Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla shouldn't copy Chrome's permission prompt for extensions

palant.de

Post reply on HN
Print view View original

61–70 of 77 posts

Re: Mozilla shouldn't copy Chrome's permission prompt for extensions

#61

Post by drdaeman »

amelius wrote: post #51

I think a permission model should have 3 choices for every question: allow, disallow, and pretend. With the last option, app-makers cannot bribe the user into installing the app with unwanted permissions anyway. For example, when the app wants file-system access, the "pretend" option would give the app a view of an empty or dummy (fake) file-system. When the app wants access to GPS coordinates, the "pretend" option w…

Won't happen. Hearing about this, some Developers get really pissed that they can't spy on users, they blow a hype how they'd completely go out of business, there won't be any great products anymore on the market and all that sort of stuff.

One relatively famous example is from some years ago when someone had proposed to spoof device IDs in Cyanogenmod and Swype had a spaz.

Re: Mozilla shouldn't copy Chrome's permission prompt for extensions

#62

Post by jimrandomh »

tetrep wrote: post #56
amelius wrote: post #51

I think a permission model should have 3 choices for every question: allow, disallow, and pretend. With the last option, app-makers cannot bribe the user into installing the app with unwanted permissions anyway. For example, when the app wants file-system access, the "pretend" option would give the app a view of an empty or dummy (fake) file-system. When the app wants access to GPS coordinates, the "pretend" option w…

I don't see "pretend" as being productive. If you're dealing with an app that would otherwise refuse to run without a permission, even if it didn't truly need the permission to function, then it would simply escalate the arms race. It would be pretty easy to detect a fake filesystem (try to write a file, then read it back) and spoofed GPS (GeoIP, ping supposed nearby servers, etc). And, of course, these checks could…

Yes, but at that point they've lost plausible deniability; they can no longer claim that they asked for permission because some obscure feature required it. People are much less likely to agree to "trade my filesystem for a game" than they are to agree to "play a game that uses the filesystem to save games".

Re: Mozilla shouldn't copy Chrome's permission prompt for extensions

#63

Post by pcwalton »

greendestiny_re wrote: post #36

I once asked a Mozilla developer why does Firefox display "Adobe Flash plugin blocked on this page" notification when the page apparently doesn't use Flash at all and choosing either option (allow/block) doesn't impede its functionality or change the appearance whatsoever. The developer replied there are Flash cookies being set and it's possible an attack could come through them. When I asked if he knows about any su…

> When I asked if he knows about any such case happening, the answer was no. Then what is the purpose of bothering the user about an attack vector if the attack is merely theoretical?

I'm not OK with the philosophy of "let's not fix any security holes until we find someone actively exploiting them".

Re: Mozilla shouldn't copy Chrome's permission prompt for extensions

#64

Post by drdaeman »

jimrandomh wrote: post #62
tetrep wrote: post #56

Earlier quoted context omitted.

I don't see "pretend" as being productive. If you're dealing with an app that would otherwise refuse to run without a permission, even if it didn't truly need the permission to function, then it would simply escalate the arms race. It would be pretty easy to detect a fake filesystem (try to write a file, then read it back) and spoofed GPS (GeoIP, ping supposed nearby servers, etc). And, of course, these checks could…

Yes, but at that point they've lost plausible deniability; they can no longer claim that they asked for permission because some obscure feature required it. People are much less likely to agree to "trade my filesystem for a game" than they are to agree to "play a game that uses the filesystem to save games".

They tend to just say "we need this permission for the application/extension to work correctly". And stop at this.

Seriously, a certain (quite famous, 5M installs) app got an update that requested a permission to install packages (!). It was actually harmless, as granting this won't work - the system won't allow this to non-system apps, but nonetheless it had just looked wrong.

I've emailed their support, asking why is it there. And - guess what? The reply was, essentially, "we need it because we do, it's required for the app to work, sorry but can't disclose the exact details". Well, polite, but essentially like this.

Long story short, I've accidentally mentioned this on a friend's blog, and my comment was noticed by his friend who had connections to the app's company (world's small, hah!) - so the ticket got elevated and took a proper review. Result is, this had just accidentally slipped from some dependency's development builds. Or something like that. Got apologies for the dubious response and a discount coupon, and the issue was fixed.

The thing is, it seems that a) I highly suspect, most users don't give a second thought about about accepting this permission (would there be more reports on this, I guess, the tier-1 support would know about the issue and the response would be different) and b) the initial attitude is "we know better".

