that being able to modify the page is a method of exfiltrating information - e.g. you can add an img tag triggering a GET to an arbitrary URL. I suspect it would be surprisingly tricky to try restricting page modification in such a way that information can't be sent anywhere the page wouldn't have…

You could, in theory, filter those sort of things. Adding, or modifying any DOM node, to the effect that it includes third-party resources could be denied. If you also deny adding inline blocks and enforce any injected javascript to run in strict CSP mode it could potentially work.

The original page's JS might depend on the DOM tree of the page. Thus a change that doesn't obviously cause any information to be emitted to third parties can cause that JS to do that (e.g. if the JS uses attributed of DOM tree nodes as URLs of data sources or data sinks).

Re: Mozilla shouldn't copy Chrome's permission prompt for extensions

#29

Post by Manishearth »

746F7475 wrote: post #16

> In fact, lots of confused users asked why Adblock Plus needed this permission and whether it was spying on them. And we explained that the process of blocking ads is in fact what Chrome describes as changing data on all websites. Sounds to me that the permissions prompt is doing exactly what it should be doing, informing users what the extension can do. Sure it would be fun if there was a qualified code review proc…

Note that Firefox has had this process for years, for addons with far more power than what Chrome gets you. Sure, it is tedious and could be improved, but the model works.

Also, I don't think you will have to go through review for extensions not requesting dangerous permissions. For some definition of dangerous :)

(I wonder if both models could be implemented simultaneously -- unreviewed extensions with "use at own risk" warnings, and reviewed ones with fine-grained semantic permissions)

Re: Mozilla shouldn't copy Chrome's permission prompt for extensions

#30

Post by robryk »

deno wrote: post #11

Even if they copy the warnings verbatim, I’d like to at least suggest adapting some sort of icon set. Preferably with color coding: yellow for frequently requested permissions, red for infrequently requested permissions. Anything really, that let’s you know at glance what you’re about to install, without having to read a bullet point list. Colors are fine but unique icons would be even better. If it potentially affec…

> If it potentially affects user’s privacy anything but a scary looking big brother eye would be inappropriate.

Well, what permissions don't?

Post reply on HN