[dead]
Let's build a Chrome extension that steals as much data as possible
271–280 of 320 posts
Re: Let's build a Chrome extension that steals as much data as possible
#272Earlier quoted context omitted.
> Users have no idea what code they're installing. Extensions aren't required to be open source, where the community can audit them for malicious behaviour. Even if an extension claimed to be open source, there's no verification system to ensure the code actually being executed is the code displayed on their github. I love this idea fwiw. Browser vendors should totally do this. Requiring OSS seems like a fair tradeof…
> Requiring OSS seems like a fair tradeoff for the power that extensions wield To be precise, I wasn't advocating requiring OSS, just source-availability. Extensions should have at a minimum a visible repository displaying the source code, where users and auditors can publicly comment or leave issues (ideally, which the maintainers can't remove). Chrome should verify that the extension code matches the code in the re…
> Chrome should verify that the extension code matches the code in the repo (without an additional build/compile step - the repo should reflect the exact code being shipped in the extension).
To ensure that the code matches, Chrome servers could download the source code and build the extension themselves. This is what F-Droid does. For each version of the extension, they could also archive the source code they used to build it. Even if the repository gets rewritten or taken down later, the archive remains.
Re: Let's build a Chrome extension that steals as much data as possible
#273Earlier quoted context omitted.
> Users have no idea what code they're installing. Extensions aren't required to be open source, where the community can audit them for malicious behaviour. Even if an extension claimed to be open source, there's no verification system to ensure the code actually being executed is the code displayed on their github. I love this idea fwiw. Browser vendors should totally do this. Requiring OSS seems like a fair tradeof…
Chrome need a "view source" equivalent for extensions. If should be just as easy to inspect extensions as it is for web pages, including all the network requests they have made.
Ideally before downloading the extension. However, with automatic updates, this is nearly useless. Malicious code can be injected at any time in the future, long after the user audits the code.
Re: Let's build a Chrome extension that steals as much data as possible
#274[dead]
Re: Let's build a Chrome extension that steals as much data as possible
#275[dead]
Re: Let's build a Chrome extension that steals as much data as possible
#276[dead]
Re: Let's build a Chrome extension that steals as much data as possible
#277Now try actually distributing it. My guess is this wouldn't even get close to getting through the review process for the Chrome Webstore. From our experience with Streak, this would def get picked up in review. Seeing other comments in the thread pointing to this article as a reason why MV3 is bad I think misses the point. Personally I think MV3 is a step in the right direction (even though it negatively affects us!)…
Just buy an already published popular extension and submit an update
Re: Let's build a Chrome extension that steals as much data as possible
#278[dead]
Re: Let's build a Chrome extension that steals as much data as possible
#279Earlier quoted context omitted.
> The chain of humans who've been responsible for developing and testing Chrome Extension functionality and security has been asleep at the wheel this whole time, for something like 15 years. As the first in this chain of humans, I can tell you that (a) we obviously considered this in the first version of extensions and did not allow permissions "below" the fold, (b) Chrome's extension model dramatically improved on…
> (a) we obviously considered this in the first version of extensions and did not allow permissions "below" the fold Irrelevant. > (b) Chrome's extension model dramatically improved on the previous state of the art which was Firefox's "every extension can do everything, extensions can't be uninstalled completely, and there's no review" Irrelevant. > (c) the install dialog is just one part in a bigger system which inc…
This is a needlessly combative reply. Your interlocutor is not sitting at the interrogation table.
Re: Let's build a Chrome extension that steals as much data as possible
#280[dead]