Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's build a Chrome extension that steals as much data as possible

mattfrisbie.substack.com

Post reply on HN
Print view View original

221–230 of 320 posts

Re: Let's build a Chrome extension that steals as much data as possible

#221

Post by sebzim4500 »

jsnell wrote: post #10
Afforess wrote: post #3

This is an excellent accidental rebuttal to the entire Manifest v3 project. The stated reason for the new major version and breaking changes is officially: > Manifest V3 represents one of the most significant shifts in the extensions platform since it launched a decade ago. Manifest V3 extensions enjoy enhancements in security, privacy, and performance... https://developer.chrome.com/docs/extensions/mv3/intro/ Web de…

It's good that it doesn't pretend to be a rebuttal, because it'd be a bad one. I'm pretty sure the point of making a declarative content blocking API for adblockers is not to block all possible ways of writing a malware extension. It is just to make the most popular category of extensions safe by design. Once that has been done, it's then much easier to improve the situation with the remaining niche use cases. What w…

How is preventing extensions from blocking requests making them safe by design. You can still use the API to record every network request and send it to a server.

Re: Let's build a Chrome extension that steals as much data as possible

#222

Post by ClumsyPilot »

Springtime wrote: post #152
ClumsyPilot wrote: post #31

Earlier quoted context omitted.

> uBlock Origin and other ad blockers Router based adblockers work well, Flint by GL.net comes with nice UI and adhlock and VPN built in. Some people complain about its chinese origin but at least I know only 1 government is spying on me - my provider supplies a router with a linux kernel older than this house. There could be an entire ensemble of Trojans partying there

Pi-Hole or the adblock package for OpenWRT are probably better examples. GL.Inet routers are already natively supported by OpenWRT (since their firmware are just custom forks) so one can flash them.

They come with OpenWRT already, just have a much nicer UI.

You can still access LUCI openWRT UI if you need advanced features.

If you need a new router, they are a decent choice, better than average performance, no need to flash anything.

Re: Let's build a Chrome extension that steals as much data as possible

#223

Post by sp332 »

dcow wrote: post #100
ClumsyPilot wrote: post #92

Earlier quoted context omitted.

> hopefully the Chrome store review process is the nanny they need. This is very disrespectrull. When you supply exhaustive documentation of your software, how it works, what it does, to users, then you can mock them.

What are you talking about? I'm not mocking anybody. We have app store reviews because it's a known fact that not all users read or care about permissions. My point is simply that those safeguards exist for those users and they seem to be working rather well.

A nanny is for kids. Saying someone needs a nanny can be pejorative.

Re: Let's build a Chrome extension that steals as much data as possible

#224

Post by ClumsyPilot »

crashmat wrote: post #205
ClumsyPilot wrote: post #71

Earlier quoted context omitted.

> Well, you can get a full refund Suppose developers of smart locks make an error, and all smartslock unlock on Fridays. When users ask the Company, they lie and claim their locks are flawless and users are to blame. Millions of houses are robbed, people loose their life possesions, and home robbers kill some grandma. Should the Grandma's family get just a $100 refund (price of the lock)? > There's basically no way y…

[flagged]

Ah yes, how could I forget:'companies shall not answer for their actions or crimes', Amad Smith, Wealth of Nations, Page 6.

Capitalism means system of Justice and democracy and markets.

'guy with most money wins' is not capitalism, it's serf mentality.

Re: Let's build a Chrome extension that steals as much data as possible

#225

Post by imiric »

> Without looking, can you name more than half of the extensions you have installed right now?

Sure.

uBlock Origin, Multi-containers, Temporary Containers and cookies.txt on Firefox, which I only use for specific purposes. History and all data is wiped frequently.

None on Chromium, which I always use in incognito mode. I use this daily, but don't need even uBlock on it, since I run a DNS ad blocker on my network.

And none on my main browser, Luakit, since it doesn't support extensions. :) Technically, I have some user scripts, which I've all reviewed or written myself.

Browser extensions are the number one security and privacy risk for all users, more than any OS exploits. The fact they've historically been handled so poorly, and these issues exist even today, should be terrifying.

Great article and extension! <3

Re: Let's build a Chrome extension that steals as much data as possible

#226

Post by Springtime »

ClumsyPilot wrote: post #222
Springtime wrote: post #152

Earlier quoted context omitted.

Pi-Hole or the adblock package for OpenWRT are probably better examples. GL.Inet routers are already natively supported by OpenWRT (since their firmware are just custom forks) so one can flash them.

They come with OpenWRT already, just have a much nicer UI. You can still access LUCI openWRT UI if you need advanced features. If you need a new router, they are a decent choice, better than average performance, no need to flash anything.

