10 ms·

Uh, yikes: > As I looked at the permissions and what our extension actually needs to operate, I noticed a great opportunity to reduce our permissions requests.

by geofft 6y ago

Uh, yikes: > As I looked at the permissions and what our extension actually needs to operate, I noticed a great opportunity to reduce our permissions requests. We do not need to request access to data on https://*/* https://*/* and http://*/* http://*/*. Instead, we can simply request data access for https://*.pushbullet.com/* https://*.pushbullet.com/*, http://*.pushbullet.com/* http://*.pushbullet.com/*, and http://localhost/* http://localhost/*. This is a huge reduction in the private data our extension could theoretically access. A big win! While I agree with the larger part about the lack of transparency of what they want you to fix, this is an amazingly huge oversight, and the fact that the extension review process got an established, popular extension to go "Wait, we don't actually need to request access to every website ever" is a point in favor of the review process - and, unfortunately, a (weak) argument in favor of the review process taking the attitude that they get lots of crap and don't have the time to explain to all the authors of crap what they're doing wrong. How did the extension ever ask for this in the first place? Also why do you need http://localhost/ http://localhost/? Is the extension running a web server on localhost with native code? If so, can you use the specific mechanism/permission for communicating with native code via a subprocess (because it turns out communicating with a web server on localhost is very hard to do securely)? If not, what's it for? I'm sympathetic to the broader argument here, but given the provided information, all of this is consistent with an extension that should be kicked off the app store within 14 days. (Among other things, if you have an approved extension with https://*/* https://*/* permissions and active users, malware authors will offer to buy your extension for a very high price. So it's definitely in the public interest to make sure there are as few of those as possible and that they're only in the hands of people who have the ability to understand why the friendly person offering them way too much money for their extension isn't just being nice.)

