Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using fake reviews to find dangerous extensions

krebsonsecurity.com

Post reply on HN
Print view View original

91–100 of 105 posts

Re: Using fake reviews to find dangerous extensions

#91

Post by sunsipples »

quotemstr wrote: post #64

I would pay for a service that reviewed the source code of my extensions (and other installed software) and stamped each specific version as being OK. Then I'd configure my browser not to update an extension to a new version until the extension-verification service had read through the code of the update and okayed it. Granted, such a service wouldn't have the resources to review all extensions, but it could probably…

I will make an extension that handles this vetting for you contact me on my official email account notascam@gmaiil.co

Re: Using fake reviews to find dangerous extensions

#92

Post by HyphenSam »

ChrisClark wrote: post #77
formerly_proven wrote: post #47

Earlier quoted context omitted.

It's the opposite actually, the Chrome store forces the use of @gmail.com addresses, so e.g. Microsoft is publishing Chrome extensions from addresses like legitmicrosoftapps@gmail.com or microsoftofficextension@gmail.com See: https://news.ycombinator.com/item?id=27192997 (no one could actually tell which where legit and which were not)

It's because of that thread that people mistakenly believe you need a gmail.com address. A bunch of people in that thread guessed you needed a gmail.com address. Others immediately said no, you don't need it and showed examples. But this is how misinformation spreads. Many people only read it and believe it without looking closer. We just trust that other people know what they are talking about. :) ... Also I could b…

You're not wrong, and it's easy to prove. Just go to the page where you create a new Google account, and select "Use my current email address instead". Then go to the page where you register to be a Chrome web store developer. You won't see any option forcing you to create a @gmail.com address.

Re: Using fake reviews to find dangerous extensions

#93

Post by rand0mx1 »

ehsankia wrote: post #59
extesy wrote: post #22

> In other words, there a great many developers who are likely to be open to someone else buying up their creation along with their user base. As a maintainer of a relatively popular extension (hoverzoom+, ~360K users) I get business offers all the time [1]. A few of them are pretty good, actually. I'm not surprised that some developers eventually give up and take one of those offers. But I am surprised that there ar…

I moved from old HoverZoom to Imagus, wasn't aware a reboot of HoverZoom around, thanks for sharing. I'm curious how the sieves and also writing custom sieves compare, if anyone has experience with both.

Imagus has been abandoned by the developer. Its no longer work on many sites

Re: Using fake reviews to find dangerous extensions

#94

Post by Franciscouzo »

quotemstr wrote: post #64

I would pay for a service that reviewed the source code of my extensions (and other installed software) and stamped each specific version as being OK. Then I'd configure my browser not to update an extension to a new version until the extension-verification service had read through the code of the update and okayed it. Granted, such a service wouldn't have the resources to review all extensions, but it could probably…

https://support.mozilla.org/en-US/kb/recommended-extensions-...

Re: Using fake reviews to find dangerous extensions

#95

Post by ben0x539 »

the_local_host wrote: post #20
leotaku wrote: post #12

Earlier quoted context omitted.

I'm not sure what you mean by non-malicious extensions being intrusive. I use a number of extensions, mostly content-blocking and privacy-related and they mostly just get out of my way. The Firefox Extension Store also has a recommended extensions feature that shows that the extension has been reviewed by Mozilla for privacy and security. Most extensions I use have this seal.

I should have said potentially intrusive. Giving any extension permission to "Access your data for all websites" would give me pause.

That's fair, but my browser has permission to access my data for all websites, and uBlock Origin probably has my best interests in mind more so than Google Chrome.

Re: Using fake reviews to find dangerous extensions

#96

Post by KronisLV »

Here's a funny story: I was once looking for a figurine online that was sold out everywhere apart from one internet store. So before giving them my money I read some of the reviews.

All seemed good and it appeared that people from all sorts of places had been their customers, until I saw one particular review. It was in Latin.

Re: Using fake reviews to find dangerous extensions

#97

Post by formerly_proven »

throwawaaarrgh wrote: post #62
formerly_proven wrote: post #52

Earlier quoted context omitted.

> it is a corporate account that is managed by google All the counter-examples I could find in the linked thread are Google Mail (for Business), which is functionally the same as requiring a gmail account in that it requires Google to be your mail-provider.

You can also create a Google Account using a non-Google e-mail address, without any special Google Business thing. I did. I keep a Google account tied to my work e-mail address, but there is no Gmail account associated with this Google account. I can use Google services, but all my mail is on our corporate servers. A lot of people in corporations set things up without necessarily understanding what they're setting up…

Thanks for the correction.

Re: Using fake reviews to find dangerous extensions

#98

Post by throwaway45209 »

matheusmoreira wrote: post #33
the_local_host wrote: post #4

I'm surprised anyone ever installs browser extensions, given how many malicious extensions exist, and how intrusive they are whether malicious or not.

Yeah. The only extensions people should install are uBlock Origin and EFF extensions like Privacy Badger. All others are potential malware. I get downvoted a lot every time I post this here.

Also HTTPS Everywhere by EFF, which can also be used for example to redirect from reddit.com to old.reddit.com.

Also Mozilla's own extensions - 'Firefox Multi-Account Containers' and 'Facebook Container'.

Re: Using fake reviews to find dangerous extensions

#99

Post by user-the-name »

deckard1 wrote: post #81
user-the-name wrote: post #40

Earlier quoted context omitted.

Of course there are, but the point is, you can not really trust any of them. Today they will be very useful, tomorrow they may be malware, and there is no way for you to know or protect yourself.

This is true of anything you find on github as well. Open source works on the idea that "given enough eyeballs, all bugs are shallow." The thing people forget is the "enough eyeballs" part. As if people are sitting around auditing every sub-dependency of a sub-dependency of React. In addition, I don't know of any package repository that requires the authoritative source[1] from github to match the compiled/minified/e…

Three things are absolutely true:

1) Package managers are a huge security risk.

2) Recursive dependencies massively increase that risk.

3) You should check all your dependencies into your repo, or at least some kind of manifest with secured signatures of those dependencies, and never automatically update dependencies.

I see a few things that can improve this situation by quite a lot:

1) Languages should provide an extensive and expressive standard library of some sort, either one bundled with the language, or a tightly vetted and controlled set of first-party dependencies.

2) Package managers should not automatically resolve recursive dependencies, but should force users to manually add all dependencies of any dependency that is added. This additional friction would force you to acknowledge all the risk you are taking on by adding dependencies, and it would force the ecosystem as a whole to reduce the number of dependencies.

Re: Using fake reviews to find dangerous extensions

#100

Post by gentleman11 »

the_local_host wrote: post #4

I'm surprised anyone ever installs browser extensions, given how many malicious extensions exist, and how intrusive they are whether malicious or not.

It’s one of the nice things about brave: it had privacy features built in that you would otherwise need a dozen extensions by various people to do the same. It seems like the built in tracking protections in Firefox have caught up a lot though, I’m not sure if the extensions are as necessary now
Post reply on HN