Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's build a Chrome extension that steals as much data as possible

mattfrisbie.substack.com

Post reply on HN
Print view View original

191–200 of 320 posts

Re: Let's build a Chrome extension that steals as much data as possible

#191

Post by pcthrowaway »

autoexec wrote: post #179
codetrotter wrote: post #13

Earlier quoted context omitted.

Because browser makers and web app devs want to be able to do everything desktop software can, but inside of a browser. In theory it’s kind of neat.

In theory that's basically like letting anyone on the internet run arbitrary code on your devices which is a terrible idea. In practice it's like letting anyone on the internet run arbitrary code with a few guardrails to catch the worst and most obvious abuses while it takes control away from the user and allows for highly invasive forms of tracking that is very hard to prevent.

In theory, there is no difference between theory and practice; but in practice, there is.

Re: Let's build a Chrome extension that steals as much data as possible

#192

Post by emaro »

quectophoton wrote: post #177

This is my main worry with Firefox as well. How can I even be confident beyond reasonable doubt that the uBlock Origin extension I have installed won't suddenly start exfiltrating any passwords I enter on websites, for example.

You cannot. Not with any software you didn't write or very carefully review. It's always about trust.

In the case of your example, I think gorhill is a prime example of a trustworthy author. He has a very good track record, never betrayed the users, explains his thought process and behaved consistently in the users (my) interest in the past. uBlock Origin is the one extension I trust the most, even more than say the Multi Container extension from Mozilla.

Re: Let's build a Chrome extension that steals as much data as possible

#193

Post by quectophoton »

bakugo wrote: post #183
quectophoton wrote: post #177

This is my main worry with Firefox as well. How can I even be confident beyond reasonable doubt that the uBlock Origin extension I have installed won't suddenly start exfiltrating any passwords I enter on websites, for example.

>How can I even be confident beyond reasonable doubt that the uBlock Origin extension I have installed won't suddenly start exfiltrating any passwords I enter on websites, for example. You can't, just like you can't be confident that any other piece of software on your computer won't start doing it. This problem isn't specific to extensions in any way and I don't understand why people act like it is. If the risks are…

Please try not to extrapolate my comments to conclusions like I'm (quote) trying to ruin it.

Keywords are "beyond reasonable doubt".

uBO is a Recommended Extension, and even has a badge that says it's only granted to extensions that meet their standards of security.

But do we know if Firefox manually reviews updates as well, for changes in their source code? Or do they only review them once (at the moment where they grant that badge)?

I can't find conclusive info on that front.

I would be happy to know that a few extensions get their updates manually reviewed.

Re: Let's build a Chrome extension that steals as much data as possible

#194

Post by concordDance »

crazygringo wrote: post #50
metadat wrote: post #9

> Chrome scrolls the permission warning message container, so more than half of the warning messages don’t even show up. I’d bet most users wouldn’t think twice about installing an extension that appears to ask for just 5 permissions. An egregious and nearly unbelievable oversight on Google's part. :-\ As a developer, it's unimaginable to me to not test the extreme high and low numbers of inputs cases to ensure thing…

> An egregious and nearly unbelievable oversight on Google's part. :-\ I agree it's egregious, but it's quite easy to believe. It's surely just using a standard modal and passing a string. The thing is, this is on a Mac that has scroll bars that are invisible until you scroll. It's easy to imagine testing was done other OS's where the scroll bars are obvious and the bottom line might be only partially hidden which ma…

> The thing is, this is on a Mac that has scroll bars that are invisible until you scroll.

Undoubtedly the stupidest UI decision made in the last 20 years.

Re: Let's build a Chrome extension that steals as much data as possible

#195

Post by quectophoton »

emaro wrote: post #192
quectophoton wrote: post #177

This is my main worry with Firefox as well. How can I even be confident beyond reasonable doubt that the uBlock Origin extension I have installed won't suddenly start exfiltrating any passwords I enter on websites, for example.

You cannot. Not with any software you didn't write or very carefully review. It's always about trust. In the case of your example, I think gorhill is a prime example of a trustworthy author. He has a very good track record, never betrayed the users, explains his thought process and behaved consistently in the users (my) interest in the past. uBlock Origin is the one extension I trust the most, even more than say the…

My worry is not the author or the extension; it's someone being able to push a new release of the extension (e.g. signing keys compromised, some vulnerability somewhere, etc), and it being automatically approved by Firefox without manual review.

Re: Let's build a Chrome extension that steals as much data as possible

#196

Post by aboodman »

pcthrowaway wrote: post #185
aboodman wrote: post #141

Earlier quoted context omitted.

