Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Button Stealer

anatolyzenkov.com

Post reply on HN
Print view View original

71–80 of 84 posts

Re: Button Stealer

#71

Post by stuffoverflow »

neontomo wrote: post #55
kickofline wrote: post #2

github: https://github.com/anatolyzenkov/button-stealer

now add a leaderboard for most collected... btw i had a look at the code and it seems benign. no clue if there's a way to verify the same code is in the chrome extension store.

On windows the location of chrome's extensions is "AppData\Local\Google\Chrome\User Data\Default\Extensions". You can read the source code of all of your installed extensions there. This requires you to install the extension first. It is also possible to download the crx file of any extension from the chrome web store and just unzip it to inspect the source, though i'm not sure how to do it with the official chrome. Ungoogled chromium downloads the crx file if you press "add to chrome" and then cancel.

Re: Button Stealer

#72

Post by skybrian »

beeboobaa3 wrote: post #68
skybrian wrote: post #66

Earlier quoted context omitted.

The lack of sandboxing in desktop applications is bad, but you aren’t going to be writing code to read every web page a user visits by accident, and that’s what some browser extensions do on purpose. They’re inherently working with more sensitive data. So that’s worse in certain ways. (And they are more sandboxed in other ways.)

> but you aren’t going to be writing code to read every web page a user visits by accident No, instead you're just reading all files on the filesystem, including the browser's cookie store or whatever. The data you are, or can be, handling is just as, if not more, sensitive since it's literally a superset of what the browser has access to. > The lack of sandboxing in desktop applications is bad Some sandboxing would…

My Mac sometimes prompts me to see if a Mac application should have access to certain directories, such as “Downloads,” so I’m not sure that’s entirely true anymore?

But in any case I think this is missing a distinction between what software developers can install in “developer mode” versus stuff that’s in the store for non-technical people to use. Apps in app stores see widespread use by people who barely know what a computer is, so I think there should be hoops you need to jump through to get distribution to the masses, at least for certain types of apps.

And those apps aren’t useless, they do important but security-sensitive things like banking, things us developers need to do too sometimes.

It’s a different world than hacking around on your Raspberry Pi or an old phone, and I think it should be different. Treating these situations the same muddies the issues.

Re: Button Stealer

#74

Post by whodev »

neontomo wrote: post #55
kickofline wrote: post #2

github: https://github.com/anatolyzenkov/button-stealer

now add a leaderboard for most collected... btw i had a look at the code and it seems benign. no clue if there's a way to verify the same code is in the chrome extension store.

I diff'd the chrome extension against the github repo and they are basically the same, outside of a few lines in the README.md missing and the manifest.json containing an update URL key to "https://clients2.google.com/service/update2/crx".

Re: Button Stealer

#75

Post by doctorpangloss »

purple-leafy wrote: post #10

Issue with this “benign” extension is that it will be using “host_permissions”: “ ” In its manifest means it can basically do anything on any webpage you visit, scrape data etc. As an extension developer, no thanks. “Fun” pointless extensions like this that have no real utility, but funnily enough require broad permissions, are dangerous

My dude. Google Chrome hoovers up all your browsing history. Google knows the content of pages you visit, because you make search queries to visit them, and most sites use Google Analytics or Webmaster tools, or the sites are in their index and can be looked up by URL reported by Chrome. Google has your Gmail, YouTube, Google Drive… if it wanted to, it could access your private stuff because it has access to your email. You are whinging about a silly joke project with a hypothetical concern, when you are already granting broad permissions to all of your data.

Re: Button Stealer

#76

Post by ocodo »

sandworm101 wrote: post #46
MOARDONGZPLZ wrote: post #32

Earlier quoted context omitted.

No. They are large and presumably have some sort of trust, and can lose the trust of people if they do particularly shady things. This may not bear itself out in practice of course. But a game studio has something to lose, whereas hobbyist developer 73683 asking for root permissions for no real gain to you has nothing to lose from any number of things like scraping sites you visit or using your browser as a tor exit…

>> No. They are large and presumably have some sort of trust, and can lose the trust of people if they do particularly shady things. Sony? Microsoft? EA? Apple? Exactly which giant megacorporation is beyond shady things? https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootk...

