AI browser extensions are a security nightmare

Post by amelius » Thu, Jun 08, 2023, 7:39 PM UTC

jprete wrote: post #59

amelius wrote: post #54

Actually, aren't all browser extensions a security nightmare? Or has something changed recently?

No, because a typical safe-to-run browser extension is written in such a way that it can be examined to see what it does. AI-based tools can’t be analyzed based on their code, so the only way to make them safe is by limiting their capabilities. Any such capability limit is likely to be either too constraining, not constraining enough, or require as much planning ability as the AI itself.

Post by vorticalbox » Thu, Jun 08, 2023, 7:41 PM UTC

matheusmoreira wrote: post #58

Pretty much every single extension that isn't uBlock Origin is a security nightmare.

Post by josteink » Thu, Jun 08, 2023, 7:49 PM UTC

amelius wrote: post #61

jprete wrote: post #59

Earlier quoted context omitted.

No, because a typical safe-to-run browser extension is written in such a way that it can be examined to see what it does. AI-based tools can’t be analyzed based on their code, so the only way to make them safe is by limiting their capabilities. Any such capability limit is likely to be either too constraining, not constraining enough, or require as much planning ability as the AI itself.

The problem is the permission system. Like apps, extensions have an all-or-nothing attitude to permissions. Browsers should allow the user to be more specific about permissions, and let extensions think the user gave more permissions than they actually did. E.g. if extension insists that they need "access to entire filesystem", the browser should make the extension believe they have access to the entire filesystem, b…

Post by jabradoodle » Thu, Jun 08, 2023, 7:54 PM UTC

hoosieree wrote: post #57

youreincorrect wrote: post #16

Earlier quoted context omitted.

Do you suppose it's possible that accessing the DOM to add a div implicitly requires access to page data?

I can see how many applications might want to read the page, but in my case it's not necessary. My extension tries to add a under the element, regardless of what's going on in the page. If there's no , my extension stops working but the browser keeps going. In short, if there were separate "read" and "write" permissions, I would only need "write". For privacy-concerned people, that's a very important distinction.

Post by dsr_ » Thu, Jun 08, 2023, 8:03 PM UTC

sebzim4500 wrote: post #49

dguest wrote: post #47

Earlier quoted context omitted.

In my field it's accepted (by some) that you write "AI" for your grant proposal and say "ML" when you talk to colleagues and want to be taken seriously. It feels a bit wrong to me, because as you say it's arguably a grift, in this case on the taxpayer who funds science grants. More charitably it might just be the applicant admitting that they have no idea what they are doing, and the funding agency seeing this as a g…

Most people outside of academia understand AI to include way more than just ML. People refer to the bots in video games as AI and they are probably a few hundred lines of straightforward code. I don't think there is anything wrong with using the colloquial definition of the term when communicating with funding agencies/the public.