Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser extensions are underrated: the promise of hackable software

geoffreylitt.com

Post reply on HN
Print view View original

131–140 of 189 posts

Re: Browser extensions are underrated: the promise of hackable software

#131

Post by gpm »

scarface74 wrote: post #63
chipperyman573 wrote: post #62

Earlier quoted context omitted.

That would be a good argument if using only the approved channels protected users, but a lot of extensions have malware that sell user data, including ones in stores. https://www.inc.com/jason-aten/the-browser-extensions-you-us...

I’m the last person who is going to defend the security architecture of browser plugins. But, when Google tried to implement an ad blocking architecture that wouldn’t allow third parties access to your browsing history similar to that of Safari, geeks were up in arms.

Google never did any such thing.

The proposed change that would have made ad blocking impossible still allowed non blocking request interception, it would have absolutely 0 impact on people trying to sell your browsing data via an extension, and a huge net increase in people selling your browsing data by people selling your browsing data by website embedded trackers.

Re: Browser extensions are underrated: the promise of hackable software

#132

Post by on_and_off »

ignoramous wrote: post #66

Extensions can be uninstalled, revoked, disabled at will. Can't really bend BigTech to do your biding, and that trumps whatever the security argument brings to the table, imo. Extensions should be done in a security friendly way [0], and not the other way around of making software secure by disabling all extensibility [1]. Take the example of the Android ecosystem: If plugins were allowed for apps, pretty sure there'…

> If plugins were allowed for apps, pretty sure there'd be a better story around privacy today .

Honest question : Can you expand on how this would work please?

If anything, extensions as in chrome extensions is something I try to avoid as much as possible : giving access to all of my data to a third party extension promising that is going to increase my privacy but that I need to trust 100% with a complete access is less than ideal.

Re: Browser extensions are underrated: the promise of hackable software

#133

Post by the_pwner224 »

Wowfunhappy wrote: post #25
danShumway wrote: post #19

Earlier quoted context omitted.

I believe Firefox Dev edition allows you to disable the signing requirement[0]. I do wish the requirements around signing were less stringent, but I'm fine using Dev Edition as a daily driver for now. [0]: https://support.mozilla.org/en-US/kb/add-on-signing-in-firef...

But then you're using the beta channel instead of the stable channel. It's great that you're fine with that, but everyone shouldn't have to. At the absolute least , Mozilla should make Unbranded auto-update.

I've been using FF nightly - the most untested version, hot off of git - for two years and have yet to encounter a single bug which I could not reproduce in normal FF (mainly rare crashes on certain sites some of the time).

Re: Browser extensions are underrated: the promise of hackable software

#134

Post by pessimizer »

weaksauce wrote: post #35
eitland wrote: post #11

Earlier quoted context omitted.

Even as much as I want my old Firefox extensions back I reaaly don't feel I can trust a small bunch of developers to keep something as complicated as the old Firefox patched in this day and age. Am I wrong?

not even a little bit. the advances that were made in multi-process firefox and reducing memory usage and speeding up firefox are all on the backs of webextensions existing. it freed up the developers from having to worry that some internal api getting changed will break the extensions. it simply had to go.

Memory usage and speeding up firefox have nothing to do with keeping the browser patched. Plenty of people thought it was fast enough and fine with memory for their use case, but very few people will be fine with gaping security holes.

Re: Browser extensions are underrated: the promise of hackable software

#135

Post by harshreality »

idoubtit wrote: post #4

I believe many people should attempt to create their own web extension, even if they don't publish it. In my younger years, I used to crack and hack software just for fun. Those were my Softice years. Later, when Opera was not Chromium based, I also had several site customisations, since it was very easy to add my own JS and CSS to any web site. Nowadays, I have 4 extensions created and tailored for my needs. One tha…

> One that deals with cookies (mostly "delete everything" outside of my white list)

That sounds a lot like the "Cookie AutoDelete" FF extension.

Re: Browser extensions are underrated: the promise of hackable software

#136

Post by therealx »

bradknowles wrote: post #93
gildas wrote: post #85

Earlier quoted context omitted.

Some also claim that Google kills innovation. Synchronous interception of requests allows developers to program sophisticated rules to fight malicious resources. In the future, they will only have a regular expressions list to block domains. It will be much easier for malicious actors to bypass this feature.

I want whitelist-only. No blacklists, unless that's something to be applied after the whitelisting step. So, no -- Google's method is not sufficient.

Sounds kinda like a firewall would server you better. Not that I don't think you should or shouldn't be able to have this feature.

Re: Browser extensions are underrated: the promise of hackable software

#137

Post by im3w1l »

zmmmmm wrote: post #128

> The modern browser extension API has done a good job balancing extensibility with security No, it hasn't. Almost every single extension I install tells me some variant of "This extension can intercept and modify all of your browsing traffic". That's not "well balanced", it's completely broken. This is happening clearly for extensions by well intentioned people that do not need those permissions . I can't help but c…

The standard for plugins on windows was for a long time "go to shady website and download a dll with arbitrary code. drop it in the magic folder to run it with full permissions"

Re: Browser extensions are underrated: the promise of hackable software

#138

Post by hybrids »

im3w1l wrote: post #137
zmmmmm wrote: post #128

> The modern browser extension API has done a good job balancing extensibility with security No, it hasn't. Almost every single extension I install tells me some variant of "This extension can intercept and modify all of your browsing traffic". That's not "well balanced", it's completely broken. This is happening clearly for extensions by well intentioned people that do not need those permissions . I can't help but c…

The standard for plugins on windows was for a long time "go to shady website and download a dll with arbitrary code. drop it in the magic folder to run it with full permissions"

I just had a horrid flashback to ActiveX plugin installation wizards in Windows 98...

Re: Browser extensions are underrated: the promise of hackable software

#139

Post by throwaway2048 »

im3w1l wrote: post #137
zmmmmm wrote: post #128

> The modern browser extension API has done a good job balancing extensibility with security No, it hasn't. Almost every single extension I install tells me some variant of "This extension can intercept and modify all of your browsing traffic". That's not "well balanced", it's completely broken. This is happening clearly for extensions by well intentioned people that do not need those permissions . I can't help but c…

The standard for plugins on windows was for a long time "go to shady website and download a dll with arbitrary code. drop it in the magic folder to run it with full permissions"

extensions could just as easily modify executable you download, or source code.

Re: Browser extensions are underrated: the promise of hackable software

#140

Post by crazygringo »

zmmmmm wrote: post #128

> The modern browser extension API has done a good job balancing extensibility with security No, it hasn't. Almost every single extension I install tells me some variant of "This extension can intercept and modify all of your browsing traffic". That's not "well balanced", it's completely broken. This is happening clearly for extensions by well intentioned people that do not need those permissions . I can't help but c…

+1000

Extensions should be able to have their permissions limited by domain (e.g. to customize YouTube or Reddit) at a minimum.

And I'd also really like a way to track both injected scripts and elements so that they wouldn't be able to make any HTTP requests without additional permissions, not even an tag if the src isn't just a data URL or local extension resource.

E.g. I want to be able to install an extension that stops YouTube videos from playing as soon as I navigate to the page, without worrying my entire browsing history or worse is being sent to a third-party.

Post reply on HN