Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's build a Chrome extension that steals as much data as possible

mattfrisbie.substack.com

Post reply on HN
Print view View original

181–190 of 320 posts

Re: Let's build a Chrome extension that steals as much data as possible

#181

Post by aboodman »

xlii wrote: post #175
aboodman wrote: post #173

Earlier quoted context omitted.

Chrome makes it pretty difficult to sideload extensions, so I'm not sure what you're seeing.

Well I’m usually browsing for development tools & such and some of them are advertised as an out of store downloads (which would be preferable as I prefer Chromium). You did prompt be to check how hard it is though, so allow me to get back to you in a few ;) Edit: I didn’t go through manual process but based on this (rather recent) Adblock guide [1] it’s not very hard. Of course one could argue that “developer mode”…

I guess it depends on what you mean by "difficult".

Chrome is unfortunately limited here by the security of the OS. No popular desktop OSes have application isolation: all apps have the same permissions. Any app can write to any other apps' storage.

This means that if Chrome makes sideloading too difficult, developers will just tell users to run their native code which will hack into Chrome, making even understanding what extensions users have or uninstalling them impossible. Sideloading on desktop OSes has to be hard enough to discourage most users but easy enough that developers like adblock don't start looking for an even bigger hammer.

This is what I meant by delicate balance of incentives.

More info here: https://news.ycombinator.com/item?id=4954915

Re: Let's build a Chrome extension that steals as much data as possible

#183

Post by bakugo »

quectophoton wrote: post #177

This is my main worry with Firefox as well. How can I even be confident beyond reasonable doubt that the uBlock Origin extension I have installed won't suddenly start exfiltrating any passwords I enter on websites, for example.

>How can I even be confident beyond reasonable doubt that the uBlock Origin extension I have installed won't suddenly start exfiltrating any passwords I enter on websites, for example.

You can't, just like you can't be confident that any other piece of software on your computer won't start doing it. This problem isn't specific to extensions in any way and I don't understand why people act like it is. If the risks are too much for you, don't install them, just like you wouldn't install any other software you don't trust. Don't try to ruin it for other people who understand and are willing to take the risk.

Re: Let's build a Chrome extension that steals as much data as possible

#184

Post by xlii »

aboodman wrote: post #181
xlii wrote: post #175

Earlier quoted context omitted.

Well I’m usually browsing for development tools & such and some of them are advertised as an out of store downloads (which would be preferable as I prefer Chromium). You did prompt be to check how hard it is though, so allow me to get back to you in a few ;) Edit: I didn’t go through manual process but based on this (rather recent) Adblock guide [1] it’s not very hard. Of course one could argue that “developer mode”…

I guess it depends on what you mean by "difficult". Chrome is unfortunately limited here by the security of the OS. No popular desktop OSes have application isolation: all apps have the same permissions. Any app can write to any other apps' storage. This means that if Chrome makes sideloading too difficult, developers will just tell users to run their native code which will hack into Chrome, making even understanding…

I absolutely understand and I agree with you. I suppose you have much more data and probably research. But on the other hand I believe Google also has literally infinite amount of developers.

Thus, it should be easy to classify and make that specific dialog more visible - especially when side-loading.

I think it definitely is hard job to reach consensus on all the fronts.

Re: Let's build a Chrome extension that steals as much data as possible

#185

Post by pcthrowaway »

aboodman wrote: post #141
metadat wrote: post #9

> Chrome scrolls the permission warning message container, so more than half of the warning messages don’t even show up. I’d bet most users wouldn’t think twice about installing an extension that appears to ask for just 5 permissions. An egregious and nearly unbelievable oversight on Google's part. :-\ As a developer, it's unimaginable to me to not test the extreme high and low numbers of inputs cases to ensure thing…

> The chain of humans who've been responsible for developing and testing Chrome Extension functionality and security has been asleep at the wheel this whole time, for something like 15 years. As the first in this chain of humans, I can tell you that (a) we obviously considered this in the first version of extensions and did not allow permissions "below" the fold, (b) Chrome's extension model dramatically improved on…

Perhaps I'm missing something, or things have changed in the last couple of years, but when I last took a look there were a few main issues with the extension security model that would have been dead-simple to implement.

My understanding at the time (I realize I could be mistaken about any of these):

* Users have no idea what code they're installing. Extensions aren't required to be open source, where the community can audit them for malicious behaviour. Even if an extension claimed to be open source, there's no verification system to ensure the code actually being executed is the code displayed on their github.

* Automatic updates. Maybe this isn't the case now, but at one point I remember extensions were updating themselves automatically. Users of popular extensions are frequently contacted to add an "analytics" dependency from some shady company, in return for a nice payout. Users don't have the ability to opt out of these kinds of updates when some of their extension devs inevitably cave into the pressure. In my mind, these kinds of updates should only be shipped with user's full consent and understanding that they are being asked to install updates which have no practical utility to them

* Code obfuscation. I don't see why every extension shouldn't be shipped fully unobfuscated, at least as an option. Perhaps minified bundles could also be shipped as a way of supporting users on low-spec devices which really need those extensions, but then again, if disk space is so short for those users maybe they shouldn't be installing extensions in the first place

* Better observability of interactions between user-requested websites and extension background pages. If I look in my network panel I want to see communication with installed extensions happening

Re: Let's build a Chrome extension that steals as much data as possible

#186

Post by flohofwoe »

bigfudge wrote: post #180
kibwen wrote: post #89

Earlier quoted context omitted.

