5 ms·

The Okta chrome extension mentioned in the article seems very cool and useful. But how do we trust the Okta chrome extension not to post all credentials to the

The Okta chrome extension mentioned in the article seems very cool and useful. But how do we trust the Okta chrome extension not to post all credentials to the developer? Even if its doing nothing shady now, in some future update?

amdavidson 8y ago
With that security model, how do you trust any extension at all? At least with this one, you can audit the source code and build it for yourself[0] 0: https://github.com/OktaSecurityLabs/passprotect-chrome https://github.com/OktaSecurityLabs/passprotect-chrome
- willvarfar 8y ago
  I once made a webpage where HNers drag-dropped their entire iphone backups. It got me thinking. http://markolson.github.io/js-sqlite-map-thing/ http://markolson.github.io/js-sqlite-map-thing/
  - crtasm 8y ago
    It decrypts their backup locally? The link to code in the footer just refreshes the page.
    - willvarfar 8y ago
      It parses an unencrypted sqlite db in their backups in client-side javascript. The whole thing is client-side javascript. But... if we'd wanted to be nasty we could have sent everything to servers we controlled. The src link stopped working when gitlab.io arrived I think https://github.com/markolson/js-sqlite-map-thing/ https://github.com/markolson/js-sqlite-map-thing/
  - ReverseCold 8y ago
    Whenever there are tools like this I usually just visit the site then unplug my ethernet/disconnect from WiFi. If it's actually client side JS it will work. I'm pretty sure this is safe, but if there's a way to defer sending an HTTP request to after the page being closed...
    - phyzome 8y ago
      If you do it from a private browsing window, maybe that would be fine. Maybe. (Otherwise the page could exfiltrate information via localstorage or something.)
    - willvarfar 8y ago
      You'd just motivate me to use client-side storage if the upload failed. Don't dare come back to the page when online! :)

amdavidson 8y ago

With that security model, how do you trust any extension at all? At least with this one, you can audit the source code and build it for yourself[0] 0: https://github.com/OktaSecurityLabs/passprotect-chrome https://github.com/OktaSecurityLabs/passprotect-chrome

willvarfar 8y ago
I once made a webpage where HNers drag-dropped their entire iphone backups. It got me thinking. http://markolson.github.io/js-sqlite-map-thing/ http://markolson.github.io/js-sqlite-map-thing/
- crtasm 8y ago
  It decrypts their backup locally? The link to code in the footer just refreshes the page.
  - willvarfar 8y ago
    It parses an unencrypted sqlite db in their backups in client-side javascript. The whole thing is client-side javascript. But... if we'd wanted to be nasty we could have sent everything to servers we controlled. The src link stopped working when gitlab.io arrived I think https://github.com/markolson/js-sqlite-map-thing/ https://github.com/markolson/js-sqlite-map-thing/
- ReverseCold 8y ago
  Whenever there are tools like this I usually just visit the site then unplug my ethernet/disconnect from WiFi. If it's actually client side JS it will work. I'm pretty sure this is safe, but if there's a way to defer sending an HTTP request to after the page being closed...
  - phyzome 8y ago
    If you do it from a private browsing window, maybe that would be fine. Maybe. (Otherwise the page could exfiltrate information via localstorage or something.)
  - willvarfar 8y ago
    You'd just motivate me to use client-side storage if the upload failed. Don't dare come back to the page when online! :)