deleted 6y ago
[deleted]
friedman23 6y ago
>Uh, yikes Agreed I wish we could send everyone that thinks this kind of response from a megacorporation is good to a kafkaesque alternate universe.
- lidHanteyk 6y ago
  https://hitchhikers.fandom.com/wiki/Golgafrinchan_Ark_Fleet_Ship_B https://hitchhikers.fandom.com/wiki/Golgafrinchan_Ark_Fleet_...
- hedora 6y ago
  > kafkaesque alternate universe You can sleep well tonight knowing a few of them will attempt to build a house in California.
  - thejynxed 6y ago
    They've already done that in Palo Alto from what I understand.
kevingadd 6y ago
https://*/* https://*/* being allowed at all without aggressive vetting is a big mistake. It's astonishing to me that they ever made it easy to do this.
- hanniabu 6y ago
  Agreed, that in itself should require an application
- phire 6y ago
  The problem is that extension behaviour is very limited without the https://*/* https://*/* permission. Say you have an extension that implements spelling check or grammar check. That need access to every single website to find the text fields it want to add functionality too. Same thing with a password manager extension, can't find the login boxes without the https://*/* https://*/* permission. You want to read data off any page users are on, or add ui elements to every page users are on, or modify style shares to any page, you need that global permission. About the only extensions that don't need global https permissions are extensions that are designed to only work on a finite set of websites (facebook improvement extensions, or reddit improvement extensions), or things like push-bullet that don't really need to be a chrome extension in the first place, they could be implement as a system tray applet. This isn't the fault of extensions, this is the fault of chrome for not providing ways to do things without full wildcard https://*/* https://*/* permissions.
  - efreak 6y ago
    Pushbullet actually has a desktop application with a tray applet. But if you keep your browser running 24/7 it might well be worthwhile to use an extension instead of another piece of software that installs separately, and has more access to your computer.
  - cryptonector 6y ago
    It should be possible to have an extension interface that allows a spellchecker/grammar checker to get a button on text input fields such that if you click it, then the extension is activated on that field at that time. That seems like a much better Least Privilege design to me than giving the extension access to... literally everything you do.
legitster 6y ago
It seems like the majority of plugins will need to access all websites. Just looking at my list of plugins: - EditThisCookie - ResourceOverride - Ad blocker - Grammarly - LastPass I absolutely expect these to work regardless of website. It seems perfectly reasonable for this to be the default behavior.
- geofft 6y ago
  And both Grammarly and LastPass have had security bugs that let any website worm their way into the extension and access all the data from the extension (anything you've ever typed, for Grammarly, and all your passwords, for LastPass). Extensions with wide-ranging access are useful, and there's a reason Chrome has support for it, but they're also very very hard to get right, even if your entire business is writing a security-focused browser extension. You could go the approach Firefox is going on mobile where there are currently six vetted extensions. As it turns out, they all need access to every website (or fine-grained APIs, perhaps). But... there are six of them. https://blog.mozilla.org/addons/2020/04/14/april-extensions-for-firefox-preview/ https://blog.mozilla.org/addons/2020/04/14/april-extensions-...
  - FillardMillmore 6y ago
    Do you have a link for that claim on LastPass? I use the extension and am wondering if I shouldn't use an PM extension thats more reliable in terms of security. Any recommendations obviously welcome.
    - geofft 6y ago
      See my podcast's episode on this :) https://looseleafsecurity.com/episodes/password-manager-security-model.html https://looseleafsecurity.com/episodes/password-manager-secu... (there's a full transcript in there if audio isn't your thing) The LastPass issues are all pretty old at this point - I mostly mention it to drive in the point that getting this stuff right is hard. (For what it's worth, the researcher who found those issues has good things to say about LastPass: https://twitter.com/taviso/status/1167311357957435392 https://twitter.com/taviso/status/1167311357957435392 and also fairly negative things to say about 1Password, which is what I happen to use.)
JaggedJax 6y ago
But you're completely ignoring the point that even without the all http(s) permission they will still be kicked off the store, so that has nothing do do with the issue at hand. If localhost is the issue, Google could literally respond exactly the way you did and the problem is gone, "why do you need http://localhost/?" http://localhost/?" This isn't about permissions at all. This is about communication and whether it's worth putting effort and trust into a company that acts like this as SOP.
- geofft 6y ago
