Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Use "Amazon 1 Button" Chrome extension to sniff all HTTPS websites

blog.kotowicz.net

Post reply on HN
Print view View original

21–30 of 61 posts

Re: Use "Amazon 1 Button" Chrome extension to sniff all HTTPS websites

#21

Post by groby_b »

Scaevolus wrote: post #20
taway2012 wrote: post #2

This sort of abusive, insecure extension poisons the well for all extension developers. Now, I wish to submit a couple of feature requests to the Chrome team. 1) I wish there was a way by which an extension could declare its access patterns in much more fine-grained manner (kinda like CORS headers). Then I can prove to my users that my extension cannot do the sort of ugly crap that Amazon is doing. 2) Second is an AP…

More extensions should use fine-grained URL permissions-- far too many request access to "all data on all websites" when they could only run on their own domains: https://developer.chrome.com/extensions/permission_warnings.... A way for users to restrict some permissions of an app would be good, but a UX/support problem when they disable something that breaks core functionality.

That's for the extension devs to handle. I'm personally in favor of the following:

1) Users can enable or disable any permission they like 2) This is transparent to developers - i.e. if you access geolocation, you'll always get one. It just won't be the right one if you don't have permission. 3) The extension is allowed to query which permissions I've given. So devs can handle blocked permissions more gracefully if they choose.

Re: Use "Amazon 1 Button" Chrome extension to sniff all HTTPS websites

#22

Post by Kerrick »

That's why in my Chrome extension that allows you to discover whether pages have been submitted on reddit as you browse [1], I was cautious with the fact that reddit is sent the URLs over HTTP.

It has a Privacy section in the settings that lets you enable Wait For Click so URLs are only checked upon explicit request. It also lets you exclude domains or URL regular expressions from automatically checking the URL, forcing those to be Wait for Click.

Plus, it comes with smart defaults. Default excluded domains include popular banks, Gmail and Google Docs. Default excluded regular expressions match Google/Yahoo/Bing SERPs and various protocols that you probably don't want checked.

All it takes are some smart defaults and a small amount of development [2], and you can protect your users' privacy. It's worth it.

[1]: http://kerrick.github.io/Mostly-Harmless

[2]: https://github.com/Kerrick/Mostly-Harmless/blob/d61d79aa85a6... (20 LOC in my extension)

Re: Use "Amazon 1 Button" Chrome extension to sniff all HTTPS websites

#23

Post by gwu78 »

So if the user has Javascript disabled, what happens then?

It seems so many exploits rely on Javascript.

Would a user ever be willing to sacrafice a little "user experience" (accomplished with Javascript) for protection against easy exploits?

Is that question ever left to the user?

Not if a website provides Javascript-free means of interacting with it; and demands that the user enable Javascript (=you "must" enable Javascript to use this site).

Re: Use "Amazon 1 Button" Chrome extension to sniff all HTTPS websites

#25

Post by lazylland »

My paranoia in installing extensions is finally justified. If Amazon is pulling these kind of stunts, then imagine the kind of mischief the smaller apps are pulling off.

This whole "scorched earth"-style permissions model that users can't make educated decisions about is what annoys me about current platforms like Chrome, Android and iOS.

JavaME had an interesting model where the app asks permissions after it is installed (e.g. internet access, local file system access) for each thing it wants to do. And the app has to consider the fact that the user can decide not to grant that particular permission. Of course, once you decide to trust the app, you could disable the prompts.

Re: Use "Amazon 1 Button" Chrome extension to sniff all HTTPS websites

#26

Post by gojomo »

nkozyra wrote: post #3

Can anyone fathom a potentially benign reason Amazon might do this?

Not entirely benign, but understandable: above all else, Amazon wants to know exactly what search results Google shows you for particular queries, so they can better understand Google's ranking policies.

They can't otherwise scrape search results as you, and getting the info as an anonymous user isn't nearly as valuable. So they need you, via an extension or toolbar, to (perhaps inadvertently) opt-in to letting them collect the data 'over your shoulder'.

Re: Use "Amazon 1 Button" Chrome extension to sniff all HTTPS websites

#28

Post by Hello71 »

groby_b wrote: post #21
Scaevolus wrote: post #20

Earlier quoted context omitted.

More extensions should use fine-grained URL permissions-- far too many request access to "all data on all websites" when they could only run on their own domains: https://developer.chrome.com/extensions/permission_warnings.... A way for users to restrict some permissions of an app would be good, but a UX/support problem when they disable something that breaks core functionality.

That's for the extension devs to handle. I'm personally in favor of the following: 1) Users can enable or disable any permission they like 2) This is transparent to developers - i.e. if you access geolocation, you'll always get one. It just won't be the right one if you don't have permission. 3) The extension is allowed to query which permissions I've given. So devs can handle blocked permissions more gracefully if t…

So... we've come full circle. Extensions can still say "nope, you need to give me ALL permissions".
Post reply on HN