5 ms·

The issue with Chrome extensions, just like with android apps, is that people never check the permissions and just click OK. Extensions make it even easier to

The issue with Chrome extensions, just like with android apps, is that people never check the permissions and just click OK. Extensions make it even easier to install them, though, just need to redirect a user. I've also come upon some spam sites that try to get you to install extensions with annoying alerts that prevent you from closing the page, playing a recorded message "To close the page, just install the XX extension". The only remedy is good screening in the app stores. Actually, for apps/extensions installed from the official repository, I would be OK with remote removal. This would probably spark an outcry from certain parties, but as long as it does not extend to manually installed extensions it's acceptable to me.

e40 10y ago
Doesn't the keyboard command to close the tab/window work in these cases? Thankfully, I've never encountered such BS.
ungzd 10y ago
Most useful extensions require access to all sites so permissions system isn't very helpful at all.
- leesalminen 10y ago
  I agree. I think that there could be more finely grained permissions. I basically have so sigh and resign myself anytime I want an extension badly enough.
- medmunds 10y ago
  > Most useful extensions require access to all sites That may be true for "always-running" extensions like ad blockers, but there's another useful class of "on-demand" extensions that don't need full access -- think Evernote or Pinboard clippers. They only need access to the one site you're looking at, and only when you invoke them. Chrome added a tightly-scoped "activeTab" permission a few years back, for exactly this case. Before that, on-demand extensions did need all-sites access, and unfortunately a lot of extensions (and tutorials and example code) haven't been updated. https://developer.chrome.com/extensions/activeTab https://developer.chrome.com/extensions/activeTab
kjaer 10y ago
I was corrected on Twitter by Will Harris, who works on Chrome security, and it turns out that remote removal actually is in place for extensions that have been blacklisted from the official repository. I've added a small addendum correcting this.
billmalarky 10y ago
I was under the impression all chrome extensions had to go through the chrome web store now. I don't think you can manually install them anymore (outside of installing in developer mode). I could be wrong though.
- nkozyra 10y ago
  This is true. They've actually made it difficult to do even with Developer Mode active, which is probably a net win.
  - bad_user 10y ago
    Obviously there's no net win, given that TFA is talking about extensions distributed on Chrome's Web Store, infecting over 130000 users before it was banned. That kind of proves the walled garden is pretty ineffective, the only accomplishment being the lock-in of users to Google's Web Store as the sole distribution mechanism, thus keeping Chrome a proprietary platform, in spite of the open-source nature of its code. The only real advantage of the web store is the ability to uninstall banned extensions. But that could have been accomplished just as well by digital signing of the distributed packages.
    - martinald 10y ago
      Yes, and Web Store only has problems if you want to keep stuff internal ('enterprise' distribution). This does seem like a total mess.
  - noinsight 10y ago
    It's so annoying - on Windows, you can't even prevent Chrome from complaining every time you start it up when you have Developer Mode (and unpacked extensions) active. On Linux it doesn't, fortunately. I just want to use my own extension and it's not something that others would benefit from. I even tried to put my extension up on the Web Store just because of this but I gave up once my (obviously valid) credit card got rejected. Now I just live with it.
- 10y ago
zeta0134 10y ago
I remain baffled that alerts in modern browsers are still handled with an OS-level modal dialog that prevents interaction with the browser's interface elements. Couldn't the alert instead be rendered as an overlay to the page itself, be modal to just that tab, and not disable the browser Chrome? This would make it much harder for pages to "trap" users with alert spam. The existing policies (don't allow this page to create more dialogs -> page instantly redirects to itself to reset the flag) aren't doing a good enough job.
- heinrich5991 10y ago
  That's at least what Firefox does.
- atomwaffel 10y ago
  > Couldn't the alert instead be rendered as an overlay to the page itself, be modal to just that tab, and not disable the browser Chrome? Firefox and Safari do exactly that. > The existing policies (don't allow this page to create more dialogs -> page instantly redirects to itself to reset the flag) aren't doing a good enough job. Does that work? I've never seen any pages that circumvent alert blocking like that, and I'd have imagined that any sensible implementation would disable alerts for the entire session (or at least a few minutes).
  - zeta0134 10y ago
    I don't know what the exact exploit of the behavior is, but I've observed it on several "infected" computers while working in tech support. I've seen it on Internet Explorer, Microsoft Edge, Google Chrome, and some variation of it on Safari, all of which I was only able to remedy by forcefully closing the browser using the task manager or equivalent. Truthfully, I have not actually observed this behavior on Firefox, and I'm quite thankfully no longer in the business of providing technical support to personal computer users, so hopefully I never will.
- greggman 10y ago
  Firefox and Safari already don't use the OS modal dialog and Chrome is working on it https://docs.google.com/document/d/1wtV5rmLhbf1OZkbg7crtCt6h1mMtig_ctTQt3BLLEIU/edit?pref=2&pli=1 https://docs.google.com/document/d/1wtV5rmLhbf1OZkbg7crtCt6h...
firewalkwithme 10y ago
I do read the permissions for Android apps - they all want permissions to everything. For no good reason. Enter apathy
- netsharc 10y ago
  BlackBerry allowed fine-grained permissions, and this was 7-8 years ago. But rooted phone, Xposed and Xprivacy brings this feature to Android.
- rogerbinns 10y ago
  There is a very good reason. Apps can auto-update (the default) if they haven't added permissions over the previous versions. Consequently it is very common practise to add every permission you can conceive of using at the beginning, versus having to support a large body of users who haven't updated your app in ages. In theory some very recent barely used newer Android version fixes this by asking for permissions at first use of them (eg first time using camera or first time accessing contacts). In practise this doesn't matter for several years.

