3 ms·

Thanks for the feedback. Privacy rights are meant to apply to everyone. Will check the wording of the privacy policy to make that clear. Regarding the instant

Thanks for the feedback. Privacy rights are meant to apply to everyone. Will check the wording of the privacy policy to make that clear. Regarding the instant popup, unfortunately I'm not able to keep it hidden with Drift, but wanted to make sure visitors know they can easily reach me.

reneberlin 7y ago
I would like to know more about how the scoring-system works. I think this will be added, don't hurry - but i am curious how that works in "realtime". Every second younbeloved extension can potentially turn into your enemy. And how does IT react on a match? Unplug the machine from the net? Close the browser? Turn off power? Sirenes? I love the idea of your service. But how to execute countermeasures, when the red flag is raised?
- flysonic10 7y ago
  Realtime refers to installations, not necessarily the threat of the extension. If a user installs an extension, you should know if the extension is a threat as soon as possible whether or not it has exposed data. Scoring is a complex problem and there's some literature on the subject. We can break down scoring / threat intelligence into a few buckets: - Known bad actors: some extensions are known bad actors. They've exposed data and even made the news for it. Let's make sure those are absolutely not running in your environment. - Heuristic classification: a number of heuristics can be used to score the threat of an extension, for example, the permissions it requests, its content security policy, etc... - Automated code review: even if an extension developer is not themselves intentionally malicious, the extension may be using outdated or vulnerable libraries that can be exploited by others. - Manual review: there are over 200k extensions so an extensive manual review of each is not practical. Still, for the most popular extensions, a manual review can effectively score the extension based on factors that are difficult to automate. For example, review of the privacy policy, investigation of the owner entity and its business practices, etc... - Corroboration / triangulation: a category of threat detection that Extension Monitor will be able to provide at scale is that of cross-referencing installations with purchased data to single out likely sources. These may also apply to a single extension across versions / time. Regarding counter-measures, Extension Monitor is read-only at this time, so remedying the threat is environment specific. Some fleet management solutions may provide this. Other self-managed machines would require the machines administrator to remove the extension. Some teams that already allowlist or blocklist extensions would find the threat scores useful in their own manual investigations of which extensions to allow or block. Hope this helps, Will (still a real human... and not a Matt)

reneberlin 7y ago

I would like to know more about how the scoring-system works. I think this will be added, don't hurry - but i am curious how that works in "realtime". Every second younbeloved extension can potentially turn into your enemy. And how does IT react on a match? Unplug the machine from the net? Close the browser? Turn off power? Sirenes? I love the idea of your service. But how to execute countermeasures, when the red flag is raised?

flysonic10 7y ago
Realtime refers to installations, not necessarily the threat of the extension. If a user installs an extension, you should know if the extension is a threat as soon as possible whether or not it has exposed data. Scoring is a complex problem and there's some literature on the subject. We can break down scoring / threat intelligence into a few buckets: - Known bad actors: some extensions are known bad actors. They've exposed data and even made the news for it. Let's make sure those are absolutely not running in your environment. - Heuristic classification: a number of heuristics can be used to score the threat of an extension, for example, the permissions it requests, its content security policy, etc... - Automated code review: even if an extension developer is not themselves intentionally malicious, the extension may be using outdated or vulnerable libraries that can be exploited by others. - Manual review: there are over 200k extensions so an extensive manual review of each is not practical. Still, for the most popular extensions, a manual review can effectively score the extension based on factors that are difficult to automate. For example, review of the privacy policy, investigation of the owner entity and its business practices, etc... - Corroboration / triangulation: a category of threat detection that Extension Monitor will be able to provide at scale is that of cross-referencing installations with purchased data to single out likely sources. These may also apply to a single extension across versions / time. Regarding counter-measures, Extension Monitor is read-only at this time, so remedying the threat is environment specific. Some fleet management solutions may provide this. Other self-managed machines would require the machines administrator to remove the extension. Some teams that already allowlist or blocklist extensions would find the threat scores useful in their own manual investigations of which extensions to allow or block. Hope this helps, Will (still a real human... and not a Matt)