4 ms·

Chrome team has tried to make some changes to improve the situation, but browser extensions are still a perfect target for malware and abuse because of a struct

Chrome team has tried to make some changes to improve the situation, but browser extensions are still a perfect target for malware and abuse because of a structural problem: Users install these (free) extensions on a whim, installation takes 2 clicks and seconds. They make a point-in-time decision: "I find this useful today, and I trust the extension is not malware today" But what they are really saying is: "I trust the (changeable) owner of this extension with whatever data this extension has access to forever and ever" (Nobody uninstalls these extensions, and now Chrome will even sync your extensions when you buy a new device.) It's the imbalance of that decision that is the problem, no amount of filtering and UI changes and API updates will fix that imbalance.

gorhill 6y ago
> Chrome team has tried to make some changes to improve the situation The remote code execution ("RCE") capability requested by the extensions is programmatically detectable by simply looking up the `content_security_policy` key in their manifest (which is JSON format). The extensions had the following `content_security_policy` in their manifest: script-src 'self' https://fly-analytics.com; The best change the CWS can do to improve the situation is to forbid RCE capability the first place -- such capability means that it's impossible to code review such extensions and conclude they are safe. Mozilla's policy is no-RCE allowed. I didn't try but I believe Mozilla's extension validator would programmatically reject any extension which asks for RCE through a manifest's `content_security_policy`.
- quotemstr 6y ago
  Won't help. You can always execute "code" if you try hard enough. Not all "code" is in the form of some JS file loaded into the extension context: it can be any custom sequence of instructions. There is no way to distinguish code from data.
_qulr 6y ago
The Chrome Web Store is grossly understaffed. Google as a whole relies too much on automated processes rather than humans, but this is particularly a problem in the Chrome Web Store, because Google requires every extension to be distributed via the Store, but they just don't have the staff to review every extension properly. There's no way Google can "curate" the volume they handle, especially with their limited staffing.
- zentiggr 6y ago
  Then it's time to mark all but the most used and obviously trustable extensions as untrusted. Then they can take whatever staff they have, and review them properly. And accept the fallout of their staffing choice if it means drop in Chrome usage or whatever else. They want to leave a gaping malware hole, it's time to hold them accountable dammit.
  - _qulr 6y ago
    > Then it's time to mark all but the most used and obviously trustable extensions as untrusted. That's basically what Firefox has done.
    - pritambaral 6y ago
      More, actually. Some excerpts from https://blog.mozilla.org/firefox/firefox-recommended-extensions/ https://blog.mozilla.org/firefox/firefox-recommended-extensi... : "Our team evaluates all content under consideration for the Recommended Extensions program.", "... subject to ongoing re-evaluations to ensure they continue ...", "... not only perform as they promise, but do so at an exceptional level. For instance, there may be many ad blockers out there, but not all ad blockers are equally effective.", (and last but not the least) "... undergo full code review by staff security experts ..."
  - ocdtrekkie 6y ago
    The problem here is tons of non-technical users get those untrusted extensions installed. The solution is to actually delist any extension they can't adequately review.
- kevingadd 6y ago
  After a fraudulent DMCA notice took my extension down, when it came back up it was flagged for manual review for another month or two. The manual review on bug fixes and updates took about a week per upload, and that was before they further scaled back investment in the Web Store. It's neglected in every possible way.

gorhill 6y ago

> Chrome team has tried to make some changes to improve the situation The remote code execution ("RCE") capability requested by the extensions is programmatically detectable by simply looking up the `content_security_policy` key in their manifest (which is JSON format). The extensions had the following `content_security_policy` in their manifest: script-src 'self' https://fly-analytics.com; The best change the CWS can do to improve the situation is to forbid RCE capability the first place -- such capability means that it's impossible to code review such extensions and conclude they are safe. Mozilla's policy is no-RCE allowed. I didn't try but I believe Mozilla's extension validator would programmatically reject any extension which asks for RCE through a manifest's `content_security_policy`.

quotemstr 6y ago
Won't help. You can always execute "code" if you try hard enough. Not all "code" is in the form of some JS file loaded into the extension context: it can be any custom sequence of instructions. There is no way to distinguish code from data.

_qulr 6y ago

The Chrome Web Store is grossly understaffed. Google as a whole relies too much on automated processes rather than humans, but this is particularly a problem in the Chrome Web Store, because Google requires every extension to be distributed via the Store, but they just don't have the staff to review every extension properly. There's no way Google can "curate" the volume they handle, especially with their limited staffing.

zentiggr 6y ago
Then it's time to mark all but the most used and obviously trustable extensions as untrusted. Then they can take whatever staff they have, and review them properly. And accept the fallout of their staffing choice if it means drop in Chrome usage or whatever else. They want to leave a gaping malware hole, it's time to hold them accountable dammit.
- _qulr 6y ago
  > Then it's time to mark all but the most used and obviously trustable extensions as untrusted. That's basically what Firefox has done.
  - pritambaral 6y ago
    More, actually. Some excerpts from https://blog.mozilla.org/firefox/firefox-recommended-extensions/ https://blog.mozilla.org/firefox/firefox-recommended-extensi... : "Our team evaluates all content under consideration for the Recommended Extensions program.", "... subject to ongoing re-evaluations to ensure they continue ...", "... not only perform as they promise, but do so at an exceptional level. For instance, there may be many ad blockers out there, but not all ad blockers are equally effective.", (and last but not the least) "... undergo full code review by staff security experts ..."
- ocdtrekkie 6y ago
  The problem here is tons of non-technical users get those untrusted extensions installed. The solution is to actually delist any extension they can't adequately review.
kevingadd 6y ago
After a fraudulent DMCA notice took my extension down, when it came back up it was flagged for manual review for another month or two. The manual review on bug fixes and updates took about a week per upload, and that was before they further scaled back investment in the Web Store. It's neglected in every possible way.