6 ms·

extensions are one lump sum offer away from becoming malware e: immaigne people down-voting facts https://www.bleepingcomputer.com/news/security/-particle-chro

extensions are one lump sum offer away from becoming malware e: immaigne people down-voting facts https://www.bleepingcomputer.com/news/security/-particle-chrome-extension-sold-to-new-dev-who-immediately-turns-it-into-adware/ https://www.bleepingcomputer.com/news/security/-particle-chr...

lisper 7y ago
The same is true of Firefox itself, or indeed any piece of software.
- LoSboccacc 7y ago
  holy false equivalence batman. it's definitely harder to buy/compromise firefox
  - lisper 7y ago
    Yes, that's true, but it would be correspondingly more difficult to find an alternative. If a plugin is compromised you're much more likely to be able to easily find an alternative. So it's a trade-off either way.
    - LoSboccacc 7y ago
      the cost of a compromised plugin is not just the inconvenience, but also all the passwords you might enter on forms if the plugin has full permissions granted
      - lisper 7y ago
        That's a stretch. We're talking about a translation plugin here. If FF doesn't have a mechanism to keep passwords safe from that, then that is the problem, not the lack of native translation.
        avereveard 7y ago
        if a plugin can read what's in a field, it can read the passwords therein, I'm not talking about the password file.
        lisper 7y ago
        I am not wise in the ways of Firefox plugins, but if the ability of a plugin to read a password field is not a separate permission, then that is a much more serious problem than the lack of native translation. That's just a huge gaping security hole, full stop. If that is indeed how Firefox is designed, then the lack of native translation should be the least of your concerns.
        avereveard 7y ago
        > I am not wise in the ways of Firefox plugins > That's just a huge gaping security hole > If that is indeed how Firefox is designed that's the whole point I'm trying to make! goddamit stop working on assumption and hypothetical thinking I'm a lunatic, this is a real issue and the actual way firefox works, how do you think all password manager work? here look yourself https://support.mozilla.org/en-US/kb/permission-request-messages-firefox-extensions#w_access-your-data-for-all-websites https://support.mozilla.org/en-US/kb/permission-request-mess... and guess what permission the language extension need? https://addons.mozilla.org/en-US/firefox/addon/automatic-spelling-language/ https://addons.mozilla.org/en-US/firefox/addon/automatic-spe...
        lisper 7y ago
        Go back to this ancestor comment in this thread: https://news.ycombinator.com/item?id=21323832 https://news.ycombinator.com/item?id=21323832 We're not talking about password managers here, we're talking about spelling checkers. If a spelling checker can read passwords, then Firefox has a problem that that has nothing to do with spelling checkers or password managers. You cannot safely use any plugin. Now, it's possible that Firefox does indeed have this very serious problem, I don't know. But I think it's much more likely that the FF engineers did the obvious thing and excluded password fields from being accessed by plugins by default if they can access text fields. If this were not the case, the complaint would not have been, "FF doesn't have native spell checking", the complaint would have been, "FF has this gaping security hole through which you can drive an M1 Abrams tank."
- kazagistar 7y ago
  Its true of things beyond software too. The problem is the power of people to produce large enough lump sums.
- RaleyField 7y ago
  There's slight difference in that in Firefox's case tech journals will be writing about it, everyone else will be talking about it and it will be on front page of HN. In the case of random extension going rogue it will likely get unnoticed for years and when it is finally noticed there's a small chance it will be picked by HN if planets align.
  - lisper 7y ago
    Maybe. Take a look at my exchange with u/LoSboccacc a parallel branch of this thread. If what he claims is correct (I don't know, but he seems pretty confident) then there is already a huge gaping security hole in FF that no one is talking about (AFAICT).
    - LoSboccacc 7y ago
      not only is factual, it comes with linked sources for all the claimed points https://news.ycombinator.com/item?id=21336440 https://news.ycombinator.com/item?id=21336440
      - lisper 7y ago
        Don't believe everything you read on the internet. Yes, the text on that page can be interpreted as supporting your position. Still, "Offer a password manager..." is not quite the same thing as "silently read all of your passwords and do whatever the extension wants with them..." I have a very hard time believing that the latter is the case and that no one has sounded the alarm on this yet. Also, add-ons have been deprecated in favor of extensions.

lisper 7y ago

The same is true of Firefox itself, or indeed any piece of software.

