Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Button Stealer

anatolyzenkov.com

Post reply on HN
Print view View original

51–60 of 84 posts

Re: Button Stealer

#51

Post by techjamie »

dspillett wrote: post #41
MOARDONGZPLZ wrote: post #37

Earlier quoted context omitted.

I don’t know what that is.

Which is the problem with games having kernel access for anti-cheat and . You don't know what they are doing in there. You don't really know who they are. Even if you do, corporate machinations might mean who has access to the facility to on your PC could change at any moment without your knowledge. Most end-users are blissfully unaware of the potential consequences of these level of access (Games having kernel acces…

Can you imagine if one of the big anti-cheats got hit with a supply chain attack? That would be devastating.

Re: Button Stealer

#52

Post by dotancohen »

6510 wrote: post #26
purple-leafy wrote: post #10

Issue with this “benign” extension is that it will be using “host_permissions”: “ ” In its manifest means it can basically do anything on any webpage you visit, scrape data etc. As an extension developer, no thanks. “Fun” pointless extensions like this that have no real utility, but funnily enough require broad permissions, are dangerous

The permissions need to be more specific some how. I think the correct approach is to have the option to have a function isolated from the rest of the code. Then pay a trusted party to review the functionality of the function. In this case said function may only 1) access the html on the website, 2) find the button and 3) return only that what makes the button. Then the permission prompt, written by the trusted party…

  > written by the trusted party
This is the weak, and expensive, link.

Re: Button Stealer

#53

Post by rc_mob »

purple-leafy wrote: post #10

Issue with this “benign” extension is that it will be using “host_permissions”: “ ” In its manifest means it can basically do anything on any webpage you visit, scrape data etc. As an extension developer, no thanks. “Fun” pointless extensions like this that have no real utility, but funnily enough require broad permissions, are dangerous

How is OP supposed to build the extension without doing this?

Re: Button Stealer

#55

Post by neontomo »

kickofline wrote: post #2

github: https://github.com/anatolyzenkov/button-stealer

now add a leaderboard for most collected...

btw i had a look at the code and it seems benign. no clue if there's a way to verify the same code is in the chrome extension store.

Re: Button Stealer

#56

Post by teruakohatu »

aembleton wrote: post #30
robryk wrote: post #28

Earlier quoted context omitted.

You can always exfiltrate by inserting stuff into the page's DOM that will do the exfil from the page's context.

Should have a seperate permission to modify the DOM. This extension only needs to read the DOM.

Yes, a network access and DOM write permission should be one and the same. I think the reason it isn't done is because there are so many ways to leak data over a network. If the extension can trigger a DNS lookup somehow, it can exfiltrate data.

Android used to have a network permission but Google removed it.

Re: Button Stealer

#57

Post by beeboobaa3 »

skybrian wrote: post #16
elaus wrote: post #14

Earlier quoted context omitted.

> [...] but funnily enough require broad permissions I don't think there is a way to implement this without said permission. You can always check out the code from GitHub and install the extension locally to avoid any malicious changes in the future.

And that’s why it shouldn’t be in the Chrome app store at all. As a hobbyist developer, having that kind of access in other people’s browsers is not something I want, and I’m suspicious of developers who do seem to want it. It’s like “hey, I wrote a fun game that requires root access.” At least limit it to people who know what Github is.

What are you even talking about? Every piece of desktop software you have ever ran has more permissions than a browser extension.

Is your stance that hobbyist developers should not be allowed to develop desktop software or CLI tools? The entire software development ecosystem would collapse in an instant. Or are you just not familiar with Windows & Macs (lack of a) permission system?

Re: Button Stealer

#58

Post by Suppafly »

dspillett wrote: post #44
MrSS wrote: post #18

Earlier quoted context omitted.

Grammarly has to be able to connect back to their online service while the button addon could be implemented in a way that it can read every website but not send antyhing anywere (in theory, the addon could of course simulate a form and send data out through that or somehow). But yeah i tested grammarly for 5 minutes and found it crazy. there has to be a better way getting both worlds :|

In DayJob we've had to block (actually block, because people didn't listen to being asked not to use it and similar tools) Grammarly because it sending text that could potentially include client data off to their servers for checking would have given us a nasty fail should a client request or conduct an audit. As an alternative there is LanguageTool which you can install locally. We have it running on a small VM that…

>As an alternative there is LanguageTool which you can install locally. We have it running on a small VM that people can configure their installs to talk to, and block the public service end-point

I'm surprised that Grammarly hasn't come up with a local service like that, I bet they have a ton of enterprise users that would appreciate it.

Post reply on HN