5 ms·

In order to install this browser extension it requires permissions of "can read and change all your data on the websites you visit". So basically a man in the m

by nickjj 7y ago

In order to install this browser extension it requires permissions of "can read and change all your data on the websites you visit". So basically a man in the middle attack that tracks every site you visit and could potentially modify the content on pages you visit without you knowing. As much as I enjoy privacy, IMO it's a much bigger violation / risk to give my complete browsing history to some extension, especially since it can "read all your data". That means it can look at the HTML response of any page you visit which means access to your banking details, email account and everything you ever browse. That's all personally identifiable data. I wouldn't even consider utm tags a privacy violation since it's really nothing more than a slightly more useful referrer header that's completely anonymous.

lightswitch05 7y ago
What are your thoughts about it being an open source extension?
- nickjj 7y ago
  > What are your thoughts about the being an open source extension? It being open source doesn't guarantee what you see on GitHub is the code that the extension uses. I'm not saying this author is acting maliciously but a very common attack is to say something is open source, point to the repo but in reality the code running in the extension is unrelated to that repo. This often happens with packages installed by popular package managers. The home page of the package will be linked to GitHub so it appears to be open source but the package itself has different code because most of these package hosting sites don't pull in code directly from GitHub. The package author can publish code from a private closed source copy of the code sitting on their dev box and no one would ever know unless they looked at the source code after installing the package. Now, when it comes to Chrome extensions I do believe there's ways to check out the source code of any extension you use, so you could double check it there but then you have to worry about the extension getting updated too.
  - gruez 7y ago
    >I'm not saying this author is acting maliciously but a very common attack is to say something is open source, point to the repo but in reality the code running in the extension is unrelated to that repo. The extension is small enough that you can inspect it yourself. Also, AMO addons are code-inspected by reviewers, unlike the chrome store. >Now, when it comes to Chrome extensions I do believe there's ways to check out the source code of any extension you use, so you could double check it there but then you have to worry about the extension getting updated too. That's why I disable addon updates for "uncommon" addons.
    - nickjj 7y ago
      > The extension is small enough that you can inspect it yourself. Also, AMO addons are code-inspected by reviewers, unlike the chrome store. I've never been involved with performing code reviews for Chrome or FF extensions but I'm not sure this type of attack would be detected by a reviewer. Because if all they do is take the HTML response and send it over to some web back-end with an ajax request, that looks innocent enough to any reviewer. For example, under what grounds would a reviewer flag that ajax request as malicious and prevent the extension from being published? It's not possible for them to know what purpose that data has for the extension unless they are really doing a deep dive on each review and take the extension's purpose into account based on their opinion of what it "should" do based on its description. I'd love to hear back from anyone who happens to review extensions for either browser.
      - commoner 7y ago
        > if all they do is take the HTML response and send it over to some web back-end with an ajax request This extension does not do that. Most extensions with the "Access your data for all websites" permission also do not do that. The permission is required to scan data (in this case, links) in the websites visited by the browser, and does not mean that the data in the website would necessarily be sent to a server. Neat URL processes the links locally. You can inspect the source code of any WebExtension you have installed by downloading the package, renaming it to the .zip extension, and unzipping it (as .xpi files are equivalent to .zip files). For Firefox add-ons, right-click the "Add to Firefox" button on the extension listing, and click "Save Link As...". The code is not minified or obfuscated. https://addons.mozilla.org/en-US/firefox/addon/neat-url/ https://addons.mozilla.org/en-US/firefox/addon/neat-url/
c0nducktr 7y ago
Not sure if this would make you feel any better, but there's a similar extension called ClearURLs[1] (I'm not affiliated with it, but I do have it installed) for Firefox which is one of their "Recommended Extentions"[2] which have passed their reviews for security. [1] https://addons.mozilla.org/en-US/firefox/addon/clearurls/ https://addons.mozilla.org/en-US/firefox/addon/clearurls/ [2] https://support.mozilla.org/en-US/kb/recommended-extensions-program?as=u&utm_source=inproduct https://support.mozilla.org/en-US/kb/recommended-extensions-...
hv42 7y ago
you can always copy the code and install locally if you don't trust the publisher. That's the full benefit of open source. If it breaks in the future, just inspect and copy the new version again?
- antpls 7y ago
  I believe the parent is asking for more granularity in browsers permissions in general. On Firefox, permission granularity is a bit lagging behind other platforms, for example Android (which is already not perfect/too permissive)
  - Too 7y ago
    I think the problem is a plugin that can rewrite the url can rewrite the url to anywhere else which in effect becomes "read all your data". Firefox has taken such side channel attacks very rigorously so almost any plugin doing anything remotely interesting will have such requirement.
soraminazuki 7y ago
> In order to install this browser extension it requires permissions of "can read and change all your data on the websites you visit". Any plugin that rewrites URLs can do all that. It so happens that ublock origin also needs this capability in order for it to function[1]. So essentially, it boils down to a matter of trust. If I trust the extension developer enough, I would gladly install the plugin rather than doing nothing to stop the rampant privacy abuses. Fortunately, this plugin is small and made of easily inspectable javascript. It's open source, so I could even build the plugin myself if I was super-paranoid. > As much as I enjoy privacy, IMO it's a much bigger violation / risk to give my complete browsing history to some extension, especially since it can "read all your data". That's some serious allegation. I just hope you had enough proof before you started pointing fingers. > I wouldn't even consider utm tags a privacy violation since it's really nothing more than a slightly more useful referrer header that's completely anonymous. How are referrer headers not a privacy violation? [1] https://github.com/gorhill/uBlock/wiki/Permissions#access-your-data-on-all-web-sites https://github.com/gorhill/uBlock/wiki/Permissions#access-yo...

