Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's guess what Google requires in 14 days or they kill our extension

blog.pushbullet.com

Post reply on HN
Print view View original

641–650 of 811 posts

Re: Let's guess what Google requires in 14 days or they kill our extension

#641

Post by rergaerg »

For one, I think this is good news. I work in a field that exposes me to a lot of dubious ways to collect peoples data. Especially what they are doing in their browser. You would not believe how many pieces of software you are using daily that do this.

A lot of these are chrome extensions. If you are honest, then I do feel for your situation. But, I am also happy to see that Google are finally stepping this up and looking after their users by not exposing them to potentially malicious services.

Re: Let's guess what Google requires in 14 days or they kill our extension

#642

Post by mrighele »

trav4225 wrote: post #393
mrighele wrote: post #177

Earlier quoted context omitted.

Some registrars let you enable automatic renewal, so in that case the only risk is to keep paying for a domain that you forgot of.

How is credit card expiration handled? Or do you suggest another payment method?

I think they sent me a notification about the expiring card once.

Another alternative is using one that accept recurring payments through PayPal; that way you would have to handle card expiration only with Paypal.

Re: Let's guess what Google requires in 14 days or they kill our extension

#643

Post by yellowapple »

teruakohatu wrote: post #569
yellowapple wrote: post #456

Earlier quoted context omitted.

I mentioned this in the GitHub issue thread (howdy!), but I strongly suspect it has to do with specific references to pornographic sites in the extension's manifest. If only Google would mind its own business instead of playing mommy-knows-best and dictating its morality on grown adults.

It is also a fork of an extension that contained malware, so an automated code review tool trained on malware might be catching it.

That's a possibility, too, but the email specifically mentioned pornographic content or extensions that might "drive traffic" to pornographic sites so that seemed like the more likely reason.

Re: Let's guess what Google requires in 14 days or they kill our extension

#644

Post by heleninboodler »

FillardMillmore wrote: post #499
geofft wrote: post #488

Earlier quoted context omitted.

And both Grammarly and LastPass have had security bugs that let any website worm their way into the extension and access all the data from the extension (anything you've ever typed, for Grammarly, and all your passwords, for LastPass). Extensions with wide-ranging access are useful, and there's a reason Chrome has support for it, but they're also very very hard to get right, even if your entire business is writing a…

Do you have a link for that claim on LastPass? I use the extension and am wondering if I shouldn't use an PM extension thats more reliable in terms of security. Any recommendations obviously welcome.

IMO a password manager is an extremely critical piece of software that I'm ok with if I trust its security model. There are a couple whose security models I do trust. However, merging those security models with random extensions that may or may not have full run of all code executing in the same context as my password manager is a hard no. It's baffling to me that any legit password managers go to the trouble to write and support browser extensions, given the risk. It's betting your reputation for security on a very small amount of user convenience.

Re: Let's guess what Google requires in 14 days or they kill our extension

#645

Post by teddyh »

nucleardog wrote: post #257
toohotatopic wrote: post #210

Earlier quoted context omitted.

So, which ones are the good registrars?

I generally trust the major cloud providers a bit more than the companies focused on acting as a domain registrar. The domain registrars are generally a race to the bottom and focused on "add-on" sales as most people are shopping on price and that's going to reflect in the overall quality of the things that most people don't really notice like, y'know, security and validation. You don't hear a lot of stories about Am…

Or… use a smaller registrar which actually charges more in order to provide support which you can contact personally. Most (if not all) large registrars are indeed in a “race to the bottom”, but that does not mean that all registrars are.

(Disclaimer: I work at such a small registrar. No, I’m not going to tell you which one; we aren’t targeting the global market, anyway, only our local area.)

Re: Let's guess what Google requires in 14 days or they kill our extension

#646

Post by tastroder »

pvg wrote: post #630
tastroder wrote: post #622

Earlier quoted context omitted.

The theoretical problems that are also hypothetical because the browser vendor isn't specifically saying that it's what they take issue with here even after the developer tried to mitigate it? And which is apparently pretty common with the prescribed best practice being buggy and badly documented as per the thread below? I'm fine with putting some blame on the extension developers here but this communication by Googl…

The theoretical problems that are also hypothetical I have some trouble following this. These are real, exploited capabilities. How are they theoretical and also hypothetical?

I just did not see any indication of the permission actually being abused by this specific extension, hence the hypothetical. That's not meant to dismiss that it is an issue but in this specific case I think the communication is worse than the potential problem given that the devs don't seem to have a negative track record and actively work on mitigating it.

