4 ms·

How can I trust that this extension, which has access to every page I visit, doesn't steal my data? How can I trust that if someone else takes over the project

How can I trust that this extension, which has access to every page I visit, doesn't steal my data? How can I trust that if someone else takes over the project and releases an update, that my data is still secure? Looks great, but I'm just so skeptical of browser extensions now.

modzu 8y ago
the need for trust applies to any software you install. this is usually just based on reputation when you can't verify the quality and integrity of the source itself (as is often the case) that said, i had the same concerns so i wrote my own :) the source code is intentionally very short and simple, so it should be extremely clear what it is doing: https://github.com/conceptualspace/nightlight https://github.com/conceptualspace/nightlight
spurgu 8y ago
Install the extension (in a throwaway Chrome profile), review the code, then repackage it (small modifications needed to package.json) and install it in developer mode. And/or put it up as a repo if you wish (and license allows it).
alexanderby 8y ago
Firefox add-ons pass full source code review before the submission after the Stylish incident. Safari extensions also pass manual review, Apple asks developer to send an ID card photo. Not sure about Chrome, you have to simply trust me, the code is not obfuscated and you can always locate the files and see what the extension does in your browser. Google recently announced some security changes https://blog.chromium.org/2018/10/trustworthy-chrome-extensions-by-default.html https://blog.chromium.org/2018/10/trustworthy-chrome-extensi...
- anewguy9900 8y ago
  to be less disingenuous, the review process seems to be limited to looking for specific known attack vectors, rather than a full review or evaluation of the sourcecode (which would be impractical). that said, yes, someone at mozilla does at least eyeball it
- gnode 8y ago
  > Apple asks developer to send an ID card photo. To me this sounds like the most vital thing to improve trust. Having browser developers review all the source code in detail is unrealistic, and even then, won't defeat underhanded programming (is it a bug or a deliberate vulnerability?). Legal accountability combined with auditability at least provide a deterrent to publishing malicious software.
  - stephenmm 8y ago
    Yah I am sure hardcore hackers are giving up the gig b/c they need a PHOTO of an ID! And now the ones who are legitimate have to trust a company with their IDs? This seems like a VERY weak stop-gap measure to a very difficult problem.
- kristofferR 8y ago
  Is that really true? I was really alarmed when this extension requested access to all websites and added a ton of obfuscated code with the latest version for no apparent reason: https://addons.mozilla.org/en-US/firefox/addon/restore-old-theme-of-youtube/ https://addons.mozilla.org/en-US/firefox/addon/restore-old-t... I've reported it, but nothing seems to happen.
  - rickycook 8y ago
    yes. to submit to firefox you’re required to provide them with the source code, but you may transpile it so long as they can verify that it’s the same AFAIK?
- 21 8y ago
  DO they also inspect the hundreds of npm packages an extension might use?
- saagarjha 8y ago
  > Apple asks developer to send an ID card photo Is this something specific to Safari extensions? I have never heard of anyone having to do this.
miles 8y ago
To his credit, the author has released the source for the Chrome and Firefox versions: https://github.com/darkreader/darkreader https://github.com/darkreader/darkreader However, I posed the same question in the MAS about the closed-source Safari version, which requires full access to webpage contents ("Can read sensitive information from webpages, including passwords, phone numbers, and credit cards on all webpages") and browsing history ("Can see when you visit all webpages"). The author's response boiled down to "trust me" and "trust Apple's review process". Shortly after mentioning recent headlines highlighting weaknesses in Apple's review process ("More malicious apps found in Mac App Store that are stealing user data" https://appleinsider.com/articles/18/09/07/more-malicious-apps-found-in-mac-app-store-that-are-stealing-user-data https://appleinsider.com/articles/18/09/07/more-malicious-ap... , "Mac App Store apps are stealing user data" https://blog.malwarebytes.com/threat-analysis/2018/09/mac-app-store-apps-are-stealing-user-data/ https://blog.malwarebytes.com/threat-analysis/2018/09/mac-ap... , etc), Apple deleted the review, but a cached version can be found here: http://www.gadgeteur.com/2018/11/26/dark-reader-for-safari-aliaksandr-shutau/ http://www.gadgeteur.com/2018/11/26/dark-reader-for-safari-a... and here: https://pastebin.com/DxsWcaj7 https://pastebin.com/DxsWcaj7 . EDIT: Other than the permissions issue (which was unfortunately a show-stopper for me), I was very pleased with the Safari extension's functionality; it could be a good fit for those who restrict their web browsing to non-sensitive sites or who can remember to disable it when necessary.
- atestu 8y ago
  But there's no proof that the published source code is the source code of the extension! You still have to just trust them
  - keehun 8y ago
    You can always load your own from source.
    - anyzen 8y ago
      Sure - but do you? Does anyone? EDIT: a better solution would be if the store itself allowed you to inspect the source that went into building the plugin. Then you would only need to trust the store itself, which you already do (when you trust the browser).
deleted 8y ago
[deleted]
balibebas 8y ago
That's a valid concern. Certainly an easy way to Target an audience to get at a rich set of data. But who's to say Chromium isn't doing this already anyway?

