Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's build a Chrome extension that steals as much data as possible

mattfrisbie.substack.com

Post reply on HN
Print view View original

171–180 of 320 posts

Re: Let's build a Chrome extension that steals as much data as possible

#171

Post by autoexec »

ClumsyPilot wrote: post #82
A4ET8a8uTh0 wrote: post #47

Earlier quoted context omitted.

I don't really disagree, but to play devil's advocate a little, if I was giving away free knives and someone cut themselves, would I be to blame in any way?

If software companies sold knives, this is how it would work: You market them as iButter knives. They are actually carving knives. Half of the users are 14 years old. You give the knives away for free, but the knives steal 1% of any food they cut. Sometimes butter knife needs an software update in the middle of cooking. If you sharpen the knives you lose warranty. Company says you should buy a new one regularly. They…

The company would be knowingly made of lead but neither owners or buyers would be informed of that by the company who is themselves heavily invested in lead.

Re: Let's build a Chrome extension that steals as much data as possible

#172

Post by danuker »

kibwen wrote: post #89
crazygringo wrote: post #50

Earlier quoted context omitted.

> An egregious and nearly unbelievable oversight on Google's part. :-\ I agree it's egregious, but it's quite easy to believe. It's surely just using a standard modal and passing a string. The thing is, this is on a Mac that has scroll bars that are invisible until you scroll. It's easy to imagine testing was done other OS's where the scroll bars are obvious and the bottom line might be only partially hidden which ma…

> I would hope somebody sees this now and prioritzes a Chromium bug for it. Rather, one would hope that Apple sees it realizes that their short-sighted, bone-headed, pea-brained idea to eliminate scroll bars should be rolled back. Of course, I'm not holding my breath. Yet another example of their crusade to prioritize form over function, exemplifying why I find their products to be infuriating to deal with.

> Rather

The air travel industry uses the Swiss cheese security model.

EVERYONE does what they can to improve security. The equivalent would be both Google and Apple making improvements.

Both of the problems might be leveraged in a future attack. Fix along the whole chain of events, not just break it - defense in depth.

Re: Let's build a Chrome extension that steals as much data as possible

#173

Post by aboodman »

xlii wrote: post #167
aboodman wrote: post #141

Earlier quoted context omitted.

> The chain of humans who've been responsible for developing and testing Chrome Extension functionality and security has been asleep at the wheel this whole time, for something like 15 years. As the first in this chain of humans, I can tell you that (a) we obviously considered this in the first version of extensions and did not allow permissions "below" the fold, (b) Chrome's extension model dramatically improved on…

I’m really curious what were the arguments against screaming “…and 58 other permission - see full list here” seems like an easy fix. As for the review process, I don’t think it’s good enough. I don’t use Chrome as a daily driver but I’m often seeing out-of-store extensions. Is there external process that would capture and mark/flag such 3rd party extensions?

Chrome makes it pretty difficult to sideload extensions, so I'm not sure what you're seeing.

Re: Let's build a Chrome extension that steals as much data as possible

#174

Post by autoexec »

nine_k wrote: post #91
dcow wrote: post #70

Earlier quoted context omitted.

Oh yes it can. Project owners have sold out before--sometimes without telling anybody. The threat vector is the same. Something you trust gets sold to someone else and it abuses previously acquired trust. Open source doesn't actually fix this specific trust issue. And BTW your browser extension's source is available to peruse locally on your machine after you install it. Surely you did that, right?

Being a popular open-source project is not a guarantee, it merely lowers the chances and complicates the attack. Regarding extensions code: indeed, I do read the code of extensions that require some elevated permissions, if these extensions are not otherwise vetted. This is why I avoid installing excessively complicated extensions, unless they ask for minor permissions. Having the list of tabs if no big deal; accessi…

> Being a popular open-source project is not a guarantee, it merely lowers the chances and complicates the attack.

It also makes it easier to deal with it after the fact. You can fork an open source project the minute it's detected that it's doing something it shouldn't. When closed source software goes bad you can't pick right up from the last known good version and move on, you have to find a product that entirely replaces what you had and hope that it does everything you need at least as well which isn't always likely since you were presumably using the other software because it was better than existing alternatives.

Re: Let's build a Chrome extension that steals as much data as possible

#175

Post by xlii »

aboodman wrote: post #173
xlii wrote: post #167

Earlier quoted context omitted.