LoSboccacc 7y ago
holy false equivalence batman. it's definitely harder to buy/compromise firefox
- lisper 7y ago
  Yes, that's true, but it would be correspondingly more difficult to find an alternative. If a plugin is compromised you're much more likely to be able to easily find an alternative. So it's a trade-off either way.
  - LoSboccacc 7y ago
    the cost of a compromised plugin is not just the inconvenience, but also all the passwords you might enter on forms if the plugin has full permissions granted
    - lisper 7y ago
      That's a stretch. We're talking about a translation plugin here. If FF doesn't have a mechanism to keep passwords safe from that, then that is the problem, not the lack of native translation.
      - avereveard 7y ago
        if a plugin can read what's in a field, it can read the passwords therein, I'm not talking about the password file.
        lisper 7y ago
        I am not wise in the ways of Firefox plugins, but if the ability of a plugin to read a password field is not a separate permission, then that is a much more serious problem than the lack of native translation. That's just a huge gaping security hole, full stop. If that is indeed how Firefox is designed, then the lack of native translation should be the least of your concerns.
        avereveard 7y ago
        > I am not wise in the ways of Firefox plugins > That's just a huge gaping security hole > If that is indeed how Firefox is designed that's the whole point I'm trying to make! goddamit stop working on assumption and hypothetical thinking I'm a lunatic, this is a real issue and the actual way firefox works, how do you think all password manager work? here look yourself https://support.mozilla.org/en-US/kb/permission-request-messages-firefox-extensions#w_access-your-data-for-all-websites https://support.mozilla.org/en-US/kb/permission-request-mess... and guess what permission the language extension need? https://addons.mozilla.org/en-US/firefox/addon/automatic-spelling-language/ https://addons.mozilla.org/en-US/firefox/addon/automatic-spe...
        lisper 7y ago
        Go back to this ancestor comment in this thread: https://news.ycombinator.com/item?id=21323832 https://news.ycombinator.com/item?id=21323832 We're not talking about password managers here, we're talking about spelling checkers. If a spelling checker can read passwords, then Firefox has a problem that that has nothing to do with spelling checkers or password managers. You cannot safely use any plugin. Now, it's possible that Firefox does indeed have this very serious problem, I don't know. But I think it's much more likely that the FF engineers did the obvious thing and excluded password fields from being accessed by plugins by default if they can access text fields. If this were not the case, the complaint would not have been, "FF doesn't have native spell checking", the complaint would have been, "FF has this gaping security hole through which you can drive an M1 Abrams tank."
kazagistar 7y ago
Its true of things beyond software too. The problem is the power of people to produce large enough lump sums.
RaleyField 7y ago
There's slight difference in that in Firefox's case tech journals will be writing about it, everyone else will be talking about it and it will be on front page of HN. In the case of random extension going rogue it will likely get unnoticed for years and when it is finally noticed there's a small chance it will be picked by HN if planets align.
- lisper 7y ago
  Maybe. Take a look at my exchange with u/LoSboccacc a parallel branch of this thread. If what he claims is correct (I don't know, but he seems pretty confident) then there is already a huge gaping security hole in FF that no one is talking about (AFAICT).
  - LoSboccacc 7y ago
    not only is factual, it comes with linked sources for all the claimed points https://news.ycombinator.com/item?id=21336440 https://news.ycombinator.com/item?id=21336440
    - lisper 7y ago
      Don't believe everything you read on the internet. Yes, the text on that page can be interpreted as supporting your position. Still, "Offer a password manager..." is not quite the same thing as "silently read all of your passwords and do whatever the extension wants with them..." I have a very hard time believing that the latter is the case and that no one has sounded the alarm on this yet. Also, add-ons have been deprecated in favor of extensions.