3 ms·

We should never have to read a title "disable immediately" by a developer. In a news article. That is not how this should be distributed, in case the original

We should never have to read a title "disable immediately" by a developer. In a news article. That is not how this should be distributed, in case the original developer is the one distributing the news. Instead, Google should generate an emergency disable code that a developer can put into a simple web form from anywhere in the world, even if the developer has been locked out of every one of their accounts, which immediately centrally disables that extension. How it should work. Parts. 1. "revocation code generation" and explanation. Text like: "this is a secret revocation code. Anyone who learns it can immediately disable your extension. Keep it secure and separate from all of your production systems. You will be able to use it even if locked out of all other acccess." 2. A web form people can submit revocation codes to, from anywhere with Internet access. The code should be very high-entropy and generated by Google. However, it should not have ambiguous characters like 1 and capital I. I personally would generate it using a dicewords-like wordlist. Also, I personally would ensure it had approximately 384 bits of total entropy of which one third is a recovery checksum. This enables the developer to write many words down wrong and still be able to disable their extension. In case the recovery record/checksum portion were used, I would offer the user the result "You appeared to have made a mistake which we could correct. Is this the correct disable key?" then show the corrected version. However, this last idea seems to be beyond the state of cryptography worldwide (i.e. for some reason I have written something that exceeds best practices worldwide, like I'm from the future or something), so I understand if Google's cryptographers don't implement this part. The above seems a bit grandiose of me so here is the comment where I first wrote about this: https://news.ycombinator.com/item?id=14571414 https://news.ycombinator.com/item?id=14571414

Animats 9y ago
We should never have to read a title "disable immediately" by a developer. In a news article. If you want to change that, start contacting reporters from mainstream media. If this hits the New York Times or the Wall Street Journal, or at least Techdirt, Google might notice.
- logicallee 9y ago
  Google is staffed by geniuses who also read HN and I feel it is sufficient that I suggested one possible correct solution here on HN. I am sure they'll introduce some solution to this problems. (I mean some way for them to disable compromised extensions centrally.) I am not personally an extension developer and don't run many.
  - likpok 9y ago
    The people you need to convince is Google management, so that they prioritize this over everything else on the roadmap. One easy way to do that from outside is to make it actually a priority, by making it a PR issue. Otherwise it turns into one of those perennial 'things we want to do' that never beats out the critical items on the roadmap.
    - logicallee 9y ago
      can you give a source for this insight? tell me more. It does explain so much. for example all this work was put into a ridiculous, animated, moving, flashing new gmail sign-in page that was pre-announced for weeks (our sign-in page is changing!) and after all that work does not include even seven and a half minutes worth of improvement by a developer. For example, I had to laugh and laugh after I realized it wasn't accepting my password because my caps lock was on. I would expect a popup warning if you have your caps lock turned on while typing. Because, you know, that is one of literally like 3 things you can do to improve a sign-in page that is that dynamic and moving and flashing. There's just not much to improve. All that flash and it doesn't do anything at all. Your comment gives a lot of insight as to why so I would like to understand this cultural shift. how does management work at Google now?
stordoff 9y ago
How would you handle exposed disable codes (say if a person who had access to it leaves the company)? There are presumably situations where revocation of the code would be needed, but that seems difficult to implement without also opening a window for the attacker to use: * instant revocation -> attacker will just revoke the code * delayed revocation where the code remains usable for some period -> accidental exposure is irrecoverable Maybe it's viable as an option (extension owner takes on the risk of properly managing the secret, knowing it can't be revoked easily).
- logicallee 9y ago
  We are competing with publishing "if you're my user, disable my extension." Revocation codes should revoke. A malicious employee or compromised gmail account should be able to disable an extension, yes. The developer should then have to work to reinstate it. Extensions are not part of the core Chrome experience. You are asking: "As a user, are you okay with Chrome extensions being disabled by Google if its developer had their revoke key compromised?" Nobody would say "no". Compare: "as a user, are you okay with Microsoft Windows locking and not booting, in case Microsoft's internal revoke key experienced a security issue?" (until Microsoft issues an update which unlocks it again.) Most people would not want that, because people need to finish working on their things in this scenario. (Of course some ultra secure installations might want that, but most wouldn't.) The difference is that these are small, third-party developers, working on extensions, not the core functionality. I hope this answers your question regarding how I personally would handle exposed codes. However, I am not an extension developer or heavy extension user! I am not saying this is the only solution.
IncRnd 9y ago
That is a good start but isn't sufficient. Many browsers exist on networks that are airgapped or are off of the Internet for extended periods of time. Plus, there are regulations or policies in many places that forbid this type of action.
- logicallee 9y ago
  Are we talking about the same thing? Chrome? Chrome literally auto-updates.
  - IncRnd 9y ago
    My point is that Chrome cannot always auto-update for all installations. From that standpoint I made the comment that an Internet based revocation code may not be sufficient, and disclosures/notifications will still need to be monitored by administrators.
    - logicallee 9y ago
      orgs running such ridiculous setups can monitor revokes coming over the wire from google and selectively apply them themselves, if they just care about their busy-work jobs sitting reading security bulletins. I don't really care about the security of their made-up non-jobs and google shouldn't either. they can do what they like.

