Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Button Stealer

anatolyzenkov.com

Post reply on HN
Print view View original

61–70 of 84 posts

Re: Button Stealer

#61

Post by Retr0id »

oneeyedpigeon wrote: post #49
skybrian wrote: post #16

Earlier quoted context omitted.

And that’s why it shouldn’t be in the Chrome app store at all. As a hobbyist developer, having that kind of access in other people’s browsers is not something I want, and I’m suspicious of developers who do seem to want it. It’s like “hey, I wrote a fun game that requires root access.” At least limit it to people who know what Github is.

Right, but Google is surely the one at fault here. There should be absolutely no reason that this extension can "change all my data on all websites", whatever the hell that actually means.

I was under the vague impression that Manifest V3 was supposed to prevent this sort of thing. But looking at the extension, it is using MV3. Maybe it really was just about weakening ad blockers.

Re: Button Stealer

#62

Post by tetromino_ »

oneeyedpigeon wrote: post #49
skybrian wrote: post #16

Earlier quoted context omitted.

And that’s why it shouldn’t be in the Chrome app store at all. As a hobbyist developer, having that kind of access in other people’s browsers is not something I want, and I’m suspicious of developers who do seem to want it. It’s like “hey, I wrote a fun game that requires root access.” At least limit it to people who know what Github is.

Right, but Google is surely the one at fault here. There should be absolutely no reason that this extension can "change all my data on all websites", whatever the hell that actually means.

Not "change all my data on all websites" but "read the content of all websites I visit".

Because an extension that finds all button elements on all websites you visit, must necessarily start by reading the content of all websites you visit.

Re: Button Stealer

#63

Post by 6510 »

dotancohen wrote: post #52
6510 wrote: post #26

Earlier quoted context omitted.

The permissions need to be more specific some how. I think the correct approach is to have the option to have a function isolated from the rest of the code. Then pay a trusted party to review the functionality of the function. In this case said function may only 1) access the html on the website, 2) find the button and 3) return only that what makes the button. Then the permission prompt, written by the trusted party…

> written by the trusted party This is the weak, and expensive, link.

The programming notary should be expensive per line.

If a function gets certified and a decent description it can be published for other developers to further scrutinize and use the same.

With user.script or greasemonkey scripts it is kinda expected to read the script before use. Short scripts are easier to check.

Funny example

https://userscripts-mirror.org/scripts/show/179526

If the potentially dubious part can be isolated the notary, the publisher, the other developer and the user can easily review it. It seems much better than the current installing black boxes?

Re: Button Stealer

#64

Post by kmoser »

Does it store the HTML/CSS for creating the buttons so you can easily repurpose them (which would be quite useful), or are they stored as images (which would be fun but less useful)? If the latter, how difficult are they to extract from the page that shows them all?

Re: Button Stealer

#65

Post by skybrian »

oneeyedpigeon wrote: post #49
skybrian wrote: post #16

Earlier quoted context omitted.

And that’s why it shouldn’t be in the Chrome app store at all. As a hobbyist developer, having that kind of access in other people’s browsers is not something I want, and I’m suspicious of developers who do seem to want it. It’s like “hey, I wrote a fun game that requires root access.” At least limit it to people who know what Github is.

Right, but Google is surely the one at fault here. There should be absolutely no reason that this extension can "change all my data on all websites", whatever the hell that actually means.

I think both the developer and Google have some control over what appears in the Chrome store.

Re: Button Stealer

#66

Post by skybrian »

beeboobaa3 wrote: post #57
skybrian wrote: post #16

Earlier quoted context omitted.

And that’s why it shouldn’t be in the Chrome app store at all. As a hobbyist developer, having that kind of access in other people’s browsers is not something I want, and I’m suspicious of developers who do seem to want it. It’s like “hey, I wrote a fun game that requires root access.” At least limit it to people who know what Github is.

What are you even talking about? Every piece of desktop software you have ever ran has more permissions than a browser extension. Is your stance that hobbyist developers should not be allowed to develop desktop software or CLI tools? The entire software development ecosystem would collapse in an instant. Or are you just not familiar with Windows & Macs (lack of a) permission system?

The lack of sandboxing in desktop applications is bad, but you aren’t going to be writing code to read every web page a user visits by accident, and that’s what some browser extensions do on purpose. They’re inherently working with more sensitive data. So that’s worse in certain ways. (And they are more sandboxed in other ways.)

Re: Button Stealer

#67

Post by oneeyedpigeon »

tetromino_ wrote: post #62
oneeyedpigeon wrote: post #49

Earlier quoted context omitted.

Right, but Google is surely the one at fault here. There should be absolutely no reason that this extension can "change all my data on all websites", whatever the hell that actually means.

Not "change all my data on all websites" but "read the content of all websites I visit". Because an extension that finds all button elements on all websites you visit, must necessarily start by reading the content of all websites you visit.

Yes, I think that one's acceptable in this case. It's the "change all my data" that is problematic.

Re: Button Stealer

#68

Post by beeboobaa3 »

skybrian wrote: post #66
beeboobaa3 wrote: post #57

Earlier quoted context omitted.

What are you even talking about? Every piece of desktop software you have ever ran has more permissions than a browser extension. Is your stance that hobbyist developers should not be allowed to develop desktop software or CLI tools? The entire software development ecosystem would collapse in an instant. Or are you just not familiar with Windows & Macs (lack of a) permission system?

The lack of sandboxing in desktop applications is bad, but you aren’t going to be writing code to read every web page a user visits by accident, and that’s what some browser extensions do on purpose. They’re inherently working with more sensitive data. So that’s worse in certain ways. (And they are more sandboxed in other ways.)

> but you aren’t going to be writing code to read every web page a user visits by accident

No, instead you're just reading all files on the filesystem, including the browser's cookie store or whatever. The data you are, or can be, handling is just as, if not more, sensitive since it's literally a superset of what the browser has access to.

> The lack of sandboxing in desktop applications is bad

Some sandboxing would be nice, but the Google/Apple approach of needing to beg the vendor for every little permission isn't the way to go, either. I'd rather have software that can actually do things as opposed to only having useless sandboxed "apps".

Re: Button Stealer

#69

Post by beeboobaa3 »

teruakohatu wrote: post #56
aembleton wrote: post #30

Earlier quoted context omitted.

Should have a seperate permission to modify the DOM. This extension only needs to read the DOM.

Yes, a network access and DOM write permission should be one and the same. I think the reason it isn't done is because there are so many ways to leak data over a network. If the extension can trigger a DNS lookup somehow, it can exfiltrate data. Android used to have a network permission but Google removed it.

> Android used to have a network permission but Google removed it.

That's because google is in the ads business and wants apps to always be able to exfiltrate data to google (google analytics, google ads, etc) & display ads without needing additional permissions.

Having a network permission means there is an incentive for apps to not have the network permission which means they can't load ads. And Google wants you to look at their ads.

Re: Button Stealer

#70

Post by pastage »

robryk wrote: post #28
resonious wrote: post #27

Earlier quoted context omitted.

It seems crazy that extensions don't have a permission for making network requests. Getting permission to access the DOM on all pages I visit is fine if there's no way to exfiltrate!

You can always exfiltrate by inserting stuff into the page's DOM that will do the exfil from the page's context.

I block all external resources on my pages, but sure it works well in most places! It think the default policy should be block on most pages.
Post reply on HN