Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's build a Chrome extension that steals as much data as possible

mattfrisbie.substack.com

Post reply on HN
Print view View original

131–140 of 320 posts

Re: Let's build a Chrome extension that steals as much data as possible

#131

Post by chii »

paulryanrogers wrote: post #55
A4ET8a8uTh0 wrote: post #47

Earlier quoted context omitted.

I don't really disagree, but to play devil's advocate a little, if I was giving away free knives and someone cut themselves, would I be to blame in any way?

Are you marketing it as a safer alternative? Do you have a near monopoly on knives?

i didn't recall chrome being marketed as a safer alternative. I suppose the original "sandbox" tab is considered safer, but not in the way that this chrome extension is dangerous in.

And why does it being a monopoly matter in this context? Not to mention that it isn't a monopoly.

Re: Let's build a Chrome extension that steals as much data as possible

#132

Post by interpol_p »

metadat wrote: post #9

> Chrome scrolls the permission warning message container, so more than half of the warning messages don’t even show up. I’d bet most users wouldn’t think twice about installing an extension that appears to ask for just 5 permissions. An egregious and nearly unbelievable oversight on Google's part. :-\ As a developer, it's unimaginable to me to not test the extreme high and low numbers of inputs cases to ensure thing…

Even if they were to somehow show everything up-front, it would be user hostile design. No one wants to read and consider every possible permission prior to granting it to the thing they want to use

Even if there were 20 items in the list, people would hit "OK," it's like accepting terms and conditions. Most people won't read them, they're trained to hit "Agree"

The whole model needs an overhaul. Extensions should be required to ask whenever they need the specific resource, rather than asking up-front. And each gated resource should get its own prompt with its own informative design. Similar to permissions on mobile

Re: Let's build a Chrome extension that steals as much data as possible

#134

Post by eviks »

2h wrote: post #130
crazygringo wrote: post #50

Earlier quoted context omitted.

> An egregious and nearly unbelievable oversight on Google's part. :-\ I agree it's egregious, but it's quite easy to believe. It's surely just using a standard modal and passing a string. The thing is, this is on a Mac that has scroll bars that are invisible until you scroll. It's easy to imagine testing was done other OS's where the scroll bars are obvious and the bottom line might be only partially hidden which ma…

> on a Mac that has scroll bars that are invisible until you scroll this has got to be one of the worst UX decisions of the past 10 years, come at me. You can just hear the meeting discussion: A: make the scrollbars invisible until you scroll, that nets us 4% more width! B: but it reduces discoverability by 50%, and its also an attack vector... C: ship it!

I love this feature, scroll bars are mostly useless, the position indicator should be decoupled and doesn't need to have extra width (can be a mark on the window border), and the security issues are solved by a summary at the top of the list, not a generic scrollbar

Re: Let's build a Chrome extension that steals as much data as possible

#135

Post by nneonneo »

odysseus wrote: post #123
crazygringo wrote: post #50

Earlier quoted context omitted.

> An egregious and nearly unbelievable oversight on Google's part. :-\ I agree it's egregious, but it's quite easy to believe. It's surely just using a standard modal and passing a string. The thing is, this is on a Mac that has scroll bars that are invisible until you scroll. It's easy to imagine testing was done other OS's where the scroll bars are obvious and the bottom line might be only partially hidden which ma…

Fortunately, you can override Apple's choice: Settings > Appearance > Scroll bar behavior > Show scroll bars > Always If I were in charge of fixing this bug for Chromium, I might start by prioritizing which permissions are the most nefarious, list them first, perhaps in red. Then ensure the entire dialog expands vertically to fit as much content as possible.

I wondered about this. I would sincerely hope that the permissions list is already priority-sorted somehow; otherwise, it’d be trivial to just list five innocuous permissions first and then put the dangerous ones later. Even with scrollbars, most users would just see the first few and likely not bother to scroll down at all. Note that in the author’s post, one of the dangerous permissions (read and modify data for all websites) is already listed in the box.

Re: Let's build a Chrome extension that steals as much data as possible

#136

Post by brookst »

2h wrote: post #130
crazygringo wrote: post #50

Earlier quoted context omitted.

> An egregious and nearly unbelievable oversight on Google's part. :-\ I agree it's egregious, but it's quite easy to believe. It's surely just using a standard modal and passing a string. The thing is, this is on a Mac that has scroll bars that are invisible until you scroll. It's easy to imagine testing was done other OS's where the scroll bars are obvious and the bottom line might be only partially hidden which ma…

> on a Mac that has scroll bars that are invisible until you scroll this has got to be one of the worst UX decisions of the past 10 years, come at me. You can just hear the meeting discussion: A: make the scrollbars invisible until you scroll, that nets us 4% more width! B: but it reduces discoverability by 50%, and its also an attack vector... C: ship it!