> The chain of humans who've been responsible for developing and testing Chrome Extension functionality and security has been asleep at the wheel this whole time, for something like 15 years. As the first in this chain of humans, I can tell you that (a) we obviously considered this in the first version of extensions and did not allow permissions "below" the fold, (b) Chrome's extension model dramatically improved on…

Perhaps I'm missing something, or things have changed in the last couple of years, but when I last took a look there were a few main issues with the extension security model that would have been dead-simple to implement. My understanding at the time (I realize I could be mistaken about any of these): * Users have no idea what code they're installing. Extensions aren't required to be open source, where the community c…

> Users have no idea what code they're installing. Extensions aren't required to be open source, where the community can audit them for malicious behaviour. Even if an extension claimed to be open source, there's no verification system to ensure the code actually being executed is the code displayed on their github.

I love this idea fwiw. Browser vendors should totally do this. Requiring OSS seems like a fair tradeoff for the power that extensions wield.

> Automatic updates.

In my day, extensions could auto-update but not change permissions. Also all updates had to be reviewed. The bribery issue is serious and sad, but killing updates seems like the wrong tradeoff. Ability to fix and deploy bugs is important for extensions just like any other software.

> Code obfuscation.

Obfuscated code is already disallowed: https://blog.chromium.org/2018/10/trustworthy-chrome-extensi...

> Better observability of interactions

It is already possible to know which extensions are active on a page: https://i.imgur.com/73lmozH.png. This is a better level of observability than what you describe because once an extension has access to a page, there is no way to prevent it from exfiltrating data from that page. The communication with background page is not relevant. There are myriad ways to exfiltrate just given access to normal DOM, unfortunately.

Re: Let's build a Chrome extension that steals as much data as possible

#197

Post by KyeRussell »

1vuio0pswjnm7 wrote: post #151
aboodman wrote: post #141

Earlier quoted context omitted.

> The chain of humans who've been responsible for developing and testing Chrome Extension functionality and security has been asleep at the wheel this whole time, for something like 15 years. As the first in this chain of humans, I can tell you that (a) we obviously considered this in the first version of extensions and did not allow permissions "below" the fold, (b) Chrome's extension model dramatically improved on…

"I also encourage readers to remember that generally speaking, you all _want_ extensions." Exception here. Never asked for them. Never wanted them. Do not and cannot use them.^1 Seems moot anyway as I doubt anyone ever asked for Chrome itself. When an extension collects data under the radar it's "malware" but when Google does this, it isn't malware. Funny. There's really no greater "danger" to www users than Google b…

How do you feel that this contributes to the discussion?

Re: Let's build a Chrome extension that steals as much data as possible

#198

Post by yywwbbn »

aboodman wrote: post #181
xlii wrote: post #175

Earlier quoted context omitted.

Well I’m usually browsing for development tools & such and some of them are advertised as an out of store downloads (which would be preferable as I prefer Chromium). You did prompt be to check how hard it is though, so allow me to get back to you in a few ;) Edit: I didn’t go through manual process but based on this (rather recent) Adblock guide [1] it’s not very hard. Of course one could argue that “developer mode”…

I guess it depends on what you mean by "difficult". Chrome is unfortunately limited here by the security of the OS. No popular desktop OSes have application isolation: all apps have the same permissions. Any app can write to any other apps' storage. This means that if Chrome makes sideloading too difficult, developers will just tell users to run their native code which will hack into Chrome, making even understanding…

macOS clearly has file system isolation though. Sandboxes apps can’t write/read anything outside without an explicit permission.

Re: Let's build a Chrome extension that steals as much data as possible

#199

Post by KyeRussell »

kibwen wrote: post #89
crazygringo wrote: post #50

Earlier quoted context omitted.

> An egregious and nearly unbelievable oversight on Google's part. :-\ I agree it's egregious, but it's quite easy to believe. It's surely just using a standard modal and passing a string. The thing is, this is on a Mac that has scroll bars that are invisible until you scroll. It's easy to imagine testing was done other OS's where the scroll bars are obvious and the bottom line might be only partially hidden which ma…

> I would hope somebody sees this now and prioritzes a Chromium bug for it. Rather, one would hope that Apple sees it realizes that their short-sighted, bone-headed, pea-brained idea to eliminate scroll bars should be rolled back. Of course, I'm not holding my breath. Yet another example of their crusade to prioritize form over function, exemplifying why I find their products to be infuriating to deal with.

No surprise that the person overreacting about an Apple design decision ends their comment with “yeah and just don’t like them anyway!”

Critiques of Apple from people that have this sort of wide-ranging vitriolic hate for Apple are a dime a dozen, and don’t make for any sort of interesting or enjoyable conversation.

Re: Let's build a Chrome extension that steals as much data as possible

#200

Post by YoshiRulz »

quectophoton wrote: post #177

This is my main worry with Firefox as well. How can I even be confident beyond reasonable doubt that the uBlock Origin extension I have installed won't suddenly start exfiltrating any passwords I enter on websites, for example.

Like all software: disable automatic updates, build from source, and vet patches when you pull them.

I can't be bothered doing that, but then I'm willing to take the maintainer at their word when they say their software doesn't just have a Free license, but also respects my freedoms. https://github.com/gorhill/uBlock/wiki/Can-you-trust-uBlock-...

Post reply on HN