6 ms·

On Web Extensions shortcomings and their impact on add-on security

108 points by stesch 9y ago

paulryanrogers 9y ago
Secure access to the clipboard is probably going to require a permission prompt. Otherwise it seems too risky.
- tyingq 9y ago
  Already out of the bag. You can manipulate the clipboard now from extensions.
  - fabrice_d 9y ago
    And behind a permission: see "Clipboard access" in https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/permissions https://developer.mozilla.org/en-US/Add-ons/WebExtensions/ma...
klondike_ 9y ago
I always thought it was bizarre that WebExtensions had no UI framework. Injecting stuff into a website seems like a poor solution
- deleted 9y ago
  [deleted]
- tyingq 9y ago
  There is a bit of separate ui, both for the config page and the div (popup panel) that pops when you click the extension button. What were you looking for instead?
  - singularity2001 9y ago
    the problem with the Pop-Up panel is that you cannot open it programmatically
- revelation 9y ago
  That's all these extensions are. Injecting stuff into websites, usually all of them. I needed a Chrome extension after they inexplicably broke backspace navigating backwards (it literally has the same icon as the backwards UI button). That extension needs to inject a script on every. single. website. It's like Google is spending millions upon dollars building convoluted sandboxing security features, and there is a place for that in protecting us from code execution. But then everyone is pushing for "apps on the web" and here we are with random extensions that can do everything. And they do: lots of them make money through selling your browsing history.
  - nothrabannosir 9y ago
    > they inexplicably broke backspace navigating backwards Hallelujah, praise the lord! He is righteous and he is Good. Finally. I cannot count the number of times I accidentally hit tab in a form text input, backspace, and lose the entire form. Of course it’s built in JS so state isn’t saved by browser on going forward. Because why use standards? It’s 2017, ain’t nobody got time for functionality. It got so bad I now automatically open a text editor to write the text in, first. This was a bug bear of epic proportions. Good riddance.
    - kuschku 9y ago
      That was the standard navigation method of every webbrowser for decades, not a bug.
      - kelnos 9y ago
        Just because something is and has been standard for a long time, it doesn't make it good UX.
      - merlish 9y ago
        It sucks that it's gone - it took me months to retrain my muscle memory to stop using backspace - but I've definitely accidentally navigated back from a form before. I've adjusted. It's a hard decision but imo the right one. Future generations shouldn't have to deal with this. To anyone reading who needs a keyboard-based substitute: Alt+Left Arrow.
- eejdoowad 9y ago
  An extension overlay API would have saved me so much pain when building Saka (saka.io). There are two options for injecting UI today: 1. Inject UI directly into the document 2. Inject an iframe containing the UI into the document Both rely on manipulating the document, which can be used to fingerprint users. Most developers opt for 1 because it requires no setup and lets the content script synchronously access the UI. 2 is needed when the injected UI containing sensitive information. I'd like an extension overlay API that lets you inject: 1. UI local to the tab 2. UI that persists across all tabs In a brief #webextensions IRC discussion, I was told an overlay API isn't viable for a number of reasons, one of which is multiple extensions may conflict.
  - hawski 9y ago
    Did they tell you how the extensions may conflict? I don't understand what it means. Couldn't it work like e.g. context menu does already for extension icon?
    - eejdoowad 9y ago
      What happens when two extensions try to place a widget in the same location? Chaos. Not that the status quo is any better. Interestingly, Firefox's sidebar API only allows a single sidebar to be shown.
      - drdaeman 9y ago
        I still don't get it. What problem they're trying to avoid? It's exactly the same if two extensions would currently try to manipulate the page by adding a frame (or, worse, a <div> with non-isolated UI) to the same location. The only difference is, with out-of-page widgets (e.g. overlay regions or popouts), they won't be visible in the page's DOM.
        eejdoowad 9y ago
        My understanding is that if they do implement an API, they want it to be better than the status quo, not the same.
Feniks 9y ago
The only shortcoming is the user. Only install ad ons that you know and understand. And only from the official project source. Or you can (correctly) assume users are a danger to themselves and coddle them. The Google Chrome/Apple/Microsoft philosophy.
- rco8786 9y ago
  History has shown us that users are overwhelmingly a danger to themselves when it comes to this sort of thing. Pretending otherwise is not a good strategy.
  - Feniks 9y ago
    Oh I know. People are why we can't have nice things. Like add ons. Already you can't install the latest versions unless Mozilla approves them. I just prefer freedom, including the freedom to make mistakes.
- benologist 9y ago
  You can't just blame the user when bad actors actively seek to purchase and re-purpose browser extensions, open source projects, downloaded software etc into malware. It will be our turn when they figure out how to compromise NPM etc modules profitably.