  That's the thing I'm sympathetic to - having fixed the bug, it's frustrating that it's not clear what the next steps are. But given that they had the bug, Chrome was absolutely in the right to deny them the first time. And while I don't like Chrome's position that they're too busy to explain to everyone what they're doing wrong, if extensions that go "oh hey, we don't actually need access to literally every website, imagine that, oops!" is what you expect out of good, competent, non-malicious extension authors, I have a lot of trouble disagreeing with their conclusion, in practice. (Would it be better if Chrome said "There are 200,000 extensions on the Chrome store, each and every one of them deserves attention, we need to spend at least 30 minutes looking at each one and composing a response, we have a ten-person team, we'll get back to you within 5 years?")
  - csours 6y ago
    The tool could tell them what the problem is. There are fine grained permissions, and Google could say which of those fine grained permissions are used badly. OR, they could just restrict those permissions themselves in the browser.
    - Filligree 6y ago
      If it did, it'd be easy for malware authors to work around the scanner. The system we've got right now isn't great, but I've yet to see any better ideas.
      - 6y ago
om2 6y ago
The outcome seems to be that this extension fixed the bug and will still be kicked off the Chrome Web Store. That's probably not a net benefit for users _as a result_, even setting aside the unclear communication. Imagine using a build system that doesn't give any error messages, except to say at the end "build failed, there was a syntax error". This sucks as a tool. Everyone would avoid it if they could, even if it found real bugs. We shouldn't accept this level of information from services either.
fenomas 6y ago
> ... an amazingly huge oversight ... a point in favor of the review process This seems like a rosy interpretation. It's not actually clear whether http permissions really are the reason the extension got flagged, and the fact that fixing them didn't affect the review feedback implies that the process isn't working the way you're imagining.
arcticbull 6y ago
> ... all of this is consistent with an extension that should be kicked off the app store within 14 days. No, it absolutely isn't. You can't take someone's livelihood off the app store within 14 days when they have every interest in complying with your policy but you just don't feel the need to even tell them what all the policy is. The fact it was approved in the first place is Google's fault, not the app developer, so is totally irrelevant to this saga. If you can hit the Reject button you can fill in a text box that says why. There's no excuse for that.
- bigfoot675 6y ago
  I mean they can. It's their store. I don't think they should, but still
  - cosmicexplorer 6y ago
    I'm pretty sure the parent comment understands that they can, and also agrees that they shouldn't.
    - Aeolun 6y ago
      I’m not at all certain about the latter. They’re pretty consistent in ignoring users and providing shitty service.
- lucideer 6y ago
  I think there's two issues here: 1. should Google provide more context to the developer? Of course. 2. if the extension is a genuine danger to users, should they remove it immediately? Of course I agree that Google should do #1 as well as #2, but I absolutely believe it's better to do #2 (even without #1) than to do neither.
IG_Semmelweiss 6y ago
I agree. This is hackernews, so it is easy why devs would feel otherwise, but as a nondev, I represent the the end users. Why would anyone think it is appropriate for google to reveal their hand, and allow blackhat operators to build apps up to the max limit of permissions? (If they were revealed by google via white glove customer service). If goog did provide guidance on permissions, goog would literally have to audit every app in the store, or come up with a way to separate bad actors from good ones. So, Im sorry. No. If its between 1 hacker's inconvenience or in extreme case , livelyhood....and the retirement savings bank account of many grandmas, i am going to side with grandmas. Google is doing many things wrong. Keeping the "red line" of allowable permissions secret, from data-hungry developers.... is not one of them.
- laughinghan 6y ago
  > If goog did provide guidance on permissions, goog would literally have to audit every app in the store, or come up with a way to separate bad actors from good ones. This makes no sense. For the sake of the grandmas, Google already needs to audit every app in the store and separate bad actors from good ones. How in the world would making it more clear how to write more secure extensions possibly worsen the extension store's malware problem?
  - icer2312 6y ago
    > How in the world would making it more clear how to write more secure extensions possibly worsen the extension store's malware problem? Unfortunately, information that helps the good guys get their extensions past the audit check is exactly the same information that helps the bad guys get their extensions in too. The bad guys simply move onto the next security flaw that Google hasn't anticipated. Maybe the bad guys use some common tactics to get their scam extensions in the store which good guys don't, which is easy for Google to detect and flag. If you release a list of known no-no's, the bad guys just get smarter and avoid them. This obviously skews in favour of refusing some good extensions to keep most bad ones out. In terms of Google already auditing every app, check out the source code for Dark Reader https://github.com/darkreader/darkreader https://github.com/darkreader/darkreader. It's fairly complex. I can only imagine how many extensions are as, or more, complex than that. I wonder how much auditing is done manually vs automated.
