Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser extensions are underrated: the promise of hackable software

geoffreylitt.com

Post reply on HN
Print view View original

41–50 of 189 posts

Re: Browser extensions are underrated: the promise of hackable software

#41

Post by modzu »

ohazi wrote: post #39
modzu wrote: post #34

Earlier quoted context omitted.

these same risks exist with any app. totally agree its a valid concern and deserves more than a footnote, but i don't think that counters anything that the author is praising about extensions specifically. at least extensions exist within an ecosystem where they are subject to manual review and approval / removal. and in terms of updates, any changes to the permissions show a prompt to the user as though they were ne…

Manual review doesn't work. The volume is too high, and subtle trickery is too easy. To first order, there is no permissions model for browser extensions. You should assume that an extension can see and do everything that your browser can see and do. This is also a huge problem with mobile apps, but the problem is at least acknowledged, and there's some degree of permissions and sandboxing, even though it's not compl…

i read this as an argument for open source. it's not a guarantee, but it's a good heuristic for an app's trustworthiness

Re: Browser extensions are underrated: the promise of hackable software

#42

Post by ohazi »

modzu wrote: post #41
ohazi wrote: post #39

Earlier quoted context omitted.

Manual review doesn't work. The volume is too high, and subtle trickery is too easy. To first order, there is no permissions model for browser extensions. You should assume that an extension can see and do everything that your browser can see and do. This is also a huge problem with mobile apps, but the problem is at least acknowledged, and there's some degree of permissions and sandboxing, even though it's not compl…

i read this as an argument for open source. it's not a guarantee, but it's a good heuristic for an app's trustworthiness

Yeah, I agree. It's not perfect, but it sure helps. This is also why a lot of the big open-source distributors (e.g. Debian) are working towards fully reproducible builds.

Re: Browser extensions are underrated: the promise of hackable software

#43

Post by agumonkey »

ohazi wrote: post #27

I don't agree with the author. He pays lip service to security being important, but then proceeds to ignore the threat because he thinks extensions are great. I think people should be more hesitant to install a browser extension than just about any other piece of software. The threat is absolutely real. Bad actors regularly offer large paydays to lone developers with popular extensions so they can roll out an update…

What about a review service ? N peers => signed extension.

Re: Browser extensions are underrated: the promise of hackable software

#44

Post by sp332 »

kevingadd wrote: post #28
ohazi wrote: post #27

I don't agree with the author. He pays lip service to security being important, but then proceeds to ignore the threat because he thinks extensions are great. I think people should be more hesitant to install a browser extension than just about any other piece of software. The threat is absolutely real. Bad actors regularly offer large paydays to lone developers with popular extensions so they can roll out an update…

Worse still, the design of the most popular extension API is intrinsically poor at protecting users from malicious extension developers (or extension resale to malicious developers). Until Google and Mozilla fix the design people shouldn't be installing more than a handful of extensions, because they end up usually having complete access to all your data for convenience reasons.

Extensions have a similar model to phone apps. They have a basic set of APIs available, and beyond that they have to ask for permission before they can use more. E.g. I have a Firefox addon called "t.co unmangler" that only has permission to access my data for twitter.com and can't read anything else. If an extension is compromised and tries to access more that it was allowed before, the browser will block it until I grant permissions.

Re: Browser extensions are underrated: the promise of hackable software

#45

Post by TeMPOraL »

ohazi wrote: post #27

I don't agree with the author. He pays lip service to security being important, but then proceeds to ignore the threat because he thinks extensions are great. I think people should be more hesitant to install a browser extension than just about any other piece of software. The threat is absolutely real. Bad actors regularly offer large paydays to lone developers with popular extensions so they can roll out an update…

> He pays lip service to security being important, but then proceeds to ignore the threat because he thinks extensions are great. I think people should be more hesitant to install a browser extension than just about any other piece of software.

I think he might not be willing to engage with this further, because extensions sit close to the border defined by the minimum of "security + usability"[0]. Making extensions more secure eats into their usability; to resolve all the security issues, you'd have to kill extensions altogether.

> Bad actors regularly offer large paydays to lone developers with popular extensions so they can roll out an update that quietly adds a backdoor.

I don't think there is a way to avoid that. It boils down to the rule that security is measured in dollars - the ultimate attack is bribing the controlling party; the ultimate defense, making it not worth it for the controlling party to sell out for any amount of money the attacker could assemble.

--

[0] - I.e. after accounting for obvious wins-wins, you reach a situation where security is opposite to usability. Once you're there, it becomes a trade-off.

Re: Browser extensions are underrated: the promise of hackable software

#46

Post by dessant »

seanwilson wrote: post #30
ohazi wrote: post #27

I don't agree with the author. He pays lip service to security being important, but then proceeds to ignore the threat because he thinks extensions are great. I think people should be more hesitant to install a browser extension than just about any other piece of software. The threat is absolutely real. Bad actors regularly offer large paydays to lone developers with popular extensions so they can roll out an update…

> Keep in mind that it's not "Here's some money, please let us roll out an evil update to your extension," it's "Our company loves your extension and would like to acquire it." I get messages like this every now and then for mobile apps and browser extensions I manage and they're painfully obvious to spot. They're often from sketchy looking generic email addresses, have no information about the buying company, don't…

Same, I get an offer every month or so for some of my extensions. One has quoted an offer of $0.25/user for the Firefox version of Search by Image in their introductory email. That kind of money would significantly improve my life, but it's all too obvious what they would do with my users.

Most extension developers are not getting any significant income from their work, despite serving millions of users, and unless browser vendors will begin to recognize the value of that labor and provide better tools for sponsoring developers, we will continue to be vulnerable to such offers.

Re: Browser extensions are underrated: the promise of hackable software

#47

Post by apsanz »

gnicholas wrote: post #21

Browser extensions are also really important for accessibility. People with many kinds of disabilities use extensions to make websites more readable, easier to navigate, or more accessible in other ways. Unfortunately, the big mobile browsers do not support extensions, which is a huge blow to accessibility. I think Firefox for Android is the only mainstream-ish browser that supports extensions. Apple prevents them fr…

Which specific extensions work well? My wife is visually impaired and she has tried a several extensions. All of them have cause more problems than they have solved. In addition, IE and firefox's attempts to change behavior when using windows high contrast mode also breaks many sites. Safari is the browser that works the most reliably.

Re: Browser extensions are underrated: the promise of hackable software

#48

Post by neilv »

pvg wrote: post #33
ohazi wrote: post #27

I don't agree with the author. He pays lip service to security being important, but then proceeds to ignore the threat because he thinks extensions are great. I think people should be more hesitant to install a browser extension than just about any other piece of software. The threat is absolutely real. Bad actors regularly offer large paydays to lone developers with popular extensions so they can roll out an update…

Raymond Hill (uBlock Origin) It's uBlock Origin because the uBlock name itself got taken over by swindlers. So even well-intentioned actors aren't immune to this kind of abuse.

You almost need a Hollywood action movie trailer for this story (i.e., hero going into peaceful retirement, bad guys kidnapping his child and taking over, hero is back and dispensing own brand of justice, to save everyone).
Post reply on HN