Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's build a Chrome extension that steals as much data as possible

mattfrisbie.substack.com

Post reply on HN
Print view View original

21–30 of 320 posts

Re: Let's build a Chrome extension that steals as much data as possible

#21

Post by eyelidlessness »

KennyBlanken wrote: post #7

The author notes that this sort of extension would be laughed out of the review queue....but there are plugin authors who get plenty of users by putting up a website and making the plugin available directly from their site. For example, the author of FB Purity hasn't explained to anyone why his plugin is not available via Firefox's extension store, only via his page. Presumably, he didn't meet some requirements they…

And this is why I welcome “control over” what I can do with my device by my OS vendor. Even though it’s mostly trivial to bypass, it still serves as a good gut check in the rare case where I might skip over my own scruples. 99% of the time if I even get this far I back out because I’ve realized by that point I was being foolishly trusting.

Re: Let's build a Chrome extension that steals as much data as possible

#22

Post by alooPotato »

Now try actually distributing it.

My guess is this wouldn't even get close to getting through the review process for the Chrome Webstore. From our experience with Streak, this would def get picked up in review.

Seeing other comments in the thread pointing to this article as a reason why MV3 is bad I think misses the point. Personally I think MV3 is a step in the right direction (even though it negatively affects us!). But it's only one piece to make extensions more secure - the others being manual review, policy adjustments and automated scanning. Even though the APIs allow for all sorts of functionality doesn't mean you'll be able to get through the rest of checks.

Re: Let's build a Chrome extension that steals as much data as possible

#23

Post by alooPotato »

drpixie wrote: post #20

I'd like a fork of chrome which removes all (or at least most) the "features" mentioned - a browser that renders well but just doesn't support these masses of unsecure features. If you want to give 3rd parties access to all that stuff, you can run chrome. But I don't - I want the bare minimum that will run normal websites. I know that will break some pages, I'll accept that. (And that would give me a smaller & faster…

What else would you remove? If it's just extensions, can you just not install them?

Re: Let's build a Chrome extension that steals as much data as possible

#24

Post by jeroenhd »

drpixie wrote: post #20

I'd like a fork of chrome which removes all (or at least most) the "features" mentioned - a browser that renders well but just doesn't support these masses of unsecure features. If you want to give 3rd parties access to all that stuff, you can run chrome. But I don't - I want the bare minimum that will run normal websites. I know that will break some pages, I'll accept that. (And that would give me a smaller & faster…

If you don't install any addons, you'll be fine. You'll have to do without uBlock Origin and other ad blockers, though. Consider Brave if you still want those and want to stick to Chromium.

In Firefox, you can go to about:config and set the default permission to deny to a lot of stuff (notifications, clipboard, etc.). You can also disable webgl and other features like those.

Re: Let's build a Chrome extension that steals as much data as possible

#25

Post by abraham »

codetrotter wrote: post #13
NovemberWhiskey wrote: post #8

> Identify and eject storage devices I mean, why?

Because browser makers and web app devs want to be able to do everything desktop software can, but inside of a browser. In theory it’s kind of neat.

It's a chrome APi, not a browser web API.

https://developer.chrome.com/docs/extensions/reference/syste...

Re: Let's build a Chrome extension that steals as much data as possible

#26

Post by drpixie »

jeroenhd wrote: post #24
drpixie wrote: post #20

I'd like a fork of chrome which removes all (or at least most) the "features" mentioned - a browser that renders well but just doesn't support these masses of unsecure features. If you want to give 3rd parties access to all that stuff, you can run chrome. But I don't - I want the bare minimum that will run normal websites. I know that will break some pages, I'll accept that. (And that would give me a smaller & faster…

If you don't install any addons, you'll be fine. You'll have to do without uBlock Origin and other ad blockers, though. Consider Brave if you still want those and want to stick to Chromium. In Firefox, you can go to about:config and set the default permission to deny to a lot of stuff (notifications, clipboard, etc.). You can also disable webgl and other features like those.

I'd feel much more secure, from extensions and websites if those permissions just didn't exist. I can only turnoff what I know about, but not those new things quietly added with each update.

Re: Let's build a Chrome extension that steals as much data as possible

#27

Post by [deleted] »

drpixie wrote: post #26
jeroenhd wrote: post #24

Earlier quoted context omitted.

If you don't install any addons, you'll be fine. You'll have to do without uBlock Origin and other ad blockers, though. Consider Brave if you still want those and want to stick to Chromium. In Firefox, you can go to about:config and set the default permission to deny to a lot of stuff (notifications, clipboard, etc.). You can also disable webgl and other features like those.

I'd feel much more secure, from extensions and websites if those permissions just didn't exist. I can only turnoff what I know about, but not those new things quietly added with each update.

[deleted]

Re: Let's build a Chrome extension that steals as much data as possible

#28

Post by ClumsyPilot »

metadat wrote: post #9

> Chrome scrolls the permission warning message container, so more than half of the warning messages don’t even show up. I’d bet most users wouldn’t think twice about installing an extension that appears to ask for just 5 permissions. An egregious and nearly unbelievable oversight on Google's part. :-\ As a developer, it's unimaginable to me to not test the extreme high and low numbers of inputs cases to ensure thing…

> The chain of humans who've been responsible for developing and testing Chrome Extension functionality and security has been asleep at the wheel this whole time, for something like 15 years.

There should be liability for negligence.

If you were told about a security hole and you have not fixed it, and you have not informed your users, in months, you should pay statutory damages.

And if you lied about your app (claiming encryption where there is none) you should be liable too, even if the app is free

Re: Let's build a Chrome extension that steals as much data as possible

#30

Post by ClumsyPilot »

nostromo wrote: post #11

Wait until you see what’s possible with executables! I like this project, but I also worry that eventually we’re going to lose access to extensions entirely because people will take away the wrong message. Safeguards are good, but at a certain point I want my devices to trust that I know what I’m doing.

> Wait until you see what’s possible with executables!

The most important thing is whay you tell the user -

Windows says "We don't know where Trojan.exe came from, it could be a virus, are you sure you want to run it?"

Chrome says: "You downloaded Trojan.exe from our store, we manage it and check it for viruses. It only asks for harmless permission, install it!"

One is warning you, the other is entrapment.

Post reply on HN