Apparently people are a telepathically interconnected species, who won't fall for corporate scams in waves.

Sadly, both those things are untrue.

Re: Button Stealer

#77

Post by vunderba »

beeboobaa3 wrote: post #57
skybrian wrote: post #16

Earlier quoted context omitted.

And that’s why it shouldn’t be in the Chrome app store at all. As a hobbyist developer, having that kind of access in other people’s browsers is not something I want, and I’m suspicious of developers who do seem to want it. It’s like “hey, I wrote a fun game that requires root access.” At least limit it to people who know what Github is.

What are you even talking about? Every piece of desktop software you have ever ran has more permissions than a browser extension. Is your stance that hobbyist developers should not be allowed to develop desktop software or CLI tools? The entire software development ecosystem would collapse in an instant. Or are you just not familiar with Windows & Macs (lack of a) permission system?

Unbelievably poor comparison... for several reasons:

1. Most antivirus solutions built into operating systems such as Microsoft defender are unlikely to find suspicious extensions that are exfiltrating your data

2. Extensions autoupdate (and don't require you to re-authenticate their permission set)

3. It is not uncommon for large spyware companies to buy up a bunch of the most popular chrome extensions, and proceed to inject them with malware.

4. Since an extension runs inside your browser, it's much easier to forget that they're essentially always running, whereas once I exit a desktop app it's presumably gone. There's a dangerous level of passivity to browser extensions for an average user who might forget they even have them installed on the browser.

Maybe number 2 has changed in the last 10 years, but it certainly didn't used to be the case.

Re: Button Stealer

#79

Post by beeboobaa3 »

vunderba wrote: post #77
beeboobaa3 wrote: post #57

Earlier quoted context omitted.

What are you even talking about? Every piece of desktop software you have ever ran has more permissions than a browser extension. Is your stance that hobbyist developers should not be allowed to develop desktop software or CLI tools? The entire software development ecosystem would collapse in an instant. Or are you just not familiar with Windows & Macs (lack of a) permission system?

Unbelievably poor comparison... for several reasons: 1. Most antivirus solutions built into operating systems such as Microsoft defender are unlikely to find suspicious extensions that are exfiltrating your data 2. Extensions autoupdate (and don't require you to re-authenticate their permission set) 3. It is not uncommon for large spyware companies to buy up a bunch of the most popular chrome extensions, and proceed…

> Most antivirus solutions built into operating systems such as Microsoft defender are unlikely to find suspicious extensions that are exfiltrating your data

They can flag antivirus signatures just like everything else, and I've experienced this happening in the past. In the end, extensions are just some javascript/css files in a folder and they get scanned just like everything else.

> Extensions autoupdate

So can any piece of software if it wants to. It's trivial to make an updater start on boot.

> It is not uncommon for large spyware companies to buy up a bunch of the most popular chrome extensions, and proceed to inject them with malware

The same can, and has, happened for "regular" software.

> Since an extension runs inside your browser, it's much easier to forget that they're essentially always running, whereas once I exit a desktop app it's presumably gone

Desktop apps can trivially just not show a window if they want to. They can trivially add themselves to autostart. It depends entirely on what they're doing, just like an extension.

Re: Button Stealer

#80

Post by dougseismic »

purple-leafy wrote: post #10

Issue with this “benign” extension is that it will be using “host_permissions”: “ ” In its manifest means it can basically do anything on any webpage you visit, scrape data etc. As an extension developer, no thanks. “Fun” pointless extensions like this that have no real utility, but funnily enough require broad permissions, are dangerous

As a fellow extension developer, you'll know that remote code is extremely sandboxed by the review process and you can jump into the code easily.

Hell if you're that paranoid, sniff any remote connections with mitmproxy and generally just... understand what an extension does before you leave it on your machine.

Some extensions are just fun; this extension is wicked for me as design inspiration but yeah, salty take and hackernews PB+J

Post reply on HN