cryptonector 6y ago
Like you, I suspect http://localhost/ http://localhost/ is part of the issue, indeed. I wonder if Google could have a <appname>.localhost origin for this.
- m-p-3 6y ago
  There is a native app for Pushbullet on Windows that you can install to add more features, and this is how the extension is able to communicate with it. I know there was a problem getting duplicate push notifications from the app and Chrome itself, and that was a way to remediate that. At least that's what I remember from the time I used it.
highlysyntropic 6y ago
paid Google shill.
- cerberusss 6y ago
  Are you saying geofft is a paid Google shill? Or the maker of the Pushbullet extension?
  - deleted 6y ago
    [deleted]
- cosmicexplorer 6y ago
  I agree with this comment and I think it improves the conversation to have around, even if many people disagree with it.
- dang 6y ago
  We've banned this account for breaking the site guidelines. Could you please stop creating accounts to do that with? https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
awill88 6y ago
Hit it right on the head. The localhost thing and coupled with the http thing make me cringe. And to know they went from https://* https://* to just one domain, yikes indeed. Then they left localhost. Hell, that probably made the case worker’s knee jerk even harder because of such a dramatic change, I can’t imagine they spend much time on each case. Yes, 14 days is not a lot of time, but this is the ecosystem that needs to change. So the maintainer should have started out being more transparent on their architecture: period. The fun is over, Google doesn’t care about loyalty or gestures of effort, this is an emotionless process. They care about provable, auditable compliance. When you think about it, for Google, this is just a little sad story about an extension that didn’t make the cut. But it’s a small price to pay in exchange for evidence they are “enduring self-inflicted wounds” and using it as ammunition in avoiding billions of dollars in fines they face for violating user privacy laws.
- LorenPechtel 6y ago
  Yeah, it sounds like they were working on a "it works, ship it" approach. That's not good enough when there are security implications to what you're doing.
onefuncman 6y ago
Oh. TIL why I was getting all those unsolicited offers. I took my extension down instead, as I didn't have time to figure out how I had painted a target on my back. I only published my extension as a fork of an open source project that started injecting malware, presumably from a similar offer...
richardwhiuk 6y ago
Why do they need http access on push bullet?
jve 6y ago
Yeah. I'v refused to install extension in the past because Chrome tells me this extension wants to read all data on all web pages... No thanks. (Except those extensions I KNOW must have those permissions) Very good thing app store may nudge people changing permission scope. Hope extension authors manage to meet the deadline and get their extension re-approved.
brosirmandude 6y ago
>if you have an approved extension with https://*/* https://*/* permissions and active users, malware authors will offer to buy your extension for a very high price. This is interesting, and I didn't realize this was a thing. Are there any lists of extensions with these permissions, or ways that as an average consumer could easily audit my list of extensions for this?
- Svenskunganka 6y ago
  I'm using Firefox and all I have to do to view permissions for an extension is to go to about:addons and click an extension, and there will be a "Permissions"-tab that lists what permissions this extension requests. It's similar in Google Chrome IIRC. Other than that, both browsers lists the permissions an extension requests when installing the extension, and further when the extension requests new permissions.
tlogan 6y ago
The sad thing is that there are so many bad extensions but they are run by professionals (crime gangs). They can figure out how to game the system (since there is no humans - that is definitely possible). So this "half-ass" approach by Google just helps malicious actors - they just need to be under the "radar" and game the system. Google is trying to do "half ass" approach. Which does not help users, does not help developers, and it also does not help Google. The right approach is to do these reviews fully and that human is involved at some point. Of course, these things are are not free. So they can require $1000 or more per year subscription if extension require more than basic permissions. They anyway require at least 60K per year for using an API. Or something like that. But it could be also that Google does not care about real security: just appearance of security. They need to sell ads and all other things they do (Chrome, Android, G Suite, etc.) is just a smoke screen.
fakeyguy 6y ago
The toughest thing in Google is getting in touch with a Human there. Its virtually impossible unless you know people working there. And this isn't just about scale. Take cloud services. Getting in touch with GCP customer service is a lot more difficult than other providers.

