11 ms·
Rogue extensions are the Achilles Heels of browsers, yet the ramifications aren't understood by the average user, who happily installs all sorts off addons and
by Santosh83 8y ago
Rogue extensions are the Achilles Heels of browsers, yet the ramifications aren't understood by the average user, who happily installs all sorts off addons and extensions. Frankly I'm surprised more sensitive information hasn't already been stolen/harvested all these years. This is why I run my browser with no extensions with the sole exception of uBlock Origin.
- Cthulhu_ 8y agoI wouldn't object to extensions becoming paid and verified - that is, an expert review team doing a code / security review for each update of an extension. Either paid for by the authors, or done for free by e.g. Google because they have plenty of money and they are directly impacted if their platform releases a malicious extension.
- codedokode 8y agoYou have described what antivirus companies usually do with traditional software.
- saagarjha 8y agoAntivirus companies do not have control over the primary distribution method of software.
- _red 8y ago>e.g. Google because they have plenty of money and they are directly impacted if their platform releases a malicious extension. I have some foxes for rent, perhaps you could use them to guard your henhouse.
- icebraining 8y agoGoogle already guards the henhouse, ie, they control who can be listed on the Chrome Store.
- saagarjha 8y agoThe downside to this would be that this would still be possible to bypass if users are allowed to install “unverified” extensions, but removing this feature would lead to the downsides of the App Store namely Google having full control over what their browser supports. Them being an advertising company, there are whole classes of popular extensions that directly hurt their business.
- tracker1 8y agoUnverified extensions are also a bitch now... I can't just install all my own via open-source extensions without a painful experience now in chrome. It's a mixed bag.
- codedokode 8y agoAn average user might not even know what a 'browser extension' is and what it can do. I think antivirus software should pay more attention to this kink of threat and block suspicious extensions.
- lbriner 8y agoDefine suspicious. Have you ever even seen the number of requests that Chrome itself makes to the web, tons of unrecognisable URLS. What happens when you change a feature on a proper extension? Submit a request to all the anti-virus vendors to whitelist it?
- delecti 8y agoThe funny thing is that your sole exception is an extension that gets access to everything you look at.
- scarface74 8y agoAnd that’s only because it’s not in Google’s best interest to provide a framework that allows users to install ad blockers in a way where the extension doesn’t have access to the user’s browsing. Safari’s content blocking framework provides an existence proof that it can be done. Extensions just give Safari a JSON file with regex expressions of content that should be blocked.
- ocdtrekkie 8y agoYou should mostly just assume all the browser extensions have access to everything you look at. Most do. ;) I'm similar to the parent comment but my sole extension is the EFF's Privacy Badger. Yes, I'm trusting the EFF with access to everything I view, but they are in turn, blocking tracking data from nearly everyone else. I may soon drop Privacy Badger though, Firefox's built-in tracking protection has inched closer and closer to that tier.