e40 10y ago

Doesn't the keyboard command to close the tab/window work in these cases? Thankfully, I've never encountered such BS.

ungzd 10y ago

Most useful extensions require access to all sites so permissions system isn't very helpful at all.

leesalminen 10y ago
I agree. I think that there could be more finely grained permissions. I basically have so sigh and resign myself anytime I want an extension badly enough.
medmunds 10y ago
> Most useful extensions require access to all sites That may be true for "always-running" extensions like ad blockers, but there's another useful class of "on-demand" extensions that don't need full access -- think Evernote or Pinboard clippers. They only need access to the one site you're looking at, and only when you invoke them. Chrome added a tightly-scoped "activeTab" permission a few years back, for exactly this case. Before that, on-demand extensions did need all-sites access, and unfortunately a lot of extensions (and tutorials and example code) haven't been updated. https://developer.chrome.com/extensions/activeTab https://developer.chrome.com/extensions/activeTab

kjaer 10y ago

I was corrected on Twitter by Will Harris, who works on Chrome security, and it turns out that remote removal actually is in place for extensions that have been blacklisted from the official repository. I've added a small addendum correcting this.

billmalarky 10y ago

I was under the impression all chrome extensions had to go through the chrome web store now. I don't think you can manually install them anymore (outside of installing in developer mode). I could be wrong though.

nkozyra 10y ago
This is true. They've actually made it difficult to do even with Developer Mode active, which is probably a net win.
- bad_user 10y ago
  Obviously there's no net win, given that TFA is talking about extensions distributed on Chrome's Web Store, infecting over 130000 users before it was banned. That kind of proves the walled garden is pretty ineffective, the only accomplishment being the lock-in of users to Google's Web Store as the sole distribution mechanism, thus keeping Chrome a proprietary platform, in spite of the open-source nature of its code. The only real advantage of the web store is the ability to uninstall banned extensions. But that could have been accomplished just as well by digital signing of the distributed packages.
  - martinald 10y ago
    Yes, and Web Store only has problems if you want to keep stuff internal ('enterprise' distribution). This does seem like a total mess.
- noinsight 10y ago
  It's so annoying - on Windows, you can't even prevent Chrome from complaining every time you start it up when you have Developer Mode (and unpacked extensions) active. On Linux it doesn't, fortunately. I just want to use my own extension and it's not something that others would benefit from. I even tried to put my extension up on the Web Store just because of this but I gave up once my (obviously valid) credit card got rejected. Now I just live with it.
10y ago

zeta0134 10y ago

I remain baffled that alerts in modern browsers are still handled with an OS-level modal dialog that prevents interaction with the browser's interface elements. Couldn't the alert instead be rendered as an overlay to the page itself, be modal to just that tab, and not disable the browser Chrome? This would make it much harder for pages to "trap" users with alert spam. The existing policies (don't allow this page to create more dialogs -> page instantly redirects to itself to reset the flag) aren't doing a good enough job.

heinrich5991 10y ago
That's at least what Firefox does.
atomwaffel 10y ago
> Couldn't the alert instead be rendered as an overlay to the page itself, be modal to just that tab, and not disable the browser Chrome? Firefox and Safari do exactly that. > The existing policies (don't allow this page to create more dialogs -> page instantly redirects to itself to reset the flag) aren't doing a good enough job. Does that work? I've never seen any pages that circumvent alert blocking like that, and I'd have imagined that any sensible implementation would disable alerts for the entire session (or at least a few minutes).
- zeta0134 10y ago
  I don't know what the exact exploit of the behavior is, but I've observed it on several "infected" computers while working in tech support. I've seen it on Internet Explorer, Microsoft Edge, Google Chrome, and some variation of it on Safari, all of which I was only able to remedy by forcefully closing the browser using the task manager or equivalent. Truthfully, I have not actually observed this behavior on Firefox, and I'm quite thankfully no longer in the business of providing technical support to personal computer users, so hopefully I never will.
greggman 10y ago
Firefox and Safari already don't use the OS modal dialog and Chrome is working on it https://docs.google.com/document/d/1wtV5rmLhbf1OZkbg7crtCt6h1mMtig_ctTQt3BLLEIU/edit?pref=2&pli=1 https://docs.google.com/document/d/1wtV5rmLhbf1OZkbg7crtCt6h...

firewalkwithme 10y ago

I do read the permissions for Android apps - they all want permissions to everything. For no good reason. Enter apathy

netsharc 10y ago
BlackBerry allowed fine-grained permissions, and this was 7-8 years ago. But rooted phone, Xposed and Xprivacy brings this feature to Android.
rogerbinns 10y ago
There is a very good reason. Apps can auto-update (the default) if they haven't added permissions over the previous versions. Consequently it is very common practise to add every permission you can conceive of using at the beginning, versus having to support a large body of users who haven't updated your app in ages. In theory some very recent barely used newer Android version fixes this by asking for permissions at first use of them (eg first time using camera or first time accessing contacts). In practise this doesn't matter for several years.