Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's build a Chrome extension that steals as much data as possible

mattfrisbie.substack.com

Post reply on HN
Print view View original

311–320 of 320 posts

Re: Let's build a Chrome extension that steals as much data as possible

#311

Post by eitland »

snowe2010 wrote: post #307
eitland wrote: post #213

Earlier quoted context omitted.

Exactly. So much is broken because of misunderstood UX design. Today I was again reminded that many years ago some UX designer thought it would be a great idea to remove back/forward buttons from the context menu in Firefox if I accidentally select some text on a page I visit. No one was asked and when someone filed a bug it was ignored because ux designers had already decided. Result: - a few times every month back/…

i'm reminded of this every day. I hate it so much.

It was reported a decade ago.

But we are only "users", even if each if us converted 10 or more IE6 users and bothered IT departments to allow Firefox, web sites to write for web standards and not IE etc etc.

When they ask for money, we are "valued community members". When we have a question we are just annoying "users" it seems.

And the worst part: if you donate to Mozilla it doesn't go to Firefox. It goes to some other project.

Because Firefox is a profit center for Mozilla and they are milking it dry year after year and our donations comes on top of that.

Still I use Firefox. It is still better for my purposes (large hierarchies of related pages that lives from hours to weeks).

And it is not like using Google Chrome would improve the situation.

But lately (maybe the last twelve months?) I have started to use LibreWolf too. I use it as my research browser while using Firefox for all logged in work. It feels good, like using Firefox back in the days.

And if I can work against both Mozilla and Google simultaneously, maybe I should cut Firefox completely :-]

Re: Let's build a Chrome extension that steals as much data as possible

#312

Post by burnished »

ClumsyPilot wrote: post #85
burnished wrote: post #81

Earlier quoted context omitted.

Please dont make up alarmist analogies to try and support your point. You introduce unnecessary points of confusion with 1) whether your scenario even fits and 2) whether the outcomes even make sense. Stick to the actual situation wherever possible.

Alarmist? In Britain we have sent ~800 innocent people to prison because a programming error said they stole money. The software development company testified in court that their software was great, despite many inconsitencies being pointed out. https://en.m.wikipedia.org/wiki/British_Post_Office_scandal I think it should be obvious that a poorly designed product can do much more damage than it costs, both through st…

Then use this real example, not hypothetical dead grandmothers.

Re: Let's build a Chrome extension that steals as much data as possible

#313

Post by msm_ »

metadat wrote: post #9

> Chrome scrolls the permission warning message container, so more than half of the warning messages don’t even show up. I’d bet most users wouldn’t think twice about installing an extension that appears to ask for just 5 permissions. An egregious and nearly unbelievable oversight on Google's part. :-\ As a developer, it's unimaginable to me to not test the extreme high and low numbers of inputs cases to ensure thing…

> The author deserves the highest tier of bug bounty reward for bringing this to light. What's that? It wasn't submitted through the proper channels to be eligible? Right.

Almost entire point of bug bounty programs is to encourage researchers to submit vulnerabilities using a proper channel and adhering to a proper procedure.

Re: Let's build a Chrome extension that steals as much data as possible

#314

Post by OkGoDoIt »

metadat wrote: post #9

> Chrome scrolls the permission warning message container, so more than half of the warning messages don’t even show up. I’d bet most users wouldn’t think twice about installing an extension that appears to ask for just 5 permissions. An egregious and nearly unbelievable oversight on Google's part. :-\ As a developer, it's unimaginable to me to not test the extreme high and low numbers of inputs cases to ensure thing…

And what’s even worse, in that screenshot there’s no visible scrollbar to show there is even any additional data below the fold, or any indication that it’s a scrollable control in the first place. I can’t tell looking at it that there’s any possibility of further permissions anywhere.

Re: Let's build a Chrome extension that steals as much data as possible

#315

Post by dcow »

jeroenhd wrote: post #308
withinboredom wrote: post #201

Earlier quoted context omitted.

Your router can proxy encrypted DNS (if you have some decent firmware) or you can set up your own DNS server. There are also things like nextdns.io which can do all the work that a pihole does but works outside your home network.

I think the point is that some applications will use DoH/DoT/a custom protocol to bypass DNS-based blocklists. It's trivial to run your own DoH/DoT/custom server if you just hardcode the IP into your application. You can still block those by doing IP-level blocks for known ad domains, but that starts to become a problem if one of those domains are run from a shared cloud host (i.e. Cloudflare etc.) because you will a…

And not once encrypted SNI has proliferated.