> I would hope somebody sees this now and prioritzes a Chromium bug for it. Rather, one would hope that Apple sees it realizes that their short-sighted, bone-headed, pea-brained idea to eliminate scroll bars should be rolled back. Of course, I'm not holding my breath. Yet another example of their crusade to prioritize form over function, exemplifying why I find their products to be infuriating to deal with.

Having less visual clutter -is- function to me. I really don’t miss permanent scroll bars and hope they don’t bring them back. Most Macs ship with a trackpad, which means I can’t remember when I last deliberately gripped a scroll bar. They are just a waste of space most of the time, even as an affordance/reminder that scrolling is possible.

I hardly use the scrollbar either (even when using a mouse), but the scrollbar is an important visual clue what portion of a scrollable page is currently being shown, no matter what the input method is. Apple could just have turned the interactive scrollbar into a much slimmer non-interactive hint and all would be fine, but no, they had to go "form over function" again :/

Re: Let's build a Chrome extension that steals as much data as possible

#187

Post by r_hoods_ghost »

metadat wrote: post #66
jszymborski wrote: post #44

Earlier quoted context omitted.

Are we certain that they are motivated to do so? Google doesn't strike me as a company committed to user privacy.

There is no company on earth with a larger privacy organization than Google. Edit: @dogecoinbase: What you propose is a shallow and dismissive analysis of the oversimplicative variety. Please put in a little more effort before derailing an otherwise thoughtful conversation.

Yes, but what is the focus of google's privacy organisation? Is it protective user privacy or is it designing and implementing ways to circumvent user privacy controls and regulations? From the evidence I'd say the latter.

Re: Let's build a Chrome extension that steals as much data as possible

#188

Post by pcthrowaway »

2OEH8eoCRo0 wrote: post #40
metadat wrote: post #9

> Chrome scrolls the permission warning message container, so more than half of the warning messages don’t even show up. I’d bet most users wouldn’t think twice about installing an extension that appears to ask for just 5 permissions. An egregious and nearly unbelievable oversight on Google's part. :-\ As a developer, it's unimaginable to me to not test the extreme high and low numbers of inputs cases to ensure thing…

> if this kind of issue can fly undetected for so long, what can organizations with drastically less resources than $GOOG do to ensure adequate velocity while not leaving the proverbial barn doors open? If $GOOG can't do it with practically infinite resources then I'm of the opinion that nobody can. Computing is broken.

I don't think Google's incentives are properly aligned with users for them to prioritize creation of a user-first extension package repository.

APIs which would make it easy for extensions to exfiltrate user information might be the same APIs they would use to do the same. APIs that allow the user to enhance their web experience (think uBlock origin) are being kneecapped by manifest v3

Re: Let's build a Chrome extension that steals as much data as possible

#189

Post by pcthrowaway »

ClumsyPilot wrote: post #82
A4ET8a8uTh0 wrote: post #47

Earlier quoted context omitted.

I don't really disagree, but to play devil's advocate a little, if I was giving away free knives and someone cut themselves, would I be to blame in any way?

If software companies sold knives, this is how it would work: You market them as iButter knives. They are actually carving knives. Half of the users are 14 years old. You give the knives away for free, but the knives steal 1% of any food they cut. Sometimes butter knife needs an software update in the middle of cooking. If you sharpen the knives you lose warranty. Company says you should buy a new one regularly. They…

Of course, by design the knives would also need to take a bit of the user's blood.

Re: Let's build a Chrome extension that steals as much data as possible

#190

Post by IshKebab »

ClumsyPilot wrote: post #30
nostromo wrote: post #11

Wait until you see what’s possible with executables! I like this project, but I also worry that eventually we’re going to lose access to extensions entirely because people will take away the wrong message. Safeguards are good, but at a certain point I want my devices to trust that I know what I’m doing.

> Wait until you see what’s possible with executables! The most important thing is whay you tell the user - Windows says "We don't know where Trojan.exe came from, it could be a virus, are you sure you want to run it?" Chrome says: "You downloaded Trojan.exe from our store, we manage it and check it for viruses. It only asks for harmless permission, install it!" One is warning you, the other is entrapment.

I'm not sure how you somehow drew the conclusion that Windows' warning is better than Chrome's.

Windows says "Now I know I say this for literally every program you download, but I'll say it again. It might be harmful because all programs can do anything at all. Good luck!".

Chrome says: "This might be harmful and it can do these things: X, Y, Z."

Apart from the stupid scrollbar issue that's clearly better.

The only problem is they have done the permission model that we've known for like a decade is broken: ask for permissions up front, you can grant all or deny all.

Could they not have spoken to the Android team who spent like a decade fixing that mistake and moving to fine grained on demand permission prompts?

Post reply on HN