Google purges bad extensions from Chrome • Hacker News Board

Re: Google purges bad extensions from Chrome

#91

Post by TazeTSchnitzel » Thu, Apr 09, 2015, 7:43 PM UTC

mmahemoff wrote: post #12

TazeTSchnitzel wrote: post #7

Earlier quoted context omitted.

Sounds like Chrome's "security model" for extensions is just as awful as Android? Large, sweeping permissions categories rather than fine-grained control, and all-or-nothing acceptance.

Pretty much the same, which is different to general websites, which do on-demand permissions (as with iOS model). Chrome extensions can request only access to specific URL regex's, so they can be fine-grained about location, but the actual permissions tend to be coarse-grained. And as a user, you can't change the URL regex (that's some low-hanging fruit right there - users should be able to edit the URL pattern for a…

>Pretty much the same, which is different to general websites, which do on-demand permissions (as with iOS model).

Websites are different probably because it wasn't Google who designed their model, thankfully.

Re: Google purges bad extensions from Chrome

#92

Post by ocdtrekkie » Fri, Apr 10, 2015, 2:08 PM UTC

username223 wrote: post #82

ocdtrekkie wrote: post #69

Earlier quoted context omitted.

A good example of Vosteran New Tab. Almost two million users, none or near none of which are consensual users. Nobody I've ever uninstalled that from ever intended to install it. It hijacks your new tab page and search. Interestingly enough, Vosteran also produces a rogue fork of Chrome which makes Vosteran's own search/ad platform built-in and unavoidable. Said rogue fork is also installed without users' permission.…

Hm, let's take a look at Vosteran. From Wikipedia[1]: "Vosteran is a browser hijacker that changes a browser's home page and default search provider to vosteran.com. This infection is essentially distributed bundled with other third-party applications. Vosteran carries the PUP virus. The identity of Vosteran is protected by privacyprotect.org from Australia." Okay, so it's malware. Let's check out their webpage[2]! H…

And Google has received reports for it, but clearly thinks there's nothing wrong with it being there.

Re: Google purges bad extensions from Chrome

#93

Post by james-skemp » Tue, Apr 14, 2015, 8:09 PM UTC

unreal37 wrote: post #90

james-skemp wrote: post #76

Earlier quoted context omitted.

Actually I think the answer is yes. Or at least they're disabled. I forget the name but I had one that allowed for a custom new tab page. It had opt-out ads, but I otherwise loved it. It kept getting disabled after each fresh start of Chrome. Debated forking it but haven't yet. It might matter that I do have my extensions sync between machines. Extension is eventually disabled on the others as well. EDIT: "This exten…

Hmm, disabling with a notice is not a bad middle-ground actually. For the worst offenders.

It's a horrible middle-ground. Google definitely dropped the ball with alerting users of a possible breach. If there's strong evidence a plugin was capturing and using credentials I need to know to change credentials.