Re: Mozilla shouldn't copy Chrome's permission prompt for extensions

#65

Post by carussell »

pfg wrote: post #43
carussell wrote: post #41

Earlier quoted context omitted.

It's also old news. This kind of URL-based whitelisting approach is exactly what Greasemonkey does. The problems with Greasemonkey come down to the same answer you'll find any time you're discussing extensions: the Firefox team is seriously underinvested in the ecosystem. Greasemonkey today is about as rough to use as it was years ago and almost has the smell of an unmaintained/abandoned project. The point is: this i…

My understanding is that user scripts allow you to match based on the URL. It would still be a predefined set of URLs (or URL patterns) with a binary option for the user (install and accept everything, or don't). That's essentially what extensions do today. zeta0134's approach would be to put the user in charge of building this white- or blacklist. Following the way plugins are currently implemented, this would allow…

> My understanding is that user scripts allow you to match based on the URL.

Yes.

> It would still be a predefined set of URLs (or URL patterns) with a binary option for the user (install and accept everything, or don't).

No.

> zeta0134's approach would be to put the user in charge of building this white- or blacklist.

As I said before, this is what Greasemonkey gives you.

Re: Mozilla shouldn't copy Chrome's permission prompt for extensions

#66

Post by [deleted] »

deno wrote: post #35
robryk wrote: post #30

Earlier quoted context omitted.

> If it potentially affects user’s privacy anything but a scary looking big brother eye would be inappropriate. Well, what permissions don't?

I meant anything that let’s the extension leak any data. Contacting 3rd-party servers, modifying DOM etc. I suppose more granular permissions might be required here.

[deleted]

Re: Mozilla shouldn't copy Chrome's permission prompt for extensions

#67

Post by greendestiny_re »

pcwalton wrote: post #63
greendestiny_re wrote: post #36

I once asked a Mozilla developer why does Firefox display "Adobe Flash plugin blocked on this page" notification when the page apparently doesn't use Flash at all and choosing either option (allow/block) doesn't impede its functionality or change the appearance whatsoever. The developer replied there are Flash cookies being set and it's possible an attack could come through them. When I asked if he knows about any su…

> When I asked if he knows about any such case happening, the answer was no. Then what is the purpose of bothering the user about an attack vector if the attack is merely theoretical? I'm not OK with the philosophy of "let's not fix any security holes until we find someone actively exploiting them".

You are using quotation marks as if though I said those words.

quote (kwəut) verb 1. to repeat the exact words of a person as they were said or written.

My point was about not giving the user enough information to make an informed decision yet demanding a decision anyway.

Re: Mozilla shouldn't copy Chrome's permission prompt for extensions

#68

Post by cbreeden »

greendestiny_re wrote: post #67
pcwalton wrote: post #63

Earlier quoted context omitted.

> When I asked if he knows about any such case happening, the answer was no. Then what is the purpose of bothering the user about an attack vector if the attack is merely theoretical? I'm not OK with the philosophy of "let's not fix any security holes until we find someone actively exploiting them".

You are using quotation marks as if though I said those words. quote (kwəut) verb 1. to repeat the exact words of a person as they were said or written. My point was about not giving the user enough information to make an informed decision yet demanding a decision anyway.

It's still not clear to me. Are you suggesting that uses not be notified of a potential yet not verified security hole or not?

Re: Mozilla shouldn't copy Chrome's permission prompt for extensions

#69

Post by ben0x539 »

greendestiny_re wrote: post #67
pcwalton wrote: post #63

Earlier quoted context omitted.

> When I asked if he knows about any such case happening, the answer was no. Then what is the purpose of bothering the user about an attack vector if the attack is merely theoretical? I'm not OK with the philosophy of "let's not fix any security holes until we find someone actively exploiting them".

You are using quotation marks as if though I said those words. quote (kwəut) verb 1. to repeat the exact words of a person as they were said or written. My point was about not giving the user enough information to make an informed decision yet demanding a decision anyway.

https://en.wikipedia.org/wiki/Use%E2%80%93mention_distinctio... suggests that quotation marks are valid here (which is clearly the most important aspect of this dispute)

Re: Mozilla shouldn't copy Chrome's permission prompt for extensions

#70

Post by 1ris »

I don't see much sense in a allow-or-it-doesn't run permission/capabilities model. If there is not a option for "make the app/extensions believe it has a capability, but it does not" I don't have more choices then before: Install or not install.

A extension could for example ask for a GPS location. I'd like to able to send to app some nonsense data and use it.

Post reply on HN