Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's build a Chrome extension that steals as much data as possible

mattfrisbie.substack.com

Post reply on HN
Print view View original

31–40 of 320 posts

Re: Let's build a Chrome extension that steals as much data as possible

#31

Post by ClumsyPilot »

jeroenhd wrote: post #24
drpixie wrote: post #20

I'd like a fork of chrome which removes all (or at least most) the "features" mentioned - a browser that renders well but just doesn't support these masses of unsecure features. If you want to give 3rd parties access to all that stuff, you can run chrome. But I don't - I want the bare minimum that will run normal websites. I know that will break some pages, I'll accept that. (And that would give me a smaller & faster…

If you don't install any addons, you'll be fine. You'll have to do without uBlock Origin and other ad blockers, though. Consider Brave if you still want those and want to stick to Chromium. In Firefox, you can go to about:config and set the default permission to deny to a lot of stuff (notifications, clipboard, etc.). You can also disable webgl and other features like those.

> uBlock Origin and other ad blockers

Router based adblockers work well, Flint by GL.net comes with nice UI and adhlock and VPN built in.

Some people complain about its chinese origin but at least I know only 1 government is spying on me - my provider supplies a router with a linux kernel older than this house. There could be an entire ensemble of Trojans partying there

Re: Let's build a Chrome extension that steals as much data as possible

#32

Post by sb8244 »

drpixie wrote: post #26
jeroenhd wrote: post #24

Earlier quoted context omitted.

If you don't install any addons, you'll be fine. You'll have to do without uBlock Origin and other ad blockers, though. Consider Brave if you still want those and want to stick to Chromium. In Firefox, you can go to about:config and set the default permission to deny to a lot of stuff (notifications, clipboard, etc.). You can also disable webgl and other features like those.

I'd feel much more secure, from extensions and websites if those permissions just didn't exist. I can only turnoff what I know about, but not those new things quietly added with each update.

I don't understand this sentiment. Websites can't use these permissions so it's not applicable at all.

Re: Let's build a Chrome extension that steals as much data as possible

#33

Post by whalesalad »

drpixie wrote: post #20

I'd like a fork of chrome which removes all (or at least most) the "features" mentioned - a browser that renders well but just doesn't support these masses of unsecure features. If you want to give 3rd parties access to all that stuff, you can run chrome. But I don't - I want the bare minimum that will run normal websites. I know that will break some pages, I'll accept that. (And that would give me a smaller & faster…

https://github.com/ungoogled-software/ungoogled-chromium

Re: Let's build a Chrome extension that steals as much data as possible

#34

Post by Gigachad »

metadat wrote: post #9

> Chrome scrolls the permission warning message container, so more than half of the warning messages don’t even show up. I’d bet most users wouldn’t think twice about installing an extension that appears to ask for just 5 permissions. An egregious and nearly unbelievable oversight on Google's part. :-\ As a developer, it's unimaginable to me to not test the extreme high and low numbers of inputs cases to ensure thing…

Extensions in general are a massive security issue and it’s impossible to fix without crippling them beyond uselessness. Or maybe having approved extensions only.

Re: Let's build a Chrome extension that steals as much data as possible

#35

Post by Gigachad »

nostromo wrote: post #11

Wait until you see what’s possible with executables! I like this project, but I also worry that eventually we’re going to lose access to extensions entirely because people will take away the wrong message. Safeguards are good, but at a certain point I want my devices to trust that I know what I’m doing.

The problem is not a single person is capable of making informed decisions on extensions. One day they could be good and reputable, next day they have been sold to a malware company.

Maybe the middle ground is all extensions have a legal entity in your country so you can sue them for spyware.

Re: Let's build a Chrome extension that steals as much data as possible

#37

Post by latchkey »

Gigachad wrote: post #34
metadat wrote: post #9

> Chrome scrolls the permission warning message container, so more than half of the warning messages don’t even show up. I’d bet most users wouldn’t think twice about installing an extension that appears to ask for just 5 permissions. An egregious and nearly unbelievable oversight on Google's part. :-\ As a developer, it's unimaginable to me to not test the extreme high and low numbers of inputs cases to ensure thing…

Extensions in general are a massive security issue and it’s impossible to fix without crippling them beyond uselessness. Or maybe having approved extensions only.

Sounds like the Apple app store.

Re: Let's build a Chrome extension that steals as much data as possible

#38

Post by ameliaquining »

eyelidlessness wrote: post #15
metadat wrote: post #9

> Chrome scrolls the permission warning message container, so more than half of the warning messages don’t even show up. I’d bet most users wouldn’t think twice about installing an extension that appears to ask for just 5 permissions. An egregious and nearly unbelievable oversight on Google's part. :-\ As a developer, it's unimaginable to me to not test the extreme high and low numbers of inputs cases to ensure thing…

This introduces an especially silly attack vector: if you expect that asking for a specific permission might alarm users, and if you can push it below the fold, just ask for more innocuous or plausible permissions than you need! Besides the oversight of hiding some permission requests, this highlights that the order they’re presented matters too. Even if it weren’t scrollable with ~invisible indication of that, peopl…

In general, for the most part, it looks like the permissions shown higher in the list are the more dangerous ones. In particular, "read and change all your data on websites" is by far the most dangerous permission, and it always appears first or second. ("Access the page debugger backend", which is above it, sounds technical and opaque to most users, but the permission that it gates also triggers the "read and change all your data" warning.) I vaguely suspect that this is by design.

Re: Let's build a Chrome extension that steals as much data as possible

#39

Post by Sebb767 »

ClumsyPilot wrote: post #28
metadat wrote: post #9

> Chrome scrolls the permission warning message container, so more than half of the warning messages don’t even show up. I’d bet most users wouldn’t think twice about installing an extension that appears to ask for just 5 permissions. An egregious and nearly unbelievable oversight on Google's part. :-\ As a developer, it's unimaginable to me to not test the extreme high and low numbers of inputs cases to ensure thing…

> The chain of humans who've been responsible for developing and testing Chrome Extension functionality and security has been asleep at the wheel this whole time, for something like 15 years. There should be liability for negligence. If you were told about a security hole and you have not fixed it, and you have not informed your users, in months, you should pay statutory damages. And if you lied about your app (claim…

Well, you can get a full refund.

I see where you are coming from, but increasing liability for free software does not feel like a good idea to me at all. There's basically no way you could extract money protected by Googles lawyers army, but any small open-source project or even medium sized company will be extremely vary of releasing anything.

I'm not saying you should never go there - GDPR does and it's a net improvement -, but it's extremely easy to massively overshoot.

Re: Let's build a Chrome extension that steals as much data as possible

#40

Post by 2OEH8eoCRo0 »

metadat wrote: post #9

> Chrome scrolls the permission warning message container, so more than half of the warning messages don’t even show up. I’d bet most users wouldn’t think twice about installing an extension that appears to ask for just 5 permissions. An egregious and nearly unbelievable oversight on Google's part. :-\ As a developer, it's unimaginable to me to not test the extreme high and low numbers of inputs cases to ensure thing…

> if this kind of issue can fly undetected for so long, what can organizations with drastically less resources than $GOOG do to ensure adequate velocity while not leaving the proverbial barn doors open?

If $GOOG can't do it with practically infinite resources then I'm of the opinion that nobody can. Computing is broken.

Post reply on HN