I dislike the invisible scroll bars, but I don’t think they’re about width, I think they’re about visual clutter. Apple likes simplicity (yes yes you can find examples where they failed) and this seems to be in keeping with simple design.

Still a bad idea though.

Re: Let's build a Chrome extension that steals as much data as possible

#137

Post by eviks »

metadat wrote: post #9

> Chrome scrolls the permission warning message container, so more than half of the warning messages don’t even show up. I’d bet most users wouldn’t think twice about installing an extension that appears to ask for just 5 permissions. An egregious and nearly unbelievable oversight on Google's part. :-\ As a developer, it's unimaginable to me to not test the extreme high and low numbers of inputs cases to ensure thing…

But it's not the issue of the quantity of resources, it's about their quality, and it's a bit puzzling you find these pervasive issues hard to imagine

Re: Let's build a Chrome extension that steals as much data as possible

#138

Post by kanbara »

kibwen wrote: post #89
crazygringo wrote: post #50

Earlier quoted context omitted.

> An egregious and nearly unbelievable oversight on Google's part. :-\ I agree it's egregious, but it's quite easy to believe. It's surely just using a standard modal and passing a string. The thing is, this is on a Mac that has scroll bars that are invisible until you scroll. It's easy to imagine testing was done other OS's where the scroll bars are obvious and the bottom line might be only partially hidden which ma…

> I would hope somebody sees this now and prioritzes a Chromium bug for it. Rather, one would hope that Apple sees it realizes that their short-sighted, bone-headed, pea-brained idea to eliminate scroll bars should be rolled back. Of course, I'm not holding my breath. Yet another example of their crusade to prioritize form over function, exemplifying why I find their products to be infuriating to deal with.

> chrome extensions have horrible flaws and browsers are fundamentally broken

> apple sucks and is the reason for all evil because scroll bars

we dont have scroll bars on mobile as in days of yore. maybe browsers need to finish playing catchup to the threat and interaction models. having a vm on your machine with access to everything you do without sandbox is pretty bad

Re: Let's build a Chrome extension that steals as much data as possible

#139

Post by lostlogin »

crazygringo wrote: post #50
metadat wrote: post #9

> Chrome scrolls the permission warning message container, so more than half of the warning messages don’t even show up. I’d bet most users wouldn’t think twice about installing an extension that appears to ask for just 5 permissions. An egregious and nearly unbelievable oversight on Google's part. :-\ As a developer, it's unimaginable to me to not test the extreme high and low numbers of inputs cases to ensure thing…

> An egregious and nearly unbelievable oversight on Google's part. :-\ I agree it's egregious, but it's quite easy to believe. It's surely just using a standard modal and passing a string. The thing is, this is on a Mac that has scroll bars that are invisible until you scroll. It's easy to imagine testing was done other OS's where the scroll bars are obvious and the bottom line might be only partially hidden which ma…

> The thing is, this is on a Mac that has scroll bars that are invisible until you scroll.

I try to live with the defaults as it makes switching machines so much less painful, however turning scroll bars in is an absolute requirement for sane usage. At least you don’t have to do it in Terminal anymore.

Edit: I can’t find any evidence that the preference could only be toggled via Terminal in some macOS versions. I’m thought that around version 10.6 this was the case, but maybe I’m wrong?

Re: Let's build a Chrome extension that steals as much data as possible

#140

Post by kevingadd »

kanbara wrote: post #138
kibwen wrote: post #89

Earlier quoted context omitted.

> I would hope somebody sees this now and prioritzes a Chromium bug for it. Rather, one would hope that Apple sees it realizes that their short-sighted, bone-headed, pea-brained idea to eliminate scroll bars should be rolled back. Of course, I'm not holding my breath. Yet another example of their crusade to prioritize form over function, exemplifying why I find their products to be infuriating to deal with.

> chrome extensions have horrible flaws and browsers are fundamentally broken > apple sucks and is the reason for all evil because scroll bars we dont have scroll bars on mobile as in days of yore. maybe browsers need to finish playing catchup to the threat and interaction models. having a vm on your machine with access to everything you do without sandbox is pretty bad

Hiding scrollbars has been obviously bad UX since day one and this has only become more obvious over time. It doesn't matter whether you're doing it in a web browser or not, whataboutism isn't an appropriate response
Post reply on HN