modzu 8y ago

the need for trust applies to any software you install. this is usually just based on reputation when you can't verify the quality and integrity of the source itself (as is often the case) that said, i had the same concerns so i wrote my own :) the source code is intentionally very short and simple, so it should be extremely clear what it is doing: https://github.com/conceptualspace/nightlight https://github.com/conceptualspace/nightlight

spurgu 8y ago

Install the extension (in a throwaway Chrome profile), review the code, then repackage it (small modifications needed to package.json) and install it in developer mode. And/or put it up as a repo if you wish (and license allows it).

alexanderby 8y ago

Firefox add-ons pass full source code review before the submission after the Stylish incident. Safari extensions also pass manual review, Apple asks developer to send an ID card photo. Not sure about Chrome, you have to simply trust me, the code is not obfuscated and you can always locate the files and see what the extension does in your browser. Google recently announced some security changes https://blog.chromium.org/2018/10/trustworthy-chrome-extensions-by-default.html https://blog.chromium.org/2018/10/trustworthy-chrome-extensi...

anewguy9900 8y ago
to be less disingenuous, the review process seems to be limited to looking for specific known attack vectors, rather than a full review or evaluation of the sourcecode (which would be impractical). that said, yes, someone at mozilla does at least eyeball it
gnode 8y ago
> Apple asks developer to send an ID card photo. To me this sounds like the most vital thing to improve trust. Having browser developers review all the source code in detail is unrealistic, and even then, won't defeat underhanded programming (is it a bug or a deliberate vulnerability?). Legal accountability combined with auditability at least provide a deterrent to publishing malicious software.
- stephenmm 8y ago
  Yah I am sure hardcore hackers are giving up the gig b/c they need a PHOTO of an ID! And now the ones who are legitimate have to trust a company with their IDs? This seems like a VERY weak stop-gap measure to a very difficult problem.
kristofferR 8y ago
Is that really true? I was really alarmed when this extension requested access to all websites and added a ton of obfuscated code with the latest version for no apparent reason: https://addons.mozilla.org/en-US/firefox/addon/restore-old-theme-of-youtube/ https://addons.mozilla.org/en-US/firefox/addon/restore-old-t... I've reported it, but nothing seems to happen.
- rickycook 8y ago
  yes. to submit to firefox you’re required to provide them with the source code, but you may transpile it so long as they can verify that it’s the same AFAIK?
21 8y ago
DO they also inspect the hundreds of npm packages an extension might use?
saagarjha 8y ago
> Apple asks developer to send an ID card photo Is this something specific to Safari extensions? I have never heard of anyone having to do this.

miles 8y ago

To his credit, the author has released the source for the Chrome and Firefox versions: https://github.com/darkreader/darkreader https://github.com/darkreader/darkreader However, I posed the same question in the MAS about the closed-source Safari version, which requires full access to webpage contents ("Can read sensitive information from webpages, including passwords, phone numbers, and credit cards on all webpages") and browsing history ("Can see when you visit all webpages"). The author's response boiled down to "trust me" and "trust Apple's review process". Shortly after mentioning recent headlines highlighting weaknesses in Apple's review process ("More malicious apps found in Mac App Store that are stealing user data" https://appleinsider.com/articles/18/09/07/more-malicious-apps-found-in-mac-app-store-that-are-stealing-user-data https://appleinsider.com/articles/18/09/07/more-malicious-ap... , "Mac App Store apps are stealing user data" https://blog.malwarebytes.com/threat-analysis/2018/09/mac-app-store-apps-are-stealing-user-data/ https://blog.malwarebytes.com/threat-analysis/2018/09/mac-ap... , etc), Apple deleted the review, but a cached version can be found here: http://www.gadgeteur.com/2018/11/26/dark-reader-for-safari-aliaksandr-shutau/ http://www.gadgeteur.com/2018/11/26/dark-reader-for-safari-a... and here: https://pastebin.com/DxsWcaj7 https://pastebin.com/DxsWcaj7 . EDIT: Other than the permissions issue (which was unfortunately a show-stopper for me), I was very pleased with the Safari extension's functionality; it could be a good fit for those who restrict their web browsing to non-sensitive sites or who can remember to disable it when necessary.

atestu 8y ago
But there's no proof that the published source code is the source code of the extension! You still have to just trust them
- keehun 8y ago
  You can always load your own from source.
  - anyzen 8y ago
    Sure - but do you? Does anyone? EDIT: a better solution would be if the store itself allowed you to inspect the source that went into building the plugin. Then you would only need to trust the store itself, which you already do (when you trust the browser).

deleted 8y ago

[deleted]

balibebas 8y ago

That's a valid concern. Certainly an easy way to Target an audience to get at a rich set of data. But who's to say Chromium isn't doing this already anyway?