21–30 of 42 posts
Earlier quoted context omitted.
Google should make the extension name case insensitive like domain names. That should help a little bit.
Then people will use cyrillic letters, etc. That approach simply does not work.
I audit every extension before I install it. You should too. https://chrome.google.com/webstore/detail/chrome-extension-s...
I audit every extension before I install it. You should too. https://chrome.google.com/webstore/detail/chrome-extension-s...
Earlier quoted context omitted.
Ordinarily, people might find seeing the repository straight-up too jarring. For people who aren't in the IT world, I'm not sure that seeing Github will be some definitive proof that an extension is legit.
Furthermore, it is only definitive until it isn't. If we trained users to look for the github page, we'd have forked projects that point to the compromised extension, fake github clones that look like the project, fraudulent likes, and so forth.
I audit every extension before I install it. You should too. https://chrome.google.com/webstore/detail/chrome-extension-s...
I am a mechanical engineer not a software developer. Any advice for me?
Extensions are the new "Let's play find the download button on a webpage" that's been around for years. [1] So many users download replicas of uBlock and find it hard to install the original uBlock Origin extension. Countless times have I had to send them direct link to Chrome's extension site just to make sure they're installing the right one. This is the case especially as the genuine extension in this case has no…
Chrome extensions are that. No other browser has this problem.
I think, it's necessary to be pointing fingers here, to get Google to maybe finally do something about it and so that people don't mistakenly limit their use of extensions on other browsers.
I audit every extension before I install it. You should too. https://chrome.google.com/webstore/detail/chrome-extension-s...
I am a mechanical engineer not a software developer. Any advice for me?
1. Minimize the amount of extensions you use to the bare essentials. If you can live without it, uninstall it. If you rarely use it, uninstall it.
2. Prefer extensions from well-known organizations rather than unknown individuals. Example: there are plenty of extensions that force HTTP requests to HTTPS when possible, but I exclusively use the one from the EFF. Organizations have less to gain and more to lose from breaching the trust of their users in this way.
3. Prefer extensions that multiple software developers have recommended personally. This won't itself protect you from malware, but it does increase the likelihood that emergent malware will be discovered promptly and loudly publicized.
4. If you absolutely need an extension and none of the above apply, download the source code of the extension yourself and manually load it into your browser, to keep it from being automatically updated. (Part of me is wary to recommend this, as software that never gets updated is historically prone to being exploited by lingering unpatched flaws, but I'm having a hard time coming up with an attack vector of this sort for browser extensions.)
Extensions are the new "Let's play find the download button on a webpage" that's been around for years. [1] So many users download replicas of uBlock and find it hard to install the original uBlock Origin extension. Countless times have I had to send them direct link to Chrome's extension site just to make sure they're installing the right one. This is the case especially as the genuine extension in this case has no…
This is especially a problem when you try looking for new extensions. It's not sufficient to just look at the reviews or popularity since often times the users themselves have no idea their browsing history is being captured and sold. Also it seems that Google is in no hurry to fix this issue as even having discovered and reported malicious extensions they remain up (see: https://news.ycombinator.com/item?id=14889619…
I don't think, Google has any interest in doing that. You can't either block internet access on a per-app basis on Android, even though this would close tons of information leaks, that the clunky permission system they currently have in place just can't fix.
And as for the best thing to do from Google's side, that would probably be what Mozilla is doing. Sit actual human beings down to look at the code of newly submitted extensions and of extension updates.
No, this does not scale, can't be automated by some algorithm, but it actually works. And it's not like it needs to scale into the millions.
Earlier quoted context omitted.
This is especially a problem when you try looking for new extensions. It's not sufficient to just look at the reviews or popularity since often times the users themselves have no idea their browsing history is being captured and sold. Also it seems that Google is in no hurry to fix this issue as even having discovered and reported malicious extensions they remain up (see: https://news.ycombinator.com/item?id=14889619…
> From the client side one mitigation might be to have all extensions denied network access by default and have the user manually whitelist those in a little-snitch like manner. I don't think, Google has any interest in doing that. You can't either block internet access on a per-app basis on Android, even though this would close tons of information leaks, that the clunky permission system they currently have in place…
Reflecting back on the automated extension review, I just realized that the problem is more complex that it seems at first glance since extensions can also contain content scripts that inject JS directly into pages themselves, so it's easy to mask the source of a POST by injecting the xhr directly into the webpage.