4 ms·

I don't agree with the author. He pays lip service to security being important, but then proceeds to ignore the threat because he thinks extensions are great. I

by ohazi 7y ago

I don't agree with the author. He pays lip service to security being important, but then proceeds to ignore the threat because he thinks extensions are great. I think people should be more hesitant to install a browser extension than just about any other piece of software. The threat is absolutely real. Bad actors regularly offer large paydays to lone developers with popular extensions so they can roll out an update that quietly adds a backdoor. There's at least some publicly documented evidence that Raymond Hill (uBlock Origin) isn't likely to cave to this sort of pressure, but do you really believe that none of the other authors of your fifteen favorite extensions would look the other way for $100k? Keep in mind that these offers don't look like "Here's some money, please let us roll out an evil update to your extension." They look like "Our company has a product with a similar name. We love your extension and would like to offer to acquire it from you so that we can use the name. We'll even let you keep the rights to your software so that you can re-release it under a different name if you'd like!" They'll make it really easy for the developer to remain in denial about what they're actually facilitating.

kevingadd 7y ago
Worse still, the design of the most popular extension API is intrinsically poor at protecting users from malicious extension developers (or extension resale to malicious developers). Until Google and Mozilla fix the design people shouldn't be installing more than a handful of extensions, because they end up usually having complete access to all your data for convenience reasons.
- sp332 7y ago
  Extensions have a similar model to phone apps. They have a basic set of APIs available, and beyond that they have to ask for permission before they can use more. E.g. I have a Firefox addon called "t.co unmangler" that only has permission to access my data for twitter.com and can't read anything else. If an extension is compromised and tries to access more that it was allowed before, the browser will block it until I grant permissions.
  - kevingadd 7y ago
    The problem is the granularity of the permissions is extremely coarse, so if you scan the top extensions on the chrome web store a vast number of them request access to All Pages, HTTP and HTTPS included. This is because various useful primitives require that access. Another problem is that requesting a new permission in an extension update has extremely bad UX, to the point that any thoughtful extension developer will just ask for everything they could possibly need up front. If you request a new permission Chrome just silently shuts off your extension until the user goes digging around in the UI for the permission request. The last time I tried this about 5% of my users figured it out and the rest thought it was broken.
seanwilson 7y ago
> Keep in mind that it's not "Here's some money, please let us roll out an evil update to your extension," it's "Our company loves your extension and would like to acquire it." I get messages like this every now and then for mobile apps and browser extensions I manage and they're painfully obvious to spot. They're often from sketchy looking generic email addresses, have no information about the buying company, don't even attempt to demonstrate knowledge of the app, and most importantly mention nothing about how they plan to grow the app. It's always just "would you like to sell?" and "how many users do you have?". A recent one: > From: *@gmail.com > My name is John. > I have noticed your google extension "https://checkbot.io/ https://checkbot.io/ Checkbot: SEO, Web Speed & Security Tester ", its looks interesting would you considering to sell it? > Best regards I've had more elaborate ones but they're always generic with no obvious business interest in the specific app they're asking to buy.
- dessant 7y ago
  Same, I get an offer every month or so for some of my extensions. One has quoted an offer of $0.25/user for the Firefox version of Search by Image in their introductory email. That kind of money would significantly improve my life, but it's all too obvious what they would do with my users. Most extension developers are not getting any significant income from their work, despite serving millions of users, and unless browser vendors will begin to recognize the value of that labor and provide better tools for sponsoring developers, we will continue to be vulnerable to such offers.
  - seanwilson 7y ago
    > Most extension developers are not getting any significant income from their work, despite serving millions of users, and until browser vendors do not start to recognize the value of that labor and provide better tools for sponsoring developers, we will continue to be vulnerable to such offers. Any ideas what specifically could be done to help? You can integrate your own payment systems into extensions and there's some ad vendors that support browser extensions.
    - 7y ago
pvg 7y ago
Raymond Hill (uBlock Origin) It's uBlock Origin because the uBlock name itself got taken over by swindlers. So even well-intentioned actors aren't immune to this kind of abuse.
- neilv 7y ago
