4 ms·

I always considered proxies, url shorteners, etc to be suspicious in the first place. Some more investigation would be required in some cases.

gruez 6y ago
>I always considered proxies, url shorteners, etc to be suspicious in the first place It doesn't have to be as overt making it look like a proxy (eg. a endpoint that makes arbitrary http requests on behalf of the caller). It can be as simple as changing the endpoint for the spying service from https://evil.example.com/api/ https://evil.example.com/api/ to https://484044b296.execute-api.us-east-1.amazonaws.com/evil/api/ https://484044b296.execute-api.us-east-1.amazonaws.com/evil/... > Some more investigation would be required in some cases. The point is that the "nutrition facts label" doesn't really do anything because it's trivial to bypass. If it becomes widespread I guarantee every malicious addon maker would adopt this tactic.
- Triv888 6y ago
  Of course it would not be the only element in the table. But either way, it would at least tell you that an extension is leaking data when it isn't supposed to leak data (for extensions that should not require an Internet connection).
- ashtonkem 6y ago
  I personally would find such an inscrutable name suspicious.
  - gruez 6y ago
    Why? Would connecting to "api.example.com" be less suspicious? The same issue would still be present (namely, smuggling requests to "shady" domains using a mundane domain), and the only difference would be that it demonstrates the author paid $10/yr for the domain.
    - ashtonkem 6y ago
      I should be able to clearly determine the intention of any domain that an extension is going to call. Anything that tries to obsfucate the actual underlying purpose is a red flag. One might not like Google analytics, but at least you know exactly what you’re going to get when someone calls analytics.google.com.
      - deleted 6y ago
        [deleted]

gruez 6y ago

>I always considered proxies, url shorteners, etc to be suspicious in the first place It doesn't have to be as overt making it look like a proxy (eg. a endpoint that makes arbitrary http requests on behalf of the caller). It can be as simple as changing the endpoint for the spying service from https://evil.example.com/api/ https://evil.example.com/api/ to https://484044b296.execute-api.us-east-1.amazonaws.com/evil/api/ https://484044b296.execute-api.us-east-1.amazonaws.com/evil/... > Some more investigation would be required in some cases. The point is that the "nutrition facts label" doesn't really do anything because it's trivial to bypass. If it becomes widespread I guarantee every malicious addon maker would adopt this tactic.

Triv888 6y ago
Of course it would not be the only element in the table. But either way, it would at least tell you that an extension is leaking data when it isn't supposed to leak data (for extensions that should not require an Internet connection).
ashtonkem 6y ago
I personally would find such an inscrutable name suspicious.
- gruez 6y ago
  Why? Would connecting to "api.example.com" be less suspicious? The same issue would still be present (namely, smuggling requests to "shady" domains using a mundane domain), and the only difference would be that it demonstrates the author paid $10/yr for the domain.
  - ashtonkem 6y ago
    I should be able to clearly determine the intention of any domain that an extension is going to call. Anything that tries to obsfucate the actual underlying purpose is a red flag. One might not like Google analytics, but at least you know exactly what you’re going to get when someone calls analytics.google.com.
    - deleted 6y ago
      [deleted]