As for the redundancy, I blame my lack of coffee for that, apologies.

Re: Let's guess what Google requires in 14 days or they kill our extension

#647

Post by marcus_holmes »

adrianN wrote: post #604
SftwrSvior81 wrote: post #540

Earlier quoted context omitted.

> But is it more or less anti-social than running a huge software platform that advertises the ways to exploit itself? Security through obscurity is no security at all. Google is not doing its user a favor by hiding the criteria it uses to determine whether an extension is malicious or not. Also, just because Google won't publish the criteria, it does not mean that it can't be discovered by someone with enough determ…

It seems likely to me that it's impossible to have an extension system that allows useful extensions that users want while also being completely secure against malicious actors. Security by obscurity is an important tool in the abuse fighting toolbox, because it allows you to have cheap heuristics while increasing the costs for malicious actors.

Not really, because malicious actors don't care about their reputations, accounts, etc.

A reputable developer has a reputation to maintain (by definition), which makes Google's threat to permaban them a threat indeed.

A disreputable developer doesn't care about their reputation (again, by definition). They can create a new throwaway account every day and apply using the same (or slightly, easily, altered) code with different permissions every hour until they get permabanned, and start again tomorrow.

So the "obscurity" can be discovered easily through experimentation by the bad guys, but is still obscure for the good guys. This is not a good outcome.

Re: Let's guess what Google requires in 14 days or they kill our extension

#648

Post by shklnrj »

nikolay wrote: post #133

Google are cutting the branch they are sitting on. I only use Chrome because certain extensions are not available on Firefox. During all these years, they've become impossible to deal with. I open Chrome with 10 tabs and after a couple of hours it's using gigabytes of RAM. From a thin client, it became the thickest client in the visible universe. It's time to consider options... not that there are many.

I just started using Brave and most extensions are available. Pretty good from privacy point of view as well. Check it out.

Re: Let's guess what Google requires in 14 days or they kill our extension

#649

Post by pineaux »

geofft wrote: post #494
JaggedJax wrote: post #485

Earlier quoted context omitted.

But you're completely ignoring the point that even without the all http(s) permission they will still be kicked off the store, so that has nothing do do with the issue at hand. If localhost is the issue, Google could literally respond exactly the way you did and the problem is gone, "why do you need http://localhost/?" This isn't about permissions at all. This is about communication and whether it's worth putting eff…

That's the thing I'm sympathetic to - having fixed the bug , it's frustrating that it's not clear what the next steps are. But given that they had the bug, Chrome was absolutely in the right to deny them the first time. And while I don't like Chrome's position that they're too busy to explain to everyone what they're doing wrong, if extensions that go "oh hey, we don't actually need access to literally every website,…

Would it be better if Chrome said "There are 200,000 extensions on the Chrome store, each and every one of them deserves attention, we need to spend at least 30 minutes looking at each one and composing a response, we have a ten-person team, we'll get back to you within 5 years?"

Yeah, but with 100 people it would take only a few months and after that it would take far less people to maintain everything. Also, they could just have their algorithm do the flagging and then have a team of 10/20 people to handle users. It's just that they don't care (enough) Not all 200.000 extensions are being killed in the next 14 days. Also if this is done for security reasons then put this responsibility with your security team and make that team bigger.

Re: Let's guess what Google requires in 14 days or they kill our extension

#650

Post by adrianN »

marcus_holmes wrote: post #647
adrianN wrote: post #604

Earlier quoted context omitted.

It seems likely to me that it's impossible to have an extension system that allows useful extensions that users want while also being completely secure against malicious actors. Security by obscurity is an important tool in the abuse fighting toolbox, because it allows you to have cheap heuristics while increasing the costs for malicious actors.

Not really, because malicious actors don't care about their reputations, accounts, etc. A reputable developer has a reputation to maintain (by definition), which makes Google's threat to permaban them a threat indeed. A disreputable developer doesn't care about their reputation (again, by definition). They can create a new throwaway account every day and apply using the same (or slightly, easily, altered) code with d…

The point is making it more expensive for malicious actors. You can't make it impossible to get malicious extensions in, but you can make it harder. It's the same as captchas. You can also defeat captchas, but adding them reduces abuse a lot. As with captchas you're making it harder for good actors too. The difficult part is finding a good balance.

Reputation can be bought too btw.

Post reply on HN