  You almost need a Hollywood action movie trailer for this story (i.e., hero going into peaceful retirement, bad guys kidnapping his child and taking over, hero is back and dispensing own brand of justice, to save everyone).
modzu 7y ago
these same risks exist with any app. totally agree its a valid concern and deserves more than a footnote, but i don't think that counters anything that the author is praising about extensions specifically. at least extensions exist within an ecosystem where they are subject to manual review and approval / removal. and in terms of updates, any changes to the permissions show a prompt to the user as though they were newly installed
- ohazi 7y ago
  Manual review doesn't work. The volume is too high, and subtle trickery is too easy. To first order, there is no permissions model for browser extensions. You should assume that an extension can see and do everything that your browser can see and do. This is also a huge problem with mobile apps, but the problem is at least acknowledged, and there's some degree of permissions and sandboxing, even though it's not completely effective, and even though most apps ask for every single permission anyway. But in general, yes, you should take a similar approach to mobile apps, and only use the minimal set that you absolutely can't live without. Don't install games or stupid shit. We already know that basically every weather app on Android contains malware. This is also a problem in free-for-all developer library ecosystems like npm, as we keep seeing. Popular dependencies get taken over or sold and then all of a sudden lots of servers are running malware. Software may be eating the world, but it's really important to know what software you're actually running. You can't just build a house of cards and hope for the best.
  - modzu 7y ago
    i read this as an argument for open source. it's not a guarantee, but it's a good heuristic for an app's trustworthiness
    - ohazi 7y ago
      Yeah, I agree. It's not perfect, but it sure helps. This is also why a lot of the big open-source distributors (e.g. Debian) are working towards fully reproducible builds.
holmberd 7y ago
This is not limited to Chrome extensions. If you build and publish any kind of software, there is a high chance that someone shady will come along and offer you money for it, or to become an "affiliate" partner.
- zzzcpan 7y ago
  Right. Extensions are just software and no need to pretend they have it worse than apps in app stores.
Causality1 7y ago
Personally I just use two browsers. Chrome with no extensions for work and anything involving sensitive data such as logging into my google account, online banking, Amazon, eBay, etc. For everything else I use an old version of Firefox with proper XUL support so I can be comfortable and retain essential functionality during casual browsing.
- jwatt 7y ago
  Presumably you're using an outdated Firefox ESR version with known exploitable holes then? The oldest supported Firefox ESR (60.0) was the first ESR version to enable Quantum and drop support for old-style Mozilla Add-ons.
  - Causality1 7y ago
    Yep, along with Ublock Origin and NoScript in whitelist mode with browser and extension updates disabled. Frankly it would be less hassle to have my identity stolen than operate all day every day without XUL extensions. Granted my attack surface and personal needs are far different from the average Joe and so my method isn't right for most people, but I've already saved so much time and effort that if starting tomorrow I had to spend the next month living off the cash in my wallet while sorting out a case of theft it would STILL have been worth it. Hell I already saved a whole day of fuckery by being immune to Mozilla's "disable all extensions everywhere by having the certificates expertise of a four year old" screw-up.
agumonkey 7y ago
What about a review service ? N peers => signed extension.
- PeterisP 7y ago
  For any number of N, it's far easier to get N positive verifications by trusted peers for a crook (which can buy or fake them) than for a honest small developer.
TeMPOraL 7y ago
> He pays lip service to security being important, but then proceeds to ignore the threat because he thinks extensions are great. I think people should be more hesitant to install a browser extension than just about any other piece of software. I think he might not be willing to engage with this further, because extensions sit close to the border defined by the minimum of "security + usability"[0]. Making extensions more secure eats into their usability; to resolve all the security issues, you'd have to kill extensions altogether. > Bad actors regularly offer large paydays to lone developers with popular extensions so they can roll out an update that quietly adds a backdoor. I don't think there is a way to avoid that. It boils down to the rule that security is measured in dollars - the ultimate attack is bribing the controlling party; the ultimate defense, making it not worth it for the controlling party to sell out for any amount of money the attacker could assemble. -- [0] - I.e. after accounting for obvious wins-wins, you reach a situation where security is opposite to usability. Once you're there, it becomes a trade-off.
sp332 7y ago
roll out an update that quietly adds a backdoor. You can turn off automatic updates on an extension-by-extension basis.