by nickjj 7y ago

lightswitch05 7y ago

What are your thoughts about it being an open source extension?

nickjj 7y ago
> What are your thoughts about the being an open source extension? It being open source doesn't guarantee what you see on GitHub is the code that the extension uses. I'm not saying this author is acting maliciously but a very common attack is to say something is open source, point to the repo but in reality the code running in the extension is unrelated to that repo. This often happens with packages installed by popular package managers. The home page of the package will be linked to GitHub so it appears to be open source but the package itself has different code because most of these package hosting sites don't pull in code directly from GitHub. The package author can publish code from a private closed source copy of the code sitting on their dev box and no one would ever know unless they looked at the source code after installing the package. Now, when it comes to Chrome extensions I do believe there's ways to check out the source code of any extension you use, so you could double check it there but then you have to worry about the extension getting updated too.
- gruez 7y ago
  >I'm not saying this author is acting maliciously but a very common attack is to say something is open source, point to the repo but in reality the code running in the extension is unrelated to that repo. The extension is small enough that you can inspect it yourself. Also, AMO addons are code-inspected by reviewers, unlike the chrome store. >Now, when it comes to Chrome extensions I do believe there's ways to check out the source code of any extension you use, so you could double check it there but then you have to worry about the extension getting updated too. That's why I disable addon updates for "uncommon" addons.
  - nickjj 7y ago
    > The extension is small enough that you can inspect it yourself. Also, AMO addons are code-inspected by reviewers, unlike the chrome store. I've never been involved with performing code reviews for Chrome or FF extensions but I'm not sure this type of attack would be detected by a reviewer. Because if all they do is take the HTML response and send it over to some web back-end with an ajax request, that looks innocent enough to any reviewer. For example, under what grounds would a reviewer flag that ajax request as malicious and prevent the extension from being published? It's not possible for them to know what purpose that data has for the extension unless they are really doing a deep dive on each review and take the extension's purpose into account based on their opinion of what it "should" do based on its description. I'd love to hear back from anyone who happens to review extensions for either browser.
    - commoner 7y ago
      > if all they do is take the HTML response and send it over to some web back-end with an ajax request This extension does not do that. Most extensions with the "Access your data for all websites" permission also do not do that. The permission is required to scan data (in this case, links) in the websites visited by the browser, and does not mean that the data in the website would necessarily be sent to a server. Neat URL processes the links locally. You can inspect the source code of any WebExtension you have installed by downloading the package, renaming it to the .zip extension, and unzipping it (as .xpi files are equivalent to .zip files). For Firefox add-ons, right-click the "Add to Firefox" button on the extension listing, and click "Save Link As...". The code is not minified or obfuscated. https://addons.mozilla.org/en-US/firefox/addon/neat-url/ https://addons.mozilla.org/en-US/firefox/addon/neat-url/

c0nducktr 7y ago

Not sure if this would make you feel any better, but there's a similar extension called ClearURLs[1] (I'm not affiliated with it, but I do have it installed) for Firefox which is one of their "Recommended Extentions"[2] which have passed their reviews for security. [1] https://addons.mozilla.org/en-US/firefox/addon/clearurls/ https://addons.mozilla.org/en-US/firefox/addon/clearurls/ [2] https://support.mozilla.org/en-US/kb/recommended-extensions-program?as=u&utm_source=inproduct https://support.mozilla.org/en-US/kb/recommended-extensions-...

hv42 7y ago

you can always copy the code and install locally if you don't trust the publisher. That's the full benefit of open source. If it breaks in the future, just inspect and copy the new version again?

antpls 7y ago
I believe the parent is asking for more granularity in browsers permissions in general. On Firefox, permission granularity is a bit lagging behind other platforms, for example Android (which is already not perfect/too permissive)
- Too 7y ago
  I think the problem is a plugin that can rewrite the url can rewrite the url to anywhere else which in effect becomes "read all your data". Firefox has taken such side channel attacks very rigorously so almost any plugin doing anything remotely interesting will have such requirement.

soraminazuki 7y ago

> In order to install this browser extension it requires permissions of "can read and change all your data on the websites you visit". Any plugin that rewrites URLs can do all that. It so happens that ublock origin also needs this capability in order for it to function[1]. So essentially, it boils down to a matter of trust. If I trust the extension developer enough, I would gladly install the plugin rather than doing nothing to stop the rampant privacy abuses. Fortunately, this plugin is small and made of easily inspectable javascript. It's open source, so I could even build the plugin myself if I was super-paranoid. > As much as I enjoy privacy, IMO it's a much bigger violation / risk to give my complete browsing history to some extension, especially since it can "read all your data". That's some serious allegation. I just hope you had enough proof before you started pointing fingers. > I wouldn't even consider utm tags a privacy violation since it's really nothing more than a slightly more useful referrer header that's completely anonymous. How are referrer headers not a privacy violation? [1] https://github.com/gorhill/uBlock/wiki/Permissions#access-your-data-on-all-web-sites https://github.com/gorhill/uBlock/wiki/Permissions#access-yo...