5 ms·
Instead of just outright limiting extensions you could give users the choice. Give us an option to make it impossible for extensions to send out data for exampl
by Mirioron 6y ago
Instead of just outright limiting extensions you could give users the choice. Give us an option to make it impossible for extensions to send out data for example.
- bgdam 6y agoExactly. What Chrome and Firefox should do, is bundle their own analytics program into the extensions program, make these analytics available via AMO or Chrome Web Store (already has a very basic version), and remove the ability for extensions to perform outgoing network requests unless the user explicitly whitelists the extension. Even then, show big scary warnings about extensions given this permission being able to steal your bank passwords, just to keep the less tech-savvy informed.
- Thorrez 6y agoOne thing extensions commonly do is modify the page. If an extension can modify the page, it can insert an <img> which will cause a network request to happen. How do you plan to prevent this? Prevent extensions from modifying the page?
- AznHisoka 6y agoSame suggestion applies. Show users the warning that extensions can modify your page and have users explicitly approve of it.
- pornel 6y agoAnd they already do that. The problem is, almost every extension has a legitimate need to read and/or modify the page, so people click through this permission warning like Vista's UAC.
- hombre_fatal 6y agoI do notice that almost all of the extensions I use have no need to make http requests nor modify the dom (e.g. to add tracking <img> or css url()). I wonder what other methods there are to exfiltrate info beyond that.
- Thorrez 6y agoWhat extensions are those?
- prox 6y agoMaybe also introduce a paranoia button where every request can be vetted in its context, so every request you get to see the code and a button permit or not.