Browser extensions are underrated: the promise of hackable software (2019) • Hacker News Board

Re: Browser extensions are underrated: the promise of hackable software (2019)

#41

Post by senkora » Sun, Feb 04, 2024, 5:20 PM UTC

empiricus wrote: post #36

Is there a way to use browser extensions safely? Any extension that looks interesting needs access to everything I see on the screen (and even modify it), which to me seems a huge security risk. My understanding is that random extension is able to read and send somewhere almost all my data when I read my email, do online banking, etc. Do I understand correctly the situation?

It's possible to extract the extensions source, save it locally, and then manually install it. That insulates you from the risk of a malicious update.

(You could also audit the extension for complete safety, but TBH I'm usually too lazy to do that, and I assume that the risk of an extension currently being malicious is far lower than the risk of an extension later being updated to become malicious)

Re: Browser extensions are underrated: the promise of hackable software (2019)

#42

Post by jwells89 » Sun, Feb 04, 2024, 5:22 PM UTC

throwaway63467 wrote: post #24

Many popular browser extensions were bought up by data brokers that use them to exfiltrate browser history, so not sure if they’re underrated, I think you have to be pretty careful as the extension security/privacy model is/was pretty awful. I e.g. know screenshotting extensions (Awesome Screenshot) that would vacuum up your browser history and send it to a data broker in Israel. So probably better to have that as a…

Yes. Because of this and the lack of fine-grained permissions mentioned by a sibling comment, I tend to use desktop apps where I can instead of extensions, keeping my extensions list quite slim — basically all I install are FOSS extensions by “big” known-good authors (e.g. Raymond Hill) or projects that aren’t going to sell out.

Of course risks exist with desktop apps too, but historically this kind of buy-and-exfiltrate scheme is comparatively rare with desktop apps, particularly on macOS where signed apps are sandboxed and can’t do a whole lot without user permissions.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#43

Post by monkellipse » Sun, Feb 04, 2024, 5:23 PM UTC

extesy wrote: post #35

monkellipse wrote: post #23

I love the idea of browser extensions but they don’t appear to be worth the security/privacy risk for my use cases. I wonder how many others are like me and too paranoid to risk extensions at all?

At all? Not even ublock origin? That would actually go against your stated goal of security/privacy.

Correct, none. I use Pihole for blocking. But the bigger point I think is that security conscious users are hesitant to employ extensions in general, even if some folks are ok with a couple select extensions they are still spooked by the general field.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#44

Post by senkora » Sun, Feb 04, 2024, 5:23 PM UTC

cranberryturkey wrote: post #2

problem is you can't sell them.

Safari extensions are an exception here. They are distributed through the Mac OS App store, often as an optional part of a desktop App that can then be enabled within Safari.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#45

Post by sp0rk » Sun, Feb 04, 2024, 5:25 PM UTC

Retr0id wrote: post #16

everybodyknows wrote: post #4

Needs [2019].

Does it? Has the browser extension landscape changed significantly since then?

It's just a Hacker News convention to include the year in parentheses if the article isn't freshly published. It doesn't have anything to do with the content of the article itself.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#46

Post by imhoguy » Sun, Feb 04, 2024, 5:29 PM UTC

seanwilson wrote: post #29

I wish browser extensions had more fine-grained permissions but it's a tricky problem verifying if software is using permissions maliciously (see the Obfuscated C Code Contest and the Underhand C Contest) and how to communicate nuanced permissions to users (most users don't read and/or understand tech stuff, and can be easily mislead). A tip in Chrome that I never see mentioned if you want to be extra safe when tryin…

Firefox user here, I wish Multi-Account Containers had a way to disable extensions per container. I don't need any on my banking site. Sure I could use separate Profile but UX hurts here.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#47

Post by notzane » Sun, Feb 04, 2024, 5:30 PM UTC

lstamour wrote: post #26

account-5 wrote: post #6

I quite like bookmarklets, easy to write. Tried a userscript but couldn't get into it. Never tried an extension, wouldn't know where to start.

