Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google purges bad extensions from Chrome

bbc.com

Post reply on HN
Print view View original

11–20 of 93 posts

Re: Google purges bad extensions from Chrome

#11

Post by tomjen3 »

userbinator wrote: post #6

Aren't extensions written in JavaScript? That alone sounds like it'd make it pretty easy to examine and remove any "unwanted functionality" from one, or to show that it's doing something it shouldn't be. It only takes one knowledgeable user to find out and spread the news... As an aside, I'm surprised at how willing most users seem to be to install any software, be it browser extensions or random apps on their phones…

>That alone sounds like it'd make it pretty easy to examine and remove

Minified and obfuscated Javascript is not much easier to check than binary files and more difficult than e.g Java class files, at least without ProGuard.

Re: Google purges bad extensions from Chrome

#12

Post by mmahemoff »

TazeTSchnitzel wrote: post #7
mmahemoff wrote: post #4

"This extension will have access to your browsing history and private data on all websites". Which is usually accompanied by the developer apologising and explaining they have to declare this in order to provide the extension's core functionality. Users then learn to ignore these warnings, malicious extensions ensue. I'm glad Google is taking malicious extensions seriously, but purging is a difficult semi-manual effo…

Sounds like Chrome's "security model" for extensions is just as awful as Android? Large, sweeping permissions categories rather than fine-grained control, and all-or-nothing acceptance.

Pretty much the same, which is different to general websites, which do on-demand permissions (as with iOS model).

Chrome extensions can request only access to specific URL regex's, so they can be fine-grained about location, but the actual permissions tend to be coarse-grained. And as a user, you can't change the URL regex (that's some low-hanging fruit right there - users should be able to edit the URL pattern for any extension).

In some respects, Chrome apps are morphing to be general websites (e.g. with manifest.json and installing to home screen on Android), so hopefully things will move more in the direction of the web. There were also some hints towards on-demand permissions in the security talk at the most recent Chrome Web Summit, I'm not sure it's proceeding.

Re: Google purges bad extensions from Chrome

#13

Post by makomk »

dankohn1 wrote: post #9

This is fantastic news. The Quick Note Chrome extension from Diigo (now removed) submits every URL visited to a third-party server and those URLs are then crawled the next day. We just switched our 25 member customer service team to Chromeboxes and were very concerned to find soon after that an EC2-based crawler was querying private URLs of our platform. Because the Chrome Web Store had not banned bad actors like Dii…

Sounds like it's the same as Google's previous clampdowns on rogue extensions - they removed a few high-profile offenders, put out a press release about it, and left a whole load of malicious extensions untouched even though they'd been repeatedly reported.

Re: Google purges bad extensions from Chrome

#14

Post by STRML »

tomjen3 wrote: post #11
userbinator wrote: post #6

Aren't extensions written in JavaScript? That alone sounds like it'd make it pretty easy to examine and remove any "unwanted functionality" from one, or to show that it's doing something it shouldn't be. It only takes one knowledgeable user to find out and spread the news... As an aside, I'm surprised at how willing most users seem to be to install any software, be it browser extensions or random apps on their phones…

>That alone sounds like it'd make it pretty easy to examine and remove Minified and obfuscated Javascript is not much easier to check than binary files and more difficult than e.g Java class files, at least without ProGuard.

Just as a reference, you might like this tool - I've gotten great results with some really gnarly minified/obfuscated JS.

http://www.jsnice.org/

Re: Google purges bad extensions from Chrome

#15

Post by afarrell »

mmahemoff wrote: post #4

"This extension will have access to your browsing history and private data on all websites". Which is usually accompanied by the developer apologising and explaining they have to declare this in order to provide the extension's core functionality. Users then learn to ignore these warnings, malicious extensions ensue. I'm glad Google is taking malicious extensions seriously, but purging is a difficult semi-manual effo…

It sounds like you would need the ability to access all the data on the page but not be able to phone home. Enforcing that sounds like a nightmare.

Re: Google purges bad extensions from Chrome

#16

Post by arcatek »

dankohn1 wrote: post #9

This is fantastic news. The Quick Note Chrome extension from Diigo (now removed) submits every URL visited to a third-party server and those URLs are then crawled the next day. We just switched our 25 member customer service team to Chromeboxes and were very concerned to find soon after that an EC2-based crawler was querying private URLs of our platform. Because the Chrome Web Store had not banned bad actors like Dii…

A good thing would probably to have a way to see the requests triggered by installed extensions. Even checking this list once in a while and manually reporting the suspicious ones with a "report" button would make these rogue extensions almost worthless.

Re: Google purges bad extensions from Chrome

#17

Post by r1ch »

userbinator wrote: post #6

Aren't extensions written in JavaScript? That alone sounds like it'd make it pretty easy to examine and remove any "unwanted functionality" from one, or to show that it's doing something it shouldn't be. It only takes one knowledgeable user to find out and spread the news... As an aside, I'm surprised at how willing most users seem to be to install any software, be it browser extensions or random apps on their phones…

It's easy to examine once, but once you grant permissions, the author can silently push out a malicious update at any time. I really wish there was a way to disable auto update on an extension by extension basis.

Re: Google purges bad extensions from Chrome

#19

Post by greggman »

arcatek wrote: post #16
dankohn1 wrote: post #9

This is fantastic news. The Quick Note Chrome extension from Diigo (now removed) submits every URL visited to a third-party server and those URLs are then crawled the next day. We just switched our 25 member customer service team to Chromeboxes and were very concerned to find soon after that an EC2-based crawler was querying private URLs of our platform. Because the Chrome Web Store had not banned bad actors like Dii…

A good thing would probably to have a way to see the requests triggered by installed extensions. Even checking this list once in a while and manually reporting the suspicious ones with a "report" button would make these rogue extensions almost worthless.

Just a guess but can you see those in the DevTools on the Network tab? Needs to be open before you load the page. I'd check but I don't have any extensions installed except WTF and the WebGL Inspector.

Re: Google purges bad extensions from Chrome

#20

Post by bad_user »

> "You would expect that an extension that injects or replaces advertisements is malicious, but then you have AdBlock that creates an ad-free browsing experience and is technically very similar."

AdBlock is very clear in what it does and users install it because they want to block ads, whereas users are usually not aware when an extension injects ads. As a note, the Awesome Screenshot extension for Firefox asks you if you want ads injected, probably because of Mozilla's review process, whereas the Chrome version does not.

It's one thing for websites to be ripped of the opportunity to make money from your eyeballs, with your consent, it's quite another for those same websites to generate money unknowingly for an obscure third-party. We are probably talking about copyright infringement done for commercial for-profit reasons.

Google is annoying me lately. I now use Firefox on my Android and I do that because AdBlock Plus and uBlock are working on it, whereas Chrome for Android still doesn't have plugins, probably because they don't want ad blockers in it.

Post reply on HN