by geofft 6y ago

deleted 6y ago

[deleted]

friedman23 6y ago

>Uh, yikes Agreed I wish we could send everyone that thinks this kind of response from a megacorporation is good to a kafkaesque alternate universe.

lidHanteyk 6y ago
https://hitchhikers.fandom.com/wiki/Golgafrinchan_Ark_Fleet_Ship_B https://hitchhikers.fandom.com/wiki/Golgafrinchan_Ark_Fleet_...
hedora 6y ago
> kafkaesque alternate universe You can sleep well tonight knowing a few of them will attempt to build a house in California.
- thejynxed 6y ago
  They've already done that in Palo Alto from what I understand.

kevingadd 6y ago

https://*/* https://*/* being allowed at all without aggressive vetting is a big mistake. It's astonishing to me that they ever made it easy to do this.

hanniabu 6y ago
Agreed, that in itself should require an application
phire 6y ago
The problem is that extension behaviour is very limited without the https://*/* https://*/* permission. Say you have an extension that implements spelling check or grammar check. That need access to every single website to find the text fields it want to add functionality too. Same thing with a password manager extension, can't find the login boxes without the https://*/* https://*/* permission. You want to read data off any page users are on, or add ui elements to every page users are on, or modify style shares to any page, you need that global permission. About the only extensions that don't need global https permissions are extensions that are designed to only work on a finite set of websites (facebook improvement extensions, or reddit improvement extensions), or things like push-bullet that don't really need to be a chrome extension in the first place, they could be implement as a system tray applet. This isn't the fault of extensions, this is the fault of chrome for not providing ways to do things without full wildcard https://*/* https://*/* permissions.
- efreak 6y ago
  Pushbullet actually has a desktop application with a tray applet. But if you keep your browser running 24/7 it might well be worthwhile to use an extension instead of another piece of software that installs separately, and has more access to your computer.
- cryptonector 6y ago
  It should be possible to have an extension interface that allows a spellchecker/grammar checker to get a button on text input fields such that if you click it, then the extension is activated on that field at that time. That seems like a much better Least Privilege design to me than giving the extension access to... literally everything you do.

legitster 6y ago

It seems like the majority of plugins will need to access all websites. Just looking at my list of plugins: - EditThisCookie - ResourceOverride - Ad blocker - Grammarly - LastPass I absolutely expect these to work regardless of website. It seems perfectly reasonable for this to be the default behavior.

geofft 6y ago
And both Grammarly and LastPass have had security bugs that let any website worm their way into the extension and access all the data from the extension (anything you've ever typed, for Grammarly, and all your passwords, for LastPass). Extensions with wide-ranging access are useful, and there's a reason Chrome has support for it, but they're also very very hard to get right, even if your entire business is writing a security-focused browser extension. You could go the approach Firefox is going on mobile where there are currently six vetted extensions. As it turns out, they all need access to every website (or fine-grained APIs, perhaps). But... there are six of them. https://blog.mozilla.org/addons/2020/04/14/april-extensions-for-firefox-preview/ https://blog.mozilla.org/addons/2020/04/14/april-extensions-...
- FillardMillmore 6y ago
  Do you have a link for that claim on LastPass? I use the extension and am wondering if I shouldn't use an PM extension thats more reliable in terms of security. Any recommendations obviously welcome.
  - geofft 6y ago
    See my podcast's episode on this :) https://looseleafsecurity.com/episodes/password-manager-security-model.html https://looseleafsecurity.com/episodes/password-manager-secu... (there's a full transcript in there if audio isn't your thing) The LastPass issues are all pretty old at this point - I mostly mention it to drive in the point that getting this stuff right is hard. (For what it's worth, the researcher who found those issues has good things to say about LastPass: https://twitter.com/taviso/status/1167311357957435392 https://twitter.com/taviso/status/1167311357957435392 and also fairly negative things to say about 1Password, which is what I happen to use.)

JaggedJax 6y ago

But you're completely ignoring the point that even without the all http(s) permission they will still be kicked off the store, so that has nothing do do with the issue at hand. If localhost is the issue, Google could literally respond exactly the way you did and the problem is gone, "why do you need http://localhost/?" http://localhost/?" This isn't about permissions at all. This is about communication and whether it's worth putting effort and trust into a company that acts like this as SOP.

geofft 6y ago
That's the thing I'm sympathetic to - having fixed the bug, it's frustrating that it's not clear what the next steps are. But given that they had the bug, Chrome was absolutely in the right to deny them the first time. And while I don't like Chrome's position that they're too busy to explain to everyone what they're doing wrong, if extensions that go "oh hey, we don't actually need access to literally every website, imagine that, oops!" is what you expect out of good, competent, non-malicious extension authors, I have a lot of trouble disagreeing with their conclusion, in practice. (Would it be better if Chrome said "There are 200,000 extensions on the Chrome store, each and every one of them deserves attention, we need to spend at least 30 minutes looking at each one and composing a response, we have a ten-person team, we'll get back to you within 5 years?")
- csours 6y ago
  The tool could tell them what the problem is. There are fine grained permissions, and Google could say which of those fine grained permissions are used badly. OR, they could just restrict those permissions themselves in the browser.
  - Filligree 6y ago
    If it did, it'd be easy for malware authors to work around the scanner. The system we've got right now isn't great, but I've yet to see any better ideas.
    - 6y ago

