Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Button Stealer

anatolyzenkov.com

Post reply on HN
Print view View original

41–50 of 84 posts

Re: Button Stealer

#41

Post by dspillett »

MOARDONGZPLZ wrote: post #37
gryn wrote: post #36

Earlier quoted context omitted.

yeah, I'm sure Genshin impact's creators went out of business when their Kernel access anti-cheat was hacked by ransomware or more recently the hacks mid live broadcasted tournaments (don't remember which game, I think it was apex). I mean that's what kids, teenagers, and young adults and non technical people in general are known for: their prudence and good technical decision making. lets not talk about the other ri…

I don’t know what that is.

Which is the problem with games having kernel access for anti-cheat and .

You don't know what they are doing in there. You don't really know who they are. Even if you do, corporate machinations might mean who has access to the facility to on your PC could change at any moment without your knowledge.

Most end-users are blissfully unaware of the potential consequences of these level of access (Games having kernel access, and browser extensions having all-sites/all-contexts access).

Re: Button Stealer

#42

Post by dspillett »

gryn wrote: post #36
MOARDONGZPLZ wrote: post #32

Earlier quoted context omitted.

No. They are large and presumably have some sort of trust, and can lose the trust of people if they do particularly shady things. This may not bear itself out in practice of course. But a game studio has something to lose, whereas hobbyist developer 73683 asking for root permissions for no real gain to you has nothing to lose from any number of things like scraping sites you visit or using your browser as a tor exit…

yeah, I'm sure Genshin impact's creators went out of business when their Kernel access anti-cheat was hacked by ransomware or more recently the hacks mid live broadcasted tournaments (don't remember which game, I think it was apex). I mean that's what kids, teenagers, and young adults and non technical people in general are known for: their prudence and good technical decision making. lets not talk about the other ri…

It doesn't even need to be a hack, or a malicious new owner taking over a game or other software package that has such access.

The original company could be malicious/stupid/both. See https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootk... for the most famous example of “both”.

Re: Button Stealer

#43

Post by m3kw9 »

elaus wrote: post #14
purple-leafy wrote: post #10

Issue with this “benign” extension is that it will be using “host_permissions”: “ ” In its manifest means it can basically do anything on any webpage you visit, scrape data etc. As an extension developer, no thanks. “Fun” pointless extensions like this that have no real utility, but funnily enough require broad permissions, are dangerous

> [...] but funnily enough require broad permissions I don't think there is a way to implement this without said permission. You can always check out the code from GitHub and install the extension locally to avoid any malicious changes in the future.

hard to know if github code is the code it is being installed unless you build it from github. 1/10000 people check+install like this

Re: Button Stealer

#44

Post by dspillett »

MrSS wrote: post #18
Refusing23 wrote: post #13

Earlier quoted context omitted.

just like 'Grammarly' which is basically just a keylogger

Grammarly has to be able to connect back to their online service while the button addon could be implemented in a way that it can read every website but not send antyhing anywere (in theory, the addon could of course simulate a form and send data out through that or somehow). But yeah i tested grammarly for 5 minutes and found it crazy. there has to be a better way getting both worlds :|

In DayJob we've had to block (actually block, because people didn't listen to being asked not to use it and similar tools) Grammarly because it sending text that could potentially include client data off to their servers for checking would have given us a nasty fail should a client request or conduct an audit.

As an alternative there is LanguageTool which you can install locally. We have it running on a small VM that people can configure their installs to talk to, and block the public service end-point (as sending to that would be a big no-no for us for the same reason as Grammarly). It doesn't have all the features of Grammarly so isn't a complete drop-in replacement, but the self-hosted version works as well as the free features of Grammarly.

Re: Button Stealer

#45

Post by gtsteve »

robryk wrote: post #28
resonious wrote: post #27

Earlier quoted context omitted.

It seems crazy that extensions don't have a permission for making network requests. Getting permission to access the DOM on all pages I visit is fine if there's no way to exfiltrate!

You can always exfiltrate by inserting stuff into the page's DOM that will do the exfil from the page's context.

I would hope that high value target sites such as banks would implement CSPs to prevent that or make it more difficult though.

Re: Button Stealer

#46

Post by sandworm101 »

MOARDONGZPLZ wrote: post #32
firtoz wrote: post #29

Earlier quoted context omitted.

> hey, I wrote a fun game that requires root access So... Just like AAA game studios, eh?

No. They are large and presumably have some sort of trust, and can lose the trust of people if they do particularly shady things. This may not bear itself out in practice of course. But a game studio has something to lose, whereas hobbyist developer 73683 asking for root permissions for no real gain to you has nothing to lose from any number of things like scraping sites you visit or using your browser as a tor exit…

>> No. They are large and presumably have some sort of trust, and can lose the trust of people if they do particularly shady things.

Sony? Microsoft? EA? Apple? Exactly which giant megacorporation is beyond shady things?

https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootk...

Re: Button Stealer

#47

Post by pigeonhole123 »

gtsteve wrote: post #45
robryk wrote: post #28

Earlier quoted context omitted.

You can always exfiltrate by inserting stuff into the page's DOM that will do the exfil from the page's context.

I would hope that high value target sites such as banks would implement CSPs to prevent that or make it more difficult though.

You can save the data and exfiltrate through a site without CSP

Re: Button Stealer

#48

Post by ape4 »

In addition to all the security concerns mentioned, you don't really need it. You can google or ask a chatBot to make you custom button.

Re: Button Stealer

#49

Post by oneeyedpigeon »

skybrian wrote: post #16
elaus wrote: post #14

Earlier quoted context omitted.

> [...] but funnily enough require broad permissions I don't think there is a way to implement this without said permission. You can always check out the code from GitHub and install the extension locally to avoid any malicious changes in the future.

And that’s why it shouldn’t be in the Chrome app store at all. As a hobbyist developer, having that kind of access in other people’s browsers is not something I want, and I’m suspicious of developers who do seem to want it. It’s like “hey, I wrote a fun game that requires root access.” At least limit it to people who know what Github is.

Right, but Google is surely the one at fault here. There should be absolutely no reason that this extension can "change all my data on all websites", whatever the hell that actually means.

Re: Button Stealer

#50

Post by graypegg »

I love the idea but the access is a bit scary.

This could be recreated in a bookmarklet ideally, though it would require saving the button html snippets into a file that you'd have to make downloadable with some Blob weirdness.

Post reply on HN