Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome users beware: Manifest v3 is deceitful and threatening

eff.org

Post reply on HN
Print view View original

271–280 of 396 posts

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#271

Post by kstenerud »

tptacek wrote: post #258

It's hard to take EFF seriously when they write so hyperbolically. What's clearly also the case is that Chrome extensions are one of the great modern security and privacy challenges --- to the point where multiple tech company security teams have people whose job it is just to screen them. Another detail that EFF doesn't want to share is that ad blockers are some of the worst offenders --- they demand maximal access…

The article talks about the extension review process at Mozilla (hint: It's manageable) and bad/malicious extensions. So I'm not sure where your "other side of the story" bit comes from...

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#272

Post by kbelder »

mappu wrote: post #252
aembleton wrote: post #171

Earlier quoted context omitted.

It's a good point. Probably best to build it into the browser and let me add my own lists for it to use. That would be a good move for Firefox, they could have it off by default but it would help to reduce the chance of a compromised extension have too much access.

This is almost exactly what Manifest V3 is - it reduces the extension to just be a list manager for a built-in blocker. The only real complaint is that Chrome did not anticipate how large these lists need to be in 2021, and the limits are too low.

Another problem is that it's static; my understanding is the extension creator needs to make a new list, get it approved by Google, put it in the repository, and get the user to download the update, before a new ad is blocked. Probably requires a restart of the browser, also.

Not sure if it removes the ability for the user to on-the-fly add any blocking, but I suspect it does.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#274

Post by josephcsible »

Bellamy wrote: post #273

Opera, Brave, Firefox, even DuckDuckGo browser works pretty well. There is really no need to use Chrome anymore.

What's even the point of switching away from Chrome if the browser you're switching to is also Chromium-based and closed source?

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#275

Post by Bellamy »

ShamelessC wrote: post #208
KevinMS wrote: post #201

I remember the old days when HN users would promote the hell out of chrome. They loved it, couldn't get enough of it. A few others, including myself, were like... um guys, this browser is created by a company that makes its money from advertising that shows in browsers, do you really think this is going to turn out well?

You may see this as naive, but there was more confidence in Google (and big tech in general) to continue to "do no evil" in those days. I personally have never been upset with my firefox experience after their big re-write a few version back. The only benefits I see with chrome lately are when sites are clearly designed and tested only for Chrome. Not much of a benefit in the grand scheme of things, obviously.

And you believed a multinational stock company. I hope you don't make that mistake again.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#276

Post by Bellamy »

ddingus wrote: post #214
KevinMS wrote: post #201

I remember the old days when HN users would promote the hell out of chrome. They loved it, couldn't get enough of it. A few others, including myself, were like... um guys, this browser is created by a company that makes its money from advertising that shows in browsers, do you really think this is going to turn out well?

Tons of people said this. They were all right. So, what's the alternative here? What can people actually do to improve on things?

Use Firefox, Opera, Brave, or DuckDuckGo browser.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#277

Post by cookiengineer »

tptacek wrote: post #258

It's hard to take EFF seriously when they write so hyperbolically. What's clearly also the case is that Chrome extensions are one of the great modern security and privacy challenges --- to the point where multiple tech company security teams have people whose job it is just to screen them. Another detail that EFF doesn't want to share is that ad blockers are some of the worst offenders --- they demand maximal access…

Every time someone mentions this I have to think about the messed up ecosystem of Safari Webextensions.

Safari only allows extensions installed via the apple store, but every single adblocker there is a scam.

I'm not kidding you, I audited most of them. Chances are it's either a three years outdated list of adblock plus that doesn't catch anything or it's an extension that replaces all google analytics identifiers with their own to make money (even when it's a paid extension).

The only thing worse than Chrome is Safari at the moment. And Apple doesn't give a shit about anything there, I reported the malicious extensions to no effect at all.

So when thinking of the other side and "removal of choice" I don't have a healthier, audited ecosystem in mind...I have Safari in mind, which right now is a worse attack surface than IE6 back in the days when it comes to Privacy or Security.

Malicious extensions (as answer to comments). DONT install any of them, as I think they're scamware.

[1] AdBlock for Safari and Adblock for Mobile, which is an outdated AdBlock Plus fork: https://apps.apple.com/de/app/adblock-for-safari/id140204259...

[2] AdBlock Plus (which is the same scam model as other eyeo GmbH products): https://apps.apple.com/de/app/adblock-plus-f%C3%BCr-safari/i...

[3] Stop Ads https://apps.apple.com/lu/app/stop-ads-der-ultimative-ad-blo...

[4] 1Blocker https://itunes.apple.com/app/id1107421413

[5] Wipr doesn't do anything, literally https://appsto.re/us/thAB9.i

[6] Ad blocker https://apps.apple.com/de/app/ad-blocker-remove-ads/id153692...

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#278

Post by londons_explore »

While I don't want to give Google PR tips here... There is a much smarter way for Google to achieve their aim...

Make the new manifest optional.

Point out that malicious extensions keep using the old manifest (which is more powerful and allows far more evil things).

Allow web developers to set a "disallow less secure extensions" http header. That allows banks and stuff to ensure an insecure old-manifest chrome extension isn't redirecting all your funds to North Korea while you do online banking.

Before long, ad networks will realise that setting this header nerfs adblockers too.

Most of the web will set the header to get more ad revenue.

In the press, it will be the evil people misusing the secure header rather then Google's fault.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#279

Post by ayushnix »

Helmut10001 wrote: post #253
AnonC wrote: post #229

A lot of comments here are wondering what Firefox will do and if uBlock Origin would be made useless in Firefox like it would be in Chrome (once Mv3 is implemented). Short answer: Firefox is adopting various parts of Mv3, but will continue to support blocking webrequest, which is used by extensions like uBlock Origin. So uBlock Origin would become useless in Chrome, possibly Edge and a few other browsers, but not on…

Get a DNS Sink (such as pfblockerNG-devel). Works without Add-Ons or client config and in any browser. uBlock Origin is really only used on my computer for when I am not at home.

No DNS based solution comes anywhere close to what uBO offers. You can hide elements you don't like. You can block individual scripts or resources in a web page, even if they are first party resources. No DNS sink solution can do that.

Browsing the internet would be an extremely bad experience for me if I just relied on a DNS sink.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#280

Post by DavideNL »

cookiengineer wrote: post #277
tptacek wrote: post #258

It's hard to take EFF seriously when they write so hyperbolically. What's clearly also the case is that Chrome extensions are one of the great modern security and privacy challenges --- to the point where multiple tech company security teams have people whose job it is just to screen them. Another detail that EFF doesn't want to share is that ad blockers are some of the worst offenders --- they demand maximal access…

Every time someone mentions this I have to think about the messed up ecosystem of Safari Webextensions. Safari only allows extensions installed via the apple store, but every single adblocker there is a scam. I'm not kidding you, I audited most of them. Chances are it's either a three years outdated list of adblock plus that doesn't catch anything or it's an extension that replaces all google analytics identifiers wi…

So "Adguard for Safari" is a scam, for example ?
Post reply on HN