Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's build a Chrome extension that steals as much data as possible

mattfrisbie.substack.com

Post reply on HN
Print view View original

71–80 of 320 posts

Re: Let's build a Chrome extension that steals as much data as possible

#71

Post by ClumsyPilot »

Sebb767 wrote: post #39
ClumsyPilot wrote: post #28

Earlier quoted context omitted.

> The chain of humans who've been responsible for developing and testing Chrome Extension functionality and security has been asleep at the wheel this whole time, for something like 15 years. There should be liability for negligence. If you were told about a security hole and you have not fixed it, and you have not informed your users, in months, you should pay statutory damages. And if you lied about your app (claim…

Well, you can get a full refund. I see where you are coming from, but increasing liability for free software does not feel like a good idea to me at all. There's basically no way you could extract money protected by Googles lawyers army, but any small open-source project or even medium sized company will be extremely vary of releasing anything. I'm not saying you should never go there - GDPR does and it's a net impro…

> Well, you can get a full refund

Suppose developers of smart locks make an error, and all smartslock unlock on Fridays. When users ask the Company, they lie and claim their locks are flawless and users are to blame.

Millions of houses are robbed, people loose their life possesions, and home robbers kill some grandma.

Should the Grandma's family get just a $100 refund (price of the lock)?

> There's basically no way you could extract money protected by Googles lawyers army

That's defeatist. If thats true, then this whole discussion is pointless.

If there are 'nobles' that don't answer to justice, we live in feudalism. Freedom and capitalism are dead.

Re: Let's build a Chrome extension that steals as much data as possible

#72

Post by Dalewyn »

dcow wrote: post #49
ClumsyPilot wrote: post #30

Earlier quoted context omitted.

> Wait until you see what’s possible with executables! The most important thing is whay you tell the user - Windows says "We don't know where Trojan.exe came from, it could be a virus, are you sure you want to run it?" Chrome says: "You downloaded Trojan.exe from our store, we manage it and check it for viruses. It only asks for harmless permission, install it!" One is warning you, the other is entrapment.

Windows has an app store now too. > It only asks for harmless permission, install it! Not true. It lists all the permissions being requested. Sure the scrollbar issue is real and should be an easy fix. I don't understand why people are so confused about permissions. If the user grants your extension permission to read your browsing history so it can provide value to them, why is that a problem? It's not. The problem…

>I don't understand why people are so confused about permissions.

I don't understand why people (read: devs) still assume permissions are read and understood.

The vast majority of people simply do not read nor understand permissions and just instantly hit the OK button. Even Linus from LinusTechTips doesn't read permissions, and he's even a tech guru unlike most people.

Re: Let's build a Chrome extension that steals as much data as possible

#73

Post by lapcat »

mard wrote: post #61
wolpoli wrote: post #29

One of the issues here is that the browser is prompting the user for all the Permissions at install time. Both Android and IOS have moved away from that. Perhaps it is time browsers to move away from that as well.

Extensions are one thing, but I'd also welcome granular permissions to various JavaScript capabilities for every website. I don't like when some websites capture native browser hotkeys (CTRL+F), disable my right mouse button, change scrolling behavior or perform asynchronous HTTP requests. The only solution I found to protect against these practices is disabling JavaScript completely for given site, but more often th…

You need extensions to stop this behavior from websites. ;-)

Re: Let's build a Chrome extension that steals as much data as possible

#74

Post by Afforess »

jsnell wrote: post #10
Afforess wrote: post #3

This is an excellent accidental rebuttal to the entire Manifest v3 project. The stated reason for the new major version and breaking changes is officially: > Manifest V3 represents one of the most significant shifts in the extensions platform since it launched a decade ago. Manifest V3 extensions enjoy enhancements in security, privacy, and performance... https://developer.chrome.com/docs/extensions/mv3/intro/ Web de…

It's good that it doesn't pretend to be a rebuttal, because it'd be a bad one. I'm pretty sure the point of making a declarative content blocking API for adblockers is not to block all possible ways of writing a malware extension. It is just to make the most popular category of extensions safe by design. Once that has been done, it's then much easier to improve the situation with the remaining niche use cases. What w…

Chrome extensions that contain malware aren't written and submitted to the chrome store hoping to sneak past review. Malware authors _purchase_ the intellectual property of fulling functioning, useful extensions, and update them to contain their extra malware payload. I'm not sure where you got the idea that a review would be involved here at all.

