11–20 of 64 posts
If you like to tweak your Chrome install, check out: chrome://flags/#extension-active-script-permission It adds an extra level of permission where each extension that doesn't ask for a specific website is, by default, locked out of every website, and you have to enable it manually by either clicking on it, whitelisting the websites where it can run or globally (example pic, sorry for not being in english: http://puu.…
Extensions like this are just the same as .exe adware downloaded and installed by user (not automatically). More serious problem is legitimate extensions that are trusted by lots of users then being sold to some rogue company, then lots of users receive malware with update.
The issue with Chrome extensions, just like with android apps, is that people never check the permissions and just click OK. Extensions make it even easier to install them, though, just need to redirect a user. I've also come upon some spam sites that try to get you to install extensions with annoying alerts that prevent you from closing the page, playing a recorded message "To close the page, just install the XX ext…
Most useful extensions require access to all sites so permissions system isn't very helpful at all.
That may be true for "always-running" extensions like ad blockers, but there's another useful class of "on-demand" extensions that don't need full access -- think Evernote or Pinboard clippers. They only need access to the one site you're looking at, and only when you invoke them.
Chrome added a tightly-scoped "activeTab" permission a few years back, for exactly this case. Before that, on-demand extensions did need all-sites access, and unfortunately a lot of extensions (and tutorials and example code) haven't been updated.
Extensions like this are just the same as .exe adware downloaded and installed by user (not automatically). More serious problem is legitimate extensions that are trusted by lots of users then being sold to some rogue company, then lots of users receive malware with update.
This article actually indicates a (probably bug-bounty'able) flaw in the Chrome webstore security checks: > The script that it fetches from the above server is a malware payload. The extension needs to download it after having been installed because it cannot ship with the payload if it wants to pass through the Chrome Webstore’s security checks. There probably are legitimate reasons to pull in remote content, but I…
The issue with Chrome extensions, just like with android apps, is that people never check the permissions and just click OK. Extensions make it even easier to install them, though, just need to redirect a user. I've also come upon some spam sites that try to get you to install extensions with annoying alerts that prevent you from closing the page, playing a recorded message "To close the page, just install the XX ext…
If you like to tweak your Chrome install, check out: chrome://flags/#extension-active-script-permission It adds an extra level of permission where each extension that doesn't ask for a specific website is, by default, locked out of every website, and you have to enable it manually by either clicking on it, whitelisting the websites where it can run or globally (example pic, sorry for not being in english: http://puu.…
Is whitelisting extensions possible?
you're an idiot.
The issue with Chrome extensions, just like with android apps, is that people never check the permissions and just click OK. Extensions make it even easier to install them, though, just need to redirect a user. I've also come upon some spam sites that try to get you to install extensions with annoying alerts that prevent you from closing the page, playing a recorded message "To close the page, just install the XX ext…
The issue with Chrome extensions, just like with android apps, is that people never check the permissions and just click OK. Extensions make it even easier to install them, though, just need to redirect a user. I've also come upon some spam sites that try to get you to install extensions with annoying alerts that prevent you from closing the page, playing a recorded message "To close the page, just install the XX ext…
I was under the impression all chrome extensions had to go through the chrome web store now. I don't think you can manually install them anymore (outside of installing in developer mode). I could be wrong though.