I’m really curious what were the arguments against screaming “…and 58 other permission - see full list here” seems like an easy fix. As for the review process, I don’t think it’s good enough. I don’t use Chrome as a daily driver but I’m often seeing out-of-store extensions. Is there external process that would capture and mark/flag such 3rd party extensions?

Chrome makes it pretty difficult to sideload extensions, so I'm not sure what you're seeing.

Well I’m usually browsing for development tools & such and some of them are advertised as an out of store downloads (which would be preferable as I prefer Chromium). You did prompt be to check how hard it is though, so allow me to get back to you in a few ;)

Edit:

I didn’t go through manual process but based on this (rather recent) Adblock guide [1] it’s not very hard.

Of course one could argue that “developer mode” is deterrent enough but - as for contrast - in order to get state mandated esignature to work I had to install some sketchy 3rd party system extensions on MacOS. On Windows it almost felt like malware (as some of the security settings had to be disabled in order for Java installers to run).

My point is - sure Chrome might have secure golden path but people are lured into skipping a lot for freebies/weird requirements and thus permission dialogue should be more informative.

[1]: https://helpcenter.getadblock.com/hc/en-us/articles/97385388...

Re: Let's build a Chrome extension that steals as much data as possible

#176

Post by autoexec »

mard wrote: post #61
wolpoli wrote: post #29

One of the issues here is that the browser is prompting the user for all the Permissions at install time. Both Android and IOS have moved away from that. Perhaps it is time browsers to move away from that as well.

Extensions are one thing, but I'd also welcome granular permissions to various JavaScript capabilities for every website. I don't like when some websites capture native browser hotkeys (CTRL+F), disable my right mouse button, change scrolling behavior or perform asynchronous HTTP requests. The only solution I found to protect against these practices is disabling JavaScript completely for given site, but more often th…

At this point I want the able to control what HTML and CSS can do!

Re: Let's build a Chrome extension that steals as much data as possible

#178

Post by [deleted] »

Eisenstein wrote: post #153
aboodman wrote: post #141

Earlier quoted context omitted.

> The chain of humans who've been responsible for developing and testing Chrome Extension functionality and security has been asleep at the wheel this whole time, for something like 15 years. As the first in this chain of humans, I can tell you that (a) we obviously considered this in the first version of extensions and did not allow permissions "below" the fold, (b) Chrome's extension model dramatically improved on…

> (a) we obviously considered this in the first version of extensions and did not allow permissions "below" the fold Irrelevant. > (b) Chrome's extension model dramatically improved on the previous state of the art which was Firefox's "every extension can do everything, extensions can't be uninstalled completely, and there's no review" Irrelevant. > (c) the install dialog is just one part in a bigger system which inc…

[deleted]

Re: Let's build a Chrome extension that steals as much data as possible

#179

Post by autoexec »

codetrotter wrote: post #13
NovemberWhiskey wrote: post #8

> Identify and eject storage devices I mean, why?

Because browser makers and web app devs want to be able to do everything desktop software can, but inside of a browser. In theory it’s kind of neat.

In theory that's basically like letting anyone on the internet run arbitrary code on your devices which is a terrible idea. In practice it's like letting anyone on the internet run arbitrary code with a few guardrails to catch the worst and most obvious abuses while it takes control away from the user and allows for highly invasive forms of tracking that is very hard to prevent.

Re: Let's build a Chrome extension that steals as much data as possible

#180

Post by bigfudge »

kibwen wrote: post #89
crazygringo wrote: post #50

Earlier quoted context omitted.

> An egregious and nearly unbelievable oversight on Google's part. :-\ I agree it's egregious, but it's quite easy to believe. It's surely just using a standard modal and passing a string. The thing is, this is on a Mac that has scroll bars that are invisible until you scroll. It's easy to imagine testing was done other OS's where the scroll bars are obvious and the bottom line might be only partially hidden which ma…

> I would hope somebody sees this now and prioritzes a Chromium bug for it. Rather, one would hope that Apple sees it realizes that their short-sighted, bone-headed, pea-brained idea to eliminate scroll bars should be rolled back. Of course, I'm not holding my breath. Yet another example of their crusade to prioritize form over function, exemplifying why I find their products to be infuriating to deal with.

Having less visual clutter -is- function to me. I really don’t miss permanent scroll bars and hope they don’t bring them back.

Most Macs ship with a trackpad, which means I can’t remember when I last deliberately gripped a scroll bar. They are just a waste of space most of the time, even as an affordance/reminder that scrolling is possible.

Post reply on HN