51–60 of 61 posts
Can anyone fathom a potentially benign reason Amazon might do this?
Read the article. The configuration from amazon is only set up to gather https data on amazon sites. Because the configuration was sent over http, he used a man in the middle attack to change it to a wildcard, and gather all https data. Amazon wasn't being evil, just incompetent. Never attribute to malice what can adequately be explained by stupidity...
Can anyone fathom a potentially benign reason Amazon might do this?
Read the article. The configuration from amazon is only set up to gather https data on amazon sites. Because the configuration was sent over http, he used a man in the middle attack to change it to a wildcard, and gather all https data. Amazon wasn't being evil, just incompetent. Never attribute to malice what can adequately be explained by stupidity...
That simple empty script allows them, at any point in the future, to remotely inject scripts that'll have full permissions over any website you visit, without having to push an extension update or have it as part of their core extension code.
They can also choose to send it to specific individuals, or only for specific websites (their script URL gets the visited page as an query string argument), making something like this extremely difficult to detect.
And of course, this could also be abused by someone who hacks their servers. He could, for example, inject a script that sends the user/password whenever you login to a bank or paypal.
Having remote code execute on every page you ever visit is either extremely stupid or an extremely smart way to spy on people without being detected. When the code is part of the extension itself and not remote it: 1) has to be signed (making abuse harder for a malicious hacker) and 2) can be more easily audited, as all users of the extension would get the "spying code" (making abuse harder for a malicious company)
edit: wording
The described technique looks like it might get me some of the way there, but it's kind of a square peg to my round hole. My google/stackoverflow searches aren't getting me very far; I found a reference to jmeter acting as an https client proxying http, but that looks like a similarly deep hole. Maybe it's easier than it looks; I don't know.
I'm no browser expert, but I'm not particularly afraid of javascript.
Advice?
So if the user has Javascript disabled, what happens then? It seems so many exploits rely on Javascript. Would a user ever be willing to sacrafice a little "user experience" (accomplished with Javascript) for protection against easy exploits? Is that question ever left to the user? Not if a website provides Javascript-free means of interacting with it; and demands that the user enable Javascript (=you "must" enable J…
My paranoia in installing extensions is finally justified. If Amazon is pulling these kind of stunts, then imagine the kind of mischief the smaller apps are pulling off. This whole "scorched earth"-style permissions model that users can't make educated decisions about is what annoys me about current platforms like Chrome, Android and iOS. JavaME had an interesting model where the app asks permissions after it is inst…
> where the app asks permissions after it is installed (e.g. internet access, local file system access) for each thing it wants to do iOS does the same for the permissions it supports (access to photo library, contacts, GPS/location, twitter accounts, etc etc), but a lot of things are always allowed (such as internet access). Facebook also lets you deny specific permissions to apps on their platform. I've always wond…
App authors also might shut off the app in less you give it all the permissions, which will cause users to just say yes every time.
Earlier quoted context omitted.
I'm one of the Disconnect devs and these definitely aren't stupid questions: 1. Unlike that other "privacy" cough extension, Disconnect doesn't send any data (user or otherwise) to Disconnect servers. In other words, Disconnect doesn't output user data that can be intercepted by a MITM attack. Disconnect does grab a config file on startup ( https://disconnect.me/help#syncing ), but unlike in the Amazon case, the file…
> encrypted (with the Stanford Javascript Crypto Library) TLS already encrypts. What threat model prompted your decision to use JavaScript cryptography?