Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser extensions are underrated: the promise of hackable software

geoffreylitt.com

Post reply on HN
Print view View original

141–150 of 189 posts

Re: Browser extensions are underrated: the promise of hackable software

#141

Post by paulryanrogers »

zmmmmm wrote: post #128

> The modern browser extension API has done a good job balancing extensibility with security No, it hasn't. Almost every single extension I install tells me some variant of "This extension can intercept and modify all of your browsing traffic". That's not "well balanced", it's completely broken. This is happening clearly for extensions by well intentioned people that do not need those permissions . I can't help but c…

Recently I started an extension which ran into a need for that 'everything' permission. IIRC it has to do with tab management. I imagine browsers could limit requests for tab access by URL patterns, so not sure why they don't yet.

Re: Browser extensions are underrated: the promise of hackable software

#142

Post by paulryanrogers »

ocdtrekkie wrote: post #98

On the contrary: Browser extensions are horribly overrated. They're a massive security problem (the number one place malware is found on a computer) often for the benefit of replacing the word "cloud" with "butt". They are rarely adequately audited or restricted and have far more access to private data than anyone generally realizes.

Making your own is still empowering though

Re: Browser extensions are underrated: the promise of hackable software

#143

Post by paulryanrogers »

megous wrote: post #129
miguelmota wrote: post #8

Sometimes popular abandoned browser extensions get bought up by malicious actors that inject malware into your browser without you ever knowing because extensions get automatically updated.

That's why you uncheck "update add-ons automatiocally' in the add-on manager.

This risks using a known-vulnerable extension unless you monitor releases another way

Re: Browser extensions are underrated: the promise of hackable software

#144

Post by noragami »

crazygringo wrote: post #140
zmmmmm wrote: post #128

> The modern browser extension API has done a good job balancing extensibility with security No, it hasn't. Almost every single extension I install tells me some variant of "This extension can intercept and modify all of your browsing traffic". That's not "well balanced", it's completely broken. This is happening clearly for extensions by well intentioned people that do not need those permissions . I can't help but c…

+1000 Extensions should be able to have their permissions limited by domain (e.g. to customize YouTube or Reddit) at a minimum. And I'd also really like a way to track both injected scripts and elements so that they wouldn't be able to make any HTTP requests without additional permissions, not even an tag if the src isn't just a data URL or local extension resource. E.g. I want to be able to install an extension that…

>should be able to have their permissions limited by domain

Does Chrome not support this? One more reason not to use it.

https://i.imgur.com/CJT8zsE.png

Re: Browser extensions are underrated: the promise of hackable software

#145

Post by djrockstar1 »

noragami wrote: post #144
crazygringo wrote: post #140

Earlier quoted context omitted.

+1000 Extensions should be able to have their permissions limited by domain (e.g. to customize YouTube or Reddit) at a minimum. And I'd also really like a way to track both injected scripts and elements so that they wouldn't be able to make any HTTP requests without additional permissions, not even an tag if the src isn't just a data URL or local extension resource. E.g. I want to be able to install an extension that…

>should be able to have their permissions limited by domain Does Chrome not support this? One more reason not to use it. https://i.imgur.com/CJT8zsE.png

It does. For instance, here are the domains my reddit app is allowed access to: https://i.imgur.com/lRetX62.png

The non-reddit domains are for expando capability.

Re: Browser extensions are underrated: the promise of hackable software

#146

Post by lbatx »

crazygringo wrote: post #140
zmmmmm wrote: post #128

> The modern browser extension API has done a good job balancing extensibility with security No, it hasn't. Almost every single extension I install tells me some variant of "This extension can intercept and modify all of your browsing traffic". That's not "well balanced", it's completely broken. This is happening clearly for extensions by well intentioned people that do not need those permissions . I can't help but c…

+1000 Extensions should be able to have their permissions limited by domain (e.g. to customize YouTube or Reddit) at a minimum. And I'd also really like a way to track both injected scripts and elements so that they wouldn't be able to make any HTTP requests without additional permissions, not even an tag if the src isn't just a data URL or local extension resource. E.g. I want to be able to install an extension that…

> Extensions should be able to have their permissions limited by domain (e.g. to customize YouTube or Reddit) at a minimum.

This seems like a good idea until you realize that the behavior you might want to modify is coming from a different domain loaded by the page and you have no control over how they set that up.

Re: Browser extensions are underrated: the promise of hackable software

#147

Post by miguelmota »

megous wrote: post #129
miguelmota wrote: post #8

Sometimes popular abandoned browser extensions get bought up by malicious actors that inject malware into your browser without you ever knowing because extensions get automatically updated.

That's why you uncheck "update add-ons automatiocally' in the add-on manager.

Standard users would have no idea they can do that or even bother. Extensions are risky additions to the browser because it's 3rd party code that can read your web pages and local storage values.

Re: Browser extensions are underrated: the promise of hackable software

#148

Post by closeparen »

gildas wrote: post #85
scarface74 wrote: post #76

Earlier quoted context omitted.

No one was upset about a plug in not getting access to your browsing history. People were upset about the declarative ad blocking that took away some of the features that they ad blockers previously had and said Google was doing it to protect their business. I’m not going to defend Google’s overall business practices, but from what I understand, it’s the same type of architecture that Apple has had for four years and…

Some also claim that Google kills innovation. Synchronous interception of requests allows developers to program sophisticated rules to fight malicious resources. In the future, they will only have a regular expressions list to block domains. It will be much easier for malicious actors to bypass this feature.

It’d be interesting to have one sandbox that can synchronously intercept requests, and one sandbox that can make its own requests, but only a one way communication channel between them. So the interceptor part can have its own stateful logic and access the blacklist, but not exfiltrate your history.

Re: Browser extensions are underrated: the promise of hackable software

#149

Post by stevefan1999 »

I was involved into developing a simple app for WebExtension. Not gonna lie, the experience is awful, for example, no IPC support, being way too complicated in terms of API design and that really hateful manifest schema file which echoes the horror of Android API permission XML. I give up at some point, but I could provide the source code if I could get a chance to recover my files.

Re: Browser extensions are underrated: the promise of hackable software

#150

Post by lern_too_spel »

scarface74 wrote: post #123
hnaccy wrote: post #118

Earlier quoted context omitted.

Why is better to fix adblocking capabilities at model that is borderline insufficient now let alone in 10 years. There is arms race and you want adblockers (good guys) to give up any improvements in perpetuity, that is a recipe for losing. Me installing uBlock for parents has improved their browser experience and security. I'd rather risk uBlock being compromised and having to phone them to uninstall it than have the…

How many incidents have we seen where the ad blockers are the bad guys? I don’t recall seeing any third party ads when browsing with Safari on iOS with 1Blocker that uses this architecture.

Edge for Android has that model. While trying it, I frequently got stopped by adblocker blockers. Firefox for Android runs uBlock Origin and never has that problem.
Post reply on HN