Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's build a Chrome extension that steals as much data as possible

mattfrisbie.substack.com

Post reply on HN
Print view View original

261–270 of 320 posts

Re: Let's build a Chrome extension that steals as much data as possible

#261

Post by jefftk »

nirimda wrote: post #246
jefftk wrote: post #63

Earlier quoted context omitted.

> It only asks for harmless permission, install it! I see it asking for two very scary permissions, two somewhat scary permissions, and one annoying one?

I think the problem is that you don't actually know what the permission is for. It isn't in relation to anything. It's a blanket permission. But almost everything asks for some kind of blanket permission when you install it. Your only option is to say yes. For mobile apps, things have got better and a lot of things ask for their blanket permission later on in the piece. In many cases, it's still not in relation to an…

How would you like this to work?

Re: Let's build a Chrome extension that steals as much data as possible

#263

Post by londons_explore »

silvestrov wrote: post #211
aboodman wrote: post #196

Earlier quoted context omitted.

> Users have no idea what code they're installing. Extensions aren't required to be open source, where the community can audit them for malicious behaviour. Even if an extension claimed to be open source, there's no verification system to ensure the code actually being executed is the code displayed on their github. I love this idea fwiw. Browser vendors should totally do this. Requiring OSS seems like a fair tradeof…

Chrome need a "view source" equivalent for extensions. If should be just as easy to inspect extensions as it is for web pages, including all the network requests they have made.

They pretty much do... In the web inspector, you can filter for network requests by an extension.

Re: Let's build a Chrome extension that steals as much data as possible

#266

Post by londons_explore »

2OEH8eoCRo0 wrote: post #40
metadat wrote: post #9

> Chrome scrolls the permission warning message container, so more than half of the warning messages don’t even show up. I’d bet most users wouldn’t think twice about installing an extension that appears to ask for just 5 permissions. An egregious and nearly unbelievable oversight on Google's part. :-\ As a developer, it's unimaginable to me to not test the extreme high and low numbers of inputs cases to ensure thing…

> if this kind of issue can fly undetected for so long, what can organizations with drastically less resources than $GOOG do to ensure adequate velocity while not leaving the proverbial barn doors open? If $GOOG can't do it with practically infinite resources then I'm of the opinion that nobody can. Computing is broken.

I agree - nobody can.

You can't make a computing environment allowing anyone to write and distribute code that has the ability to do all the things users want it to do, without having a good chunk of bad actors trying to trick/persuade users into granting malicious code enough permissions to hurt the user.

You have to either severely limit what code can do (the iOS model), or allow users to shoot themselves in the foot (the windows download a random .exe and run it model). Chrome falls in between.

Re: Let's build a Chrome extension that steals as much data as possible

#269

Post by moneywoes »

alooPotato wrote: post #22

Now try actually distributing it. My guess is this wouldn't even get close to getting through the review process for the Chrome Webstore. From our experience with Streak, this would def get picked up in review. Seeing other comments in the thread pointing to this article as a reason why MV3 is bad I think misses the point. Personally I think MV3 is a step in the right direction (even though it negatively affects us!)…

The real trick isn’t publishing a new app, it’s purchasing an existing app and pushing an update with malicious code. The latter review process is more lax
Post reply on HN