7 ms·
I am too wary of malware extensions to install that many. It is clearly trivial [0] for malware to get into the Chrome store, and Google is not doing enough to
by jahlove 6y ago
I am too wary of malware extensions to install that many. It is clearly trivial [0] for malware to get into the Chrome store, and Google is not doing enough to make me feel comfortable with it.
Additionally, I know that even as non-malware extensions grow in popularity they are solicited by malware companies to integrate their software in an update. I experienced this first hand with the HoverZoom extension. [1]
[0] https://awakesecurity.com/blog/the-internets-new-arms-dealers-malicious-domain-registrars/ https://awakesecurity.com/blog/the-internets-new-arms-dealer...
[1] https://www.ghacks.net/2013/12/26/hoverzooms-malware-controversy-imagus-alternative https://www.ghacks.net/2013/12/26/hoverzooms-malware-controv...
- Chirael 6y agoYes, this - absolutely. Every extension you install is another potential risk/attack vector. Consider the sources carefully and run the least number of extensions possible. Each one potentially has control of your browser, so choose accordingly.
- nine_k 6y agoLately I ended up running much fewer extensions than I used to, and actually looking at their source first. I think the only closed-source extension I run is lastpass, and I'm evaluating open-source alternatives. How do people who cannot read code even cope, I don't know.
- squidofbits 6y ago+1 for bitwarden. Of all the things not to trust closed source software with, passwords are the main one
- KeepassXC 6y agoKeepassXC is fortunately the only sane password-manager; so; bite your heads off with all the other crap. Bitwarden is a POS over-commercialized POS; use KeepassXC instead. Obvisously not afflitiated with KXC; and certainly not Shitwarden. Good for you that KeepassXC is free; unlike Shitwarden! Have your choices.
- Lukas_Skywalker 6y agoCan you comment on why you think Bitwarden is a „POS“ and what KeepassXC does better?
- gruez 6y ago>KeepassXC is fortunately the only sane password-manager What's wrong with Keepass?
- daviross 6y agoIf there were ever a post to drive me away from a product, this'd be it. Good to know that I should stay well away from KeepassXC, if this is what its defenders sound like.
- noah_buddy 6y agoIt's really disappointing to see what's a now flagged post and push-back to what was obviously a flagrant comment. For a more level-headed opinion on KeepassXC, it's decently polished and easy to use. It's also open-source and cross-platform. I like it and came from the original Keepass. I didn't have any specific issues with the first besides wanting to try something new. I haven't noticed any major issues with KeepassXC myself but open to hearing others' experiences.
- SquareWheel 6y agoComment was flagged so I have no idea what they said, but I use KeePassXC and I'm happy with it. Regular KeePass is good too, but I use XC because it's cross-platform.
- p1necone 6y agoIf you turn on showdead in your user profile settings you can see flagged comments. I find it helps with context in situations like this, but certain types of posts do attract a lot of racist/sexist garbage that you normally cant see so be forewarned.
- lovelyviking 6y agoCan you list those open source extensions you run? I think this could help a lot to cope ..
- esperent 6y agoI signed up for LastPass a couple of weeks ago, and they started sending me spammy emails every single day. I went into account settings and disabled the emails, and they kept coming. I opened a support thread on their forum, linking many other similar threads going back several years, and saying that they have to fix this under GDPR... Silence. I deleted my account and switched to BitDefender. Still getting the LastPass emails though, whenever I check my spam folder. Also, LastPass slowed my Android phone a lot. BitDefender doesn't seem to do that. In short, my recommendation is: stay the hell away from LastPass. They can't even handle an email system, I don't trust them at all to handle my passwords.
- skinkestek 6y ago> Also, LastPass slowed my Android phone a lot. Their Windows application was also painfully slow. I paid them for years but I no longer trust them, it seems to me they are incompetent as an organization even if the people who work there might or might not be smart.
- kwanbix 6y agoYou meant to say bitwarden? Afaik Bitdefender Is an Antivirus.
- esperent 6y agoOops, yes. Thanks.
- ahmedfromtunis 6y agoIsn't this true, to some degree, with all software distribution channels? Weren't CCleaner and FileZilla hacked to distribute malware alongside the main payload?
- hackinthebochs 6y agoUnvalidated auto-update really is an anti-pattern. Giving arbitrary third parties the power to install and run software on your system in perpetuity is a massive attack vector. Most software doesn't represent a large active and ongoing attack surface that auto-updates would be a net positive.
- rndmze 6y agoI can't count the time I have heard good things about an extension, went to the chrome store page and ... "asks to read your data on all websites". Hard pass. I can't prevent the apps/OSes I use from gathering data about me, but that's at least one vector (although sadly a small one) I can do something about.
- Groxx 6y agoI really wish browsers would change their security model for extensions :\ "all or nothing" is ridiculous as the only option - let me revoke access or restrict it to specific sites. I may not care if X has access to site Y, but giving it access to Z means giving it the keys to my life so hell no. I don't even want to use it on Z.
- gnicholas 6y agoChrome lets you limit access to a list of specified websites. Right click the extension icon, click manage extension, and find the option there.
- Groxx 6y agoExcellent, I hadn't noticed that one yet. Yeah, that's a good start.
- mehrdadn 6y agoIt's fairly new (maybe 1-2 years old, I forget), that's probably why you didn't notice it.
- gnicholas 6y agoI only discovered it because I was going to add a similar feature to my Chrome extension, and I was researching to see how others tend to implement it. I was glad to see that Chrome offers the feature natively, and surprised to see that Firefox didn’t.
- ffpip 6y agoYou can add domains to protected sites. No addons will work there. So if you want no extension to be able to read gmail, Add mail.google.com or google.com to extensions.webextensions.RestrictedDomains in about:config
- FriendlyNormie 6y agoHow useless. If you are forced to initially install it with all permissions then it can instantly access any site and do whatever it wants. By the time you manually change the settings seconds later it’s already too late, your private shit has all been harvested and sent to hackers in Tel Aviv.
- hnick 6y agoJust yesterday I ran into an invisible layer right here on HN when replying with a comment that opened a new page when I tried to click on something. I disabled all extensions that I don't commonly use and am watching for now, but I have no idea how to actually tell which one did it (many of them were recently updated due to a Chrome change on August 6th or something).