Re: Let's build a Chrome extension that steals as much data as possible

#316

Post by dcow »

Gigachad wrote: post #103
dcow wrote: post #90

Earlier quoted context omitted.

1. Android and iOS sandbox applications. But if I grant permission, a mobile app can read files from my photos, or documents, SD card on Android, etc. folders. I can even ship a mobile Safari extension on iOS. 2. Desktop platforms do not universally sandbox applications (though they are trying). You can install a desktop app that steals all the data in your home directory, including your entire browsing history, with…

The shared data on ios and android isnt all that important. Sure, you might not want a random app to read your photos, but it's not getting access to your bank session token. And these days you can grant apps to only specific photos. The vast majority of extensions require the ability to read and modify the dom on any website to do anything. This is so much worse than the average app permissions.

An extension can read another origin’s secure cookies? That’s news to me.

Re: Let's build a Chrome extension that steals as much data as possible

#317

Post by loa_in_ »

dcow wrote: post #97
thelopa wrote: post #87

Earlier quoted context omitted.

Browser JS definitely never had the ability to unmount storage volumes before Chromebooks existed.

Oh but your Java applet surely could.

And nothing would prevent an extension from loading an applet

Re: Let's build a Chrome extension that steals as much data as possible

#318

Post by aboodman »

Eisenstein wrote: post #306
kccqzy wrote: post #304

Earlier quoted context omitted.

Frankly your tone made yourself sound like an entitled armchair expert, whereas the paragraphs you have labeled as "irrelevant" sound extremely relevant. Why don't you use a few words to explain why you think that paragraph is irrelevant? Even though he didn't take responsibility I walk away convinced that he's doing a good enough job.

> Frankly your tone made yourself sound like an entitled armchair expert Well, the OP's tone was flippant, and I thought it was dismissive. Who cares how thankless the job is -- it is your job. Stop blaming it on the users for wanting things and fix the problem and stop making excuses and acting put out. > whereas the paragraphs you have labeled as "irrelevant" sound extremely relevant. Why don't you use a few words…

To clarify:

1. I agree the bug should be fixed.

2. I don't work on Chrome anymore and have not for 8 years. I should have made that more clear.

3. I was responding to the claim: 'the entire chain of people working on this has been asleep at the wheel'. OP was assuming this bug has existed forever. I know for a fact it hasn't, because I remember caring about getting this right and implementing custom UI for it. I also listed some other things we improved over status quo at the time, which refute this claim.

4. Based on my knowledge of how this all used to work, it's not as big an issue as the original article and several people in this thread are making it seem, because the review process is really the primary safety check in the system. It needs to be because, as many have noted, most users don't read the dialog. Extensions are required to have a single purpose and extraneous permissions aren't allowed. And if an extension with a large number of permissions was approved, extensions (and updates) are reviewed both with automated and manual processes, and it would be difficult to get a malicious extension through the process or to get large numbers of users on it.

I still agree the bug should be fixed. We cared a lot about getting this UI right when we originally implemented it, and it's unfortunate that it regressed.

Re: Let's build a Chrome extension that steals as much data as possible

#319

Post by efreak »

dcow wrote: post #45

This is a spicy essay for sure but what is the author's actual point? If the user grants you permission to do all these things, then you have permission to do all these things. If you can't be trusted and abuse that permission then you are not ethical. If you aren't ethical someone will find out and your extension will be removed in the worst case and simply not approved in the common case. The author even admits as…

> force the user to scroll through the permissions box before accepting.

Something else used to do that. Java, maybe? Whatever it was had regular enough updates that I _habitually_ drag the scroll bar directly or simply hit the end key to this day when I get to EULAs and other long modal popups.

Re: Let's build a Chrome extension that steals as much data as possible

#320

Post by panda888888 »

dcow wrote: post #297
panda888888 wrote: post #202

Earlier quoted context omitted.

It's very early for users to not understand and for apps to ask for a bunch of permissions. One great example is Grammarly, which is a keylogger that helps users with grammar. I don't think Grammarly has bad intentions, but still, millions of users are giving it access to everything they type.

How else would it correct their grammar? Users want it doing that. It’s not malware.

Okay, maybe "keylogger" was incorrect, but Grammarly has the potential to expose users to all types of security risks they might not realize are possible.

Here's a past example: https://bugs.chromium.org/p/project-zero/issues/detail?id=15...

I have nothing against Grammarly; it's a legitimate company and they seem to respond well to security vulnerabilities, but it still bothers me because a user doesn't think through the potential ramifications of using software that records every keystroke.

Post reply on HN