31–40 of 320 posts
Many popular browser extensions were bought up by data brokers that use them to exfiltrate browser history, so not sure if they’re underrated, I think you have to be pretty careful as the extension security/privacy model is/was pretty awful. I e.g. know screenshotting extensions (Awesome Screenshot) that would vacuum up your browser history and send it to a data broker in Israel. So probably better to have that as a…
Make it easy to find out which web pages they access and which they modified.
Minimized/encrypted code in extensions should be forbidden. It should be very easy to read the code.
E.g. this extensions says "records user activity", but what is that really: https://chromewebstore.google.com/detail/coffeelings/hcbddpp...
I use a very limited set of extensions I trust like uBlock origin and Bitwarden. Also some developer extensions, but usually not on my main browser. Everything else is just not worth the risk for me.
No support on mobile devices is the big drawback.
I love the idea of browser extensions but they don’t appear to be worth the security/privacy risk for my use cases. I wonder how many others are like me and too paranoid to risk extensions at all?
I love the idea of browser extensions but they don’t appear to be worth the security/privacy risk for my use cases. I wonder how many others are like me and too paranoid to risk extensions at all?
That way I force myself to build them from source.
My habit is also to inspect the changes between upstream releases. It's mostly spot checks, but it's better than nothing.
[1]: https://aur.archlinux.org/packages?O=0&SeB=nd&K=firefox-exte...
Is there a way to use browser extensions safely? Any extension that looks interesting needs access to everything I see on the screen (and even modify it), which to me seems a huge security risk. My understanding is that random extension is able to read and send somewhere almost all my data when I read my email, do online banking, etc. Do I understand correctly the situation?
> Browser extensions remind us what it’s like to have deep control over how we use our computers. Uh. Linux users would like a word here. But more generally, there's a significant component of this that seems isomorphous to the question I was trying to discuss in a post I wrote several years ago called "Is Open Source a diversion from what users really want?" There seems to be much more excitement about ways to "hack…
> Uh. Linux users would like a word here. As a Linux user, I disagree. It's not quite the same. Yes, I could recompile my kernel if I wanted to. I can recompile most of userspace too. But it's a hassle, especially if you want to diverge from upstream, and maintain that divergence on a long-term basis. You can do some fun hacks with LD_PRELOAD et al, but it's nowhere near the degree of flexibility and ease of access o…
The question isn't whether you need to recompile source, change config files, download application plugins or set-up a bunch of check-boxes in a nice GUI.
It's whether you can trust those settings to stick.
I've lost count of people telling me that phone settings I suggested simply "reverted" or somehow turned themselves back on/off.
Even some Linux distros that use Snap alongside auto-updates etc are really quite sneaky.
But to my mind web browsers (and I include all of them, Chrome, Firefox or whatever) are utterly treacherous.
Any careful security stance requires constantly checking and re-checking that policies are still in effect.
I think what we need the most is a "view source" for browser extensions installed from the store: make it easy to view the source and to extract the browser extension into a folder. Make it easy to find out which web pages they access and which they modified. Minimized/encrypted code in extensions should be forbidden. It should be very easy to read the code. E.g. this extensions says "records user activity", but what…