Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AI browser extensions are a security nightmare

kolide.com

Post reply on HN
Print view View original

11–20 of 129 posts

Re: AI browser extensions are a security nightmare

#11

Post by hoosieree »

mahogany wrote: post #5
CyberDildonics wrote: post #3

Browser Extensions Are a Security Nightmare - I guess you can add AI in front to make it seem new.

Exactly - it blows my mind how normalized the permission Access your data for all websites is (I think it's Read and Change all your data on all websites for Chrome ). I use only one or two extensions because of this. Why does a procrastination tool need such an insanely broad permission?

I wrote a Chrome extension[1] that reads no data but places a colored translucent div over the page. It requires that same "change all your data" permission.

My takeaway lesson is that the permissions model for extensions is confusing and nearly useless.

[1] https://chrome.google.com/webstore/detail/obscura/nhlkgnilpm...

Re: AI browser extensions are a security nightmare

#12

Post by ravenstine »

kypro wrote: post #2

> Yes, large language models (LLMs) are not actually AI in that they are not actually intelligent, but we’re going to use the common nomenclature here. I'm sorry for the off-topic comment, but why do I keep seeing this? What am I missing here – is it that some people define intelligence as >= human, or that LLM are not intelligence because they're *just* statistical models?

> is it that some people define intelligence as >= human

I just want to say that this seems to be how many, if not most people define intelligence internally. If an LLM gets something wrong or doesn't know something, then it must be completely unintelligent. (as if humans never get anything wrong!)

Re: AI browser extensions are a security nightmare

#13

Post by russdill »

kypro wrote: post #2

> Yes, large language models (LLMs) are not actually AI in that they are not actually intelligent, but we’re going to use the common nomenclature here. I'm sorry for the off-topic comment, but why do I keep seeing this? What am I missing here – is it that some people define intelligence as >= human, or that LLM are not intelligence because they're *just* statistical models?

It's statistical models all the way down.

Re: AI browser extensions are a security nightmare

#14

Post by xigency »

sublinear wrote: post #8
kypro wrote: post #2

> Yes, large language models (LLMs) are not actually AI in that they are not actually intelligent, but we’re going to use the common nomenclature here. I'm sorry for the off-topic comment, but why do I keep seeing this? What am I missing here – is it that some people define intelligence as >= human, or that LLM are not intelligence because they're *just* statistical models?

> LLM are not intelligence because they're just statistical models This is exactly it for me.

Are you intelligent or just a bunch of cells? Given that I can query it for all sorts of information that I don’t know, I would consider LLMs to, at the very least, contain and present intelligence…artificially.

Re: AI browser extensions are a security nightmare

#15

Post by xigency »

ravenstine wrote: post #12
kypro wrote: post #2

> Yes, large language models (LLMs) are not actually AI in that they are not actually intelligent, but we’re going to use the common nomenclature here. I'm sorry for the off-topic comment, but why do I keep seeing this? What am I missing here – is it that some people define intelligence as >= human, or that LLM are not intelligence because they're *just* statistical models?

> is it that some people define intelligence as >= human I just want to say that this seems to be how many, if not most people define intelligence internally. If an LLM gets something wrong or doesn't know something, then it must be completely unintelligent. (as if humans never get anything wrong!)

Clearly the test isn’t >= as ChatGPT is already more coherent than large swaths of the population. The AI test for some is that its intelligence >>> human intelligence. Which is funny because by that point in time, their opinion will be more than worthless.

Re: AI browser extensions are a security nightmare

#16

Post by youreincorrect »

hoosieree wrote: post #11
mahogany wrote: post #5

Earlier quoted context omitted.

Exactly - it blows my mind how normalized the permission Access your data for all websites is (I think it's Read and Change all your data on all websites for Chrome ). I use only one or two extensions because of this. Why does a procrastination tool need such an insanely broad permission?

I wrote a Chrome extension[1] that reads no data but places a colored translucent div over the page. It requires that same "change all your data" permission. My takeaway lesson is that the permissions model for extensions is confusing and nearly useless. [1] https://chrome.google.com/webstore/detail/obscura/nhlkgnilpm...

Do you suppose it's possible that accessing the DOM to add a div implicitly requires access to page data?

Re: AI browser extensions are a security nightmare

#17

Post by thfuran »

hoosieree wrote: post #11
mahogany wrote: post #5

Earlier quoted context omitted.

Exactly - it blows my mind how normalized the permission Access your data for all websites is (I think it's Read and Change all your data on all websites for Chrome ). I use only one or two extensions because of this. Why does a procrastination tool need such an insanely broad permission?

I wrote a Chrome extension[1] that reads no data but places a colored translucent div over the page. It requires that same "change all your data" permission. My takeaway lesson is that the permissions model for extensions is confusing and nearly useless. [1] https://chrome.google.com/webstore/detail/obscura/nhlkgnilpm...

How would you allow changing page contents with a narrow permission?

Re: AI browser extensions are a security nightmare

#18

Post by [deleted] »

hoosieree wrote: post #11
mahogany wrote: post #5

Earlier quoted context omitted.

Exactly - it blows my mind how normalized the permission Access your data for all websites is (I think it's Read and Change all your data on all websites for Chrome ). I use only one or two extensions because of this. Why does a procrastination tool need such an insanely broad permission?

I wrote a Chrome extension[1] that reads no data but places a colored translucent div over the page. It requires that same "change all your data" permission. My takeaway lesson is that the permissions model for extensions is confusing and nearly useless. [1] https://chrome.google.com/webstore/detail/obscura/nhlkgnilpm...

[deleted]

Re: AI browser extensions are a security nightmare

#19

Post by bee_rider »

kypro wrote: post #2

> Yes, large language models (LLMs) are not actually AI in that they are not actually intelligent, but we’re going to use the common nomenclature here. I'm sorry for the off-topic comment, but why do I keep seeing this? What am I missing here – is it that some people define intelligence as >= human, or that LLM are not intelligence because they're *just* statistical models?

Very clever people have located true intelligence in the gaps between what an machine can do and what a human can. Therefore, to show that you aren’t a starry-eyed rube you put a disclaimer that you aren’t really talking about intelligence, but something that just looks and acts like it.

True intelligence is, of course, definitionally the ability to do things like art or… err, wait, sorry, I haven’t checked recently, where have we put the goalposts nowadays?

Re: AI browser extensions are a security nightmare

#20

Post by gnicholas »

thfuran wrote: post #17
hoosieree wrote: post #11

Earlier quoted context omitted.

I wrote a Chrome extension[1] that reads no data but places a colored translucent div over the page. It requires that same "change all your data" permission. My takeaway lesson is that the permissions model for extensions is confusing and nearly useless. [1] https://chrome.google.com/webstore/detail/obscura/nhlkgnilpm...

How would you allow changing page contents with a narrow permission?

I also have a Chrome extension that needs access to page content on all pages, for the purpose of making text easier to read.

I could see distinguishing between extensions that in any way exfiltrate data from the pages you view, versus extensions that process the DOM and do something locally, but never send the data anywhere.

This requires a bit closer vetting than Google currently does, I think. To demonstrate that all processing happens locally, we encourage our users to load various websites with our extension toggled off, then go into airplane mode, and then turn our extension on. This doesn't strictly guarantee that we're not separately exfiltrating data (we aren't), but it does prove that our core process happens locally.

Post reply on HN