Start with ChatGPT or a sample extension. The unfortunate part of web browser extensions is that, like the treadmill of web frameworks and app development, browsers can’t seem to stop changing and tweaking how extensions work and remove perfectly good functionality. So you end up sometimes having to rewrite an extension or its manifest with very little assistance from browser makers. But at least you don’t need to le…

I made this extension fully using chatGPT to diagnose some layout issues. It’s super simple but chatGPT was definitely useful setting up the chrome boilerplate (and commenting what each option meant). Make sure you ask it to target the most recent version, they recently changed (to v3?) and it seems chatGPT prefers writing for the old version.

https://github.com/notzane/red-box-outline

Re: Browser extensions are underrated: the promise of hackable software (2019)

#48

Post by seanwilson » Sun, Feb 04, 2024, 5:35 PM UTC

jwells89 wrote: post #42

throwaway63467 wrote: post #24

Many popular browser extensions were bought up by data brokers that use them to exfiltrate browser history, so not sure if they’re underrated, I think you have to be pretty careful as the extension security/privacy model is/was pretty awful. I e.g. know screenshotting extensions (Awesome Screenshot) that would vacuum up your browser history and send it to a data broker in Israel. So probably better to have that as a…

Yes. Because of this and the lack of fine-grained permissions mentioned by a sibling comment, I tend to use desktop apps where I can instead of extensions, keeping my extensions list quite slim — basically all I install are FOSS extensions by “big” known-good authors (e.g. Raymond Hill) or projects that aren’t going to sell out. Of course risks exist with desktop apps too, but historically this kind of buy-and-exfilt…

> I tend to use desktop apps where I can instead of extensions

How locked down are desktop apps now on Mac, Windows and Linux? I haven't kept up. Do they still a lot of access by default to do malicious things with? I recently saw someone install the Adobe Acrobat desktop app and it installed its own extension inside of Chrome without asking. Games can have scary DRM as well.

Chrome extensions can't read/write to arbitrary places on your hard disk without asking for example and you can isolate them within separate profiles. Not saying they're perfect but there is robust sandboxing of what they're allowed to do. I'm curious how this compares to an Electron-based desktop app i.e. which is running Chrome on the inside but with the standard restrictions Chrome places on tabs and extensions unlocked.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#49

Post by Retr0id » Sun, Feb 04, 2024, 5:37 PM UTC

capitainenemo wrote: post #30

Retr0id wrote: post #25

Earlier quoted context omitted.

> Uh. Linux users would like a word here. As a Linux user, I disagree. It's not quite the same. Yes, I could recompile my kernel if I wanted to. I can recompile most of userspace too. But it's a hassle, especially if you want to diverge from upstream, and maintain that divergence on a long-term basis. You can do some fun hacks with LD_PRELOAD et al, but it's nowhere near the degree of flexibility and ease of access o…

I feel gentoo reduces that hassle a fair amount since you can just toss the patches in and the distro pulls them in on updates. So long as you're not messing with APIs it's not too bad in terms of bitrot. ... I suppose you could do the same thing with debian too. You'd just need to maintain an overlay repo that rebuilds off the upstream deb sources for the packages you touched. At that point you're pretty much doing…

I should maybe give Gentoo a second try. I last tried it on a dual-core thinkpad and it was a pretty miserable experience due to the long compile times. These days I have fast computers, and I hear Gentoo even started shipping binaries recently.

I have a huge amount of respect for the work distro maintainers do. It's not especially fun or glamorous work, and many are unaware that it even happens, but it's essential.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#50

Post by a13o » Sun, Feb 04, 2024, 5:39 PM UTC

silvestrov wrote: post #32

I think what we need the most is a "view source" for browser extensions installed from the store: make it easy to view the source and to extract the browser extension into a folder. Make it easy to find out which web pages they access and which they modified. Minimized/encrypted code in extensions should be forbidden. It should be very easy to read the code. E.g. this extensions says "records user activity", but what…

In chrome go to chrome://extensions, enable developer mode, and now you can view source for any extension in devtools. The content scripts are already available in the regular web page's devtools without enabling developer mode.

The total list of websites is available in the installation popup for the extension.

The chrome web store already bans code obfuscation. minification is allowed as there's no meaningful way to enforce the quality of variable names