by ohazi 7y ago

kevingadd 7y ago

Worse still, the design of the most popular extension API is intrinsically poor at protecting users from malicious extension developers (or extension resale to malicious developers). Until Google and Mozilla fix the design people shouldn't be installing more than a handful of extensions, because they end up usually having complete access to all your data for convenience reasons.

sp332 7y ago
Extensions have a similar model to phone apps. They have a basic set of APIs available, and beyond that they have to ask for permission before they can use more. E.g. I have a Firefox addon called "t.co unmangler" that only has permission to access my data for twitter.com and can't read anything else. If an extension is compromised and tries to access more that it was allowed before, the browser will block it until I grant permissions.
- kevingadd 7y ago
  The problem is the granularity of the permissions is extremely coarse, so if you scan the top extensions on the chrome web store a vast number of them request access to All Pages, HTTP and HTTPS included. This is because various useful primitives require that access. Another problem is that requesting a new permission in an extension update has extremely bad UX, to the point that any thoughtful extension developer will just ask for everything they could possibly need up front. If you request a new permission Chrome just silently shuts off your extension until the user goes digging around in the UI for the permission request. The last time I tried this about 5% of my users figured it out and the rest thought it was broken.

seanwilson 7y ago

> Keep in mind that it's not "Here's some money, please let us roll out an evil update to your extension," it's "Our company loves your extension and would like to acquire it." I get messages like this every now and then for mobile apps and browser extensions I manage and they're painfully obvious to spot. They're often from sketchy looking generic email addresses, have no information about the buying company, don't even attempt to demonstrate knowledge of the app, and most importantly mention nothing about how they plan to grow the app. It's always just "would you like to sell?" and "how many users do you have?". A recent one: > From: *@gmail.com > My name is John. > I have noticed your google extension "https://checkbot.io/ https://checkbot.io/ Checkbot: SEO, Web Speed & Security Tester ", its looks interesting would you considering to sell it? > Best regards I've had more elaborate ones but they're always generic with no obvious business interest in the specific app they're asking to buy.

dessant 7y ago
Same, I get an offer every month or so for some of my extensions. One has quoted an offer of $0.25/user for the Firefox version of Search by Image in their introductory email. That kind of money would significantly improve my life, but it's all too obvious what they would do with my users. Most extension developers are not getting any significant income from their work, despite serving millions of users, and unless browser vendors will begin to recognize the value of that labor and provide better tools for sponsoring developers, we will continue to be vulnerable to such offers.
- seanwilson 7y ago
  > Most extension developers are not getting any significant income from their work, despite serving millions of users, and until browser vendors do not start to recognize the value of that labor and provide better tools for sponsoring developers, we will continue to be vulnerable to such offers. Any ideas what specifically could be done to help? You can integrate your own payment systems into extensions and there's some ad vendors that support browser extensions.
  - 7y ago

pvg 7y ago

Raymond Hill (uBlock Origin) It's uBlock Origin because the uBlock name itself got taken over by swindlers. So even well-intentioned actors aren't immune to this kind of abuse.

neilv 7y ago
You almost need a Hollywood action movie trailer for this story (i.e., hero going into peaceful retirement, bad guys kidnapping his child and taking over, hero is back and dispensing own brand of justice, to save everyone).

