41–50 of 64 posts
Earlier quoted context omitted.
I wish this was the default.
If it was, it would make Chrome all but unusable to a very large portion of its users. Once they realized Flash didn't work on any websites, they'd switch back to Internet Explorer or Firefox or Safari, rather than trying to figure out why it does that.
Getting "hacked" by a sleazy browser extension is about as surprising as getting a virus after installing something from a warez site.
The issue with Chrome extensions, just like with android apps, is that people never check the permissions and just click OK. Extensions make it even easier to install them, though, just need to redirect a user. I've also come upon some spam sites that try to get you to install extensions with annoying alerts that prevent you from closing the page, playing a recorded message "To close the page, just install the XX ext…
I do read the permissions for Android apps - they all want permissions to everything. For no good reason. Enter apathy
In theory some very recent barely used newer Android version fixes this by asking for permissions at first use of them (eg first time using camera or first time accessing contacts). In practise this doesn't matter for several years.
The danger is that many people do not pay much attention to the requested permissions.
To fight the issue, I think there should be a culture of open sourcing Chrome extensions. I open sourced mine, and if I build one again, I would.
Earlier quoted context omitted.
If it was, it would make Chrome all but unusable to a very large portion of its users. Once they realized Flash didn't work on any websites, they'd switch back to Internet Explorer or Firefox or Safari, rather than trying to figure out why it does that.
Flash is built-in to Chrome. You'll have to invent another straw man. In fact, I recommend Chrome to unsophisticated users (hi Mom!) who need access to flash content. I tell Mom to never install anything ever. (She's managed to get malware on her Mac, even though I keep reminding her not to ever click on anything that says "your computer needs updates", etc.)
A big problem is also with unmaintained extensions that are being bought my malicious players (or developers' accounts hijacked), which then slap on an adware script and push a new version. That way, a previously good extension with a legitimate reason for "accessing your data on all websites" can silently become malicious.
Yes. Mozilla also allows that, which is really sleazy for Mozilla.
You could imagine that a malicious company would put through a "clean" version for testing and then once approved swap the script for the one loading malware.
Earlier quoted context omitted.
I remain baffled that alerts in modern browsers are still handled with an OS-level modal dialog that prevents interaction with the browser's interface elements. Couldn't the alert instead be rendered as an overlay to the page itself, be modal to just that tab, and not disable the browser Chrome? This would make it much harder for pages to "trap" users with alert spam. The existing policies (don't allow this page to c…
> Couldn't the alert instead be rendered as an overlay to the page itself, be modal to just that tab, and not disable the browser Chrome? Firefox and Safari do exactly that. > The existing policies (don't allow this page to create more dialogs -> page instantly redirects to itself to reset the flag) aren't doing a good enough job. Does that work? I've never seen any pages that circumvent alert blocking like that, and…
Truthfully, I have not actually observed this behavior on Firefox, and I'm quite thankfully no longer in the business of providing technical support to personal computer users, so hopefully I never will.
Thanks for raising awareness of the possible danger of Chrome extension as a malware. I recently built my first Chrome extension and was amazed by what harm an extension could do if the maker had bad intension. The danger is that many people do not pay much attention to the requested permissions. To fight the issue, I think there should be a culture of open sourcing Chrome extensions. I open sourced mine, and if I bu…
The issue with Chrome extensions, just like with android apps, is that people never check the permissions and just click OK. Extensions make it even easier to install them, though, just need to redirect a user. I've also come upon some spam sites that try to get you to install extensions with annoying alerts that prevent you from closing the page, playing a recorded message "To close the page, just install the XX ext…
I remain baffled that alerts in modern browsers are still handled with an OS-level modal dialog that prevents interaction with the browser's interface elements. Couldn't the alert instead be rendered as an overlay to the page itself, be modal to just that tab, and not disable the browser Chrome? This would make it much harder for pages to "trap" users with alert spam. The existing policies (don't allow this page to c…
https://docs.google.com/document/d/1wtV5rmLhbf1OZkbg7crtCt6h...
A few months ago Google fixed a vulnerability on the inline installation. It was possible to start a install on the attacker's website and then redirect the page to an arbitrary one. This would confuse the user, making him believe that the install came from the arbitrary page.
Here is the PoC if anyone is interested (CVE-2016-1640): https://www.youtube.com/watch?v=f_9ObDqBoo8