4 ms·

If it did, it'd be easy for malware authors to work around the scanner. The system we've got right now isn't great, but I've yet to see any better ideas.

bentcorner 6y ago
Couldn't malware authors start from the other direction? Create a no-op extension with no permissions and gradually add things until it's no longer approved.
- IG_Semmelweiss 6y ago
  No. This gets you banned.
  - mirimir 6y ago
    Is that really true?
    - thejynxed 6y ago
      Only years later, as in the case of a certain Vietnamese hacking group that did exactly this starting at the end of 2015 and didn't have their apps yanked until Nov & Dec of 2019 and another batch located & yanked only last month, well after any and all damage was already done to those who used the apps.
      - mirimir 6y ago
        Well, I meant for devs who are doing it innocently ;) The fact that it took four years in your example implies that permission shaving isn't hugely risky for devs.
  - labawi 6y ago
    Malware authors can register a dozen or thousand throwaway accounts (probably not super easy but not hard either). It's the honest developers that get their meaningful accounts banned.
laughinghan 6y ago
I don't understand what you're talking about. If the scanner looks for extension with permissions for all your web browsing activity, so malware authors stop asking for permissions for all your browsing activity...isn't that great news?
csours 6y ago
I understand that's the reason they give. I just don't believe them. At some point you have to assume good faith. Maybe that point is when the item in question has over a million users and a good rating.
- petre 6y ago
  You're missing the fact that the reason is given by software not an actual person. Welcome to the world of social automation.
caf 6y ago
How does that make any sense? There's some set of permissions that's safe enough to approve, but too dangerous to tell you it's safe enough to approve?

bentcorner 6y ago

Couldn't malware authors start from the other direction? Create a no-op extension with no permissions and gradually add things until it's no longer approved.

IG_Semmelweiss 6y ago
No. This gets you banned.
- mirimir 6y ago
  Is that really true?
  - thejynxed 6y ago
    Only years later, as in the case of a certain Vietnamese hacking group that did exactly this starting at the end of 2015 and didn't have their apps yanked until Nov & Dec of 2019 and another batch located & yanked only last month, well after any and all damage was already done to those who used the apps.
    - mirimir 6y ago
      Well, I meant for devs who are doing it innocently ;) The fact that it took four years in your example implies that permission shaving isn't hugely risky for devs.
- labawi 6y ago
  Malware authors can register a dozen or thousand throwaway accounts (probably not super easy but not hard either). It's the honest developers that get their meaningful accounts banned.

laughinghan 6y ago

I don't understand what you're talking about. If the scanner looks for extension with permissions for all your web browsing activity, so malware authors stop asking for permissions for all your browsing activity...isn't that great news?

csours 6y ago

I understand that's the reason they give. I just don't believe them. At some point you have to assume good faith. Maybe that point is when the item in question has over a million users and a good rating.

petre 6y ago
You're missing the fact that the reason is given by software not an actual person. Welcome to the world of social automation.

caf 6y ago

How does that make any sense? There's some set of permissions that's safe enough to approve, but too dangerous to tell you it's safe enough to approve?