Let's build a Chrome extension that steals as much data as possible • Hacker News Board

Re: Let's build a Chrome extension that steals as much data as possible

#81

Post by burnished » Wed, Feb 22, 2023, 2:08 AM UTC

ClumsyPilot wrote: post #71

Sebb767 wrote: post #39

Earlier quoted context omitted.

Well, you can get a full refund. I see where you are coming from, but increasing liability for free software does not feel like a good idea to me at all. There's basically no way you could extract money protected by Googles lawyers army, but any small open-source project or even medium sized company will be extremely vary of releasing anything. I'm not saying you should never go there - GDPR does and it's a net impro…

> Well, you can get a full refund Suppose developers of smart locks make an error, and all smartslock unlock on Fridays. When users ask the Company, they lie and claim their locks are flawless and users are to blame. Millions of houses are robbed, people loose their life possesions, and home robbers kill some grandma. Should the Grandma's family get just a $100 refund (price of the lock)? > There's basically no way y…

Please dont make up alarmist analogies to try and support your point. You introduce unnecessary points of confusion with 1) whether your scenario even fits and 2) whether the outcomes even make sense.

Stick to the actual situation wherever possible.

Re: Let's build a Chrome extension that steals as much data as possible

#82

Post by ClumsyPilot » Wed, Feb 22, 2023, 2:10 AM UTC

A4ET8a8uTh0 wrote: post #47

Sebb767 wrote: post #39

Earlier quoted context omitted.

Well, you can get a full refund. I see where you are coming from, but increasing liability for free software does not feel like a good idea to me at all. There's basically no way you could extract money protected by Googles lawyers army, but any small open-source project or even medium sized company will be extremely vary of releasing anything. I'm not saying you should never go there - GDPR does and it's a net impro…

I don't really disagree, but to play devil's advocate a little, if I was giving away free knives and someone cut themselves, would I be to blame in any way?

If software companies sold knives, this is how it would work:

You market them as iButter knives. They are actually carving knives. Half of the users are 14 years old.

You give the knives away for free, but the knives steal 1% of any food they cut.

Sometimes butter knife needs an software update in the middle of cooking.

If you sharpen the knives you lose warranty. Company says you should buy a new one regularly.

They come with a bug, when iButter knife is used on Cheese, they spontaneously transform into chainsaws.

The company says it's not a real problem because using iButter knife on anything else is against EULA

Re: Let's build a Chrome extension that steals as much data as possible

#83

Post by nightpool » Wed, Feb 22, 2023, 2:13 AM UTC

Dalewyn wrote: post #68

crazygringo wrote: post #50

Earlier quoted context omitted.

> An egregious and nearly unbelievable oversight on Google's part. :-\ I agree it's egregious, but it's quite easy to believe. It's surely just using a standard modal and passing a string. The thing is, this is on a Mac that has scroll bars that are invisible until you scroll. It's easy to imagine testing was done other OS's where the scroll bars are obvious and the bottom line might be only partially hidden which ma…

>this is on a Mac that has scroll bars that are invisible until you scroll. What modern UI even has visible scroll bars by default? And assuming it's even visible (either by default or user-configured after the fact if that's even possible), what modern UI even has scroll bars wider than 1px?

74% of all users? https://en.wikipedia.org/wiki/Usage_share_of_operating_syste...

Re: Let's build a Chrome extension that steals as much data as possible

#84

Post by dcow » Wed, Feb 22, 2023, 2:16 AM UTC

Gigachad wrote: post #76

dcow wrote: post #48

Earlier quoted context omitted.

What? The same can happen with any piece of software in the world. Why single out extensions?

We sandbox apps to prevent them from reading each others data. It's impossible to sandbox web extensions and have them retain basically any of the functionality needed. As well as almost all regular software is backed by some large company with legal presence to hold responsible. The same can not be said for most extensions.

> We sandbox apps to prevent them from reading each others data.

This is also true of web extensions. I suspect you've never developed one. You can't read another extension's data. It's also not true on desktop platforms. The user is still the security domain in desktop computing.

> As well as almost all regular software is backed by some large company with legal presence to hold responsible. The same can not [sic] be said for most extensions.

Is this true? All the browser extensions I use are published by a real legal entity that can be sued if they are negligent. What corner of the web are you on?

Re: Let's build a Chrome extension that steals as much data as possible

#85

Post by ClumsyPilot » Wed, Feb 22, 2023, 2:16 AM UTC

burnished wrote: post #81

ClumsyPilot wrote: post #71

Earlier quoted context omitted.

> Well, you can get a full refund Suppose developers of smart locks make an error, and all smartslock unlock on Fridays. When users ask the Company, they lie and claim their locks are flawless and users are to blame. Millions of houses are robbed, people loose their life possesions, and home robbers kill some grandma. Should the Grandma's family get just a $100 refund (price of the lock)? > There's basically no way y…

Please dont make up alarmist analogies to try and support your point. You introduce unnecessary points of confusion with 1) whether your scenario even fits and 2) whether the outcomes even make sense. Stick to the actual situation wherever possible.

Alarmist? In Britain we have sent ~800 innocent people to prison because a programming error said they stole money. The software development company testified in court that their software was great, despite many inconsitencies being pointed out.

https://en.m.wikipedia.org/wiki/British_Post_Office_scandal

I think it should be obvious that a poorly designed product can do much more damage than it costs, both through stolen data and by causing legal action

As software intrudes into physical world, the potential for damage will keep growing.

