Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's build a Chrome extension that steals as much data as possible

mattfrisbie.substack.com

Post reply on HN
Print view View original

101–110 of 320 posts

Re: Let's build a Chrome extension that steals as much data as possible

#101

Post by schoolornot »

alooPotato wrote: post #22

Now try actually distributing it. My guess is this wouldn't even get close to getting through the review process for the Chrome Webstore. From our experience with Streak, this would def get picked up in review. Seeing other comments in the thread pointing to this article as a reason why MV3 is bad I think misses the point. Personally I think MV3 is a step in the right direction (even though it negatively affects us!)…

My experience so far with publishing to the extension store has been that they examine both the code shipped as well as the scopes used. I've had apps rejected due to overly broad scopes and it was obvious based on the responses that the reviewer was pretty competent at JS.

Re: Let's build a Chrome extension that steals as much data as possible

#102

Post by dcow »

nine_k wrote: post #91
dcow wrote: post #70

Earlier quoted context omitted.

Oh yes it can. Project owners have sold out before--sometimes without telling anybody. The threat vector is the same. Something you trust gets sold to someone else and it abuses previously acquired trust. Open source doesn't actually fix this specific trust issue. And BTW your browser extension's source is available to peruse locally on your machine after you install it. Surely you did that, right?

Being a popular open-source project is not a guarantee, it merely lowers the chances and complicates the attack. Regarding extensions code: indeed, I do read the code of extensions that require some elevated permissions, if these extensions are not otherwise vetted. This is why I avoid installing excessively complicated extensions, unless they ask for minor permissions. Having the list of tabs if no big deal; accessi…

Sounds like we agree then that extensions are not any different from other apps in this respect and that you should always review the source code if you are installing software that needs to be given great power.

Re: Let's build a Chrome extension that steals as much data as possible

#103

Post by Gigachad »

dcow wrote: post #90
Gigachad wrote: post #77

Earlier quoted context omitted.

Care to provide an example of an ios app which can read the data from other apps when they shouldn't?

1. Android and iOS sandbox applications. But if I grant permission, a mobile app can read files from my photos, or documents, SD card on Android, etc. folders. I can even ship a mobile Safari extension on iOS. 2. Desktop platforms do not universally sandbox applications (though they are trying). You can install a desktop app that steals all the data in your home directory, including your entire browsing history, with…

The shared data on ios and android isnt all that important. Sure, you might not want a random app to read your photos, but it's not getting access to your bank session token. And these days you can grant apps to only specific photos.

The vast majority of extensions require the ability to read and modify the dom on any website to do anything. This is so much worse than the average app permissions.

Re: Let's build a Chrome extension that steals as much data as possible

#105

Post by dcow »

lapcat wrote: post #19
mimimi31 wrote: post #14

Earlier quoted context omitted.

Don't all Firefox extensions have to be signed by Mozilla in order to be installable (in non-developer Firefox editions at least) these days? Even if they're publishing it on their own site, it should have gone through the review.

Yes. It's mostly automated review, usually taking a matter of minutes, though I guess Mozilla reserves the right to do manual checks if they find something suspicious.

Which is exactly why these permissions exists. If you don't take permissions that allows you to horrible things, you are rubber stamped and can go on your way. If you want to do more involved things, you're escalated.

Re: Let's build a Chrome extension that steals as much data as possible

#106

Post by jsnell »

Afforess wrote: post #74
jsnell wrote: post #10

Earlier quoted context omitted.

It's good that it doesn't pretend to be a rebuttal, because it'd be a bad one. I'm pretty sure the point of making a declarative content blocking API for adblockers is not to block all possible ways of writing a malware extension. It is just to make the most popular category of extensions safe by design. Once that has been done, it's then much easier to improve the situation with the remaining niche use cases. What w…

Chrome extensions that contain malware aren't written and submitted to the chrome store hoping to sneak past review. Malware authors _purchase_ the intellectual property of fulling functioning, useful extensions, and update them to contain their extra malware payload. I'm not sure where you got the idea that a review would be involved here at all.

AFAIK updates go through a review process as well.

Reducing the attack surface has similar benefits for this case. There will be fewer extensions with dangerous permissions around for bad actors to buy, and the the reviews for the remaining legit use cases for those dangerous permissions can be stricter.

Re: Let's build a Chrome extension that steals as much data as possible

#107

Post by ocdtrekkie »

metadat wrote: post #9

> Chrome scrolls the permission warning message container, so more than half of the warning messages don’t even show up. I’d bet most users wouldn’t think twice about installing an extension that appears to ask for just 5 permissions. An egregious and nearly unbelievable oversight on Google's part. :-\ As a developer, it's unimaginable to me to not test the extreme high and low numbers of inputs cases to ensure thing…

> An egregious and nearly unbelievable oversight on Google's part.

This describes Google's entire approach to browser extensions. It's so cosmically and hilariously bad, and because extensions grant post-decryption access, renders basically every other security and privacy effort they've ever done with web standards completely pointless.

All that garbage about encrypting everything in transit is entirely irrelevant when the endpoint is a masterpiece of bad security design.

Re: Let's build a Chrome extension that steals as much data as possible

#108

Post by lapcat »

dcow wrote: post #105
lapcat wrote: post #19

Earlier quoted context omitted.

Yes. It's mostly automated review, usually taking a matter of minutes, though I guess Mozilla reserves the right to do manual checks if they find something suspicious.

Which is exactly why these permissions exists. If you don't take permissions that allows you to horrible things, you are rubber stamped and can go on your way. If you want to do more involved things, you're escalated.

My Firefox add-on has "" permission and gets rubber-stamped.

Re: Let's build a Chrome extension that steals as much data as possible

#109

Post by dcow »

ClumsyPilot wrote: post #85
burnished wrote: post #81

Earlier quoted context omitted.

Please dont make up alarmist analogies to try and support your point. You introduce unnecessary points of confusion with 1) whether your scenario even fits and 2) whether the outcomes even make sense. Stick to the actual situation wherever possible.

Alarmist? In Britain we have sent ~800 innocent people to prison because a programming error said they stole money. The software development company testified in court that their software was great, despite many inconsitencies being pointed out. https://en.m.wikipedia.org/wiki/British_Post_Office_scandal I think it should be obvious that a poorly designed product can do much more damage than it costs, both through st…

You should read any one of Mark Russinovich's amusing novels on viruses destroying the world. You might be convinced we should stop using any software.

Re: Let's build a Chrome extension that steals as much data as possible

#110

Post by [deleted] »

Dalewyn wrote: post #68
crazygringo wrote: post #50

Earlier quoted context omitted.

> An egregious and nearly unbelievable oversight on Google's part. :-\ I agree it's egregious, but it's quite easy to believe. It's surely just using a standard modal and passing a string. The thing is, this is on a Mac that has scroll bars that are invisible until you scroll. It's easy to imagine testing was done other OS's where the scroll bars are obvious and the bottom line might be only partially hidden which ma…

>this is on a Mac that has scroll bars that are invisible until you scroll. What modern UI even has visible scroll bars by default? And assuming it's even visible (either by default or user-configured after the fact if that's even possible), what modern UI even has scroll bars wider than 1px?

[deleted]
Post reply on HN