Yes, theirs is a custom fork. Only commented about flashing to vanilla OpenWRT in relation to your comment about being spying concerns (and since some, including myself, aren't that comfortable with their remote cloud service built into it).

Re: Let's build a Chrome extension that steals as much data as possible

#227

Post by dmitriid »

jsnell wrote: post #215
dmitriid wrote: post #208

Earlier quoted context omitted.

https://www.theverge.com/2020/8/26/21403202/google-engineers... Edit: a better article https://www.businessinsider.com/unredacted-google-lawsuit-do... Short quote: --- start quote --- Jack Menzel, a former vice president overseeing Google Maps, admitted during a deposition that the only way Google wouldn't be able to figure out a user's home and work locations is if that person intentionally threw Google off the trai…

Thanks. But neither of those sources matches your initial description. The first is not anyone "admitting" anything in a "court case". Nor does it discuss "where user data is stored" or "what systems have access to it". It is quotes from an email discussion on some article, about the behavior of a UI toggle, with no indication that these are people working on that system who would be expected to know where data is st…

Unfortunately I cannot find the exact article describing this now.

There were a few over the years. If I can find one, I will update you with the link.

Meanwhile Google has settled for $85 million in this case https://eu.usatoday.com/story/money/2022/10/05/google-arizon... A whooping 0.6% of their profir for 2022

Re: Let's build a Chrome extension that steals as much data as possible

#228

Post by oefrha »

froggit wrote: post #204
bigfudge wrote: post #180

Earlier quoted context omitted.

Having less visual clutter -is- function to me. I really don’t miss permanent scroll bars and hope they don’t bring them back. Most Macs ship with a trackpad, which means I can’t remember when I last deliberately gripped a scroll bar. They are just a waste of space most of the time, even as an affordance/reminder that scrolling is possible.

Wouldn't it be cool if apple had some kind of menu called like "display settings" or something, and in that menu there was like a checkbox labeled "use invisible scrollbars", and when the checkbox was checked, scrollbars would be invisible, then when it was unchecked, and I know this'll sound crazy, the scollbars would be visible, and people could just make it look the way they like?

Can’t even tell if this is satire, but yes, there happens to be such a setting, System Preferences -> Appearance -> Show scroll bars, with options “automatically based on mouse or trackpad”, “when scrolling”, and “always”. It’s been there since forever. Of course that’s not going to assuage the wrath of non-Apple users like kibwen. Don’t use it if you don’t like it, ffs. As for me, I’m happy to do without bars everywhere.

Re: Let's build a Chrome extension that steals as much data as possible

#229

Post by pcthrowaway »

aboodman wrote: post #220
pcthrowaway wrote: post #210

Earlier quoted context omitted.

> Requiring OSS seems like a fair tradeoff for the power that extensions wield To be precise, I wasn't advocating requiring OSS, just source-availability. Extensions should have at a minimum a visible repository displaying the source code, where users and auditors can publicly comment or leave issues (ideally, which the maintainers can't remove). Chrome should verify that the extension code matches the code in the re…

Funny story, the original version of the web store had a button you could press to see the source of an extension. > Ability to deploy bugs is an antipattern Disagree then. One doesn't come without the other. > even background scripts which don't have access to the DOM can communicate with the content script through sendMessage If by "content script" you mean the web page script, then this is true, but in that case t…

> If by "content script" you mean the web page script, then this is true, but in that case the web page is collaborating with the extension. Whatever the web page is sending to the extension it could just as easily send anywhere on the internet.

Content script would be part of the extension that runs in the context of the webpage, and has access to the DOM

Yes, I agree this could be sent anywhere, but when sent to the background script with the sendMessage API, you don't get visibility into that with devtools out of the box

Re: Let's build a Chrome extension that steals as much data as possible

#230

Post by pflenker »

ameliaquining wrote: post #38
eyelidlessness wrote: post #15

Earlier quoted context omitted.

This introduces an especially silly attack vector: if you expect that asking for a specific permission might alarm users, and if you can push it below the fold, just ask for more innocuous or plausible permissions than you need! Besides the oversight of hiding some permission requests, this highlights that the order they’re presented matters too. Even if it weren’t scrollable with ~invisible indication of that, peopl…

In general, for the most part, it looks like the permissions shown higher in the list are the more dangerous ones. In particular, "read and change all your data on websites" is by far the most dangerous permission, and it always appears first or second. ("Access the page debugger backend", which is above it, sounds technical and opaque to most users, but the permission that it gates also triggers the "read and change…

Every ad blocker asks for "read and change all your data on websites" permission, same as page scrapers/readability tools - so depending on the disguise I think it won't be hard to get this permission.
Post reply on HN