Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's build a Chrome extension that steals as much data as possible

mattfrisbie.substack.com

Post reply on HN
Print view View original

161–170 of 320 posts

Re: Let's build a Chrome extension that steals as much data as possible

#161

Post by s4i »

metadat wrote: post #9

> Chrome scrolls the permission warning message container, so more than half of the warning messages don’t even show up. I’d bet most users wouldn’t think twice about installing an extension that appears to ask for just 5 permissions. An egregious and nearly unbelievable oversight on Google's part. :-\ As a developer, it's unimaginable to me to not test the extreme high and low numbers of inputs cases to ensure thing…

But isn't the scrolling problematic here only because macOS by default hides the scrollbars when there is no traditional mouse connected?

Re: Let's build a Chrome extension that steals as much data as possible

#162

Post by eimrine »

> Just set a MutationObserver to watch the entire page, and reapply listeners as needed.

I did not know such thing is possible. I want to make an extension which undeletes some chat messages in typical chats (usually that happens because of moderation)

Re: Let's build a Chrome extension that steals as much data as possible

#163

Post by ano88888 »

metadat wrote: post #9

> Chrome scrolls the permission warning message container, so more than half of the warning messages don’t even show up. I’d bet most users wouldn’t think twice about installing an extension that appears to ask for just 5 permissions. An egregious and nearly unbelievable oversight on Google's part. :-\ As a developer, it's unimaginable to me to not test the extreme high and low numbers of inputs cases to ensure thing…

there is always a balance or tradeoff between convienence and security. If you maximize security, you will have a piece of software nobody wants to use unless there is a gun pointing at their head. Not that security is unimportant but please also keep user experience in mind when you design security.

Re: Let's build a Chrome extension that steals as much data as possible

#164

Post by vore »

1vuio0pswjnm7 wrote: post #151
aboodman wrote: post #141

Earlier quoted context omitted.

> The chain of humans who've been responsible for developing and testing Chrome Extension functionality and security has been asleep at the wheel this whole time, for something like 15 years. As the first in this chain of humans, I can tell you that (a) we obviously considered this in the first version of extensions and did not allow permissions "below" the fold, (b) Chrome's extension model dramatically improved on…

"I also encourage readers to remember that generally speaking, you all _want_ extensions." Exception here. Never asked for them. Never wanted them. Do not and cannot use them.^1 Seems moot anyway as I doubt anyone ever asked for Chrome itself. When an extension collects data under the radar it's "malware" but when Google does this, it isn't malware. Funny. There's really no greater "danger" to www users than Google b…

If you’re not using Chrome, then obviously you’re not the target demographic for Chrome extensions.

Re: Let's build a Chrome extension that steals as much data as possible

#165

Post by eimrine »

s4i wrote: post #161
metadat wrote: post #9

> Chrome scrolls the permission warning message container, so more than half of the warning messages don’t even show up. I’d bet most users wouldn’t think twice about installing an extension that appears to ask for just 5 permissions. An egregious and nearly unbelievable oversight on Google's part. :-\ As a developer, it's unimaginable to me to not test the extreme high and low numbers of inputs cases to ensure thing…

But isn't the scrolling problematic here only because macOS by default hides the scrollbars when there is no traditional mouse connected?

I've experienced this problem once on Windows when I've installed a free VPN and noticed that the list of permissions lacks some obvious points.

Re: Let's build a Chrome extension that steals as much data as possible

#166

Post by kazinator »

ano88888 wrote: post #163
metadat wrote: post #9

> Chrome scrolls the permission warning message container, so more than half of the warning messages don’t even show up. I’d bet most users wouldn’t think twice about installing an extension that appears to ask for just 5 permissions. An egregious and nearly unbelievable oversight on Google's part. :-\ As a developer, it's unimaginable to me to not test the extreme high and low numbers of inputs cases to ensure thing…

there is always a balance or tradeoff between convienence and security. If you maximize security, you will have a piece of software nobody wants to use unless there is a gun pointing at their head. Not that security is unimportant but please also keep user experience in mind when you design security.

What's that saying? Ah, found it:

"Security at the expense of usability comes at the expense of security."

If you maximize security, so that there is poor convenience/usability, people will find usability workarounds which compromise security.

Re: Let's build a Chrome extension that steals as much data as possible

#167

Post by xlii »

aboodman wrote: post #141
metadat wrote: post #9

> Chrome scrolls the permission warning message container, so more than half of the warning messages don’t even show up. I’d bet most users wouldn’t think twice about installing an extension that appears to ask for just 5 permissions. An egregious and nearly unbelievable oversight on Google's part. :-\ As a developer, it's unimaginable to me to not test the extreme high and low numbers of inputs cases to ensure thing…

> The chain of humans who've been responsible for developing and testing Chrome Extension functionality and security has been asleep at the wheel this whole time, for something like 15 years. As the first in this chain of humans, I can tell you that (a) we obviously considered this in the first version of extensions and did not allow permissions "below" the fold, (b) Chrome's extension model dramatically improved on…

I’m really curious what were the arguments against screaming “…and 58 other permission - see full list here” seems like an easy fix.

As for the review process, I don’t think it’s good enough. I don’t use Chrome as a daily driver but I’m often seeing out-of-store extensions. Is there external process that would capture and mark/flag such 3rd party extensions?

Re: Let's build a Chrome extension that steals as much data as possible

#168

Post by aboodman »

DigiDigiorno wrote: post #157
aboodman wrote: post #141

Earlier quoted context omitted.

> The chain of humans who've been responsible for developing and testing Chrome Extension functionality and security has been asleep at the wheel this whole time, for something like 15 years. As the first in this chain of humans, I can tell you that (a) we obviously considered this in the first version of extensions and did not allow permissions "below" the fold, (b) Chrome's extension model dramatically improved on…

OP could have worded the criticism as an organizational attack and not aimed at the individuals that make up the organization... But anyhow, you work on the system and can't point out if this is an issue or not in the end-to-end sense? Like, why say OP is "missing the point" if you are not sure if they are missing the point? TBF you do say "I'm not even certain that an extension that requests more than 5 permissions…

I have not worked on the system for something like 8 years, so I cannot say what the current situation is.

Re: Let's build a Chrome extension that steals as much data as possible

#169

Post by waqas_x »

Maintainer of a Chrome Extension with 10,000+ installs here. Chrome doesnt willy nilly approve your extension. They even take down extensions that ask for permissions you do not legitimately use. The article doesnt say for how long op was able to put his extension on the chrome store without it being reviewed or taken down.

Re: Let's build a Chrome extension that steals as much data as possible

#170

Post by Reventlov »

waqas_x wrote: post #169

Maintainer of a Chrome Extension with 10,000+ installs here. Chrome doesnt willy nilly approve your extension. They even take down extensions that ask for permissions you do not legitimately use. The article doesnt say for how long op was able to put his extension on the chrome store without it being reviewed or taken down.

It does: « Publishing to the Chrome Web Store − I’m kidding, of course. This extension would be laughed out of the review queue. »
Post reply on HN