om2 6y ago

The outcome seems to be that this extension fixed the bug and will still be kicked off the Chrome Web Store. That's probably not a net benefit for users _as a result_, even setting aside the unclear communication. Imagine using a build system that doesn't give any error messages, except to say at the end "build failed, there was a syntax error". This sucks as a tool. Everyone would avoid it if they could, even if it found real bugs. We shouldn't accept this level of information from services either.

fenomas 6y ago

> ... an amazingly huge oversight ... a point in favor of the review process This seems like a rosy interpretation. It's not actually clear whether http permissions really are the reason the extension got flagged, and the fact that fixing them didn't affect the review feedback implies that the process isn't working the way you're imagining.

arcticbull 6y ago

> ... all of this is consistent with an extension that should be kicked off the app store within 14 days. No, it absolutely isn't. You can't take someone's livelihood off the app store within 14 days when they have every interest in complying with your policy but you just don't feel the need to even tell them what all the policy is. The fact it was approved in the first place is Google's fault, not the app developer, so is totally irrelevant to this saga. If you can hit the Reject button you can fill in a text box that says why. There's no excuse for that.

bigfoot675 6y ago
I mean they can. It's their store. I don't think they should, but still
- cosmicexplorer 6y ago
  I'm pretty sure the parent comment understands that they can, and also agrees that they shouldn't.
  - Aeolun 6y ago
    I’m not at all certain about the latter. They’re pretty consistent in ignoring users and providing shitty service.
lucideer 6y ago
I think there's two issues here: 1. should Google provide more context to the developer? Of course. 2. if the extension is a genuine danger to users, should they remove it immediately? Of course I agree that Google should do #1 as well as #2, but I absolutely believe it's better to do #2 (even without #1) than to do neither.

IG_Semmelweiss 6y ago

I agree. This is hackernews, so it is easy why devs would feel otherwise, but as a nondev, I represent the the end users. Why would anyone think it is appropriate for google to reveal their hand, and allow blackhat operators to build apps up to the max limit of permissions? (If they were revealed by google via white glove customer service). If goog did provide guidance on permissions, goog would literally have to audit every app in the store, or come up with a way to separate bad actors from good ones. So, Im sorry. No. If its between 1 hacker's inconvenience or in extreme case , livelyhood....and the retirement savings bank account of many grandmas, i am going to side with grandmas. Google is doing many things wrong. Keeping the "red line" of allowable permissions secret, from data-hungry developers.... is not one of them.

laughinghan 6y ago
> If goog did provide guidance on permissions, goog would literally have to audit every app in the store, or come up with a way to separate bad actors from good ones. This makes no sense. For the sake of the grandmas, Google already needs to audit every app in the store and separate bad actors from good ones. How in the world would making it more clear how to write more secure extensions possibly worsen the extension store's malware problem?
- icer2312 6y ago
  > How in the world would making it more clear how to write more secure extensions possibly worsen the extension store's malware problem? Unfortunately, information that helps the good guys get their extensions past the audit check is exactly the same information that helps the bad guys get their extensions in too. The bad guys simply move onto the next security flaw that Google hasn't anticipated. Maybe the bad guys use some common tactics to get their scam extensions in the store which good guys don't, which is easy for Google to detect and flag. If you release a list of known no-no's, the bad guys just get smarter and avoid them. This obviously skews in favour of refusing some good extensions to keep most bad ones out. In terms of Google already auditing every app, check out the source code for Dark Reader https://github.com/darkreader/darkreader https://github.com/darkreader/darkreader. It's fairly complex. I can only imagine how many extensions are as, or more, complex than that. I wonder how much auditing is done manually vs automated.

