4 ms·

Slightly offtopic but still related to web-security in general; how can I be sure about chrome extensions that I'm using are not doing malicious stuff? I think

Slightly offtopic but still related to web-security in general; how can I be sure about chrome extensions that I'm using are not doing malicious stuff? I think if a state actor or a resourceful entity wishes to steal data of users, attacking/hijacking/buying a popular chrome extension would be so much easier than attacking a CA or doing MITM over SSL, and trying to decrypt it. I've always hated the concept of certain chrome extensions having full access to all the pages I visit in the browser but sometimes its necessary. Ad blockers are way too high on the list of potential attack targets, close second would be web development extensions like editthiscookie. There needs to be a way for webpages to indicate that they don't want any external scripts running on the page. Even a setting in chrome would be really helpful. I don't want external scripts to be running on my bank website, or when I'm working with my stock exchange website. Right now I'm making do with multiple chrome profiles but that doesn't cut it. There needs to be some initiative in this regard from major browser vendors.

mehrdadn 9y ago
Yes, I agree. The possibility of a rogue extension stealing data also freaks me out. All you need is the Google account of 1 popular extension's author to be hijacked, and now the person has full control over all the credentials of every user of that extension within an hour or so. I was so concerned about this potentially ticking time bomb, in fact, that I sent an email about this to a prominent person on Chrome's security team many months ago. I did not receive a reply.
Dylan16807 9y ago
For web pages to indicate? No, that'll get attached to every terrible ad in the world.
- dpacmittal 9y ago
  Yes, that would actually do more harm than good, but no reason to not provide a setting where user can add to the list of URLs similar to what chrome is already doing for flash, notifications, location, camera etc
_nedR 9y ago
Chrome has a good permissions model that i don't think can be much improved on. An ad-blocker needs access to data on every page you visit in order to do its job. I don't really see a way around it; Thats just how the web is constructed.. You can disable 3rd party scripts on your side (Firefox has Noscript addon for that; chrome should have something similar) but that may break the website you 're visiting Workarounds : Disable add-ons in incognito mode, and conduct your important business there.. Or use a second chrome profile with no extensions for confidential stuff..
- mehrdadn 9y ago
  > Chrome has a good permissions model that i don't think can be much improved on. An ad-blocker needs access to data on every page you visit in order to do its job. I don't really see a way around it I don't imagine an ad blocker needs the ability to send data over the network. I also don't expect it should need to alter cookies or local storage, though perhaps there's a random counterexample somewhere? Most importantly of all, I think disable forced auto-update of extensions would help. It would make things a lot safer if users had control over when their extensions were updated. That way a malicious version could be taken down without having affected too many people.
- dpacmittal 9y ago
  Chrome doesn't allow extensions running on https://chrome.google.com/webstore/category/extensions https://chrome.google.com/webstore/category/extensions, which means there's already provisions in code which disallows extensions to run on certain URLs. They could just add a setting where users can add to that list of pages.

mehrdadn 9y ago

Yes, I agree. The possibility of a rogue extension stealing data also freaks me out. All you need is the Google account of 1 popular extension's author to be hijacked, and now the person has full control over all the credentials of every user of that extension within an hour or so. I was so concerned about this potentially ticking time bomb, in fact, that I sent an email about this to a prominent person on Chrome's security team many months ago. I did not receive a reply.

Dylan16807 9y ago

For web pages to indicate? No, that'll get attached to every terrible ad in the world.

dpacmittal 9y ago
Yes, that would actually do more harm than good, but no reason to not provide a setting where user can add to the list of URLs similar to what chrome is already doing for flash, notifications, location, camera etc

_nedR 9y ago

Chrome has a good permissions model that i don't think can be much improved on. An ad-blocker needs access to data on every page you visit in order to do its job. I don't really see a way around it; Thats just how the web is constructed.. You can disable 3rd party scripts on your side (Firefox has Noscript addon for that; chrome should have something similar) but that may break the website you 're visiting Workarounds : Disable add-ons in incognito mode, and conduct your important business there.. Or use a second chrome profile with no extensions for confidential stuff..

mehrdadn 9y ago
> Chrome has a good permissions model that i don't think can be much improved on. An ad-blocker needs access to data on every page you visit in order to do its job. I don't really see a way around it I don't imagine an ad blocker needs the ability to send data over the network. I also don't expect it should need to alter cookies or local storage, though perhaps there's a random counterexample somewhere? Most importantly of all, I think disable forced auto-update of extensions would help. It would make things a lot safer if users had control over when their extensions were updated. That way a malicious version could be taken down without having affected too many people.
dpacmittal 9y ago
Chrome doesn't allow extensions running on https://chrome.google.com/webstore/category/extensions https://chrome.google.com/webstore/category/extensions, which means there's already provisions in code which disallows extensions to run on certain URLs. They could just add a setting where users can add to that list of pages.