Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Button Stealer

anatolyzenkov.com

Post reply on HN
Print view View original

21–30 of 84 posts

Re: Button Stealer

#21

Post by jimvdv »

elaus wrote: post #14
purple-leafy wrote: post #10

Issue with this “benign” extension is that it will be using “host_permissions”: “ ” In its manifest means it can basically do anything on any webpage you visit, scrape data etc. As an extension developer, no thanks. “Fun” pointless extensions like this that have no real utility, but funnily enough require broad permissions, are dangerous

> [...] but funnily enough require broad permissions I don't think there is a way to implement this without said permission. You can always check out the code from GitHub and install the extension locally to avoid any malicious changes in the future.

If chrome permissions made sense a user could choose to activate the extension when they visit a site.

Also the extension could have no network access and have read-only access to the DOM to name a few improvements.

Re: Button Stealer

#22

Post by d--b »

purple-leafy wrote: post #10

Issue with this “benign” extension is that it will be using “host_permissions”: “ ” In its manifest means it can basically do anything on any webpage you visit, scrape data etc. As an extension developer, no thanks. “Fun” pointless extensions like this that have no real utility, but funnily enough require broad permissions, are dangerous

Yes they sell for quite a bit, and the buyer may not have the same idea of “fun” than the original guy.

Re: Button Stealer

#23

Post by purple-leafy »

elaus wrote: post #14
purple-leafy wrote: post #10

Issue with this “benign” extension is that it will be using “host_permissions”: “ ” In its manifest means it can basically do anything on any webpage you visit, scrape data etc. As an extension developer, no thanks. “Fun” pointless extensions like this that have no real utility, but funnily enough require broad permissions, are dangerous

> [...] but funnily enough require broad permissions I don't think there is a way to implement this without said permission. You can always check out the code from GitHub and install the extension locally to avoid any malicious changes in the future.

There is a way:

1) Extension could use the “activeTab” permission (would require user to click the extension once when inside the current tab to activate the extension, then the extension will run for any url they visit

Re: Button Stealer

#24

Post by vstollen »

bargainbin wrote: post #20
MrSS wrote: post #18

Earlier quoted context omitted.

Grammarly has to be able to connect back to their online service while the button addon could be implemented in a way that it can read every website but not send antyhing anywere (in theory, the addon could of course simulate a form and send data out through that or somehow). But yeah i tested grammarly for 5 minutes and found it crazy. there has to be a better way getting both worlds :|

Local software of course! But good luck getting funding for a product that doesn’t phone home every 5 seconds and present an opportunity to plague the user with ads “that they want to see”

I haven’t used it myself, but the LanguageTool browser extension might allow users to use a self-hosted or locally running instance.

Re: Button Stealer

#25

Post by vstollen »

purple-leafy wrote: post #10

Issue with this “benign” extension is that it will be using “host_permissions”: “ ” In its manifest means it can basically do anything on any webpage you visit, scrape data etc. As an extension developer, no thanks. “Fun” pointless extensions like this that have no real utility, but funnily enough require broad permissions, are dangerous

Are (updates to) extensions from the Chrome and Firefox store usually vetted before publication?

I‘ve heard that Firefox will only run signed extensions. Would you trust this process?

Re: Button Stealer

#26

Post by 6510 »

purple-leafy wrote: post #10

Issue with this “benign” extension is that it will be using “host_permissions”: “ ” In its manifest means it can basically do anything on any webpage you visit, scrape data etc. As an extension developer, no thanks. “Fun” pointless extensions like this that have no real utility, but funnily enough require broad permissions, are dangerous

The permissions need to be more specific some how.

I think the correct approach is to have the option to have a function isolated from the rest of the code. Then pay a trusted party to review the functionality of the function.

In this case said function may only 1) access the html on the website, 2) find the button and 3) return only that what makes the button.

Then the permission prompt, written by the trusted party, can be something accurate like: This extension wants to copy buttons from websites.

I'm calling it DEWISOTT computing: does exactly what it says on the tin

You can go wild update your extension 1000 times per day without touching the function.

Re: Button Stealer

#27

Post by resonious »

purple-leafy wrote: post #10

Issue with this “benign” extension is that it will be using “host_permissions”: “ ” In its manifest means it can basically do anything on any webpage you visit, scrape data etc. As an extension developer, no thanks. “Fun” pointless extensions like this that have no real utility, but funnily enough require broad permissions, are dangerous

It seems crazy that extensions don't have a permission for making network requests. Getting permission to access the DOM on all pages I visit is fine if there's no way to exfiltrate!

Re: Button Stealer

#28

Post by robryk »

resonious wrote: post #27
purple-leafy wrote: post #10

Issue with this “benign” extension is that it will be using “host_permissions”: “ ” In its manifest means it can basically do anything on any webpage you visit, scrape data etc. As an extension developer, no thanks. “Fun” pointless extensions like this that have no real utility, but funnily enough require broad permissions, are dangerous

It seems crazy that extensions don't have a permission for making network requests. Getting permission to access the DOM on all pages I visit is fine if there's no way to exfiltrate!

You can always exfiltrate by inserting stuff into the page's DOM that will do the exfil from the page's context.

Re: Button Stealer

#29

Post by firtoz »

skybrian wrote: post #16
elaus wrote: post #14

Earlier quoted context omitted.

> [...] but funnily enough require broad permissions I don't think there is a way to implement this without said permission. You can always check out the code from GitHub and install the extension locally to avoid any malicious changes in the future.

And that’s why it shouldn’t be in the Chrome app store at all. As a hobbyist developer, having that kind of access in other people’s browsers is not something I want, and I’m suspicious of developers who do seem to want it. It’s like “hey, I wrote a fun game that requires root access.” At least limit it to people who know what Github is.

> hey, I wrote a fun game that requires root access

So... Just like AAA game studios, eh?

Re: Button Stealer

#30

Post by aembleton »

robryk wrote: post #28
resonious wrote: post #27

Earlier quoted context omitted.

It seems crazy that extensions don't have a permission for making network requests. Getting permission to access the DOM on all pages I visit is fine if there's no way to exfiltrate!

You can always exfiltrate by inserting stuff into the page's DOM that will do the exfil from the page's context.

Should have a seperate permission to modify the DOM. This extension only needs to read the DOM.
Post reply on HN