Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser extensions are underrated: the promise of hackable software (2019)

geoffreylitt.com

Post reply on HN
Print view View original

111–120 of 320 posts

Re: Browser extensions are underrated: the promise of hackable software (2019)

#111

Post by Fnoord »

mnau wrote: post #83
lapcat wrote: post #66

Earlier quoted context omitted.

> Many popular browser extensions were bought up by data brokers that use them to exfiltrate browser history, so not sure if they’re underrated I would say, as the developer of an upfront paid web browser extension, that upfront paid web browser extensions are underrated. ;-) It's a truism that if you're not the customer, you're the product. But what if you are the customer? I think a lot of the mistrust of browser e…

I will leave this as a gallery of emails with offers to buy extension hoverzoom: https://github.com/extesy/hoverzoom/discussions/670 Sidenote: The "collaboration" offers come from time to time even to non-extensions projects, if they are reasonably widely used. E.g. simple tools (rather widely used suite of android apps recently sold).

This is fantastic. Too bad they redacted the names. These scumbags deserve to be known. And the saddest part of the story is you don't know if is true or a cover-up. On the other hand it appears to be MIT. Are Google Chrome extensions reproducible?

Re: Browser extensions are underrated: the promise of hackable software (2019)

#112

Post by Fnoord »

mnau wrote: post #110
lapcat wrote: post #92

Earlier quoted context omitted.

"Your real profit per day will be $ 9000." LOL

I believe the profit number, even the number of lines > 8 lines of code in the manifest of your extension. As long as they are lines [like ones used to collect card info]( https://www.theregister.com/2018/09/11/british_airways_websi... ) from British Airways (supply chain attack). For how many days will profit be collected is the question (plus the fun criminal investigation).

Yup, and he won't care about the criminal investigation because from other side of iron curtain v2. But if you're from the side where the nation isn't the cover for criminal enterprise you could get in trouble.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#114

Post by syoc »

foobiekr wrote: post #107
akkartik wrote: post #86

Just the framing of "browser extensions" is extremely problematic in the year 2024. Most browser extensions by weight are Google Chrome extensions. Google Chrome is unambiguously demonstrating that no API is safe in its quest to juice revenues. Anybody who builds extensions using Chrome's APIs should be very aware that they're quite possibly putting effort into something a juggernaut will stomp away without a second…

Forget all that. 1. They increase the attack surface of the browser 2. They have routinely been transferred to (for money) or taken over by malicious entities 3. Often they subtly break things in ways that are fine for expert users but which result in support reach out by others The whole extension thing is a mess.

Replace browser with operating system or computer and expand extensions to user installable programs and it mostly still rings true. I believe users should be empowered to modify their installed applications as they see fit.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#115

Post by xmprt »

emodendroket wrote: post #97
lapcat wrote: post #66

Earlier quoted context omitted.

> Many popular browser extensions were bought up by data brokers that use them to exfiltrate browser history, so not sure if they’re underrated I would say, as the developer of an upfront paid web browser extension, that upfront paid web browser extensions are underrated. ;-) It's a truism that if you're not the customer, you're the product. But what if you are the customer? I think a lot of the mistrust of browser e…

> It's a truism that if you're not the customer, you're the product. Though, even if you are, paid products are often monetized in all the exact same ways. Why not.

The only difference between a paid and unpaid piece of software is the revenue stream. In a paid software, your incentive to not screw over existing users is because your app would get poorer ratings and you won't acquire new paying customers. I've seen many times where a paid app stops growing as much and turns into a subscription model or becomes unpaid, giving paid users some small benefit (or nothing at all) and starts screwing over all users indiscriminately.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#116

Post by mozball »

empiricus wrote: post #36

Is there a way to use browser extensions safely? Any extension that looks interesting needs access to everything I see on the screen (and even modify it), which to me seems a huge security risk. My understanding is that random extension is able to read and send somewhere almost all my data when I read my email, do online banking, etc. Do I understand correctly the situation?

