Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's build a Chrome extension that steals as much data as possible

mattfrisbie.substack.com

Post reply on HN
Print view View original

91–100 of 320 posts

Re: Let's build a Chrome extension that steals as much data as possible

#91

Post by nine_k »

dcow wrote: post #70
nine_k wrote: post #58

Earlier quoted context omitted.

Not really any: popular open-source software, which gets reviewed and rebuilt by many independent people (distro maintainers) has a much lower chance to be hijacked this way.

Oh yes it can. Project owners have sold out before--sometimes without telling anybody. The threat vector is the same. Something you trust gets sold to someone else and it abuses previously acquired trust. Open source doesn't actually fix this specific trust issue. And BTW your browser extension's source is available to peruse locally on your machine after you install it. Surely you did that, right?

Being a popular open-source project is not a guarantee, it merely lowers the chances and complicates the attack.

Regarding extensions code: indeed, I do read the code of extensions that require some elevated permissions, if these extensions are not otherwise vetted. This is why I avoid installing excessively complicated extensions, unless they ask for minor permissions. Having the list of tabs if no big deal; accessing data in your tabs, even for a particular site, triggers scrutiny.

Re: Let's build a Chrome extension that steals as much data as possible

#92

Post by ClumsyPilot »

dcow wrote: post #80
Dalewyn wrote: post #72

Earlier quoted context omitted.

>I don't understand why people are so confused about permissions. I don't understand why people (read: devs) still assume permissions are read and understood. The vast majority of people simply do not read nor understand permissions and just instantly hit the OK button. Even Linus from LinusTechTips doesn't read permissions, and he's even a tech guru unlike most people.

So hopefully the Chrome store review process is the nanny they need. The only thing that has permission to read and modify website data on my browsers is my password manager. I trust it. Without that permission it could not operate and provide me immense value. Yes, I would be hosed if it got pwned. It's a calculated risk on my part. One cannot live in a world where we have the benefits of browser extensions and also…

> hopefully the Chrome store review process is the nanny they need.

This is very disrespectrull.

When you supply exhaustive documentation of your software, how it works, what it does, to users, then you can mock them.

Re: Let's build a Chrome extension that steals as much data as possible

#93

Post by dcow »

kibwen wrote: post #89
crazygringo wrote: post #50

Earlier quoted context omitted.

> An egregious and nearly unbelievable oversight on Google's part. :-\ I agree it's egregious, but it's quite easy to believe. It's surely just using a standard modal and passing a string. The thing is, this is on a Mac that has scroll bars that are invisible until you scroll. It's easy to imagine testing was done other OS's where the scroll bars are obvious and the bottom line might be only partially hidden which ma…

> I would hope somebody sees this now and prioritzes a Chromium bug for it. Rather, one would hope that Apple sees it realizes that their short-sighted, bone-headed, pea-brained idea to eliminate scroll bars should be rolled back. Of course, I'm not holding my breath. Yet another example of their crusade to prioritize form over function, exemplifying why I find their products to be infuriating to deal with.

[flagged]

Re: Let's build a Chrome extension that steals as much data as possible

#94

Post by dcow »

nine_k wrote: post #57
dcow wrote: post #51

Earlier quoted context omitted.

The naivety of innocence is rather blissful, isn't it?

But the idea of the app isolation is just that — apps should not be able to touch each other. There are of course escape hatches, because sometimes you want apps to interact.

Extensions cannot touch each other. They also can't touch other websites without an escape hatch, because sometimes you want your password manager to modify the DOM and fill in your password for you.

Re: Let's build a Chrome extension that steals as much data as possible

#95

Post by politician »

A4ET8a8uTh0 wrote: post #47
Sebb767 wrote: post #39

Earlier quoted context omitted.

Well, you can get a full refund. I see where you are coming from, but increasing liability for free software does not feel like a good idea to me at all. There's basically no way you could extract money protected by Googles lawyers army, but any small open-source project or even medium sized company will be extremely vary of releasing anything. I'm not saying you should never go there - GDPR does and it's a net impro…

I don't really disagree, but to play devil's advocate a little, if I was giving away free knives and someone cut themselves, would I be to blame in any way?

If they were known to be unsafe, such as heavily rusted and the handle was loose, then yes, you could be liable.

Re: Let's build a Chrome extension that steals as much data as possible

#96

Post by Shared404 »

Dalewyn wrote: post #68
crazygringo wrote: post #50

Earlier quoted context omitted.

> An egregious and nearly unbelievable oversight on Google's part. :-\ I agree it's egregious, but it's quite easy to believe. It's surely just using a standard modal and passing a string. The thing is, this is on a Mac that has scroll bars that are invisible until you scroll. It's easy to imagine testing was done other OS's where the scroll bars are obvious and the bottom line might be only partially hidden which ma…

>this is on a Mac that has scroll bars that are invisible until you scroll. What modern UI even has visible scroll bars by default? And assuming it's even visible (either by default or user-configured after the fact if that's even possible), what modern UI even has scroll bars wider than 1px?

> What modern UI even has visible scroll bars by default?

Pretty much all of them except Mac.

Can speak personally for KDE, Sway, GNOME, and Windows 10.

And when they are invisible, they usually show up on mouse motion/window interaction, so it's still not as egregious.

Re: Let's build a Chrome extension that steals as much data as possible

#97

Post by dcow »

thelopa wrote: post #87
dcow wrote: post #56

Earlier quoted context omitted.

You should have been around before chrome books when any extension could do whatever it wanted without any permissions at all. Your understanding of history is missing some key pieces. Over time, Google has generally locked these APIs down not opened them up.

Browser JS definitely never had the ability to unmount storage volumes before Chromebooks existed.

Oh but your Java applet surely could.

Re: Let's build a Chrome extension that steals as much data as possible

#98

Post by interpol_p »

I don't understand why Chrome even does up-front permissions.

iOS got this right from the start: ask on the first attempted access of the gated resource, allow the user to grant the permission once or on an ongoing basis, respect the choice. Don't allow permission prompt spam.

Even Android recently moved to this model from up-front permissions, so Google is aware of it.

Re: Let's build a Chrome extension that steals as much data as possible

#99

Post by dogecoinbase »

metadat wrote: post #66
jszymborski wrote: post #44

Earlier quoted context omitted.

Are we certain that they are motivated to do so? Google doesn't strike me as a company committed to user privacy.

There is no company on earth with a larger privacy organization than Google. Edit: @dogecoinbase: What you propose is a shallow and dismissive analysis of the oversimplicative variety. Please put in a little more effort before derailing an otherwise thoughtful conversation.

The lesson, then, appears to be that size of privacy organization does not have a correlated effect on effectiveness.

Re: Let's build a Chrome extension that steals as much data as possible

#100

Post by dcow »

ClumsyPilot wrote: post #92
dcow wrote: post #80

Earlier quoted context omitted.

So hopefully the Chrome store review process is the nanny they need. The only thing that has permission to read and modify website data on my browsers is my password manager. I trust it. Without that permission it could not operate and provide me immense value. Yes, I would be hosed if it got pwned. It's a calculated risk on my part. One cannot live in a world where we have the benefits of browser extensions and also…

> hopefully the Chrome store review process is the nanny they need. This is very disrespectrull. When you supply exhaustive documentation of your software, how it works, what it does, to users, then you can mock them.

What are you talking about? I'm not mocking anybody. We have app store reviews because it's a known fact that not all users read or care about permissions. My point is simply that those safeguards exist for those users and they seem to be working rather well.
Post reply on HN