modzu 7y ago

these same risks exist with any app. totally agree its a valid concern and deserves more than a footnote, but i don't think that counters anything that the author is praising about extensions specifically. at least extensions exist within an ecosystem where they are subject to manual review and approval / removal. and in terms of updates, any changes to the permissions show a prompt to the user as though they were newly installed

ohazi 7y ago
Manual review doesn't work. The volume is too high, and subtle trickery is too easy. To first order, there is no permissions model for browser extensions. You should assume that an extension can see and do everything that your browser can see and do. This is also a huge problem with mobile apps, but the problem is at least acknowledged, and there's some degree of permissions and sandboxing, even though it's not completely effective, and even though most apps ask for every single permission anyway. But in general, yes, you should take a similar approach to mobile apps, and only use the minimal set that you absolutely can't live without. Don't install games or stupid shit. We already know that basically every weather app on Android contains malware. This is also a problem in free-for-all developer library ecosystems like npm, as we keep seeing. Popular dependencies get taken over or sold and then all of a sudden lots of servers are running malware. Software may be eating the world, but it's really important to know what software you're actually running. You can't just build a house of cards and hope for the best.
- modzu 7y ago
  i read this as an argument for open source. it's not a guarantee, but it's a good heuristic for an app's trustworthiness
  - ohazi 7y ago
    Yeah, I agree. It's not perfect, but it sure helps. This is also why a lot of the big open-source distributors (e.g. Debian) are working towards fully reproducible builds.

holmberd 7y ago

This is not limited to Chrome extensions. If you build and publish any kind of software, there is a high chance that someone shady will come along and offer you money for it, or to become an "affiliate" partner.

zzzcpan 7y ago
Right. Extensions are just software and no need to pretend they have it worse than apps in app stores.

Causality1 7y ago

Personally I just use two browsers. Chrome with no extensions for work and anything involving sensitive data such as logging into my google account, online banking, Amazon, eBay, etc. For everything else I use an old version of Firefox with proper XUL support so I can be comfortable and retain essential functionality during casual browsing.

jwatt 7y ago
Presumably you're using an outdated Firefox ESR version with known exploitable holes then? The oldest supported Firefox ESR (60.0) was the first ESR version to enable Quantum and drop support for old-style Mozilla Add-ons.
- Causality1 7y ago
  Yep, along with Ublock Origin and NoScript in whitelist mode with browser and extension updates disabled. Frankly it would be less hassle to have my identity stolen than operate all day every day without XUL extensions. Granted my attack surface and personal needs are far different from the average Joe and so my method isn't right for most people, but I've already saved so much time and effort that if starting tomorrow I had to spend the next month living off the cash in my wallet while sorting out a case of theft it would STILL have been worth it. Hell I already saved a whole day of fuckery by being immune to Mozilla's "disable all extensions everywhere by having the certificates expertise of a four year old" screw-up.

agumonkey 7y ago

What about a review service ? N peers => signed extension.

PeterisP 7y ago
For any number of N, it's far easier to get N positive verifications by trusted peers for a crook (which can buy or fake them) than for a honest small developer.

TeMPOraL 7y ago

> He pays lip service to security being important, but then proceeds to ignore the threat because he thinks extensions are great. I think people should be more hesitant to install a browser extension than just about any other piece of software. I think he might not be willing to engage with this further, because extensions sit close to the border defined by the minimum of "security + usability"[0]. Making extensions more secure eats into their usability; to resolve all the security issues, you'd have to kill extensions altogether. > Bad actors regularly offer large paydays to lone developers with popular extensions so they can roll out an update that quietly adds a backdoor. I don't think there is a way to avoid that. It boils down to the rule that security is measured in dollars - the ultimate attack is bribing the controlling party; the ultimate defense, making it not worth it for the controlling party to sell out for any amount of money the attacker could assemble. -- [0] - I.e. after accounting for obvious wins-wins, you reach a situation where security is opposite to usability. Once you're there, it becomes a trade-off.

sp332 7y ago

roll out an update that quietly adds a backdoor. You can turn off automatic updates on an extension-by-extension basis.