cryptonector 6y ago

Like you, I suspect http://localhost/ http://localhost/ is part of the issue, indeed. I wonder if Google could have a <appname>.localhost origin for this.

m-p-3 6y ago
There is a native app for Pushbullet on Windows that you can install to add more features, and this is how the extension is able to communicate with it. I know there was a problem getting duplicate push notifications from the app and Chrome itself, and that was a way to remediate that. At least that's what I remember from the time I used it.

highlysyntropic 6y ago

paid Google shill.

cerberusss 6y ago
Are you saying geofft is a paid Google shill? Or the maker of the Pushbullet extension?
- deleted 6y ago
  [deleted]
cosmicexplorer 6y ago
I agree with this comment and I think it improves the conversation to have around, even if many people disagree with it.
dang 6y ago
We've banned this account for breaking the site guidelines. Could you please stop creating accounts to do that with? https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

awill88 6y ago

Hit it right on the head. The localhost thing and coupled with the http thing make me cringe. And to know they went from https://* https://* to just one domain, yikes indeed. Then they left localhost. Hell, that probably made the case worker’s knee jerk even harder because of such a dramatic change, I can’t imagine they spend much time on each case. Yes, 14 days is not a lot of time, but this is the ecosystem that needs to change. So the maintainer should have started out being more transparent on their architecture: period. The fun is over, Google doesn’t care about loyalty or gestures of effort, this is an emotionless process. They care about provable, auditable compliance. When you think about it, for Google, this is just a little sad story about an extension that didn’t make the cut. But it’s a small price to pay in exchange for evidence they are “enduring self-inflicted wounds” and using it as ammunition in avoiding billions of dollars in fines they face for violating user privacy laws.

LorenPechtel 6y ago
Yeah, it sounds like they were working on a "it works, ship it" approach. That's not good enough when there are security implications to what you're doing.

onefuncman 6y ago

Oh. TIL why I was getting all those unsolicited offers. I took my extension down instead, as I didn't have time to figure out how I had painted a target on my back. I only published my extension as a fork of an open source project that started injecting malware, presumably from a similar offer...

richardwhiuk 6y ago

Why do they need http access on push bullet?

jve 6y ago

Yeah. I'v refused to install extension in the past because Chrome tells me this extension wants to read all data on all web pages... No thanks. (Except those extensions I KNOW must have those permissions) Very good thing app store may nudge people changing permission scope. Hope extension authors manage to meet the deadline and get their extension re-approved.

brosirmandude 6y ago

>if you have an approved extension with https://*/* https://*/* permissions and active users, malware authors will offer to buy your extension for a very high price. This is interesting, and I didn't realize this was a thing. Are there any lists of extensions with these permissions, or ways that as an average consumer could easily audit my list of extensions for this?

Svenskunganka 6y ago
I'm using Firefox and all I have to do to view permissions for an extension is to go to about:addons and click an extension, and there will be a "Permissions"-tab that lists what permissions this extension requests. It's similar in Google Chrome IIRC. Other than that, both browsers lists the permissions an extension requests when installing the extension, and further when the extension requests new permissions.

tlogan 6y ago

The sad thing is that there are so many bad extensions but they are run by professionals (crime gangs). They can figure out how to game the system (since there is no humans - that is definitely possible). So this "half-ass" approach by Google just helps malicious actors - they just need to be under the "radar" and game the system. Google is trying to do "half ass" approach. Which does not help users, does not help developers, and it also does not help Google. The right approach is to do these reviews fully and that human is involved at some point. Of course, these things are are not free. So they can require $1000 or more per year subscription if extension require more than basic permissions. They anyway require at least 60K per year for using an API. Or something like that. But it could be also that Google does not care about real security: just appearance of security. They need to sell ads and all other things they do (Chrome, Android, G Suite, etc.) is just a smoke screen.

fakeyguy 6y ago

The toughest thing in Google is getting in touch with a Human there. Its virtually impossible unless you know people working there. And this isn't just about scale. Take cloud services. Getting in touch with GCP customer service is a lot more difficult than other providers.