Re: Let's build a Chrome extension that steals as much data as possible

#86

Post by danielheath » Wed, Feb 22, 2023, 2:21 AM UTC

2OEH8eoCRo0 wrote: post #40

metadat wrote: post #9

> Chrome scrolls the permission warning message container, so more than half of the warning messages don’t even show up. I’d bet most users wouldn’t think twice about installing an extension that appears to ask for just 5 permissions. An egregious and nearly unbelievable oversight on Google's part. :-\ As a developer, it's unimaginable to me to not test the extreme high and low numbers of inputs cases to ensure thing…

> if this kind of issue can fly undetected for so long, what can organizations with drastically less resources than $GOOG do to ensure adequate velocity while not leaving the proverbial barn doors open? If $GOOG can't do it with practically infinite resources then I'm of the opinion that nobody can. Computing is broken.

It's not a question of having enough resources. $GOOG can't do it because anyone who isn't building a promo packet by launching new services is on the way out.

Re: Let's build a Chrome extension that steals as much data as possible

#87

Post by thelopa » Wed, Feb 22, 2023, 2:21 AM UTC

dcow wrote: post #56

Gigachad wrote: post #36

Earlier quoted context omitted.

It’s all because of chromebooks. Google has had to implement basically every capability as a js api so Chromebook’s can do real work.

You should have been around before chrome books when any extension could do whatever it wanted without any permissions at all. Your understanding of history is missing some key pieces. Over time, Google has generally locked these APIs down not opened them up.

Browser JS definitely never had the ability to unmount storage volumes before Chromebooks existed.

Re: Let's build a Chrome extension that steals as much data as possible

#88

Post by thrdbndndn » Wed, Feb 22, 2023, 2:21 AM UTC

crazygringo wrote: post #50

metadat wrote: post #9

> Chrome scrolls the permission warning message container, so more than half of the warning messages don’t even show up. I’d bet most users wouldn’t think twice about installing an extension that appears to ask for just 5 permissions. An egregious and nearly unbelievable oversight on Google's part. :-\ As a developer, it's unimaginable to me to not test the extreme high and low numbers of inputs cases to ensure thing…

> An egregious and nearly unbelievable oversight on Google's part. :-\ I agree it's egregious, but it's quite easy to believe. It's surely just using a standard modal and passing a string. The thing is, this is on a Mac that has scroll bars that are invisible until you scroll. It's easy to imagine testing was done other OS's where the scroll bars are obvious and the bottom line might be only partially hidden which ma…

> nearly unbelievable

I don't get why people say something like this, especially on HN where lots of people are SDE themselves.

Every single feature is hand-crafted by a/some real person(s), and is usually only reviewed by a handful people. It only makes sense sometimes it has serious oversight.

Re: Let's build a Chrome extension that steals as much data as possible

#89

Post by kibwen » Wed, Feb 22, 2023, 2:23 AM UTC

crazygringo wrote: post #50

metadat wrote: post #9

> Chrome scrolls the permission warning message container, so more than half of the warning messages don’t even show up. I’d bet most users wouldn’t think twice about installing an extension that appears to ask for just 5 permissions. An egregious and nearly unbelievable oversight on Google's part. :-\ As a developer, it's unimaginable to me to not test the extreme high and low numbers of inputs cases to ensure thing…

> An egregious and nearly unbelievable oversight on Google's part. :-\ I agree it's egregious, but it's quite easy to believe. It's surely just using a standard modal and passing a string. The thing is, this is on a Mac that has scroll bars that are invisible until you scroll. It's easy to imagine testing was done other OS's where the scroll bars are obvious and the bottom line might be only partially hidden which ma…

> I would hope somebody sees this now and prioritzes a Chromium bug for it.

Rather, one would hope that Apple sees it realizes that their short-sighted, bone-headed, pea-brained idea to eliminate scroll bars should be rolled back. Of course, I'm not holding my breath. Yet another example of their crusade to prioritize form over function, exemplifying why I find their products to be infuriating to deal with.

Re: Let's build a Chrome extension that steals as much data as possible

#90

Post by dcow » Wed, Feb 22, 2023, 2:25 AM UTC

Gigachad wrote: post #77

dcow wrote: post #51

Earlier quoted context omitted.

The naivety of innocence is rather blissful, isn't it?

Care to provide an example of an ios app which can read the data from other apps when they shouldn't?

1. Android and iOS sandbox applications. But if I grant permission, a mobile app can read files from my photos, or documents, SD card on Android, etc. folders. I can even ship a mobile Safari extension on iOS.

2. Desktop platforms do not universally sandbox applications (though they are trying). You can install a desktop app that steals all the data in your home directory, including your entire browsing history, with no permission dialog whatsoever.

3. That aside, browsers sandbox extensions just like mobile applications. One extension cannot access another extension's data.

4. Furthermore, by default, a browser extension can only access content from its own origin. It is in fact sandboxed from the rest of the sites you visit.

5. If the user grants permission, a browser extension may access other sites.

So in short, browser extensions are in fact sandboxed.

And your idea of mobile apps accessing data is entirely dependent on the qualifier "when they shouldn't", which, arguably if given permission, they should so it's a moot point.