Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Button Stealer

anatolyzenkov.com

Post reply on HN
Print view View original

31–40 of 84 posts

Re: Button Stealer

#31

Post by zinekeller »

vstollen wrote: post #25
purple-leafy wrote: post #10

Issue with this “benign” extension is that it will be using “host_permissions”: “ ” In its manifest means it can basically do anything on any webpage you visit, scrape data etc. As an extension developer, no thanks. “Fun” pointless extensions like this that have no real utility, but funnily enough require broad permissions, are dangerous

Are (updates to) extensions from the Chrome and Firefox store usually vetted before publication? I‘ve heard that Firefox will only run signed extensions. Would you trust this process?

> Are (updates to) extensions from the Chrome and Firefox store usually vetted before publication?

Mozilla does not manually review most extensions (only extensions which Mozilla recommended are manually reviewed: https://support.mozilla.org/en-US/kb/add-on-badges).

Chrome's policy is extensions are "reviewed periodically for compliance", but is unclear on how frequent is this periodic review (https://developer.chrome.com/docs/webstore/review-process).

Re: Button Stealer

#32

Post by MOARDONGZPLZ »

firtoz wrote: post #29
skybrian wrote: post #16

Earlier quoted context omitted.

And that’s why it shouldn’t be in the Chrome app store at all. As a hobbyist developer, having that kind of access in other people’s browsers is not something I want, and I’m suspicious of developers who do seem to want it. It’s like “hey, I wrote a fun game that requires root access.” At least limit it to people who know what Github is.

> hey, I wrote a fun game that requires root access So... Just like AAA game studios, eh?

No. They are large and presumably have some sort of trust, and can lose the trust of people if they do particularly shady things. This may not bear itself out in practice of course. But a game studio has something to lose, whereas hobbyist developer 73683 asking for root permissions for no real gain to you has nothing to lose from any number of things like scraping sites you visit or using your browser as a tor exit node or any number of things.

Re: Button Stealer

#33

Post by ivanjermakov »

purple-leafy wrote: post #10

Issue with this “benign” extension is that it will be using “host_permissions”: “ ” In its manifest means it can basically do anything on any webpage you visit, scrape data etc. As an extension developer, no thanks. “Fun” pointless extensions like this that have no real utility, but funnily enough require broad permissions, are dangerous

1. Wait for an extension to become popular

2. Sell it to a company with malicious intentions

3. Get ad/spy/malware in your browser

Re: Button Stealer

#34

Post by geek_at »

ivanjermakov wrote: post #33
purple-leafy wrote: post #10

Issue with this “benign” extension is that it will be using “host_permissions”: “ ” In its manifest means it can basically do anything on any webpage you visit, scrape data etc. As an extension developer, no thanks. “Fun” pointless extensions like this that have no real utility, but funnily enough require broad permissions, are dangerous

1. Wait for an extension to become popular 2. Sell it to a company with malicious intentions 3. Get ad/spy/malware in your browser

that happened to me. I installed a plugin that would parse all pages for email addresses and store them for later reference. A few months later i started to see strange ads on pages that shouldn't have ads.

Re: Button Stealer

#35

Post by lofaszvanitt »

purple-leafy wrote: post #23
elaus wrote: post #14

Earlier quoted context omitted.

> [...] but funnily enough require broad permissions I don't think there is a way to implement this without said permission. You can always check out the code from GitHub and install the extension locally to avoid any malicious changes in the future.

There is a way: 1) Extension could use the “activeTab” permission (would require user to click the extension once when inside the current tab to activate the extension, then the extension will run for any url they visit

And that is so annoying noone would do it.

Re: Button Stealer

#36

Post by gryn »

MOARDONGZPLZ wrote: post #32
firtoz wrote: post #29

Earlier quoted context omitted.

> hey, I wrote a fun game that requires root access So... Just like AAA game studios, eh?

No. They are large and presumably have some sort of trust, and can lose the trust of people if they do particularly shady things. This may not bear itself out in practice of course. But a game studio has something to lose, whereas hobbyist developer 73683 asking for root permissions for no real gain to you has nothing to lose from any number of things like scraping sites you visit or using your browser as a tor exit…

yeah, I'm sure Genshin impact's creators went out of business when their Kernel access anti-cheat was hacked by ransomware or more recently the hacks mid live broadcasted tournaments (don't remember which game, I think it was apex).

I mean that's what kids, teenagers, and young adults and non technical people in general are known for: their prudence and good technical decision making.

lets not talk about the other risk vector that Tencent, a chinese company is the one buying most of these game studios that have Kernel access (not exclusively).

Re: Button Stealer

#37

Post by MOARDONGZPLZ »

gryn wrote: post #36
MOARDONGZPLZ wrote: post #32

Earlier quoted context omitted.

No. They are large and presumably have some sort of trust, and can lose the trust of people if they do particularly shady things. This may not bear itself out in practice of course. But a game studio has something to lose, whereas hobbyist developer 73683 asking for root permissions for no real gain to you has nothing to lose from any number of things like scraping sites you visit or using your browser as a tor exit…

yeah, I'm sure Genshin impact's creators went out of business when their Kernel access anti-cheat was hacked by ransomware or more recently the hacks mid live broadcasted tournaments (don't remember which game, I think it was apex). I mean that's what kids, teenagers, and young adults and non technical people in general are known for: their prudence and good technical decision making. lets not talk about the other ri…

I don’t know what that is.

Re: Button Stealer

#39

Post by emadda »

resonious wrote: post #27
purple-leafy wrote: post #10

Issue with this “benign” extension is that it will be using “host_permissions”: “ ” In its manifest means it can basically do anything on any webpage you visit, scrape data etc. As an extension developer, no thanks. “Fun” pointless extensions like this that have no real utility, but funnily enough require broad permissions, are dangerous

It seems crazy that extensions don't have a permission for making network requests. Getting permission to access the DOM on all pages I visit is fine if there's no way to exfiltrate!

Or also a permission to disable automatic updates to reduce the issue of “popular extension sold to malware corp”.

Re: Button Stealer

#40

Post by [deleted] »

elaus wrote: post #14
purple-leafy wrote: post #10

Issue with this “benign” extension is that it will be using “host_permissions”: “ ” In its manifest means it can basically do anything on any webpage you visit, scrape data etc. As an extension developer, no thanks. “Fun” pointless extensions like this that have no real utility, but funnily enough require broad permissions, are dangerous

> [...] but funnily enough require broad permissions I don't think there is a way to implement this without said permission. You can always check out the code from GitHub and install the extension locally to avoid any malicious changes in the future.

[deleted]
Post reply on HN