108 points by stesch 9y ago

paulryanrogers 9y ago

Secure access to the clipboard is probably going to require a permission prompt. Otherwise it seems too risky.

tyingq 9y ago
Already out of the bag. You can manipulate the clipboard now from extensions.
- fabrice_d 9y ago
  And behind a permission: see "Clipboard access" in https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/permissions https://developer.mozilla.org/en-US/Add-ons/WebExtensions/ma...

klondike_ 9y ago

I always thought it was bizarre that WebExtensions had no UI framework. Injecting stuff into a website seems like a poor solution

deleted 9y ago
[deleted]
tyingq 9y ago
There is a bit of separate ui, both for the config page and the div (popup panel) that pops when you click the extension button. What were you looking for instead?
- singularity2001 9y ago
  the problem with the Pop-Up panel is that you cannot open it programmatically
revelation 9y ago
That's all these extensions are. Injecting stuff into websites, usually all of them. I needed a Chrome extension after they inexplicably broke backspace navigating backwards (it literally has the same icon as the backwards UI button). That extension needs to inject a script on every. single. website. It's like Google is spending millions upon dollars building convoluted sandboxing security features, and there is a place for that in protecting us from code execution. But then everyone is pushing for "apps on the web" and here we are with random extensions that can do everything. And they do: lots of them make money through selling your browsing history.
- nothrabannosir 9y ago
  > they inexplicably broke backspace navigating backwards Hallelujah, praise the lord! He is righteous and he is Good. Finally. I cannot count the number of times I accidentally hit tab in a form text input, backspace, and lose the entire form. Of course it’s built in JS so state isn’t saved by browser on going forward. Because why use standards? It’s 2017, ain’t nobody got time for functionality. It got so bad I now automatically open a text editor to write the text in, first. This was a bug bear of epic proportions. Good riddance.
  - kuschku 9y ago
    That was the standard navigation method of every webbrowser for decades, not a bug.
    - kelnos 9y ago
      Just because something is and has been standard for a long time, it doesn't make it good UX.
    - merlish 9y ago
      It sucks that it's gone - it took me months to retrain my muscle memory to stop using backspace - but I've definitely accidentally navigated back from a form before. I've adjusted. It's a hard decision but imo the right one. Future generations shouldn't have to deal with this. To anyone reading who needs a keyboard-based substitute: Alt+Left Arrow.
eejdoowad 9y ago
An extension overlay API would have saved me so much pain when building Saka (saka.io). There are two options for injecting UI today: 1. Inject UI directly into the document 2. Inject an iframe containing the UI into the document Both rely on manipulating the document, which can be used to fingerprint users. Most developers opt for 1 because it requires no setup and lets the content script synchronously access the UI. 2 is needed when the injected UI containing sensitive information. I'd like an extension overlay API that lets you inject: 1. UI local to the tab 2. UI that persists across all tabs In a brief #webextensions IRC discussion, I was told an overlay API isn't viable for a number of reasons, one of which is multiple extensions may conflict.
- hawski 9y ago
  Did they tell you how the extensions may conflict? I don't understand what it means. Couldn't it work like e.g. context menu does already for extension icon?
  - eejdoowad 9y ago
    What happens when two extensions try to place a widget in the same location? Chaos. Not that the status quo is any better. Interestingly, Firefox's sidebar API only allows a single sidebar to be shown.
    - drdaeman 9y ago
      I still don't get it. What problem they're trying to avoid? It's exactly the same if two extensions would currently try to manipulate the page by adding a frame (or, worse, a <div> with non-isolated UI) to the same location. The only difference is, with out-of-page widgets (e.g. overlay regions or popouts), they won't be visible in the page's DOM.
      - eejdoowad 9y ago
        My understanding is that if they do implement an API, they want it to be better than the status quo, not the same.

Feniks 9y ago

The only shortcoming is the user. Only install ad ons that you know and understand. And only from the official project source. Or you can (correctly) assume users are a danger to themselves and coddle them. The Google Chrome/Apple/Microsoft philosophy.

rco8786 9y ago
History has shown us that users are overwhelmingly a danger to themselves when it comes to this sort of thing. Pretending otherwise is not a good strategy.
- Feniks 9y ago
  Oh I know. People are why we can't have nice things. Like add ons. Already you can't install the latest versions unless Mozilla approves them. I just prefer freedom, including the freedom to make mistakes.
benologist 9y ago
You can't just blame the user when bad actors actively seek to purchase and re-purpose browser extensions, open source projects, downloaded software etc into malware. It will be our turn when they figure out how to compromise NPM etc modules profitably.