Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AI browser extensions are a security nightmare

kolide.com

Post reply on HN
Print view View original

71–80 of 129 posts

Re: AI browser extensions are a security nightmare

#71

Post by Animats »

shagie wrote: post #52
sebzim4500 wrote: post #49

Earlier quoted context omitted.

Most people outside of academia understand AI to include way more than just ML. People refer to the bots in video games as AI and they are probably a few hundred lines of straightforward code. I don't think there is anything wrong with using the colloquial definition of the term when communicating with funding agencies/the public.

Would those topics that "outside academia understands AI to include" be covered in http://aima.cs.berkeley.edu ? When you say "bots in video games as AI" that's covered in the book titled Artificial Intelligence: A Modern Approach, 4th US ed. : II Problem-solving 3 Solving Problems by Searching ... 63 4 Search in Complex Environments ... 110 5 Adversarial Search and Games ... 146 6 Constraint Satisfaction Problems ..…

I think I have an original edition of that book somewhere. Good Old Fashioned AI.

Re: AI browser extensions are a security nightmare

#75

Post by madeofpalk »

hxugufjfjf wrote: post #73
madeofpalk wrote: post #72

Earlier quoted context omitted.

Such as?

Privacy Badger, 1Password, HTTPS Everywhere, Dark Reader, to name a few.

> Add "Dark Reader"?

> It can: Read and change all data on all your websites

It already has the broadest permissions available. Dark Reader injects arbitary code into every page you visit. It's one silent update away from stealing all your sessions. This is a security nightmare.

All browser extensions are a security nightmare.

Re: AI browser extensions are a security nightmare

#76

Post by gnicholas »

sebzim4500 wrote: post #48
gnicholas wrote: post #20

Earlier quoted context omitted.

I also have a Chrome extension that needs access to page content on all pages, for the purpose of making text easier to read. I could see distinguishing between extensions that in any way exfiltrate data from the pages you view, versus extensions that process the DOM and do something locally, but never send the data anywhere. This requires a bit closer vetting than Google currently does, I think. To demonstrate that…

There are hundreds of thousands of extensions, and none of them make Google any money. Hard to see how they could justify any serious manual review.

Yeah, it could make sense for them to structure their extension framework so that developers could work with website data in a sandbox, if their use case allows for it. That would enable developers who don't need to send data to a server for processing to prove that the data never leaves the user's machine.

Re: AI browser extensions are a security nightmare

#77

Post by sebzim4500 »

dsr_ wrote: post #69
sebzim4500 wrote: post #49

Earlier quoted context omitted.

Most people outside of academia understand AI to include way more than just ML. People refer to the bots in video games as AI and they are probably a few hundred lines of straightforward code. I don't think there is anything wrong with using the colloquial definition of the term when communicating with funding agencies/the public.

I think you're entirely wrong about this. Using the term AI or artificial intelligence directly invokes several centuries of cultural baggage about golems, robots, Terminators, androids and cyborgs and Matrix-squid. Saying "large language models" does not. Saying "giant correlation networks" does not. Not to be too Sapir-Whorfian, but the terminology we use influences our conversations: terrorists, guerillas, rebels,…

Should a nuclear power station rebrand itself to avoid being associated with Hiroshima? I really don't get what you are trying to say.

Re: AI browser extensions are a security nightmare

#78

Post by ryanklee »

russdill wrote: post #36
ryanklee wrote: post #22

Earlier quoted context omitted.

That is not a very good reason to call an entity unintelligent. There are uncontroversial models of human intelligence that are Bayesian.

That's what I'm alluding to.

Ah, apologies, I read your comment as alluding to statistics as a reason to dismiss intelligence in machines

Re: AI browser extensions are a security nightmare

#79

Post by girvo »

nathan_compton wrote: post #55
hospitalJail wrote: post #50

Earlier quoted context omitted.

In this examples, it likely took that those companies are often praised about their marketing in the same sentence marketing is mentioned. LLMs don't repeat text its seen before, it links words/tokens/phrases that are related. Its prediction, but the prediction isnt just copypasting a previous webpage. Have you use chatgpt yet? I wouldn't delay. Heck you are here on HN, you basically have a responsibility to test it.

I've used it extensively . GPT4 is great, but it is not intelligent. I think its really weird and also totally understandable that people think it is.

It’s something so new and foreign that I’m deeply unsurprised that some feel it’s intelligent.

I personally don’t care one way or the other, whether it is or isn’t. What I care about is whether it’s useful.

Re: AI browser extensions are a security nightmare

#80

Post by actionablefiber »

josteink wrote: post #65
amelius wrote: post #61

Earlier quoted context omitted.

The problem is the permission system. Like apps, extensions have an all-or-nothing attitude to permissions. Browsers should allow the user to be more specific about permissions, and let extensions think the user gave more permissions than they actually did. E.g. if extension insists that they need "access to entire filesystem", the browser should make the extension believe they have access to the entire filesystem, b…

> Like apps, extensions have an all-or-nothing attitude to permissions Browser extensions needs to declare their permissions. With Manifest V3 we’re seeing even more need to declare permissions. Any extension cannot do anything not explicitly granted to it by the user upon installation.

The issue is those extensions can withhold valuable functionality needlessly.

If I download $usefulWikipediaCompanionExtension whose functionality only depends on access to *.wikipedia.org but whose manifest demands permission on all sites, I'd like to be able to tell my browser "if I'm not really on Wikipedia, only show the extension a blank page."

Post reply on HN