Animats 9y ago

We should never have to read a title "disable immediately" by a developer. In a news article. If you want to change that, start contacting reporters from mainstream media. If this hits the New York Times or the Wall Street Journal, or at least Techdirt, Google might notice.

logicallee 9y ago
Google is staffed by geniuses who also read HN and I feel it is sufficient that I suggested one possible correct solution here on HN. I am sure they'll introduce some solution to this problems. (I mean some way for them to disable compromised extensions centrally.) I am not personally an extension developer and don't run many.
- likpok 9y ago
  The people you need to convince is Google management, so that they prioritize this over everything else on the roadmap. One easy way to do that from outside is to make it actually a priority, by making it a PR issue. Otherwise it turns into one of those perennial 'things we want to do' that never beats out the critical items on the roadmap.
  - logicallee 9y ago
    can you give a source for this insight? tell me more. It does explain so much. for example all this work was put into a ridiculous, animated, moving, flashing new gmail sign-in page that was pre-announced for weeks (our sign-in page is changing!) and after all that work does not include even seven and a half minutes worth of improvement by a developer. For example, I had to laugh and laugh after I realized it wasn't accepting my password because my caps lock was on. I would expect a popup warning if you have your caps lock turned on while typing. Because, you know, that is one of literally like 3 things you can do to improve a sign-in page that is that dynamic and moving and flashing. There's just not much to improve. All that flash and it doesn't do anything at all. Your comment gives a lot of insight as to why so I would like to understand this cultural shift. how does management work at Google now?

stordoff 9y ago

How would you handle exposed disable codes (say if a person who had access to it leaves the company)? There are presumably situations where revocation of the code would be needed, but that seems difficult to implement without also opening a window for the attacker to use: * instant revocation -> attacker will just revoke the code * delayed revocation where the code remains usable for some period -> accidental exposure is irrecoverable Maybe it's viable as an option (extension owner takes on the risk of properly managing the secret, knowing it can't be revoked easily).

logicallee 9y ago
We are competing with publishing "if you're my user, disable my extension." Revocation codes should revoke. A malicious employee or compromised gmail account should be able to disable an extension, yes. The developer should then have to work to reinstate it. Extensions are not part of the core Chrome experience. You are asking: "As a user, are you okay with Chrome extensions being disabled by Google if its developer had their revoke key compromised?" Nobody would say "no". Compare: "as a user, are you okay with Microsoft Windows locking and not booting, in case Microsoft's internal revoke key experienced a security issue?" (until Microsoft issues an update which unlocks it again.) Most people would not want that, because people need to finish working on their things in this scenario. (Of course some ultra secure installations might want that, but most wouldn't.) The difference is that these are small, third-party developers, working on extensions, not the core functionality. I hope this answers your question regarding how I personally would handle exposed codes. However, I am not an extension developer or heavy extension user! I am not saying this is the only solution.

IncRnd 9y ago

That is a good start but isn't sufficient. Many browsers exist on networks that are airgapped or are off of the Internet for extended periods of time. Plus, there are regulations or policies in many places that forbid this type of action.

logicallee 9y ago
Are we talking about the same thing? Chrome? Chrome literally auto-updates.
- IncRnd 9y ago
  My point is that Chrome cannot always auto-update for all installations. From that standpoint I made the comment that an Internet based revocation code may not be sufficient, and disclosures/notifications will still need to be monitored by administrators.
  - logicallee 9y ago
    orgs running such ridiculous setups can monitor revokes coming over the wire from google and selectively apply them themselves, if they just care about their busy-work jobs sitting reading security bulletins. I don't really care about the security of their made-up non-jobs and google shouldn't either. they can do what they like.