Why is a browser extension required to access research papers?

#1

Post by bsenftner » Thu, Jan 13, 2022, 2:17 PM UTC

There are a series of subreddits concerned with machine learning topics. In those subreddits there is an organization named CatalyzeX that is constantly promoting their browser plugin to access the latest ML papers, code, etc.

Here is one such post of theirs: https://old.reddit.com/r/LatestInML/comments/s2l10i/given_a_single_video_of_a_human_performing_an/

My question: why a browser extension? This really smells fishy, because a browser extension bypasses any browser security one may have, and has access to one's entire computer. What valid reasoning could there be to justify a browser extension for this purpose?

Re: Why is a browser extension required to access research papers?

#2

Post by warrenm » Thu, Jan 13, 2022, 2:35 PM UTC

It's a way of ensuring you're on a supported platform with a supported browser, and, most likely, that you're only logging-in once (or in only one place at a time) with any given set of credentials

Since it's an authenticated (from their perspective) add-on, they also might do some "clever" things with the materials being offered (animations vs flat PDFs, for example)

It may also handle/verify some aspect of their support model

Re: Why is a browser extension required to access research papers?

#3

Post by mschuster91 » Thu, Jan 13, 2022, 2:37 PM UTC

> This really smells fishy, because a browser extension bypasses any browser security one may have, and has access to one's entire computer.

IIRC that one is no longer true since the advent of sandboxing (and the end of native-code extensions via NPAPI and friends), all permissions have to be granted by the user explicitly.

> What valid reasoning could there be to justify a browser extension for this purpose?

Given the permissions it asks for (access catalyzex.com, arxiv, google scholar, twitter and google) and the description, I'd guess that whenever you search for some research paper it will forward the search to catalyzex and annotate search results.

Unfortunately, the access to Google and Twitter can also be used to exfiltrate your credentials or to commit actions on your behalf there, so I'd be very careful. Too bad the Chrome extension store (unlike the Firefox extension store) does not allow you to directly download the extension to examine it, or to prevent automatic updates.

Re: Why is a browser extension required to access research papers?

#4

Post by jakub_g » Thu, Jan 13, 2022, 2:39 PM UTC

FWIW in latest Chrome if extension wants access to all websites, you can toggle it to be "click to enable", or only whitelist a few websites authorized to run it. Go to extension page -> choose extension and modify where it can run.

Re: Why is a browser extension required to access research papers?

#5

Post by helsinkiandrew » Thu, Jan 13, 2022, 2:40 PM UTC

You don't need the plugin to view the paper.

CatalyzeX appear to be just posting (or spamming depending on your point of view) interesting papers/videos to AI/ML subredits to publicise their chrome plugin (that "finds and shows implementation code for any... research papers").

The link to the paper is at the top of the post under "paper link" from that you can click through to the paper on arxiv.org

The reason its a browser extension is on the plugin page: https://chrome.google.com/webstore/detail/aiml-papers-with-c...

▶ Browse the web as usual and you'll start seeing [CODE] buttons next to papers everywhere.

Re: Why is a browser extension required to access research papers?

#6

Post by horsawlarway » Thu, Jan 13, 2022, 2:44 PM UTC

> because a browser extension bypasses any browser security one may have, and has access to one's entire computer.

This isn't true. They don't have any access outside of the browser with that extension. Further, the list of sites that they've asked for permissions to seems vaguely reasonable. I have not actually looked at the extension code to see what they're doing, but they have only asked for permissions to the following:

Catalyze.com domains

twitter.com

arxiv.com

scholar.google.com

google.com

And unfortunately the extension security model isn't all that granular, so "Read and change your data" really just means they wanted to touch the DOM somewhere on those sites. They could be recording data, but it's more likely they wanted to add a button/link somewhere.

Re: Why is a browser extension required to access research papers?

#7

Post by aspenmayer » Thu, Jan 13, 2022, 2:46 PM UTC

jakub_g wrote: post #4

FWIW in latest Chrome if extension wants access to all websites, you can toggle it to be "click to enable", or only whitelist a few websites authorized to run it. Go to extension page -> choose extension and modify where it can run.

Very nice. Firefox needs this too.

Re: Why is a browser extension required to access research papers?

#8

Post by eli » Thu, Jan 13, 2022, 2:57 PM UTC

horsawlarway wrote: post #6

> because a browser extension bypasses any browser security one may have, and has access to one's entire computer. This isn't true. They don't have any access outside of the browser with that extension. Further, the list of sites that they've asked for permissions to seems vaguely reasonable. I have not actually looked at the extension code to see what they're doing, but they have only asked for permissions to the fo…

"Can read and change your data on google.com" is the opposite of reassuring.

Re: Why is a browser extension required to access research papers?

#9

Post by horsawlarway » Thu, Jan 13, 2022, 3:06 PM UTC

eli wrote: post #8

horsawlarway wrote: post #6

> because a browser extension bypasses any browser security one may have, and has access to one's entire computer. This isn't true. They don't have any access outside of the browser with that extension. Further, the list of sites that they've asked for permissions to seems vaguely reasonable. I have not actually looked at the extension code to see what they're doing, but they have only asked for permissions to the fo…

"Can read and change your data on google.com" is the opposite of reassuring.

It means they can view/modify the DOM of those sites.

Lots of harmless reasons to want to do that (ex: adding a link/button) but yes, it also means they can grab the text content of the site (read your data) and change the site DOM or your text nodes (change your data).

Just because they can doesn't mean they do, though (but it also doesn't mean they don't... shrug).

Again - the problem here is there's absolutely no way to tell the browser "Hey, I don't want to see text nodes, just put this button here in the DOM".

---

I should add - they appear to have only requested www.google.com, which is usually just search. Gmail/Docs/Sheets/Suite/Other are usually under seperate subdomains - ex: gmail is mail.google.com.

Re: Why is a browser extension required to access research papers?

#10

Post by martin_a » Thu, Jan 13, 2022, 3:10 PM UTC

horsawlarway wrote: post #9

eli wrote: post #8

Earlier quoted context omitted.

"Can read and change your data on google.com" is the opposite of reassuring.

It means they can view/modify the DOM of those sites. Lots of harmless reasons to want to do that (ex: adding a link/button) but yes, it also means they can grab the text content of the site (read your data) and change the site DOM or your text nodes (change your data). Just because they can doesn't mean they do, though (but it also doesn't mean they don't... shrug ). Again - the problem here is there's absolutely no…

> It means they can view/modify the DOM of those sites.

Not really into this topic (extensions), but could this capability be used by an extension to create fake (invisible) login forms, grab your login data through auto-complete and send it home?