Re: Let's build a Chrome extension that steals as much data as possible

#75

Post by dcow »

modeless wrote: post #69
dcow wrote: post #45

This is a spicy essay for sure but what is the author's actual point? If the user grants you permission to do all these things, then you have permission to do all these things. If you can't be trusted and abuse that permission then you are not ethical. If you aren't ethical someone will find out and your extension will be removed in the worst case and simply not approved in the common case. The author even admits as…

Is that solving any real problem? Will any single person actually be protected by that annoyance? The permissions already appear roughly sorted by invasiveness. Is the sixth one really going to be the one that your install decision hinges on? I mean, once you have "Read and change all your data on websites" it's game over anyway if the extension is truly malicious.

I think perhaps we need to agree on the real problems that exist.

It's not like users are getting their data stolen left and right out there and man these extension trojans are winning the battle against good extensions and we just can't shake 'em. All your base... are belong to us.

It seems the status quo is that extension fraud, while entirely possible as this article demonstrates, is not actually a problem. If you don't trust a piece of software to access your webpage content then don't grant it the permission to do so. I think the onus is on alarmist pieces like this to bring the data supporting the existence of a problem to be alarmed about in the first place.

I mean, raise your hand if you've been pwned by a malicious Chrome extension recently...

Re: Let's build a Chrome extension that steals as much data as possible

#76

Post by Gigachad »

dcow wrote: post #48
Gigachad wrote: post #35

Earlier quoted context omitted.

The problem is not a single person is capable of making informed decisions on extensions. One day they could be good and reputable, next day they have been sold to a malware company. Maybe the middle ground is all extensions have a legal entity in your country so you can sue them for spyware.

What? The same can happen with any piece of software in the world. Why single out extensions?

We sandbox apps to prevent them from reading each others data. It's impossible to sandbox web extensions and have them retain basically any of the functionality needed.

As well as almost all regular software is backed by some large company with legal presence to hold responsible. The same can not be said for most extensions.

Re: Let's build a Chrome extension that steals as much data as possible

#77

Post by Gigachad »

dcow wrote: post #51
Gigachad wrote: post #41

Earlier quoted context omitted.

Apps are a different thing since even if you sideload apps, one app can’t insert itself in to another app to scrape your data. While extensions are almost like kernel extensions that can do just about anything.

The naivety of innocence is rather blissful, isn't it?

Care to provide an example of an ios app which can read the data from other apps when they shouldn't?

Re: Let's build a Chrome extension that steals as much data as possible

#78

Post by whalesalad »

jefftk wrote: post #64
whalesalad wrote: post #33

Earlier quoted context omitted.

https://github.com/ungoogled-software/ungoogled-chromium

The features mentioned in the article are available to extensions, and ungoogled-chromium supports these just as well.

Sure, but you don’t need to install them.

Re: Let's build a Chrome extension that steals as much data as possible

#79

Post by sangnoir »

NovemberWhiskey wrote: post #8

> Identify and eject storage devices I mean, why?

Chrome has a a USB interface; I'm guessing identification and ejectionnis required functionality fir dual-mode USB devices that may present as storage devices foe driver installation.

Re: Let's build a Chrome extension that steals as much data as possible

#80

Post by dcow »

Dalewyn wrote: post #72
dcow wrote: post #49

Earlier quoted context omitted.

Windows has an app store now too. > It only asks for harmless permission, install it! Not true. It lists all the permissions being requested. Sure the scrollbar issue is real and should be an easy fix. I don't understand why people are so confused about permissions. If the user grants your extension permission to read your browsing history so it can provide value to them, why is that a problem? It's not. The problem…

>I don't understand why people are so confused about permissions. I don't understand why people (read: devs) still assume permissions are read and understood. The vast majority of people simply do not read nor understand permissions and just instantly hit the OK button. Even Linus from LinusTechTips doesn't read permissions, and he's even a tech guru unlike most people.

So hopefully the Chrome store review process is the nanny they need.

The only thing that has permission to read and modify website data on my browsers is my password manager. I trust it. Without that permission it could not operate and provide me immense value. Yes, I would be hosed if it got pwned. It's a calculated risk on my part.

One cannot live in a world where we have the benefits of browser extensions and also disallow all behavior that could ever possibly be used for bad. It's an inconsistent worldview.

Post reply on HN