>My understanding is that random extension is able to read and send somewhere almost all my data when I read my email, do online banking, etc.

Depends on the permissions requested by the extension but often yes. The permission "Can read all data on any webpage" means exactly that.

> Is there a way to use browser extensions safely?

Yes. Depending on your paranoia /security standards. Here's what you can do ( ordered by importance.)

1. Use more than one browser (but stay away from proprietary or less popular browsers) and/or use multiple profiles (both firefox and chrome has them)

2. Have separate profiles for banking, personal email, work and general browsing. (Also good for productivity)

3. Banking profile should have no extensions.

4. Use only mozilla-vetted 'recommended' and 'security reviewed' extensions in firefox for less important accounts. Check the permissions carefully and see if they're sane. I don't use extensions in chrome at all since google web store does no vetting at all beyond automated scanning. It's the wild west out there.

5. You can be less careful with general browsing profiles as long as you don't log into important accounts. Use firefox containers (this is more for privacy though than security)

6. If some addon is tempting but not reviewed - i try to review the code (if its small and readable enough). after vetting, i disable auto-updates. A greasemonkey script that does equivalent functionality is often preferable since the code is usually smaller and readable. Disable auto-update there too. Otherwise resist the temptation to install too many addons.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#117

Post by sunshowers »

foobiekr wrote: post #107
akkartik wrote: post #86

Just the framing of "browser extensions" is extremely problematic in the year 2024. Most browser extensions by weight are Google Chrome extensions. Google Chrome is unambiguously demonstrating that no API is safe in its quest to juice revenues. Anybody who builds extensions using Chrome's APIs should be very aware that they're quite possibly putting effort into something a juggernaut will stomp away without a second…

Forget all that. 1. They increase the attack surface of the browser 2. They have routinely been transferred to (for money) or taken over by malicious entities 3. Often they subtly break things in ways that are fine for expert users but which result in support reach out by others The whole extension thing is a mess.

Ultimately, as a society, we have to decide what is more important: the best of us or the worst of us.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#118

Post by dividendpayee »

There was a good article from John Loeber a few months back about browser extensions: https://loeber.substack.com/p/9-15-years-of-market-gaps-for-...

He had the same point, where it feels like browser extensions are a big, somehow under-appreciated market. Browsers are huge platforms -- creating add-ons and making them more capable should be a popular, value-generating thing to do! But for a number of (developer) UX/UI issues, that just hasn't been the case. I hope this changes!

Re: Browser extensions are underrated: the promise of hackable software (2019)

#119

Post by fritzo »

mosselman wrote: post #94

I wanted to build an internal company extension, but for that (chrome) you still need to go through the review process with Google and it is even worse than Apple’s App Store reviews.

Would it be too much friction to host internally and require your users to "load unpacked"?

Re: Browser extensions are underrated: the promise of hackable software (2019)

#120

Post by mozball »

ysavir wrote: post #65
empiricus wrote: post #36

Is there a way to use browser extensions safely? Any extension that looks interesting needs access to everything I see on the screen (and even modify it), which to me seems a huge security risk. My understanding is that random extension is able to read and send somewhere almost all my data when I read my email, do online banking, etc. Do I understand correctly the situation?

Not really, I don't think. I hear a lot of people saying that you can inspect the source if you follow steps X, Y, and Z, but that's not a one time thing. Each time the extension is updated you have to do a full audit. You can install it independently to avoid updates, but then you run the risk of things breaking or falling behind (such as adblocker lists). Happy to learn from more experienced people that I'm wrong o…

- An addon like vimium shouldn't need too many updates so auditing and disabling auto-updates might be worth it.

- Firefox has 'recommended' addons. In addition some of the more popular addons are security vetted (Their addon pages doesn't come with the scary "not reviewed" warning. These can be reasonably assumed to be safe.

- Also read my other reply to gp.

> These days I just use a small handful of extensions

Same here. Resisting fomo and temptations for new shiny is the hardest part but still worthwhile imo

Post reply on HN